We are excited to announce that as of April 1, 2021, Google Cloud VMware Engine is covered under the Google Cloud Business Associate Agreement (BAA), meaning it has achieved HIPAA compliance. Healthcare organizations can now migrate and run their HIPAA-compliant VMware workloads in a fully compatible VMware Cloud Verified stack running natively in Google Cloud with Google Cloud VMware Engine, without changes or re-architecture to tools, processes, or applications.

Healthcare organizations increasingly use cloud platforms to personalize patient care, analyze large datasets more effectively, enhance research and development collaboration, and share medical knowledge. Leveraging cloud platforms can also help healthcare organizations increase the privacy and security of information systems, including protected health information (PHI), and, as a result, better comply with applicable laws and regulations while reducing the burden of compliance. For PHI, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) set standards in the United States to protect individually identifiable health information. HIPAA applies to health plans, most healthcare providers, and healthcare clearinghouses that manage PHI electronically, and to persons or entities that perform certain functions on their behalf. 

With Google Cloud, organizations can leverage solutions that enable secure, continuous patient care and data-driven clinical and operational decisions with ease, while being empowered with collaboration and productivity tools. Further, Google Cloud Platform supports HIPAA compliance. We offer HIPAA-regulated customers the same products at the same pricing that is available to all customers, unlike many other cloud providers. 

For healthcare organizations that leverage VMware on-premises, having a consistent, cloud-integrated platform that provides seamless access to native cloud services unlocks the opportunity to extend, migrate, and modernize healthcare IT infrastructure and applications in a fast, low-risk manner at their own pace. This is especially important for mission-critical healthcare provider workloads, where having a low-risk way to adopt the cloud is important. Google Cloud VMware Engine offers that solution. By achieving coverage under Google Cloud’s BAA, Google Cloud VMware Engine enables healthcare organizations to realize the benefits of cloud computing and stay on track with their HIPAA compliance efforts without additional complexity. This is very relevant in hybrid scenarios, where customers would like to leverage other native cloud services such as analytics and big data processing, without having to enter into multiple BAAs.

Google Cloud VMware Engine offers dedicated, isolated software-defined datacenter environments with fully redundant and dedicated 100 Gbps networking that are suitable for healthcare organizations to run applications storing and processing PHI data. Customers have the ability to encrypt their virtual storage area network (vSAN) using an external key management server. Healthcare customers can run their workloads in a native VMware environment—vSphere, vCenter, vSAN, NSX-T, and HCX—while benefiting from Google Cloud’s highly performant infrastructure to meet the needs of their workloads. Customers can connect their VMware applications to native Google Cloud services such as BigQuery and artificial intelligence (AI) to derive new insights from existing data and quickly make informed decisions. 

Protecting against and mitigating the impact of ransomware attacks is top-of-mind for Healthcare organizations. This requires building a cyber resilience program and back-up strategy to prepare for how users can restore core systems or assets affected by a security (in this case, ransomware) incident. This is a critical function for supporting recovery timelines and lessening the impact of a cyber event so organizations can get back to operating their business.  Google Cloud VMware Engine in combination with Google Cloud first party solutions such as Actifio Go, or partner solutions such as NetApp CVO can provide an efficient way to recover incremental point-in-time backups along with on-demand provisioning of new compute to  recover both data and infrastructure from Ransomware attacks quickly and efficiently. 

Healthcare customers can also use Google Cloud VMware Engine as a disaster recovery (DR) target for their on-premises VMware workloads. Healthcare organizations also need a business continuity plan for their mission critical applications. When a disaster occurs, hospitals need their data protected so they can quickly get back to treating patients. It is a HIPAA requirement that healthcare organizations must be able to recover from a natural disaster. Google Cloud VMware Engine offers a like-for-like cost-effective DR target for these customers. The DR environment can be operated without new training using the same tools as their on-premises deployment. Google Cloud VMware Engine is currently available in 12 regions across the globe including three regions in the US, which means our regional and multi-national customers can take advantage of this service for geographic diversification as well. 

If you are interested in understanding more and taking advantage of Google Cloud VMware Engine, contact your Google sales team now.

For details, see HIPAA compliance on Google Cloud Platform.

Small and medium-sized businesses and enterprises are the backbone of the US economy generating more than 44% of GDP¹. Yet these organizations are still underserved when it comes to online financial tools—and dealing with payments is no exception. Complaints include hidden fees, limited capabilities, long-term lease agreements, and poor customer service.

These are the issues that we wanted to solve when we launched Helcim in 2020 in Calgary (Alberta, Canada). We provide a payment service that offers low rates through our interchange plus pricing model, no monthly fee for the core payments offering, and numerous payment options, as well as simple, affordable hardware such as card readers. 

Our digital-first approach makes it easy for owners of small and medium-sized businesses to get started. Online sign-up means no paperwork and near instant access to Helcim’s software and all-in-one platform experience. Merchants can choose from a range of payment solutions from the Helcim app including in-person payments, SMS payment requests, online invoices with pay now buttons, and more. 

To achieve our goals, we built most of the business systems and processes in-house including our technology stack, financial partnerships, marketing, and everything in between. This is something that few startups would dare to do, but it enabled us to build a payments platform offering the rich capabilities and performance SMBs really need.

Taking control with the cloud

Before migrating our infrastructure to Google Cloud, it was hosted at two colocation data centers in Calgary. This model served us well, but as we grew, most of our hardware needed to be replaced to maintain service security and performance.

A successful round of Series A funding also impacted our trajectory. Giving us the fuel we needed to scale and innovate faster. When we considered the choice between making a large capital investment in our existing environment, or to transition to the cloud, the decision was clear: The cloud was the way to go.

We looked at other big names in cloud hosting and tested another platform. But Google Cloud is by far the best environment for us. It’s much easier for a lean technology team to manage, as we embark on our first cloud strategy. It also offers all the tools and advanced machine learning capabilities we need.

Google Cloud also comes with the backing of Alphabet, a business that in the past five years has spent more on research and development than any other organization in the S&P 500². The ability to engage the Google Workspace account team for guidance to improve our everyday processes was another bonus. 

A variety of investment and training programs from Google Cloud also influenced our decision. We participated in Google for Startups Accelerator Canada which gave us access to Google Cloud experts across all our technology domains. This helped accelerate our infrastructure migration while ensuring we optimized every service from day one. We were also eligible for $100,000 USD of Google Cloud credits, covering our Google Cloud costs which helped us get everything up and running cost-effectively. The partnership with the wider Google team has been extremely impactful as we stand everything up for our business.

But ultimately, it’s the sheer depth and breadth of the Google Cloud environment that makes the difference. Here are the Google Cloud tools we currently have at Helcim.

BigQuery

We chose BigQuery because it is easy to aggregate new data and apply the right access controls. It also delivers outstanding performance running our analytics workloads.

Vertex AI

Vertex AI makes the deployment of new models exponentially faster, and with Google Cloud, we can do most of the work through containers instead of proprietary tooling.

GKE

GKE has enabled us to migrate to a fully managed cloud service and avoid a lift-and-shift exercise that would have prevented us from getting the full benefits of a containerized infrastructure. Running a new GKE environment also enabled us to significantly reduce platform latency by 20%-50%. We can now deploy projects in hours instead of days. 

Cloud Storage

We updated our centralized file system to use Cloud Storage, which is faster and more scalable.

Cloud SQL

All of our software today is built on top of MySQL, so CloudSQL was the natural choice for cloud database management.

Cloud Run

Cloud Run is more flexible than other serverless tools and was an easy way to reduce the burden of managing some of our services.

Boosting performance across the business

By migrating to Google Cloud, we transformed our application performance. We were able to decouple the infrastructure between systems and use modern server hardware for our compute and database instances. With very little change to our code, we saw a 50%+ increase in the speed of our entire platform.

Giving developers more control of the technology running their systems via containers means that they can enhance systems through more frequent language updates and by deploying new technologies to optimize workloads.

We can more closely monitor our systems to diagnose issues and fix their root cause faster. Being able to quickly add resources gives us further options if we experience platform latency or increased traffic.

Maintaining momentum with machine learning

Leveraging Vertex AI has significantly reduced the time it takes the team to build and deploy new machine learning models. Greater agility in our data stack has also freed up time for exploratory work in the data team. For instance, by creating low fidelity proxy data for human behavior in the application process, we created a new model that will reduce the number of manually reviewed batches by more than 10%.

We’ve also been able to improve our deployment process and the time to rollback. As a result, breaking changes in production have been reduced from more than five minutes to less than 30 seconds.

Thanks to BigQuery, we can make better use of data to support key business decisions. Previously it was hard to aggregate data from different sources and while maintaining our strict requirements for customer data confidentiality. We also needed specialist SQL knowledge to consume it. By investing in a more modern data stack, the availability of trusted data across the organization has increased exponentially. 

We’ve also overcome the constraints imposed by static hardware environments especially when maintaining a high-availability configuration between two locations. With Google Cloud, we’re no longer constrained by such a rigid arrangement and the deployment velocity of new infrastructure tooling has been reduced from months to days.

Security is another area where Google Cloud excels. From hackers and fraudsters to bots and web attacks, it protects our users, applications, and data, while facilitating compliance with local and regional authorities. We can also integrate more easily with our security partners ensuring that we can empower our team to stay ahead of cyber criminals and other external threats.

Building the payments platform for the future, today

When we look to the future, Google Cloud opens the door to dozens of opportunities to widen our appeal to SMBs while remaining competitive. Its advanced infrastructure for cloud computing, data analytics and ML supports our roadmap to profitability and will help us attract future rounds of funding.

Above all it provides a foundation for growth. We grew 400% in 2021 and raised more capital in the spring of 2022 to grow even faster. In 2022 we were also listed as one of the top payments processors by industry publications such as Nerdwallet and Merchant Maverick. With Google Cloud, we can build on this success, continue to innovate, and help our SMB customers take their payments and e-commerce strategies to the next level. 

If you want to learn more about how Google Cloud can help your startup, visit our page here to get more information about our program, and sign up for our communications to get a look at our community activities, digital events, special offers, and more. 

To learn more about Google for Startups Accelerators and to apply to a program in your region, visit the website here. 

^{1. Small Businesses Generate 44 Percent Of U.S. Economic Activity
2. Alphabet: Big Value In Big Tech}

With a global, always-on workforce, the U.S. Navy requires secure collaboration between teams across countries and time zones. This is especially relevant for the 50,000 U.S. Navy sailors deployed aboard approximately 100 ships at any given time, who need to connect with personnel at regional shipyards for everything from routine maintenance, to more serious ship repairs.

Google Public Sector directly assists Naval Sea Systems Command (NAVSEA), the largest of the U.S. Navy’s five “systems commands,” by providing support to the U.S. Naval Ship Repair Facility and Japan Regional Maintenance Center (SRF-JRMC) in Yokosuka and Sasebo, Japan. NAVSEA is using Google Workspace, which harnesses Google’s threat protection and zero trust capabilities, to enable effective, secure, and compliant collaboration between the SRF-JRMC and Navy stakeholders around the world.

The workforce in the SRF-JRMC facility had two unique challenges. The first was around ineffective collaboration and communication channels. Before deploying Google Workspace, a Navy officer in Japan would need to be on-base to communicate over a secure connection, and calls were typically late at night given the time difference. This challenge was even further magnified when the COVID-19 pandemic hit, further restricting staff mobility.

The second challenge was a language barrier. With more than 3,000 Japanese Master Labor Contract (MLC) employees providing critical support to SRF-JRMC’s shipyard, Navy leadership needed an easier way to communicate with their Japanese-speaking counterparts. Breaking down this barrier would ensure work could be completed faster and more effectively, facilitating a more collaborative environment.

Enabling secure collaboration

The Navy partnered with Google Public Sector to enable Google Workspace for SRF-JRMC. Today, Google Workspace assists the Navy’s shipyards by enabling Google Voice for secure voice over Internet Protocol (VoIP) calling options, so personnel can join calls and sessions on-site or at-home to communicate securely and reliably across continents. In addition, early access to solutions like English to Japanese translated captions in Google Meet help break down the language barrier by providing instant translation during meetings. The platform also saves the U.S. Navy thousands of dollars a month in phone bills by providing country-specific dial-in numbers for interviews.

Moreover, Google Workspace tools like Google Drive and Docs also help to simplify human resource workflows by streamlining the hiring for onboarding local Japanese employees for the shipyard. Having a shared Google Drive eliminates the need to send multiple files back and forth among the NAVSEA team, allowing them to minimize on-premises storage space. In addition, Google Docs enables Navy employees to communicate and collaborate with each other and with potential candidates securely, and across any device.

“As the largest overseas ship repair facility of the U.S. Navy, operational readiness and continuity of operations is our top priority,” said Peter Guo, chief information officer at SRF-JRMC. “Cloud collaboration capabilities provide us seamless and secure connectivity across continents and break down language barriers with our colleagues across the globe. We’ve improved our ability to operate anytime, and anywhere and have increased our ability to securely communicate and coordinate especially during network outages and natural disasters.”

Providing pandemic assistance

Google for Government’s Workspace solutions also became useful to the SRF-JRMC during the pandemic, providing valuable communication and collaboration tools during a time of uncertainty. In addition to deploying Google Workspace, SRF-JRMC’s IT department created a COVID-19 Pandemic Dashboard, a Google-based site that consolidated Japanese and international open-source data on COVID-19 outbreaks and provided updated guidance. The Dashboard was built in less than two hours, using Looker Studio, and it leveraged an automated data collection process to track local hospitalization numbers. Before building the site, it took the NAVSEA team hours to compile this information; now, the team can access this information in real-time.

“This Dashboard drastically reduced redundant weekly meetings centered on COVID-19 updates, and saved more than 10 hours per week manually gathering data and presenting it via slide decks,” said Guo. “Additionally, this capability enabled our leadership to make real-time, data-driven decisions and put necessary risk mitigations in place. It empowered supervisors across the shipyard to reference this website at any time and put additional health measures in place to minimize the transmission of COVID-19. Every minute counts at our two shipyards in Japan, so this made a tremendous impact on our operational efficiency and ensured the safety of our sailors.”

Delivering the best possible tools means making life better and work more fulfilling for millions of people, inside and outside of government. To help government agencies maintain access to communications and collaboration tools that they need during and after an incident to keep work going, we are also offering workshops for federal, state and local governments. Learn more about Google for Government solutions for the Department of Defense, and Google Workspace for Government.

Over the past decade, cybersecurity has posed an increasing risk for organizations. In fact, cyber incidents topped the recent Allianz Risk Barometer for only the second time in the survey’s history. The challenges in combating these risks only continue to grow. Adversaries tend to be agile and are consistently looking for new ways to land within your digital environments. They also drive attack vectors that work, which means enterprise risk leaders are now forced to look for new ways of securing infrastructure and data.

Cloud comes of age in the modern day cybersecurity threat landscape

When cloud, in its various delivery models, was first introduced, it didn’t fit neatly into the security frameworks that had seemingly protected networks for many decades. Public cloud was the answer to ongoing IT challenges: scale, resources, security capabilities, and budget cycle limitations. Now, public cloud is meeting the increasing challenge of implementing cybersecurity controls and frameworks that are capable of protecting today’s global enterprise.

Cloud adoption – with all its scale and redistribution of longstanding security paradigms – is the optimal choice for infrastructure and security, particularly as organizations grapple with the need to engage in digital transformation. We assert that successful digital transformation is impossible without incorporating the use of the scale, security architecture, and resiliency of the cloud.

Consequently, cloud adoption becomes a necessary component of roadmap discussions and planning as your organization looks to reduce overall risk. Risk leaders and enterprise cybersecurity leaders must consider that moving data, digital processes, and priority workloads to the public cloud is a crucial step for meeting the current and future digital needs of the enterprise. Going forward, this digital transformation increasingly will include hybrid infrastructure environments composed of a combination of on-premises and cloud solutions.

Pinpointing where threats thrive

As digital environments become more complex within a given organization, proactively countering adversaries becomes all the more difficult. It’s harder to implement, scale, and adhere to existing security and control frameworks. It’s also increasingly challenging to apply framework guidance to new applications, build and support infrastructure within a secure foundation, and maintain good cyber hygiene through the digital lifecycle.

As reported by TechTarget, the 2020 hack of the SolarWinds Orion IT performance monitoring system is a prime example. It grabbed headlines “not because a single company was breached, but because it triggered a much larger software supply chain incident.” This vulnerability in popular, commercially available, and widely utilized software compromised the data, networks, and systems of thousands of companies when a routine software update turned out to be backdoor malware.

A close look at the root problems behind high-profile security breaches reveals that it’s a lack of agility and an inability to scale resources that prohibit the modern security organization’s ability to respond quickly enough to counter new challenges. Look even closer and you’ll often find an insufficient implementation of best practices and ineffective solutions, leaving an organization continually chasing the next tool or solution and scrambling to stay ahead of emerging threats.

While the cost to individual businesses is high, most organizations struggle with the needed skills and resources to rigorously maintain data security basics and ensure readiness for inevitable attacks. The previous sentence is especially true when you consider that maintaining an effective state of cybersecurity readiness is a costly practice that requires the continual development of expertise, the evaluation of new tools, and an ongoing element of vigilance.

Threat visibility is a big part of the problem. You can’t protect your company from what you can’t see. For individual enterprises – with critical data workloads housed in a combination of on-premises servers, a variety of endpoints, and both private and public cloud instances – staying ahead in the ongoing battle requires a new approach.

The identification of actionable alerts and other data contributes to a better overall state of readiness. Thought leadership and discussions related to Autonomic Security Operations provide a promising outlook for security organizations willing to lean into the changing technology landscape – a landscape that now benefits from leveraging automation and machine learning currently used in security stacks. Reducing the chance of introducing vulnerabilities or missing-critical alerts starts with ensuring full visibility into an increasingly expanding and complex environment.

The evolution of a shared responsibility to a shared fate

Industry megatrends are driving cloud adoption and with it a path to improved cybersecurity. Among these trends is the concept of shared fate as an evolution of the historical shared-responsibility model. Shared fate drives a flywheel of increasing trust which develops as more enterprises transition to the cloud. This compels an even higher security investment and a more vested interest from cloud service providers.

At Google Cloud, shared fate means we take an active stake in our customers’ security posture, offering capabilities and defaults that help ensure secure deployments and configurations in the public cloud. We also offer experience-based guidance on how to configure cloud workloads for security, and can assist with risk management, reduction, and transfer.

The Google Cloud Risk Protection Program represents the continuing evolution of the shared-fate model. The program offers a practical solution that provides the modern enterprise a snapshot comparison of its current security state against well-adopted cloud-security frameworks. It also give you an opportunity to explore cyber insurance designed to meet your needs from our partners Allianz and Munich Re.

When performed with diligence, cloud adoption can help increase your overall cybersecurity effectiveness. Using a hybrid approach – and steadily reducing which data assets remain on premises – can strengthen your overall security posture and reduce risks to the organization.

Cloud security and the ability to reduce risk

In comparison to the enterprise-by-enterprise security scramble to protect data and workloads in individual private clouds, global public cloud solutions like Google Cloud can be a force multiplier when adhering to established best practices. By that, we mean, quite literally, that you get more security at every touchpoint – from infrastructure and software to access and data security.

Strong security in the public cloud starts with the foundational pieces: the hardware and design elements. At Google, for example, we take a security-by-design approach within both the data center and purpose-built components themselves. Within Google Cloud, data is encrypted by default – both at rest and in transit. Google’s baseline security architecture adheres to the zero trust principles, meaning that every network, device, person, or service initially cannot be trusted.

Embarking on a zero trust architecture journey gives modern security practitioners the ability to methodically shut down traditional attack vectors. Zero trust also provides more granular visibility and control of rapidly expanding environments. The recent emphasis of its benefits, as the U.S. White House set forth through an executive order on increasing cybersecurity resilience, is an example of the wide-scale recognition by both government and industry on the benefits of this approach.

Since adopting a zero trust approach more than a decade ago, Google has achieved a recognizable level of maturity, reflected by our internal infrastructure and multiple enterprise offerings, enabling different aspects of the zero trust security journey.

Compliance and privacy drive critical elements of the cloud adoption cycle

Privacy frameworks, regulatory compliance, and data sovereignty are driving critical elements of the cloud adoption cycle. Cloud providers must ensure they have the necessary controls, attestations, and abilities to audit in order to provide organizations with the tools to preemptively satisfy regulatory and compliance mandates across the globe.

Now consistently expected to be part of a design feature that’s built into the cloud journey, it cannot simply be an add-on capability. The direction of this evolution promises to play more of a role in the future of cloud adoption, not less. Because this is an ongoing component of enterprise risk evaluation, your business must consider cloud providers that can partner on this critical aspect of the journey – and not leave you without the resources to respond to this growing critical need.

Building trust into your digital transformation journey

Digital transformation is difficult because the modern enterprise must build and design for both today and tomorrow. From a security perspective, the challenge has often been that security industry practitioners cannot always predict what the future will look like. That said, there are clear steps you can take to mitigate all-around risk throughout the process.

How you approach the cloud is, of course, integral to your journey, but it doesn’t need to be an all-or-nothing proposition. And although technology debt continues to persist with legacy systems, that doesn’t mean you shouldn’t begin to move forward.

Google Cloud enables you to modernize at your own pace and understand what’s realistic. We recommend you move what data you can to a more secure public cloud today, followed by a phased approach to move more in the months and years that follow. The key tenets of our approach to security in the public cloud include:

• The security-by-design posture of Google Cloud can help modern-day enterprises scale security capabilities and reduce risk with an architecture built on zero trust principles.
• The Google Cloud approach to security and resiliency includes a framework to help you protect against adverse cyber events by using our comprehensive suite of solutions.
• Google Cloud can help ensure your organization adheres to the requirements of a growing and increasingly complex regulatory and compliance environment.
• The ideal model of a future organization is one where cloud plays a major role in infrastructure design and architecture. Your organization should begin to view public cloud as an enabler of the business and a core component of digital transformation.

As you transition more data to the public cloud, it’s paramount that trust is ingrained in every step you take with your cloud service provider. Many service providers readily take on a shared responsibility with your organization when it comes to security. At Google, we take it several steps further with our shared fate model to help ensure data security in the public cloud. Your future and our’s are part of the same data security journey.