Overview: Cloud SaaS in Healthcare IT

The healthcare industry has been one of the most consequential and challenging domains for enterprise software. Managing patient records, clinical workflows, regulatory compliance, and financial operations at scale demands robust, secure, and highly integrated platforms. Cloud computing and Software-as-a-Service (SaaS) models have become the dominant delivery mechanism for these platforms, replacing expensive on-premises infrastructure with subscription-based services hosted on remote servers.

Two companies have consistently stood out in this space: Veeva Systems (NYSE: VEEV), which focuses on life sciences and pharmaceutical clients, and Cerner Corporation (NASDAQ: CERN), which targets hospitals, health systems, and broader healthcare providers. Understanding the differences between them matters not only for investors but also for DevOps engineers, healthcare IT architects, and technology decision-makers evaluating platforms for their organizations.

The Healthcare Cloud Market: Why It Matters

Cloud adoption in healthcare has moved well past the experimental phase. Organizations use cloud infrastructure to host electronic health records (EHRs), analytics pipelines, patient engagement portals, and regulatory submission systems. SaaS delivery, in particular, reduces the operational burden on internal IT teams by offloading infrastructure management, patching, and scaling to the vendor.

Key drivers of cloud adoption in healthcare include:

• Interoperability requirements: Regulations such as the 21st Century Cures Act push providers to adopt systems that can share data via open APIs.
• Aging population demographics: Growing demand for healthcare services increases the volume of data that must be managed and analyzed.
• Cost pressure: SaaS models convert capital expenditure into predictable operational expenditure, which appeals to CFOs across the industry.
• Regulatory complexity: Pharmaceutical and clinical trial workflows are subject to strict FDA and EMA requirements, creating demand for purpose-built compliance platforms.

Other major competitors in the healthcare IT space include Allscripts (NASDAQ: MDRX), Epic Systems, and athenahealth, making the market competitive and fast-moving.

Risks of Cloud-Based Healthcare Software

Despite the tailwinds, healthcare SaaS platforms carry specific risks that engineering and operations teams must account for:

• Data security and compliance: Healthcare data is subject to HIPAA in the United States and equivalent regulations elsewhere. A breach does not just damage reputation — it can trigger regulatory penalties and customer churn.
• Vendor lock-in: Healthcare organizations tend to be highly loyal to their software vendors once implemented, but this same stickiness means migration projects are expensive and disruptive when they do occur.
• Integration complexity: Healthcare IT ecosystems are notoriously fragmented. A new SaaS platform must integrate with legacy EHR systems, lab information systems, billing platforms, and third-party data sources — all of which may use different standards (HL7, FHIR, proprietary APIs).
• Competitive pressure: Enterprise software giants such as Microsoft, Oracle, and Salesforce have entered adjacent healthcare markets, increasing competitive intensity.

Cerner Corporation: Platform, Market Position, and Financials

What Cerner Does

Cerner provides a broad suite of healthcare IT products, with its core offering being the Cerner Millennium EHR platform. Its product portfolio covers:

• Electronic health records (EHR) and clinical documentation
• Revenue cycle management and financial systems
• Population health management tools
• Health information exchange (HIE) infrastructure
• Data analytics and reporting

Cerner serves hospitals, ambulatory care facilities, physician practices, and government health agencies. As of the original publication (early 2019), the company reported partnerships with approximately 27,000 healthcare providers across 35 countries, with an estimated 24% share of the U.S. healthcare IT market.

Financial Snapshot (as of early 2019)

Cerner reported revenue of approximately $5.4 billion for fiscal year 2018, representing roughly 4% year-over-year growth. The company carried approximately $441 million in debt, largely attributable to its 2015 acquisition of Siemens Health Services. At the time of the original article, the stock had recovered approximately 11% year-to-date after a difficult Q4 2018, during which disappointing Q3 results caused the share price to fall around 12% in a single session.

Technical and Operational Considerations

Cerner’s scale means it must support a highly heterogeneous customer base with varying levels of technical maturity. Its HealtheIntent platform offers population health analytics built on a cloud-native architecture, but much of the core Millennium EHR product has deep roots in client-server architecture, which presents modernization challenges. DevOps teams working with Cerner integrations typically deal with HL7 v2 and FHIR R4 interfaces, and Cerner’s open developer program (now part of Oracle Health following Oracle’s 2022 acquisition) provides APIs for extending its ecosystem.

Veeva Systems: Platform, Market Position, and Financials

What Veeva Does

Veeva Systems occupies a distinct niche from Cerner. Rather than targeting hospitals and clinical providers, Veeva focuses on pharmaceutical companies, biotech firms, and contract research organizations (CROs). Its platform is built on top of Salesforce infrastructure (for its commercial cloud products) and includes:

• Veeva Commercial Cloud: CRM tools tailored for pharmaceutical sales teams, medical affairs, and marketing operations
• Veeva Vault: A content and data management platform used for regulatory submissions, clinical data management, and quality management — built on Veeva’s own cloud infrastructure
• Veeva CRM: A life-sciences-specific customer relationship management application
• Veeva Nitro and Veeva Data Cloud: Analytics and data services

As of the original article (early 2019), Veeva served approximately 700 enterprise customers in life sciences, with CEO Peter Gassner signaling plans to expand into adjacent industries such as consumer goods and chemicals.

Financial Snapshot (as of early 2019)

Veeva’s stock had appreciated approximately 70% during 2018 and was up roughly 35% year-to-date at the time of the original article. The company was projecting its first year of $1 billion in annual revenue — a milestone that reflected its position as one of the fastest-growing enterprise software vendors of that period. Veeva carried no significant debt at the time, giving it a stronger balance sheet relative to Cerner. Fortune magazine ranked Veeva as the second fastest-growing enterprise software company at or near the time of publication.

The original article noted a price-to-earnings-to-growth (PEG) ratio of approximately 1.66 for Veeva at the time, which some analysts interpreted as a mild overvaluation signal.

Technical and Operational Considerations

Veeva’s Vault platform is purpose-built for regulated environments. It supports 21 CFR Part 11 compliance for electronic records and electronic signatures, which is a hard requirement for pharmaceutical companies operating under FDA oversight. Vault’s document management, audit trail, and workflow automation capabilities are central to clinical trial management, regulatory submission authoring, and quality systems.

From a DevOps perspective, Veeva provides REST APIs for integrating Vault with external systems such as CTMS, LIMS, and enterprise data warehouses. Its developer ecosystem is smaller than Cerner’s but tightly focused on life sciences workflows.

Veeva vs. Cerner: Direct Comparison

Which Platform Is Right for Your Organization?

The choice between Veeva and Cerner is not typically a competitive one — these platforms serve fundamentally different buyers and use cases.

• If you are a pharmaceutical company, biotech, or CRO managing regulatory submissions, clinical content, or commercial operations, Veeva Vault and Veeva CRM are purpose-built for your workflows. The platform’s native compliance features reduce the custom development required to meet FDA and EMA requirements.
• If you are a hospital, health system, or ambulatory provider looking for an EHR, revenue cycle management, or population health tools, Cerner is a primary candidate. Its scale and breadth of product offerings make it suitable for large integrated delivery networks.
• If you are building integrations or extensions, evaluate the maturity of each vendor’s API ecosystem, the availability of FHIR-compliant endpoints, and the quality of developer documentation before committing to either platform.

Important Note on Oracle’s Acquisition of Cerner

This article draws on data from May 2019. A significant development since then is Oracle’s completed acquisition of Cerner in 2022. Cerner now operates as Oracle Health, and its strategic direction, product roadmap, and competitive positioning are evolving under Oracle’s ownership. Any evaluation of Cerner as a technology platform or investment should account for this material change.

Summary

Veeva Systems and Cerner Corporation are both significant players in healthcare technology, but they address different segments of the market with different architectural approaches. As of 2019, Veeva showed stronger short-term growth momentum and a cleaner balance sheet, while Cerner offered broader market reach and established revenue at a much larger scale. For engineers and architects evaluating these platforms today, the more relevant questions are about API maturity, compliance capabilities, integration ecosystem, and long-term vendor stability — particularly given Cerner’s transition to Oracle Health.

Original article sourced from ktva.com via bestdevops.com, published May 2019.

DevOps Adoption Is Growing — and So Are the Risks

Enterprise adoption of DevOps has steadily accelerated as organisations look to close the gap between software development and IT operations. By breaking down silos and enabling continuous delivery pipelines, DevOps helps teams ship software faster, respond to market changes more quickly, and collaborate more effectively across business functions.

But as more CIOs bring DevOps into their organisations, a critical tension is emerging: the same speed and openness that makes DevOps powerful also creates measurable security and compliance risks. Managing that tension is fast becoming one of the defining challenges for enterprise IT leadership.

The Business Case for DevOps

The appeal of DevOps to business leaders is straightforward. Faster release cycles mean faster time to market — a decisive competitive advantage in industries where digital products and services are core to the business model.

“It certainly does offer benefits in terms of time to market. In this day and age, IT is part of doing business and it has to deliver at the speed matching the need of business.”

— Sumit Singh, CIO, Wockhardt Hospitals Ltd.

Singh notes that Wockhardt Hospitals deployed a small, dedicated team working in a DevOps-like model to deliver a GST compliance project — an example of how even traditionally conservative sectors such as healthcare are experimenting with agile delivery practices.

“DevOps will reduce risk and improve quality of IT delivery. This is not risky and no worry, mainly because we are using DevOps as a copy of productions — a simulated environment — and this is very much required for the future to address statutory changes like GST.”

— Satyanarayana Kasturi, GM & CIO – Projects Business, Essar Projects (India) Limited

The drive toward continuous innovation is another core motivator. As Arsalaan Kashif, Associate Director of Product Engineering Services at Happiest Minds Technologies, puts it:

“DevOps is driven by the need to continuously innovate and deliver, to reach the market before the ever-shrinking window of opportunity shuts down.”

— Arsalaan Kashif, Happiest Minds Technologies

Where DevOps Creates Security and Compliance Risk

The same urgency that drives DevOps adoption can undermine security. When teams are under pressure to ship continuously, security reviews and compliance checks are frequently treated as friction rather than fundamentals — and they get skipped.

“Even with the best of intentions in place, the rush to deliver on tight deadlines can cause DevOps teams to cut corners and be out of compliance with their company’s security policies. As security teams are left in the dark, there could be a lapse in judgement about what potentially is leaked to the internet, exposing the organization to unnecessary risk.”

— Arsalaan Kashif, Happiest Minds Technologies

Privileged access is a particularly acute concern. DevOps environments depend heavily on automation, scripts, and service accounts — all of which require credentials. If those credentials are poorly managed, they become high-value attack targets.

“DevOps is an area which again is a bit of a challenge in terms of cybersecurity because the developers would typically want to access everything and anything that means agility for software development. The DevOps team would download a lot of freeware and experiment with it, as they would want to test all possible conditions because they want to have agility, but don’t want laws around it.”

— Rohan Vaidya, Regional Director – Sales India, CyberArk

CyberArk is an enterprise security company specialising in privileged access management, including purpose-built tooling for securing DevOps pipelines and secrets management. The risks Vaidya describes — unmanaged credentials, ungoverned tool downloads, over-permissioned service accounts — are well-documented attack vectors in modern CI/CD environments.

The Answer: DevSecOps and Continuous Security

The consensus among practitioners is that treating security as a post-delivery audit is incompatible with DevOps. Instead, security must be embedded into the pipeline itself — shifting left so that vulnerabilities are caught earlier and more cheaply.

“The key ingredient of DevOps is the automation of infrastructure, testing and delivery. In my opinion, to make it safe, DevOps needs to become DevSecOps — which means security and risk assessment need to become continuous and adaptive. Like Continuous Integration and Continuous Delivery (CI/CD), security needs to become continuous as well. In many organisations the code will be shipped to a security team to assess vulnerabilities, which can take days to weeks. In DevSecOps, this process needs to be automated as part of the Continuous Delivery framework.”

— Meerah Rajavel, CIO, Forcepoint

Rajavel’s point is practical and well-supported by industry experience. Manual security reviews at the end of a sprint create bottlenecks, delay releases, and generate friction between security and engineering teams. Automating vulnerability scanning, compliance checks, and secrets detection within the CI/CD pipeline removes that bottleneck without sacrificing security rigour.

What DevSecOps Looks Like in Practice

• Shift-left security testing: Static application security testing (SAST) and dependency scanning run automatically on every code commit, not just at release time.
• Secrets management: Credentials, API keys, and certificates are managed through a dedicated secrets manager (such as HashiCorp Vault or a cloud-native equivalent) rather than hardcoded in repositories.
• Policy-as-code: Infrastructure and deployment policies are codified and enforced automatically, preventing out-of-compliance configurations from reaching production.
• Continuous monitoring: Runtime security monitoring and logging are built into the deployment pipeline, not bolted on afterwards.
• Penetration testing cadence: Regular pen tests and red team exercises are scheduled as ongoing operations, not one-off pre-launch activities.

The Adaptive Risk Model: CARTA

The broader strategic framework for this approach is the concept of Continuous Adaptive Risk and Trust Assessment (CARTA), a model introduced by Gartner. CARTA argues that in a digital-first environment, static perimeter-based security is insufficient. Instead, organisations must continuously evaluate risk and trust in real time, adjusting access and controls dynamically based on context.

For CIOs pursuing digital transformation — where DevOps and Agile are core delivery tools — CARTA provides a governance framework that accommodates speed without abandoning risk management. The emphasis is on monitoring, adaptive response, and continuous learning rather than binary allow/deny decisions made at a fixed point in time.

Organisational Culture Is the Hardest Problem

Technology and tooling are only part of the challenge. DevOps — and by extension DevSecOps — requires a cultural shift that many enterprises find difficult to sustain.

“A ‘generative’ culture where information and ideas are exchanged freely is critical for DevOps to succeed. When the core driving principle is ‘failing fast’ and learning from it, it is important to foster an environment where failures aren’t brushed under the carpet. Collaboration is another key factor that cannot be overstated. Apart from the development and operations teams coming together, there is also a need to collaborate with the security group to ensure compliance and high-quality releases that aren’t just timely but secure.”

— Arsalaan Kashif, Happiest Minds Technologies

This is a well-established finding in DevOps research. The Westrum organisational model — which categorises cultures as pathological, bureaucratic, or generative — has been cited in multiple State of DevOps reports as a strong predictor of software delivery performance. Teams operating in generative cultures consistently outperform those in more siloed environments, regardless of the tools they use.

Introducing security as a shared responsibility — rather than a gate owned exclusively by a separate security team — requires trust, clear communication, and executive support. CIOs play a pivotal role in creating the conditions for that cultural change.

What CIOs Should Do

Forcepoint CIO Meerah Rajavel offers a useful analogy: the goal of business is to fly high and fast, which carries inherent risk. The CIO’s job is not to ground the aircraft — it is to design a flight system safe enough to fly confidently.

“The CIO job should be to design a solid security and risk framework, which will enable the business to fly safe, not hold them back saying flying is dangerous.”

— Meerah Rajavel, CIO, Forcepoint

Practically, that means CIOs should:

• Reframe the security conversation: Position security as a delivery enabler, not a blocker. Automated security in the pipeline means fewer late-stage surprises, not slower releases.
• Mandate DevSecOps from the start: Security requirements, threat modelling, and compliance checks should be part of project inception, not a review that happens after the code is written.
• Invest in automation: Manual security gates do not scale with DevOps velocity. Tooling for SAST, DAST, secrets scanning, and infrastructure compliance checks must be embedded in CI/CD pipelines.
• Build cross-functional security literacy: Developers do not need to become security specialists, but they do need enough context to write defensively and recognise risk.
• Communicate risk transparently to business stakeholders: Business leaders who understand the risk landscape can make better-informed decisions about acceptable trade-offs between speed and security.
• Adopt an adaptive monitoring posture: Assume breach. Invest in runtime monitoring, anomaly detection, and incident response capabilities that work continuously — not just at release time.

Bottom Line

DevOps is not a passing trend — it is the operational model that modern software delivery is built around. But its benefits are only sustainable when security is treated as a first-class concern, not an afterthought. The shift from DevOps to DevSecOps is less a change of tooling than a change of mindset: security belongs in every sprint, every commit, and every deployment — not just at the end of the release cycle.

CIOs who build that security-first culture, automate compliance within their pipelines, and communicate risk clearly to business stakeholders will be positioned to capture the full value of DevOps without exposing their organisations to avoidable harm.