InformationWeek

Most businesses do an inadequate job of preparing security plans, Maloff says. "Less than 5% of businesses have some kind of written network security policy and plan in place," he says. Before they turn to a service provider for help in developing an extranet, businesses must first decide what they want the network to do, Maloff says. They need to determine who will connect to the network and what those people can have access to once inside.

MemorialCare, a nonprofit system of six hospitals in the Los Angeles area, did its security homework ahead of time. It wanted to find a way to give access to patient records to physicians who work at hospitals in the network but who aren't company employees. To do so, MemorialCare turned to Pilot Network Services Inc.

"We briefly considered building the extranet on our own," says Scott Cebula, executive director of IS at MemorialCare. "We even bought a remote-access system. But after using it for a short time, we determined we'd be able to acquire better services out in the market than we could develop on our own."

Within eight months, Pilot set up an extranet that lets physicians dial in to MemorialCare's network remotely to give and receive patient information. Building the same extranet on its own would have taken MemorialCare at least a year and a half, Cebula says-and he wasn't confident the company would have achieved the level of security it needed on its own.

Physicians dial in to the MemorialCare network through their own Internet service providers. Once the user is connected, all traffic between the user and the network is encrypted for added security. MemorialCare is working with Pilot to extend the extranet to include dedicated connectivity for larger physician practices.

Companies considering outsourcing an extranet to a service provider should put together a questionnaire to determine whether the ISP can deliver a quality service, says John Pescatore, research director for Internet security at Gartner Group. "Service providers are starting to pop up like weeds," he says. "You've got to be able to evaluate their competency."