Midrange Stuff, OS/400 Edition

Things are growing quickly at Apria Healthcare these days. The company's revenues, the size of its iSeries servers, and the number of e-mail users have all increased substantially in the last year. Unfortunately, Apria's daily dose of spam e-mail has also shot up, requiring its IBM Lotus Notes users to manually delete thousands of unwanted--and sometimes obscenely objectionable--electronic messages every day. Apria began its search for a spam filter a year ago, with hopes of keeping the filter on its iSeries.

Apria Healthcare is a devoted OS/400 shop. It's a model OS/400 shop as well, the kind of forward-thinking open place you'd like to see every OS/400 shop become. Unlike many midmarket companies, Apria resides on the cutting edge of promising new technology and IT trends. Take these for example:

Besides these notable implementations, Apria relies on a mix of homegrown OS/400 programs and OS/400 applications from well-known vendors to run its $1.1 billion home-healthcare business, including a human resources application from SAP, employee management from Kronos, high availability from Vision Solutions, change management from Aldon Computer Group, 4GL development tools from Computer Associates, and, of course, e-mail and collaboration software from IBM Lotus.

With all of this technical expertise, you might think a simple little thing like a few pesky pieces of spam would not pose much of a problem for such an obviously capable IT outfit. In fact, spam was becoming a major headache for Apria's IT department and a real drain on the productivity and bottom line of the company.

As Apria doubled the number of employees with access to its Notes/Domino e-mail system--bringing the total to 3,000 users--the amount of spam increased proportionately. Before long, the basic address-blocking capability in Domino was allowing 90 percent of the spam to go through. Considering that almost 30 percent of the 9,000 outside e-mails that Apria users receive every day from the Internet was spam, this was a definitely a problem, says Ted Hardenburgh, a senior systems analyst for Domino at Apria.

"The number of mail users was growing by leaps and bounds, and we realized we needed security," Hardenburgh says. "The users we were adding were not technically savvy, and they were getting more spam, reporting more spam. . . . We saw a need to kill this [spam] as much as possible."

In addition to spam blocking, Apria required an e-mail archive program. Because some of the e-mail that Apria sends and receives contains patient information, the Health Insurance Portability and Accountability Act of 1996 mandates that the company archive these documents for a period of time. The company had already implemented other HIPPA requirements (such as mirroring its iSeries servers to ensure availability), and e-mail archiving would be one of the final steps as the April 14, 2003, HIPPA compliance deadline neared.

Apria stores patient data on iSeries servers, so it needed to keep its e-mail archive on the OS/400 platform to satisfy the HIPPA requirement. The company didn't have the same motivation to keep the spam-blocking software on OS/400. Although Apria saw the advantages in keeping the different pieces of its e-mail security software on the same platform, if the right solution wasn't available for OS/400, it could see offloading the spam blocking to a Windows NT server, as it had done with its McAfee antivirus software for Domino.

When Hardenburgh set out on his search for anti-spam and e-mail archiving software about one year ago, he found most of the anti-spam and archiving packages were designed for the Unix and Windows platforms. On top of that, the packages seemed kind of pricey, he says, especially the outsourced spam-blocking services.

Then Hardenburgh's search brought him to GROUP Software, a German-owned company that offers a range of e-mail security tools that run on OS/400, as well as other major platforms that support Domino and Microsoft's Exchange e-mail system. At the time, GROUP Software was the only company that Hardenburgh could find with OS/400-based e-mail archiving software that supported Domino, so that was a definite plus in GROUP's favor. Because spam blocking was a more pressing priority than archiving, Hardenburgh decided to test the spam filter first, so he obtained a copy of GROUP's securiQ.Wall program.

Upon activating securiQ.Wall, the software immediately started flagging about 25 percent of incoming e-mail as spam, Hardenburgh says. "It helped out greatly, but it didn't catch everything," he says, adding that it "took some time" to tune the content filters and to enable the "white list," a filter that lets trusted sources successfully send e-mail that might otherwise be blocked before it reaches its intended recipient. The company has since integrated securiQ.Wall with a spammer "black list" that comes with the new release of Domino.

Price had a big effect on Apria's decision to purchase GROUP's software, as did the breadth of the solutions that GROUP sold to Apria, which included securiQ.Safe for archiving; securiQ.Watchdog for anti-virus enhancement and content filtering; securiQ.Trailer for legal disclaimers; and securiQ.Wall. (GROUP also sells more advanced software that blocks pornographic images by detecting skin tones in images, but that solution runs only on Unix and was not something Apria needed at the time, Hardenburgh says.)

George Suda, Apria's executive vice president of IS, was pleased that his company didn't have to mix and match products from other vendors or build its own. "Apria purchased these four products," Suda says, "at a total cost that was less than the price of one piece of content-filtering software offered by other vendors."

Hardenburgh figures it took Apria four months to recoup its investment in GROUP's anti-spam software. This return-on-investment figure is based on analyst group studies that show each spam e-mail takes about a 25-cent toll on its recipient, in terms of the lost productivity of the user who has to identify the e-mail as spam and delete it, the storage space the company wastes to house the spam, and administrative overhead.

Based on Hardenburgh's figures, spam was costing Apria about $600 per day. Thanks to securiQ.Wall, the company has gotten a hold on its growing spam problem and is well on its way to HIPPA compliance.

All of this sounds just fine to Hardenburgh. "I'm happy with what we've bought," he says. "It was not a purchase of desperation, because GROUP was the only [OS/400] game in town. We wouldn't have bought it if it didn't work."