Live @ Vive Partner Perspective Q&A with Ryan Witt, VP, Industry Solutions, Healthcare, Proofpoint: Healthcare is Blessed to Have 405(d)

Healthcare is abuzz with talk of artificial intelligence. And when it comes to cybersecurity, that buzz both has to do with how the bad guys are going to use it, and how the good guys can apply it to defense. But Ryan Witt, VP, Industry Solutions, Healthcare, Proofpoint, warns that today, the time of small- to mid-sized health systems is better spent on basic blocking and tackling, especially around the major threat vector of email. Amazingly, he adds, some of the foundational steps for email security are still not in place. In this Live @ Vive interview with healthsystemCIO Founder & Editor-in-Chief Anthony Guerra, Witt covers these issues, the Health Sector Coordinating Council’s efforts to consolidate and simplify guidance, and whether mandatory cyber guidance should eventually become a reality.

Bold Statements

If I had to guide anybody in terms of, where would you focus your time and effort, we’re really blessed in healthcare with the 405D program and the document they produced that’s called HICP. They also put out very strong, very worthwhile, guidance all around cybersecurity preparedness.

It feels like we still haven’t shaken away from the Meaningful Use era when we were all focused on the patient record. We were all focused on the things that gave us funding for the patient record, and not those conditions that were security related, which were actually much more regulatory-related, compliance-related, and so we made investments in that direction. We did not make enough investments in security, and I don’t think healthcare has ever really caught up.

… there’s now a strong understanding that cyber events are related to patient outcomes. We’re no longer just doing these things because it makes good sense financially, or because there’s some compliance measure we’re trying to meet, or because we care about our reputation or whatever.

Anthony: Welcome to healthsystemCIO’s Live @ ViVE Interview with Ryan Witt, VP of Industry Solutions at Healthcare, Proofpoint. Ryan, thanks for joining me.

Ryan: It’s great to be here, Anthony. Live at ViVE. I mean, it feels like I’m live at HIMSS, my goodness.

Anthony: Well, we’ll be there in two weeks.

Ryan: Right, right.

Anthony: Let’s start off with a little bit of a background on Proofpoint, a little bit about your organization and role.

Ryan: Proofpoint is all about human-centric security. There’s this acknowledgment now that the bad actors are really focusing their efforts on attacking humans and how they work. Proofpoint tries to help organizations mitigate against that; so protecting humans and then ultimately defending what’s often the ultimate target – data. So we defend data, defend people how they work, and try to prevent data exfiltration.

Then, from my standpoint, I focus on creating that aperture really around healthcare, so that we are building out solutions and strategies to go make sure that healthcare industry customers have a great experience working with Proofpoint.

Anthony: Very good. We’re here at the show, and every year there seems to be a different buzzword; blockchain was one that was huge a few years ago. Obviously, the pandemic stuff in the middle and now we have AI everywhere, in every conversation, what’s going on with AI, what are people doing with AI, and they want to know what their vendors are doing with AI, what the bad guys are doing with AI, all kinds of stuff. I’m sure you get asked all the time by customers and prospects about what you’re doing with AI. Your thoughts?

Ryan: You’re absolutely right. I think, unlike blockchain where that might have been a moment in time – I don’t want to diminish blockchain, but it might have been a moment-in-time topic – I think AI is not going away. I don’t think it’s a moment in time, it’s going to ultimately revolutionize how we all interact with technology going forward.

But I think it’s also important to temper it a l...