Code Red: HIMSS' Cybersecurity Podcast

This Episode’s GuestGreg WolvertonChief Information OfficerARcareLearn more about GregFollow Greg on Twitter: @GregWolvertonLearn more about ARcareUniversity of Houston professor Brené Brown understands the strength that comes from embracing our vulnerabilities. “When we spend our lives”, Brown says, “waiting until we’re perfect or bulletproof before we walk into the arena, we ultimately sacrifice relationships and opportunities that may not be recoverable, we squander our precious time, and we turn our backs on our gifts, those unique contributions that only we can make. Perfect and bulletproof are seductive, but they don’t exist in the human experience.”In an age of ubiquitous cybersecurity threats, it takes a strong organization to embrace its vulnerabilities.  To understand that true strength comes from the willingness to examine and reexamine our weaknesses.  To lead by the need to learn about ourselves.  To lead by the need to share with others.  Welcome HIMSS’s new health IT cybersecurity podcast, Code Red. Code Red focuses on cybersecurity challenges facing health care today & tomorrow, featuring the voices of the people on the front lines. The goal of the podcast is to explore the interplay between the people, processes & technologies that make up an organization’s cybersecurity posture from both a leadership & skills-based perspective.  In today’s episode, we will discuss how ARcare, a Davies award recipient and EMRAM Stage 7 non-profit that provides medical and dental care to residents in rural Arkansas responded to a recent cybersecurity breach with Greg Wolverton, CIO of ARcare and Chair of the HIMSS User Experience committee.     This Episode’s PromosHIMSS17 is the meeting place for all things health IT. Experience over 300 education programs, more than 1,200 vendors, hundreds of special programs, and limitless networking opportunities. Collaborate with HIMSS and thousands of colleagues worldwide as you work to positively transform health and lives through IT.Register Today

Let’s accept the fact that we want to feel secure in some way, whether it is secure in our jobs, our relationships, or our personal safety and wellbeing.  We want the best for our families, our business endeavors or, as in healthcare, for the other people for whom we have some degree of responsibility.  But how do you place a value on the effort we make to create a secure environment?   In this episode of Code Red, we talk with Fred Cox, Director of Information Security at Varian Medical Systems about the financial implications of cybersecurity, including direct and indirect costs of security, the idea of table stakes and behavior analytics, and at which point the concept of cybersecurity’s ROI can effectively be considered.   This Episode’s GuestFredrick Cox, CISSPDirector, Information SecurityVarian Medical SystemsLearn more about FredFollow Varian Medical Systems on Twitter: @VarianMedSysLearn more about Varian Medical Systems This Episode’s PromosHIMSS17 is the meeting place for all things health IT. Experience over 300 education programs, more than 1,200 vendors, hundreds of special programs, and limitless networking opportunities. Collaborate with HIMSS and thousands of colleagues worldwide as you work to positively transform health and lives through IT.Register Today

It’s amazing what a difference a moment can make.  By the time you’re done listening to this introduction, 160 new malware samples will be released.  By the time you’re done listening to this introduction, someone will have become the first victim of a spam-based malware attack. By the time you’re done listening to this episode, ten thousand Facebook accounts will be compromised.  27 thousand computers worldwide will be added to a botnet. The US Navy will be cyberattacked 45,000 times.  The NSA will be cyberattacked 5.2 Million times.  Since 2009, detected cybersecurity incidents have increased 66% year-over-year.  By the time you’re done listening to this episode, how many of your records have been attacked?  By the time you’re done listening to this episode, who, undetected, has gained access to your network?  Who has compromised your system? Do you know?  It’s amazing what a different a moment can make.  Scared yet? Don’t worry.  We won’t be offended.  Go ahead and pause the podcast to call your chief security officer.  Go ahead.  Go. Go now.Welcome HIMSS’s new health IT cybersecurity podcast, Code Red. Code Red focuses on cybersecurity challenges facing health care today & tomorrow, featuring the voices of the people on the front lines. The goal of the podcast is to explore the interplay between the people, processes & technologies that make up an organization’s cybersecurity posture from both a leadership & skills-based perspective.  In today’s episode, we will explore the speedy evolution of hacking techniques, their impact on the health care industry, and the role we all have in effective cybersecurity with Kevin Johnson, CEO of Secure Ideas and HIMSS16 Views from the Top speaker.  We will also hear about the launch of HIMSS’ new Cybersecurity hub at the HIMSS Innovation Center in Cleveland, Ohio.  This Episode’s GuestKevin JohnsonFounder & CEOSecure IdeasLearn more about KevinFollow Kevin on Twitter: @secureideas Learn more about Secure Ideas This Episode’s PromosThe HIMSS Privacy & Security Forum is the nation’s leading event dedicated exclusively to healthcare privacy and security. These premier two-day conferences are held around the country and bring together hundreds of senior executives for thought leadership focused on solving some of the industry’s toughest challenges.  The HIMSS Privacy & Security Forum is designed to meet the needs of CIOs, CISOs and other senior health IT leaders. The information shared at the forum is practical, solutions-based and actionable – designed to help with planning, coordination and oversight. Each event offers the opportunity to learn of industry developments, network with peers, and discuss key topical issues. Topics covered include: cloud security; cybersecurity; HIPAA; identity & access management; incident response; medical device security; vendor management; and more.  The next HIMSS Privacy & Security Forum is scheduled for December 5th to the 7th at the Westin Boston Waterfront in Boston, Massachusetts.  Find more information about the upcoming HIMSS Privacy & Security Forum.

On March 12, 2008, the New York Times reported about a team of computer security researchers from Beth Israel Deaconess Medical Center and the Universities of Washington and Massachusetts that able to gain wireless access and reprogram a combination heart defibrillator and pacemaker to deliver potentially fatal jolts of electricity to a person with the device.   Since that zero day nine years ago, the health care industry has moved up to top of the list for cybersecurity attacks.  Since that zero day nine years ago, millions of pacemakers have been implanted worldwide.  Since that zero day nine years ago, the mobile device market has been forecasted to have 8-Billion-dollar market value by 2019.  So as we begin Cybersecurity Awareness Month, what should healthcare organizations do to protect patients and their connected medical devices from being compromised?  In this episode of Code Red, we discuss the impact that connected health will have on medical device security with HIMSS Privacy & Security Committee member Cathy Petrozinno, Principal, Cybersecurity Partnerships and Information Privacy at MITRE Corporation. This Episode’s GuestCatherine M. Petrozzino, CIPP/G/US/ITPrincipal, Cybersecurity Partnerships and Information PrivacyMITRE CorporationLearn more about CathyFollow the MITRE Corporation on Twitter: @MITREcorpLearn more about the MITRE Corporation This Episode’s PromosThe HIMSS Privacy & Security Forum is the nation’s leading event dedicated exclusively to healthcare privacy and security. These premier two-day conferences are held around the country and bring together hundreds of senior executives for thought leadership focused on solving some of the industry’s toughest challenges.  The HIMSS Privacy & Security Forum is designed to meet the needs of CIOs, CISOs and other senior health IT leaders. The information shared at the forum is practical, solutions-based and actionable – designed to help with planning, coordination and oversight. Each event offers the opportunity to learn of industry developments, network with peers, and discuss key topical issues. Topics covered include: cloud security; cybersecurity; HIPAA; identity & access management; incident response; medical device security; vendor management; and more.  The next HIMSS Privacy & Security Forum is scheduled for December 5th to the 7th at the Westin Boston Waterfront in Boston, Massachusetts.  Find more information about the upcoming HIMSS Privacy & Security Forum.

Need to know the dosage for a patient’s medication?  Tough, pay me.  Need to know the lab results for that biopsy?  Tough, pay me.  Need to access your notes to reconsider a patient’s prognosis?  Tough, pay me.Well, this is a new problem, isn’t it? Paper records on a shelf?  Pretty hard to walk off with those.  You can keep an eye on those.  You can lock a door on those.  Electronic records on your database?  Take a number.  Who isn’t after them? Who isn’t going to earn more money on the street today, on this very day, from those records than you are?  Because we all know negotiating a new world of evolving health care revenue models is challenging.  Because we all know that their revenue model is one of the world’s oldest and easiest to understand.  You want it, I got it.  You want it, I got it.  Now let’s see how bad you want it back.So how does a newly digitized health care industry react to all this attention from a long-ago digitized criminal industry?  How can health care organizations operate in a marketplace that asks them to share data both widely and securely?   How does a health care organization ready itself to handle unwanted ransomware attacks?  How do health care organizations build trust between their people, partners & patients that they are ready when the attack happens to them?  Because.It.Will.Happen.In this episode of Code Red, we explore the evolving threat of ransomware attacks on the health care industry and what organizations can do to protect themselves with the Chair of the HIMSS Privacy & Security Committee, Josh Black.This Episode’s GuestJosh BlackManager, IT Security AdministrationInformation Risk OfficerAssistant HIPAA Security OfficerUniversity of Arkansas for Medical SciencesLearn more about JoshFollow CUniversity of Arkansas for Medical Sciences on Twitter: @uamshealthLearn more about University of Arkansas for Medical Sciences This Episode’s PromosHealthcare Privacy & Security Forum The Privacy & Security Forums are two-day conferences, presented by HIMSS Media, held around the nation, with a specific focus on current industry topics. Register for the December 2016 Healthcare Privacy & Security Forum in Boston, Massachusetts This Episode’s Event RecapHost Rod Piechowski describes the cybersecurity challenges being discussed at the 2016 HIMSS AsiaPac Conference. Learn more about the HIMSS Asia Pac ConferenceRead Rod's blog post on the conference "We're All In This Together"

Welcome to Code Red, HIMSS’s new health IT cybersecurity podcast. Code Red focuses on cybersecurity challenges facing health care today & tomorrow, featuring the voices of the people on the front lines. The goal of the podcast is to explore the interplay between the people, processes & technologies that make up an organization’s cybersecurity posture from both a leadership & skills-based perspective. In this August update episode, we will explore the right skills needed for Chief Information Security Officers from two thought leaders in health care security. We will hear about privacy & security initiatives you can participate in here at HIMSS.This Episode’s GuestsMac McMillan, FHIMSS, CISMCEOCynergisTek, Inc.Learn more about MacFollow CynergisTek, Inc on Twitter: @cynergistekLearn more about CynergisTek, Inc. Heather Roszkowski, MSIA, CISSPChief Information Security OfficerThe University of Vermont Medical CenterLearn more about HeatherFollow The University of Vermont Medical Center on Twitter: @UVMMedCenterLearn more about The University of Vermont Medical Center Find Mac & Heather's HIMSS15 Presentation "Selecting the Right CISO & Building the Security Office" in the HIMSS eLearning Center This Episode’s PromosHIMSS17The 2017 HIMSS Annual Conference & Exhibition, February 19–23, 2017 in Orlando, brings together 40,000+ health IT professionals, clinicians, executives and vendors from around the world. Exceptional education, world-class speakers, cutting-edge health IT products and powerful networking are hallmarks of this industry-leading conference. Register today for HIMSS17Healthcare Privacy & Security Forum The Privacy & Security Forums are two-day conferences, presented by HIMSS Media, held around the nation, with a specific focus on current industry topics. Register today for the December 2016 Healthcare Privacy & Security Forum in Boston, Massachusetts

So here’s what keeps me up at night:   The neighbor’s barking dog. The stray firecracker that goes off at 2:30. And Patients.  Millions of patients.  And when I say patients, I really mean people.  Millions of people whose most intimate details… their stories…have been laid bare for the world to see on behalf of the highest bidder.  Millions of people who have to wonder who knows about their recent bout of depression.  Or who knows about their history of high blood pressure and their medication for it?  What about that cancer scare?  And if that isn’t enough, that these people have to wonder, whose got my social security number?  How many accounts have been opened in my name?  How many purchases made with my credit? Collectively, we have to wonder if we can ever be truly secure?  Are our physical and virtual lives irreversibly intertwined? Is the idea of privacy even a valid concept anymore?  These questions, for which there are no easy answers, are some of the things that keep me up at night. I bet they keep you up too.  So here’s what keeps me going each day.  For every malicious hacker, there is a white-hatted one.  For every attack on a server, there is a dedicated IT security professional ready to respond.  For every malicious line of code, there is one created to defend against the malice.So how do we respond?  How does the health care sector deal with the cybersecurity issue?  Who do we look to for leadership and guidance through the battles ahead of us?   Welcome to HIMSS’s new health IT cybersecurity podcast, Code Red.  Code Red focuses on cybersecurity challenges facing health care today & tomorrow, featuring the voices of the people on the front lines. The goal of the podcast is to explore the interplay between the people, processes & technologies that make up an organization’s cybersecurity posture from both a leadership & skills-based perspective.In this episode we will discuss the existential threat of cybersecurity attacks in the age of ubiquitous digital health and the range of current cyber-security threats. We’ll talk to HIMSS Privacy & Security Committee member, Ram Ramadoss, Vice President – Privacy, Information Security & EHR Oversight at Catholic Health Initiatives, the nation’s third-largest nonprofit health system.  -Rod Piechowski (Host) This Episode’s Guest:  Ram RamadossVice President, Privacy, Information Security & EHR OversightCatholic Health InitiativesMember-Cybersecurity Task Force, Department of Health & Human ServicesLearn more about Ram: https://www.linkedin.com/in/ramramadossFollow Catholic Health Initiatives on Twitter: @CHI_UpdatesMore on Catholic Health Initiatives: http://www.catholichealthinitiatives.org/ This Episode's TranscriptRead it here This Episode’s News: 2016 HIMSS Cybersecurity Survey ResultsDownload a copy of the 2016 HIMSS Cybersecurity Survey results.  Cybercriminal TheDarkOverlord stole more patient records and medical images than originally thought, InfoArmor reportsThe hacker broke into organizations on the HL7 network, the security firm has found, and has since put those records up for sale on the dark web. The security firm also said TheDarkOverlord is actively looking for more servers to hack in healthcare.  Read moreInformatics experts offer guidance for defense against ransomwareAs ransomware attacks continue to increase, healthcare stakeholders across the board are going to have to step up their efforts both to prevent and recover from security incidents as quickly as possible.  In an attempt to move those efforts forward, Dean Sittig, a professor at the University of Texas School of Biomedical Informatics, and Hardeep Singh, MD, chief of the Health Policy, Quality and Informatics Program for the Department of Veterans Affairs, recently wrote "A Socio-technical Approach to Preventing, Mitigating, and Recovering from Ransomware Attacks.”  Read moreRead the whitepaper “A Socio-technical Approach to Preventing, Mitigating, and Recovering from Ransomware Attacks”This Episode’s Hashtags: #HITSecurity, #HITworks, #Ransomware, #YouAreTheNextTargetThis Episode’s Promo:Healthcare Privacy & Security Forum The Privacy & Security Forums are two-day conferences, presented by HIMSS Media, held around the nation, with a specific focus on current industry topics. Register for the December 2016 Healthcare Privacy & Security Forum in Boston, Massachusetts.