Like many leadership positions in healthcare, the role of the CNIO is constantly evolving. Whereas in the past, the conversations revolved primarily around workflow, now it’s about being a “thought leader” — someone who can help influence decisions as organization delve further into digital transformation.

And while this certainly requires a deeper skillset than in the past, one criterion has remained the same: the ability to listen. As leaders are learning, moving the needle forward with value-based care and creating a better experience for both patients and providers can’t happen without building buy-in. And that, according to Brian Norris, means taking the time to truly understand pain points and explain why metrics are being collected — and how they will be used. “There’s a lot of low-hanging fruit in terms of optimization.”

During a recent interview, Norris talked about how his team is leveraging data to help improve ease of use and reduce burnout; the challenges leaders face in meeting the changing needs of consumers; the non-traditional path that led him to the CNIO role; and his bold prediction for the future.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Key Takeaways

* As health systems reach the “pivotal moment” of how to effectively utilize the data that’s been collected, informatics leaders have an opportunity to “become a thought partner” and help influence decision-making.

* It’s not enough just to focus on workflows; nursing leaders need to be thinking (and talking) about how to leverage analytics to reduce length of stay, and the role informatics can play in redesigning care models.

* Something as simple as leveraging virtual nursing to automate the admissions process can have a big impact, said Norris. Changing the modality “just a little bit” has created a ripple effect” across the system.

* When the pandemic hit, IU Health was already equipped to offer virtual visits. “We didn’t have to go out and buy any new technology; we just needed to change the process a little bit and then measure it.”

* Norris’ prediction for 20 years from now: “I bet we’ll see a lot of informatics and clinical professionals who are much more data savvy than they are today, helping move the needle along in those arenas.”

Q&A with Brian Norris, CNIO, IU Health, Part 1

Gamble:  Hi Brian, thank you for taking some time to speak with us. Can you start by giving a high-level overview of Indiana University Health?

Norris:  Sure. IU Health is Indiana’s largest health system. We have about 17 hospitals that serve tens of thousands of patients across northern, southern, and central Indiana. We’re a vertically integrated organization. We have a health plan, acute care facilities, home health, and hospital-at-home programs. We’re home to Riley Children’s Hospital as well as IU School of Medicine.

We’re constantly growing; we have a lot of specialties and a lot of growth.

 

Gamble:  One thing I’m learning from doing some research into the CNIO role is that it can differ quite a bit depending on the size and scope of the organization.

Norris:  For sure. I’ve been in informatics for a long time. This is my second CNIO role and my third CNIO-like role. I had an entrepreneurial stint in the middle. And so, I know that each one is a little bit different.

The role has evolved over time. In many ways, nursing informatics — if you go back 20 years or so — is synonymous with electronic medical records. As you go through the HITECH Act and the infuse of capital to beef up EMRs across the country,

These days, some health system CISOs wonder where the buck stops when a cybersecurity event goes down. Who’s responsible for helping the clinical side go through the motions when the CISO says it’s time to go to paper? It should be the CEO, COO, CFO and/or other top executives, and the entire process needs to be planned and practiced until your organization is bored, says Erik Decker, vice president and CISO at Intermountain Healthcare. In this interview with healthsystemCIO Founder and Editor-in-Chief Anthony Guerra, Decker says the enterprise-wide response to a cyberattack comes down to muscle memory. “Because then when it’s muscle memory, if and when the event happens, you’re going to be able to get over all the original decision-making burden and be able to manage the context of the specific incidents that you have in front of you.”

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Bold Statements

… ideally, if you have a new contract coming in that’s for technology or data services, that should go through a supply chain; a supply chain should have a fork that comes directly to you. And that way, you don’t have to go out there chasing everybody all the time.

The majority of threat actors out there are criminal organizations that are looking to make money. And they’re doing that through extortion and extortion via ransomware, etc., they’re going to go for the lowest drag pathway possible in order to do that. And that’s why basics is the thing that you have to make sure you’re up to snuff on.

… SBOM is good. It’s the first step in understanding and unpacking what’s going on underneath it. But if you have to do that manually for hundreds of thousands of devices, you can’t. It’s just not enough. You don’t have enough people to do that.

Guerra: Erik, thanks for joining me.

Decker: Happy to be here.

Guerra: All right, great. Erik, do you want to just briefly give us a quick overview of your organization and your role?

Decker: Yes, you bet. So, I’m Erik Decker, I’m the VP and chief information security officer for Intermountain Healthcare. Intermountain Healthcare is an integrated delivery network located in the Mountain West region. So based in Salt Lake City, Utah, but we have Nevada, Utah, Idaho, Colorado, Kansas, and Montana in our portfolio. And being an integrated delivery network, we’re also both a health plan as well as healthcare delivery organization.

Guerra: Very good, Erik. All right, I want to just see what’s on your mind. So what are some of the top trends that you think CISOs should be working on or preparing their organizations to handle?

Decker: Yes, so the top issues that are happening today, of course, still start with ransomware. And there have been several big ones that have hit in the last 30, 60 days or so. And, you know, if you look at how these intruders are getting into these systems, it’s still the basics. Some of the trends that we need to be focusing on are our hygiene, our minimum standards, minimum controls that should be in place that work against the most prevalent attack vectors. And so it’s still multifactor authentication on your VPN, or the lack thereof on VPN, or email, remote desktop open to the outside world, critical vulnerabilities open on your perimeter. You know, these are things that are not overly complex, but the environments that we manage are really complex.

CIOs have a lot of weight on their shoulders, says Steven Ramirez, vice president and chief information security officer (CISO) at Renown Health. If there is a breach, the CEO will be calling the CIO first, and he or she will have to be able to talk the talk. That’s something the CISO should always keep in mind. And that’s also why a mutual relationship of trust between CIOs and CISOs is the best defense nowadays, he says. “All things that go beep are owned by the CIO,” he says. “So my job is to protect all things that go beep.” In this interview with healthsystemCIO’s Founder and Editor-in-Chief Anthony Guerra, Ramirez shares his views of the challenges health systems face with their big, fluid attack surfaces. Driving home the reality of a possible ransomware attack with the C-suite and tightening down on identity access management are some of the approaches he uses.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Bold Statements

A lot of people aren’t used to downtime if you have to go to paper. That’s why we’re seeing ransomware and whatnot being so impactful to organizations, just because of people being so dependent on technology and never having to do it the old-fashioned way.

So I’ve really put a focus on 10 to 15 minute detection times with containment, and then being able to have that seamless incident response. Because stopping the spread, stopping the impact, is really how we can have a more seamless and expedited recovery, versus all systems are off, we’re out for multiple weeks.

… that’s why healthcare is such an easier target than some of these other systems, because they’re able to harden their systems, harden their perimeter, but our attack surface is just so much wider and more expansive.

Guerra: Steve, thanks for joining me.

Ramirez: Glad to be here.

Guerra: All right, very good. Do you want to start off telling me a little bit about your organization and your role?

Ramirez: Yes. My name is Steven Ramirez again, and I’m the vice president and chief information security officer of Renown Health. I’ve been at Renown for about 10 months; today, actually. It is a system up in Reno, Nevada. It’s the area’s trauma center, so any of you bad skiers that have been out there, definitely come see us. So it does have a dedicated Children’s Cancer Center and a new affiliation with the University of Nevada, Reno, UNR. So that partnership’s really going to enable us to start getting cutting-edge research, innovation, etc. And they have been the biggest player in the market for quite some time, serving Northern Nevada for quite a while.

Guerra: Very good. Can you tell us a little bit about your career journey? I like to find out how CISOs in healthcare wind up where they are.

Ramirez: Yes, it actually started up in Georgetown, up in Washington, DC. And right as a lot of the digital transformation components were going on I was the “millennial,” so they threw a lot of the IT risk management and some of that at me, since I had the only Facebook account in the office. And really the rest is history. I went from there to CHI. CHI was really in acquisition mode. CHI is now CommonSpirit, so it was part of the merger and acquisition team. So I really saw that footprint grow to 19 states, over 100 hospitals into what it is today with CommonSpirit and that merger with Dignity. Then, I went over to a short stint at Baptist Health in Louisville, Kentucky,

Most health systems are moving (or considering moving) much of their data to the cloud, hoping to realize the promise of enhanced analytics and reporting capabilities when all that information is freed from its on-prem silos. However, for many organizations that have made the move, the promise has yet to be realized. Factors causing this suboptimal situation include lack of a comprehensive roadmap, a need for IT skill-set retooling and a tendency to migrate too much data too quickly. In this webinar, we’ll hear from leaders who have made the plans, and the changes, necessary to realize the goals of their cloud journey.

Speakers:

* Chris Hutchins, VP, Chief Data & Analytics Officer, Northwell Health

* Beth Lindsay-Wood, VP/CIO, City of Hope

* Siv Raman, MD, Chief Product & Analytics Officer, 314e

It’s quite a paradox.

During the first wave of the Covid-19 pandemic, the streets of New York City were deserted — even in the middle of the day. Specialized since 1863, Hospital for Special Surgery proactively paused 95 percent of procedures and transformed to provide multi-specialty support to the city’s overburdened healthcare system.

“There was so much break-fix work to do,” said Jamie Nelson, now in her 11th year as CIO at HSS. In the few days of transition before and after HSS pivoted to support the surge, “our teams were so busy with day-to-day projects that it didn’t feel like anything slowed down.”

As a result, once her team was given the green light to move forward with projects such as selecting a new ERP solution, they were ready, said Nelson. During a recent interview, she talked about how HSS survived the lockdown – and why she made it a point to show up every day, and her team’s big plans to continue to digitize as much as possible. She also discussed the “new paradigm” leaders face in the wake of Covid, and what worries her most as a female leader.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Key Takeaways

* “There’s so much focus on digital in terms of the consumer, with apps and things like that, but it’s much broader than that. It’s digitizing the back office, digitizing human resources, and digitizing pathology.”

* Another benefit of digitization? Being able to use cutting-edge technologies “helps motivate staff and keep them moving in the right direction.”

* Implementing a plan for bringing staff back to the office doesn’t happen overnight — and perhaps it shouldn’t. “It’s okay to take a few months to put this together, because hopefully you’re getting real-time feedback from the staff on what’s good, what’s not good, and what they want to change.”

* As some workers — particularly women — choose to remain remote, Nelson is concerned it may “cause us to slip backwards in terms of equality in the workplace. And that scares me.”

Q&A with Jamie Nelson, SVP & CIO, HSS, Part 2 [Click here to view Part 1]

Gamble:  I read an interview you did where you talked about the work HSS is doing with digital pathology. That seems really exciting.

Nelson:  We actually brought that live during Covid.

 

Gamble:  That’s really impressive.

Nelson:  We were very lucky. We’ve been looking at that probably for five years. It had to get FDA clearance, and so we needed to clear three pieces: Sectra, the Leica scanner, and Epic Beaker. They were all cleared, and we brought that live more than a year and ago. In the middle of Covid, we did that.

It’s interesting; there’s so much focus on digital in terms of the consumer, with apps and things like that, but it’s much broader than that. It’s digitizing the back office, digitizing human resources, and digitizing pathology. Now, pathologists can bring up images of the bone using PACS and view the pathology underneath it, and put the two together. Surgeons are doing the same thing, and now they’re interested in pathology again because it’s easy and interesting and they can mov...

True digital transformation can only be built upon a data ecosystem in which information moves across applications, ultimately coming together to form a more complete picture of the patient. And that data can only come together correctly when the identity element — whether for individual patient records or patient-provider matching — has been resolved. In this important webinar, we’ll speak to leaders who believe that in order to have a welcoming digital front door, IT leaders must first move their organizations towards an interoperable data ecosystem.

Speakers:

* Maia Hightower, MD, Chief Digital & Technology Officer, University of Chicago Medicine

* Aaron Miri, SVP, Chief Digital & Information Officer, Baptist Health

* Clay Ritchey, CEO, Verato

Samantha Jacques, PhD, VP of clinical engineering at McLaren Health Care, is concerned about the security risks of medical devices. More and more, bad actors are using devices as a way to access a health system’s network. But it’s not as simple as shutting these devices down when a threat is discovered, as they could be connected to patients, she explains. In this interview with healthsystemCIO Founder & Editor-in-Chief Anthony Guerra, Jacques discusses the security implications of medical devices. Hacks are on the increase and patches sometimes take a year for approval, leaving these devices vulnerable. That’s why, now more than ever, the clinical engineering department and C-suite IT team need to put their heads together — and even involve the board, listen to each other, keep an open mind, have a plan and practice it, she says.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Bold Statements

There are literally devices that still roll off the manufacturing floor today that have outdated operating systems because the newer operating system has yet to be approved and released by the manufacturer.

If I’m tracking hundreds of patches for hundreds of devices over a year from when they’re released, it’s very time consuming and very effort intensive to figure out what your risk is, where it is, and which one’s the one you need to prioritize to try and really control what’s going on within your environment.

… those CISOs that are out there doing large education efforts to help their population understand and drive home that security is everybody’s responsibility, I applaud you, because that’s fundamentally where, as a society, we’re moving.

Guerra: Sam, thanks for joining me.

Jacques: Thank you very much, Anthony. I’m happy to be here.

Guerra: Excellent. Looking forward to a fun chat. So, Sam, do you want to start off by telling me a little bit about your organization and your role?

Jacques: Sure. So McLaren Health is a 14-hospital system in Michigan and Ohio. And I run the clinical engineering department. So that’s the department that maintains all the medical equipment across all of our 14-hospital system.

Guerra: Very good, maintains medical equipment. We’ll get into that a little more. But first, do you want to tell me a little bit about your career journey, how you wound up in the position you’re in?

Jacques: Sure. So I’ve been in healthcare about 15 years now, I actually came from a completely different background. I was a professor for a couple of years before transitioning into healthcare. I’ve run programs at Texas Children’s Hospital down in Houston, as well as Penn State in Pennsylvania. And then I’ve been here at McLaren for about three years now.

Guerra: So what made you interested in this particular field of work? How did that transition happen?

Jacques: So I actually taught biomedical engineering. And so transitioning into healthcare is just doing what I used to teach. So it’s wonderful to be able to give back to those of us that work in healthcare with this mission and vision to really help individuals do the best that we can with, in my instance, technology.

Guerra: Excellent. Let’s talk a little bit more about the role of clinical engineering and, just for my benefit, is it the same thing as biomedical engineering? Are they slightly different? Remember,

“There’s no secret there that other countries are attacking us,” says Dennis Leber, PhD, interim chief CISO at UConn Health. And this puts a huge responsibility on the shoulders of a CISO. But in the end, the ultimate responsibility for making big security-related calls lies with the organization’s top leaders, and CISOs have to find a way to give them all the information they need to make those decisions. In this interview with Anthony Guerra, healthsystemCIO founder and editor-in-chief, Leber – who has been chasing after the bad guys for a long time; first in the military, then in a career as a police officer and now as a CISO – says that CISOs and CEOs often don’t use the same language when it comes to talking cybersecurity risk, and that’s why it’s important to use a CEO’s language rather than cyber-speak.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Bold Statements

Folks have been scamming other folks as long as there’s been folks. It’s the shell games, the three-card Monty. Now we just do it with computers and social engineering.

How do we put those checks in place, considering human psychology, that will eliminate or vastly reduce the ability to have that plane crash, and we need to mirror that into our cybersecurity industry programs.

So it’s not necessarily that you want to inform, coach, mentor or train the CEO on the language that you use, but you want to use their language more, and be able to relate that back to your team.

It’s not in a vacuum or silo. It takes a community. You are going to not be very effective, and you’re going to be very frustrated, if you’re trying to go it alone.

Guerra: Dennis, thanks for joining me.

Leber: Happy to be here. Thanks for having me.

Guerra: All right, great. Thank you. Dennis, do you want to tell me a little bit about UConn Health and your role over there?

Leber: Sure. I am serving as the interim CISO at UConn Health. UConn Health is approximately a 300-bed hospital serving Connecticut and the residents there in the Connecticut-Hartford-Farmington area. We have two schools, College of Medicine, College of Dentistry. And so it’s a learning hospital. Like most hospitals, we have a nice research branch, and we have a population demographic of researchers as well.

Guerra: Excellent, very good. All right. I always like to ask folks in the CISO role how they came to be where they are. So how did you specifically come to wind up in the security side of healthcare information technology?

Leber: So it was a career change for me. I got out of high school and went in the military – in the Marines. When I got out of the Marine Corps, I came back home looking for a job. I actually joined the police department. Never really had a desire to be a police officer. It just sounded like a good job, and it paid well. And I did it for a long time. But I also noticed a lot of police officers when they retired, they were retiring and coming back to work as police officers. And I’m originally from Louisville, Kentucky. And so you have two big Ford plants in Louisville. And I was watching friends that work at UPS and Ford and when they retired, they didn’t go work for Chevy. Or if you worked at UPS and you retired, you didn’t go work for FedEx, right? So I started really looking inward and said, “I’ve got to be worth more than that.” And not that that’s a bad profession. But it was like,

One of the biggest challenges facing hospitals and health systems is a lack of financial transparency — how much is being spent by which departments, and on which technologies. When Chris Akeroyd assumed the role of CIO at Children’s Health, it became immediately clear that there was a communications breakdown, which resulted in overinvestment in certain areas and underinvestment in others. “It was hard to find a strategy,” he recalled in a recent interview. And so, one of his first priorities was to initiate conversations that have been “eye-opening” and have led to reduced spending and a better understanding of the business.

However, for Akeroyd, who has been with the organization since 2015, it’s just one of many areas of focus for his team. During a discussion with Kate Gamble, Managing Editor of healthsystemCIO, he talked about how they’re leveraging digital tools to create a better experience for pediatric patients and their families; his philosophy when it comes to hybrid and remote work models; and the “immense opportunity” that drew him to the CIO role.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Key Takeaways

* Going from chief digital and technology officer to CIO provided an opportunity to lead the organization “in our next evolution of technology and partnership with the business” and “change how we partner and grow Children’s through its next evolution.”

* One of the keys to recruiting and retaining talent is flexibility and “being able to work and live anywhere,” Akeroyd said. “And so, we’ve diversified our hiring region.”

* As the CIO role continues to evolve, “it’s less about technical knowledge, especially at the more senior levels, and more about your body of knowledge and how you partner and engage with operations.”

* In a highly complex, matrixed organization, it has become critical to implement a solid governance structure and “use caution in terms of who needs to approve and sign off on things.

Q&A with Children’s Health CIO Chris Akeroyd, Part 2 [Click here to view Part 1]

Gamble:  Based on what you’re saying, it’s not surprising to me that you were previously in the CTO role. What was it like to make that transition from chief digital and technology officer to CIO?

Akeroyd:  One advantage is familiarity with the organization. I knew the politics. I knew the people. I knew the teams, so that made it easier. In the same breadth, though, it made it a little bit more of a challenge taking on some of the teams within my group that had not reported to me directly before. From there, it was building relationships and empowering the people who are there. I have strong leaders who their subject areas.

And so, for me, it was casting the vision and getting everybody aligned to that and supporting the changes we’ve been through, which has been amazing to see. But like I said, a lot of the catalyst behind that was the existing relationships and, and knowing people that made that transition, um, straightforward.

 

Gamble:  What was it about the CIO role that appealed to you?

Akeroyd:  Leading this organization in our next evolution of technology and partnership with the business. I saw a big opportunity to change how we partner and grow Children’s through its next evolution as we prepare to increase our brand recognition and the volume of children we support in the North Texas area.

By all accounts, there have been significant advances in the ERP software market over the last few years, leaving CIOs with the opportunity to introduce these new features to their health systems for evaluation. In addition to new features, today’s ERP suites can live in the cloud, potentially freeing up staff and data-center space for other things. In this webinar, we’ll cover the gamut of ERP decision points — from discussing the potential advantages of a modern ERP, to whether you’re ready for such a project, to how to execute if it’s the right time. With all health systems looking to make every dollar count, this is one webinar you can’t afford to miss.

Speakers:

* Bradd Busick, SVP/CIO, MultiCare Health System

* Zafar Chaudry, MD, SVP, Chief Digital & Information Officer, Seattle Children’s

* Gretchen Tegethoff, Regional VP, Strategic Relationships, ELLKAY