CIOs have a lot of weight on their shoulders, says Steven Ramirez, vice president and chief information security officer (CISO) at Renown Health. If there is a breach, the CEO will be calling the CIO first, and he or she will have to be able to talk the talk. That’s something the CISO should always keep in mind. And that’s also why a mutual relationship of trust between CIOs and CISOs is the best defense nowadays, he says. “All things that go beep are owned by the CIO,” he says. “So my job is to protect all things that go beep.” In this interview with healthsystemCIO’s Founder and Editor-in-Chief Anthony Guerra, Ramirez shares his views of the challenges health systems face with their big, fluid attack surfaces. Driving home the reality of a possible ransomware attack with the C-suite and tightening down on identity access management are some of the approaches he uses.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Bold Statements

A lot of people aren’t used to downtime if you have to go to paper. That’s why we’re seeing ransomware and whatnot being so impactful to organizations, just because of people being so dependent on technology and never having to do it the old-fashioned way.

So I’ve really put a focus on 10 to 15 minute detection times with containment, and then being able to have that seamless incident response. Because stopping the spread, stopping the impact, is really how we can have a more seamless and expedited recovery, versus all systems are off, we’re out for multiple weeks.

… that’s why healthcare is such an easier target than some of these other systems, because they’re able to harden their systems, harden their perimeter, but our attack surface is just so much wider and more expansive.

Guerra: Steve, thanks for joining me.

Ramirez: Glad to be here.

Guerra: All right, very good. Do you want to start off telling me a little bit about your organization and your role?

Ramirez: Yes. My name is Steven Ramirez again, and I’m the vice president and chief information security officer of Renown Health. I’ve been at Renown for about 10 months; today, actually. It is a system up in Reno, Nevada. It’s the area’s trauma center, so any of you bad skiers that have been out there, definitely come see us. So it does have a dedicated Children’s Cancer Center and a new affiliation with the University of Nevada, Reno, UNR. So that partnership’s really going to enable us to start getting cutting-edge research, innovation, etc. And they have been the biggest player in the market for quite some time, serving Northern Nevada for quite a while.

Guerra: Very good. Can you tell us a little bit about your career journey? I like to find out how CISOs in healthcare wind up where they are.

Ramirez: Yes, it actually started up in Georgetown, up in Washington, DC. And right as a lot of the digital transformation components were going on I was the “millennial,” so they threw a lot of the IT risk management and some of that at me, since I had the only Facebook account in the office. And really the rest is history. I went from there to CHI. CHI was really in acquisition mode. CHI is now CommonSpirit, so it was part of the merger and acquisition team. So I really saw that footprint grow to 19 states, over 100 hospitals into what it is today with CommonSpirit and that merger with Dignity. Then, I went over to a short stint at Baptist Health in Louisville, Kentucky,

Most health systems are moving (or considering moving) much of their data to the cloud, hoping to realize the promise of enhanced analytics and reporting capabilities when all that information is freed from its on-prem silos. However, for many organizations that have made the move, the promise has yet to be realized. Factors causing this suboptimal situation include lack of a comprehensive roadmap, a need for IT skill-set retooling and a tendency to migrate too much data too quickly. In this webinar, we’ll hear from leaders who have made the plans, and the changes, necessary to realize the goals of their cloud journey.

Speakers:

* Chris Hutchins, VP, Chief Data & Analytics Officer, Northwell Health

* Beth Lindsay-Wood, VP/CIO, City of Hope

* Siv Raman, MD, Chief Product & Analytics Officer, 314e

It’s quite a paradox.

During the first wave of the Covid-19 pandemic, the streets of New York City were deserted — even in the middle of the day. Specialized since 1863, Hospital for Special Surgery proactively paused 95 percent of procedures and transformed to provide multi-specialty support to the city’s overburdened healthcare system.

“There was so much break-fix work to do,” said Jamie Nelson, now in her 11th year as CIO at HSS. In the few days of transition before and after HSS pivoted to support the surge, “our teams were so busy with day-to-day projects that it didn’t feel like anything slowed down.”

As a result, once her team was given the green light to move forward with projects such as selecting a new ERP solution, they were ready, said Nelson. During a recent interview, she talked about how HSS survived the lockdown – and why she made it a point to show up every day, and her team’s big plans to continue to digitize as much as possible. She also discussed the “new paradigm” leaders face in the wake of Covid, and what worries her most as a female leader.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Key Takeaways

* “There’s so much focus on digital in terms of the consumer, with apps and things like that, but it’s much broader than that. It’s digitizing the back office, digitizing human resources, and digitizing pathology.”

* Another benefit of digitization? Being able to use cutting-edge technologies “helps motivate staff and keep them moving in the right direction.”

* Implementing a plan for bringing staff back to the office doesn’t happen overnight — and perhaps it shouldn’t. “It’s okay to take a few months to put this together, because hopefully you’re getting real-time feedback from the staff on what’s good, what’s not good, and what they want to change.”

* As some workers — particularly women — choose to remain remote, Nelson is concerned it may “cause us to slip backwards in terms of equality in the workplace. And that scares me.”

Q&A with Jamie Nelson, SVP & CIO, HSS, Part 2 [Click here to view Part 1]

Gamble:  I read an interview you did where you talked about the work HSS is doing with digital pathology. That seems really exciting.

Nelson:  We actually brought that live during Covid.

 

Gamble:  That’s really impressive.

Nelson:  We were very lucky. We’ve been looking at that probably for five years. It had to get FDA clearance, and so we needed to clear three pieces: Sectra, the Leica scanner, and Epic Beaker. They were all cleared, and we brought that live more than a year and ago. In the middle of Covid, we did that.

It’s interesting; there’s so much focus on digital in terms of the consumer, with apps and things like that, but it’s much broader than that. It’s digitizing the back office, digitizing human resources, and digitizing pathology. Now, pathologists can bring up images of the bone using PACS and view the pathology underneath it, and put the two together. Surgeons are doing the same thing, and now they’re interested in pathology again because it’s easy and interesting and they can mov...

True digital transformation can only be built upon a data ecosystem in which information moves across applications, ultimately coming together to form a more complete picture of the patient. And that data can only come together correctly when the identity element — whether for individual patient records or patient-provider matching — has been resolved. In this important webinar, we’ll speak to leaders who believe that in order to have a welcoming digital front door, IT leaders must first move their organizations towards an interoperable data ecosystem.

Speakers:

* Maia Hightower, MD, Chief Digital & Technology Officer, University of Chicago Medicine

* Aaron Miri, SVP, Chief Digital & Information Officer, Baptist Health

* Clay Ritchey, CEO, Verato

Samantha Jacques, PhD, VP of clinical engineering at McLaren Health Care, is concerned about the security risks of medical devices. More and more, bad actors are using devices as a way to access a health system’s network. But it’s not as simple as shutting these devices down when a threat is discovered, as they could be connected to patients, she explains. In this interview with healthsystemCIO Founder & Editor-in-Chief Anthony Guerra, Jacques discusses the security implications of medical devices. Hacks are on the increase and patches sometimes take a year for approval, leaving these devices vulnerable. That’s why, now more than ever, the clinical engineering department and C-suite IT team need to put their heads together — and even involve the board, listen to each other, keep an open mind, have a plan and practice it, she says.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Bold Statements

There are literally devices that still roll off the manufacturing floor today that have outdated operating systems because the newer operating system has yet to be approved and released by the manufacturer.

If I’m tracking hundreds of patches for hundreds of devices over a year from when they’re released, it’s very time consuming and very effort intensive to figure out what your risk is, where it is, and which one’s the one you need to prioritize to try and really control what’s going on within your environment.

… those CISOs that are out there doing large education efforts to help their population understand and drive home that security is everybody’s responsibility, I applaud you, because that’s fundamentally where, as a society, we’re moving.

Guerra: Sam, thanks for joining me.

Jacques: Thank you very much, Anthony. I’m happy to be here.

Guerra: Excellent. Looking forward to a fun chat. So, Sam, do you want to start off by telling me a little bit about your organization and your role?

Jacques: Sure. So McLaren Health is a 14-hospital system in Michigan and Ohio. And I run the clinical engineering department. So that’s the department that maintains all the medical equipment across all of our 14-hospital system.

Guerra: Very good, maintains medical equipment. We’ll get into that a little more. But first, do you want to tell me a little bit about your career journey, how you wound up in the position you’re in?

Jacques: Sure. So I’ve been in healthcare about 15 years now, I actually came from a completely different background. I was a professor for a couple of years before transitioning into healthcare. I’ve run programs at Texas Children’s Hospital down in Houston, as well as Penn State in Pennsylvania. And then I’ve been here at McLaren for about three years now.

Guerra: So what made you interested in this particular field of work? How did that transition happen?

Jacques: So I actually taught biomedical engineering. And so transitioning into healthcare is just doing what I used to teach. So it’s wonderful to be able to give back to those of us that work in healthcare with this mission and vision to really help individuals do the best that we can with, in my instance, technology.

Guerra: Excellent. Let’s talk a little bit more about the role of clinical engineering and, just for my benefit, is it the same thing as biomedical engineering? Are they slightly different? Remember,

“There’s no secret there that other countries are attacking us,” says Dennis Leber, PhD, interim chief CISO at UConn Health. And this puts a huge responsibility on the shoulders of a CISO. But in the end, the ultimate responsibility for making big security-related calls lies with the organization’s top leaders, and CISOs have to find a way to give them all the information they need to make those decisions. In this interview with Anthony Guerra, healthsystemCIO founder and editor-in-chief, Leber – who has been chasing after the bad guys for a long time; first in the military, then in a career as a police officer and now as a CISO – says that CISOs and CEOs often don’t use the same language when it comes to talking cybersecurity risk, and that’s why it’s important to use a CEO’s language rather than cyber-speak.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Bold Statements

Folks have been scamming other folks as long as there’s been folks. It’s the shell games, the three-card Monty. Now we just do it with computers and social engineering.

How do we put those checks in place, considering human psychology, that will eliminate or vastly reduce the ability to have that plane crash, and we need to mirror that into our cybersecurity industry programs.

So it’s not necessarily that you want to inform, coach, mentor or train the CEO on the language that you use, but you want to use their language more, and be able to relate that back to your team.

It’s not in a vacuum or silo. It takes a community. You are going to not be very effective, and you’re going to be very frustrated, if you’re trying to go it alone.

Guerra: Dennis, thanks for joining me.

Leber: Happy to be here. Thanks for having me.

Guerra: All right, great. Thank you. Dennis, do you want to tell me a little bit about UConn Health and your role over there?

Leber: Sure. I am serving as the interim CISO at UConn Health. UConn Health is approximately a 300-bed hospital serving Connecticut and the residents there in the Connecticut-Hartford-Farmington area. We have two schools, College of Medicine, College of Dentistry. And so it’s a learning hospital. Like most hospitals, we have a nice research branch, and we have a population demographic of researchers as well.

Guerra: Excellent, very good. All right. I always like to ask folks in the CISO role how they came to be where they are. So how did you specifically come to wind up in the security side of healthcare information technology?

Leber: So it was a career change for me. I got out of high school and went in the military – in the Marines. When I got out of the Marine Corps, I came back home looking for a job. I actually joined the police department. Never really had a desire to be a police officer. It just sounded like a good job, and it paid well. And I did it for a long time. But I also noticed a lot of police officers when they retired, they were retiring and coming back to work as police officers. And I’m originally from Louisville, Kentucky. And so you have two big Ford plants in Louisville. And I was watching friends that work at UPS and Ford and when they retired, they didn’t go work for Chevy. Or if you worked at UPS and you retired, you didn’t go work for FedEx, right? So I started really looking inward and said, “I’ve got to be worth more than that.” And not that that’s a bad profession. But it was like,

One of the biggest challenges facing hospitals and health systems is a lack of financial transparency — how much is being spent by which departments, and on which technologies. When Chris Akeroyd assumed the role of CIO at Children’s Health, it became immediately clear that there was a communications breakdown, which resulted in overinvestment in certain areas and underinvestment in others. “It was hard to find a strategy,” he recalled in a recent interview. And so, one of his first priorities was to initiate conversations that have been “eye-opening” and have led to reduced spending and a better understanding of the business.

However, for Akeroyd, who has been with the organization since 2015, it’s just one of many areas of focus for his team. During a discussion with Kate Gamble, Managing Editor of healthsystemCIO, he talked about how they’re leveraging digital tools to create a better experience for pediatric patients and their families; his philosophy when it comes to hybrid and remote work models; and the “immense opportunity” that drew him to the CIO role.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Key Takeaways

* Going from chief digital and technology officer to CIO provided an opportunity to lead the organization “in our next evolution of technology and partnership with the business” and “change how we partner and grow Children’s through its next evolution.”

* One of the keys to recruiting and retaining talent is flexibility and “being able to work and live anywhere,” Akeroyd said. “And so, we’ve diversified our hiring region.”

* As the CIO role continues to evolve, “it’s less about technical knowledge, especially at the more senior levels, and more about your body of knowledge and how you partner and engage with operations.”

* In a highly complex, matrixed organization, it has become critical to implement a solid governance structure and “use caution in terms of who needs to approve and sign off on things.

Q&A with Children’s Health CIO Chris Akeroyd, Part 2 [Click here to view Part 1]

Gamble:  Based on what you’re saying, it’s not surprising to me that you were previously in the CTO role. What was it like to make that transition from chief digital and technology officer to CIO?

Akeroyd:  One advantage is familiarity with the organization. I knew the politics. I knew the people. I knew the teams, so that made it easier. In the same breadth, though, it made it a little bit more of a challenge taking on some of the teams within my group that had not reported to me directly before. From there, it was building relationships and empowering the people who are there. I have strong leaders who their subject areas.

And so, for me, it was casting the vision and getting everybody aligned to that and supporting the changes we’ve been through, which has been amazing to see. But like I said, a lot of the catalyst behind that was the existing relationships and, and knowing people that made that transition, um, straightforward.

 

Gamble:  What was it about the CIO role that appealed to you?

Akeroyd:  Leading this organization in our next evolution of technology and partnership with the business. I saw a big opportunity to change how we partner and grow Children’s through its next evolution as we prepare to increase our brand recognition and the volume of children we support in the North Texas area.

By all accounts, there have been significant advances in the ERP software market over the last few years, leaving CIOs with the opportunity to introduce these new features to their health systems for evaluation. In addition to new features, today’s ERP suites can live in the cloud, potentially freeing up staff and data-center space for other things. In this webinar, we’ll cover the gamut of ERP decision points — from discussing the potential advantages of a modern ERP, to whether you’re ready for such a project, to how to execute if it’s the right time. With all health systems looking to make every dollar count, this is one webinar you can’t afford to miss.

Speakers:

* Bradd Busick, SVP/CIO, MultiCare Health System

* Zafar Chaudry, MD, SVP, Chief Digital & Information Officer, Seattle Children’s

* Gretchen Tegethoff, Regional VP, Strategic Relationships, ELLKAY

When it comes to IT security at hospitals, the third and even fourth-party risk involved has expanded the front line from a moated castle to everywhere. And that’s not easy to protect, says Jason Elrod, chief information security officer (CISO) for MultiCare Health System. But protecting patient data vulnerability is the mission — and zero trust is going to reveal itself as the standard approach. In this interview with healthsystemCIO Founder & Editor-in-Chief Anthony Guerra, Elrod talks about how he has defended MultiCare Health System for the past 12 years. He starts by closing the perimeter with identity and digging in stakes with a solid zero trust journey. Elrod knows there’s no silver bullet out there, but he is aligning with federal regulators on zero trust by using NIST CSF. He then beefs up his IT talent by getting deeply involved in the recruiting process, and builds relationships with cyberinsurers.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Bold Statements

“As you get to a second- or third-party and that supply chain of a solution, the importance of that third-party risk management grows.”

“In order for the perimeter to scale, you have to shrink it all the way down, you have to be more atomic with your perimeter, the individual identity, in order to scale it, wherever it may roam.”

“For me, zero trust is a strategy attitude methodology that relies on a trail of techniques and technology.”

“I think the best way to do (cyber-insurance) is not to think of it as an adversarial relationship, because it’s not at all.”

Guerra: Jason, thanks for joining me.

Elrod: Thank you very much, Anthony. Happy to be here.

Guerra: Why don’t you tell me a little bit about your organization and your role?

Elrod: Excellent. I am the vice president and chief information security officer for MultiCare Health System. We’re an 11-hospital system based out of Tacoma, Washington, and our area of service is primarily the Pacific Northwest.

Guerra: I find CISOs have sometimes very interesting career journeys. Why don’t you tell me how you wound up in not only technology, but healthcare and security? How did you wind up in that very specific place?

Elrod: So I wrote my first computer program back in 1979, and that was on a system called a Commodore PET.

Guerra: Okay, I had a Commodore 64. I didn’t do anything with it. But I had it. Go ahead.

Elrod: My dad was a programmer for the Department of Justice at the time, and we had access to it. So I was very lucky, from that standpoint, to have early access to technology and computers. Today, I tell my kids, you know, “Back when I was your age, I had to type my video game in by hand, it took me four hours uphill in the snow both ways, no shoes, and then it wasn’t fun. We couldn’t save it and we had to do it again.”

So long time in IT, a longtime technologist, longtime love of technology. I would say that, professionally, I’ve been in IT since probably the mid-80s. And I began my career in finance. I managed data centers for financial organizations at the time, back in the “You’ve Got Mail” era, and had an ISP back in the mid-90s to the year 2000 crossover. And it was during that time, when you were running an ISP early on, that you find out there’s nobody you can call when somebody hacks your system. Nobody out there.

Most healthcare security programs and regulations focus on protecting data, but such an approach can leave many necessary steps undone when it comes to medical devices. Unlike many threats, cyberattacks on medical devices have direct and immediate patient safety ramifications, which those leading security must consider. And when considered, those executives soon realize they must build stronger relationships, have more profound and more frequent conversations, and establish emergency processes with clinical leaders. In this important webinar, we’ll hear from executives who have worked to ensure that patients stay safe if medical devices go down due to a cyberattack.

Speakers:

* Todd Bell, CISO & Executive Director, IT Compliance, Valleywise Health

* Theresa Meadows, RN, SVP/CIO, Cook Children’s Health Care System

* Rich Temple, VP/CIO, Deborah Heart and Lung Center

* John Gomez, CEO, Sensato