Health systems today face increasing odds of a breach, and that’s what drives Rishi Tripathi, CISO at Mount Sinai Health System in New York City. “There is an opportunity for us to step up and do a far better job than we do protecting our banks or factories, because this is literally life and death,” he says. And Tripathi should know. He’s been around the block with cybersecurity. In his career, he has guarded a utility, a media company, manufacturing and financial services – landing most recently in healthcare. The significance of the responsibility is not lost on him. In this interview, Anthony Guerra, founder and editor-in-chief, interviews Tripathi on what he’s learned from other industries about the cyberbattle and how he handles the fearsome task at the front line.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Bold Statements

“If you compare the expectations that we have in healthcare versus the expectations financial services has on their vendors, there is a disparity.”

“ … if you have a security function that becomes almost like a bottleneck or a bureaucracy, where things go in and you don’t know when the output would be delivered, that becomes an issue.”

“ … the name of the game is talent. How you attract the best talent. And I can tell you the best talent wants to work in a mission-driven organization.”

Guerra: Rishi, thanks for joining me today.

Tripathi: Anthony, thanks for having me.

Guerra: All right, very good. Let’s start off. You want to tell me a little bit about your organization and your role as CISO over there.

Tripathi: I’m the chief information security officer for the Mount Sinai Health System. And it is a pretty complex operating environment from a healthcare provider perspective. We’re tasked with protecting the health system in total, which includes a number of hospitals, ambulatory clinics, research, facilities, university, etc. So it’s a fairly complex environment, and we’ve been on a path to mature the program. There are some things that were of interest to me when I joined here. And we’ve been executing on that to take it to the next level.

Guerra: Can you tell me a little bit about your career journey, how you wound up here and your perspective, as you compare it to the other industries you’ve worked in?

Tripathi: Yes, absolutely, Anthony. I started my career, actually, working in electrical substations. I was working for a construction company wiring up regulators and substations, and then I got a job for the utility where this connectivity was being made to in their SCADA system. 911 happened, and they were looking at beefing up their security. And I, essentially, raised my hand, and I started working a lot on cybersecurity at that time. So I’ve worked in SCADA system; I’ve worked in financial systems. I have worked in manufacturing. I have worked in media and entertainment, and I’ve worked in healthcare. So five jobs in total, each in cybersecurity, and each in different industries.

So it has been  unique trajectory in that sense. I’ve seen that every industry has a lot of commonalities, but also some differences. At a base level, if you think about it, every industry will have a piece of technology or an organization that is easy to secure your traditional IT stuff. But at the same time, every industry will have these OTs, which are more difficult to secure. So in case of an electrical utility,

In a fee-for-service world, analytics are nice to have, but in a value-based one, they are the difference between operational success and failure. That’s because solid analytics mean better and more timely care, while also helping avoid that which is unnecessary and repetitive. In this timely webinar, we’ll speak to leaders who have specifically worked to develop the technologies and overall analytics programs required to support value-based care.

Speakers:

* Adam Carvel, VP, Data Management & Analytics, Fairview Health Services

* Bradley Crotty, MD, Chief Digital Engagement Officer, Froedtert Health

* Don Gray, Chief Enterprise Data & Analytics Officer, Mercy

George T. “Buddy” Hickman has been “very, very involved in health IT,” as a CIO for the past 24 years, and in other capacities. Now as the chief strategy officer with First Health Advisory, a global risk management and digital transformation advisory firm, he imparts his vast industry knowledge to others as part of his daily job.

In this episode of healthsystemCIO’s Partner Perspective Interview Series, Anthony Guerra, founder and editor-in-chief, picks Hickman’s brain on how he sees new trends affecting CIOs, particularly the latest title of chief digital officer. Is it important to go after this title? Hickman says it depends. Sometimes, it’s just a matter of a new trendy name for the same CIO job. But if a CIO is a trailblazer, drastically driving change at his or her enterprise, it might be right to assume this new title. And by the way, don’t expect the role to come without conflict, as that comes with the territory for any C-suite IT position. Hickman offers some ways to work with it and win, along with a host of other career gems in this interview.

The ultimate challenge for a CISO is to get all of an enterprise’s stakeholders to recognize that IT is not just in the security game to protect the data, it has the organization’s bottom line and care outcomes at heart, says Michael Carr, VP, CTO and CISO at Health First, an integrated healthcare delivery network on Florida’s Space Coast. According to Carr, this is done by finding a good way to articulate risk in the context of all the organizational risks. “And I think the ability to quantify, the ability to measure, and really to help people understand everything is a critical issue,” he says. In this interview with healthsystemCIO Founder & Editor-in-Chief Anthony Guerra, Carr discusses testing business continuity plans, getting buy-in on purchasing decisions, third-party risk, cyber insurance and more.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Bold Statements

“(Getting cyber-insurance) is a long, tedious, painful process. And I think part of it is because there is no industry standard around information security. I know a lot of organizations have adopted NIST CSF, not everyone. So everybody’s got a different playbook – even the insurers look at different information.”

“I think third-party vendor management is one of the hardest things that organizations have to deal with. It’s not just you and your business partners, it’s business partners of your business partners or business partners to the business partners of your business partners.”

“ … we’ve got to have commitment to actually test that. I think that’s the last piece. It’s great to have a documented plan. But if you’ve never tested, if you’ve never exercised it, good luck in the case of a real disaster.”

Guerra: Michael, thanks for joining me.

Carr: Thank you for having me.

Guerra: Why don’t we start off with you telling me a little bit about your organization and your role.

Carr: Sure. Well, Health First is an integrated delivery network that primarily serves Brevard County, Florida. So we’re about an hour east of Orlando, along the Space Coast. Our organization has a health plan, four hospitals and about a 500-member provider group. My role is chief technology and information security officer. In that role, I’m accountable for our core platforms, technology, development, architecture, our data and analytics and our information security program.

Guerra: Excellent. I always like to find out, especially for CISOs, how you wound up where you are. So, tell me a little bit about your career path that got you to the security side of healthcare technology.

Carr: Sure. Going back before healthcare, my background is in finance. That’s where I started my career. I spent about the last 15 years in healthcare — for about the last eight or so, it was more of a specialization focus on security. Honestly, I got into security by accident. And what I found is an affinity to my finance background in terms of not just around audit and compliance; a lot of people think that that’s a natural fit. It’s really more about, how do we take something that we know is important (like information security) and how do we make it actionable? How do we make it measurable? And once I understood the impact of security—on not just healthcare, but across all of our critical industries—it really drew me into it. So being able to take my finance background, my operations background,

Both consumer desires and regulatory mandates are requiring health systems to share more PHI with more entities than ever before. While such sharing can go a long way to improving outcomes and patient satisfaction, it also presents new challenges for IT security professionals. That’s because traditional cybersecurity is not designed to protect PHI and clinical workflows at the edge of decentralized, virtual healthcare. In this important webinar, we’ll discuss how clinicians have become the new perimeter, leaving security professionals in the position of figuring out how to secure them without inhibiting productivity.

Speakers:

* Jacki Monson, VP, Interim CIO, Chief Technology Risk Officer, CISO, & Chief Privacy Officer, Sutter Health

* Anahi Santiago, CISO, ChristianaCare

* David Ting, CTO/Founder, Tausight

 

During the first wave of the Covid-19 pandemic, the streets of New York City were deserted — even in the middle of the day. Organizations like the Hospital for Special Surgery were forced to pause all procedures. And yet, for the IT team, things were as hectic as ever. “There was so much break-fix work to do,” said Jamie Nelson, now in her 11th year as CIO at HSS. The book of business may have dried up, but “our teams were so busy with day-to-day projects that it didn’t feel like anything slowed down.”

As a result, once her team was given the green light to move forward with projects such as selecting a new ERP solution, they were ready, said Nelson. During a recent interview, she talked about how HSS survived the lockdown – and why she made it a point to show up every day, and her team’s big plans to continue to digitize as much as possible. She also discussed the “new paradigm” leaders face in the wake of Covid, and what worries her most as a female leader.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Key Takeaways

* Although most work happened remotely during the early stages of Covid, Nelson remained onsite throughout to be able to support teams and make quick changes when needed.

* Despite HSS’ “book of business drying up” in 2020, IT stayed busy with day-to-day projects and break-fix work, Nelson said. “It didn’t feel like anything slowed down.”

* Six years ago, a “soup-to-nuts” Epic implementation took up most of IT’s time and resources; now the priority is digitizing back-office functions, which Nelson believes will be a game-changer.

* The ultimate goal with HHS’ new facility is to create “a tech-enabled building that delivers fabulous orthopedic healthcare.”

Q&A with Jamie Nelson, SVP & CIO, HSS, Part 1

Gamble:  Hi Jamie, thank you as always for your time. A lot to talk about today, but I wanted to start with Covid and how it affected your teams. Obviously, everybody was hit hard by Covid in one way or another, but being in an epicenter like New York must’ve been very challenging.

Nelson:  So, I actually came to the office every day. I have a place in New York City, and so I was able to walk to work. I have two offices: one is at the hospital. The desktop team is right outside my door. And I have my regular office at 49th Street and Third Avenue, where the larger IT team is based.

But I came in every day. We had to stop doing surgeries since orthopedics is considered elective, and we retooled several of our ORs to turn them into ICUs so that we could take Covid patients from New York-Presbyterian. We thought we were taking ‘Covid-light’ patients — but as it turned out, there’s no such thing as a COVID-light patient in the height of a pandemic. And so, we had patients on respirators; we even had sometimes die. That doesn’t happen here. We don’t have patients die. If somebody gets really sick, we take them over the bridge over to New York-Presbyterian. They handle that; it’s not what we do. But our clinicians just pivoted and did an amazing job.

It was a very unique time to be in New York City. You’d walk down 5th Avenue in the middle of the day and the street was empty. It was such a different time.

 

Gamble:  For you, what was behind the decision to be there every day?

Nelson:  There are two pieces. First, it was out of respect for the clinicians who had to be here. I’m a senior executive, and so I think it was important to support our clinical users and have visibility when they’re on the floors.

We were making a lot of very fast changes.

With any major decision, having the right representation is critical – even when the decision seems like an obvious one, said Rich Rogers, CIO at Prisma Health, in this interview. “You have to make sure you have a number of folks represented who voice that same opinion.”

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Key Takeaways

* To be successful, vendor partnerships need to go beyond purchasing a product and supporting it. “It’s about how do you help our business and help us take care of our populations better.”

* The talent war is becoming increasingly intense. For leaders, it means learning what motivates individuals and getting them involved in the right projects “so that they feel fulfilled.”

* After the merger that created Prisma Health, the next step was to “create one IT organization,” which meant building the right teams and making “difficult decisions.”

* One of the most important qualities in future leaders? The ability to “manage other people, treat them with respect, and be able to deliver business results.”

Q&A with Rich Rogers, Part 2 [To view Part 1, click here.]

Gamble:  Has your approach to vendor relationships evolved over the years or have you had pretty much the same strategy?

Rogers:  We’ve always tried to maintain good relationships with our vendors, but this is a little bit different because it takes it a step further. It goes beyond purchasing the product and supporting it. It’s about how do you help our business and help us take care of our populations better collectively? It takes a step beyond that and it supports our transition to a value-based care model as well for the populations we serve. And so, it has gone beyond the traditional relationships we’ve had in the past.

 

Gamble:  You talked earlier about innovative initiatives. I would imagine that’s key in being able to retain good people.

Rogers:  There’s a talent war out there. You have to find what motivates your individuals and get them involved in the right projects so that they feel fulfilled and can grow. It has definitely helped from that perspective in terms of getting involved with some of the projects with Siemens.

 

Gamble:  You’ve also done some work with Phillips around enterprise imaging, which is something we’re starting to see get picked back up again. Can you talk about what you’re doing in that area?

Rogers:  Phillips is another one of our strategic partners. We’re standardizing on their patient monitoring system throughout our health system. That puts us in a position to do some creative things on the nursing side such as central monitoring and other tools that can help combat the nursing shortage.

From an imaging standpoint, Phillips is implementing their enterprise imaging and PACS solution across our enterprise. As part of that, we brought together three distinct radiology groups. We had one PACS system upstate, and another four or five across the Midlands. Now we’re consolidating to one for the entire health system — one consistent image sharing solution, one VNA, etc.

That helps drive our strategy of having a few core systems and leveraging them as much as possible to standardize our care processes across the health system. It’s the final piece we needed to support our overall IT strategy. So those are the main components right now.

We’re also talking with Phillips about using virtual care center assistance...

The first and most important question for CISOs to ask is, “Am I risk aligned with the place where I work?” If not, they might be swimming upstream as they promote a culture of security that the organization doesn’t embrace, says Aaron Weismann, CISO with Main Line Health in Philadelphia.

In this interview with healthsystemCIO Founder and Editor-in-Chief Anthony Guerra, Weismann shares a number of valuable insights with CISOs on how to keep a health system secure in this post-pandemic era. It takes dedicated effort to build the team of security champions among staff and vendors, and it’s “absolutely critical” to build rapport through one-on-one time with major stakeholders to get them on the same page with the organization’s security goals, Weismann says.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

“ … burnout is a thing that we care greatly about. And security contributes greatly to clinician burnout. So we want to make sure that what we’re doing is both meaningful on the security side, but also limits the impact on our clinicians.”

“When you move everybody remote, your threat landscape increases significantly. Everybody’s house is now an attack vector, every computer that’s at their house is an attack vector.”

“It is difficult on a day-to-day basis to deal with an organization, I think, where you don’t align on a risk posture with them. You know, one option is certainly finding a place that does … ”

Guerra: Do you want to start out by telling me a little bit about your organization and your role, please?

Weismann: Our organization is a health system in the Philadelphia suburbs. We’re about 12,000 staff, nurses, clinicians, etc. We have five hospitals, a number of different ambulatory and clinician sites. And few corporate offices. As far as my background, I have been at Main Line Health for a couple of years. I was at Massachusetts Health and Human Services as their CISO for approximately three and a half, four years prior to that. And then before doing that I was an attorney with Health and Human Services for about five or six years as an assistant general counsel there doing IT contracting, information security law, IP licensing, etc. I can go further back than that if you need but I figured that’s a pretty good overview.

Guerra: That’s a good start. Let’s talk a little bit more about the attorney experience. That’s very interesting. So, when did you decide to become an attorney? And then it sounds like you were doing IT contracting as an attorney. Just tell me how the IT and the security and the healthcare evolved from wanting to be an attorney. Just take me through that a little bit.

Weismann: Sure. Yes. So I originally wanted to be an attorney, you know, specializing in technology. My undergrad, I didn’t have a technical background. But when I was in law school, I very heavily got into intellectual property law, contracting, IT licensing, etc. After law school, I went to Suffolk University in Boston to get an LLM, which is a master’s in law in technology and intellectual property. My first job out of law school actually was at State Street Bank and Trust Company, I did finance work. I was in their investment services office, working in their general counsel’s office there.

After a couple of years, the position over at Health and Human Services of Massachusetts opened up as a technology attorney. I decided I wanted to do that.

Of the many components needed to ensure a successful EHR implementation, one of the most important — and least recognized — is grace, according to Stacey Johnston, MD. As Chief Applications Officer and Epic Program Executive at Baptist Health, which recently marked a major milestone, she often reminds her teams to be patient with each other and themselves. This particularly holds true for those who have been pulled away from their everyday roles to serve as analysts. “You’re not going to be perfect,” she said during a podcast interview with Kate Gamble, Managing Editor at healthsystemCIO. “It’s a new skill you’re learning that will continue to improve over time.”

During the interview, she talked Baptist Health’s Epic journey—what they’ve done so far and what they need to do going forward, and what she considers to be the most important components of any major initiative.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Key Takeaways

* Johnston’s previous experience as CMIO at a community hospital, where she “worked closely with analysts to build out templates,” provided the perfect preparation for her current stint as Epic Program Executive at Baptist.

* As a practicing hospitalist Johnston has insights into which alerts and clicks can be eliminated to ensure a system works as efficiently as possible for end users.

* Optimization is critical with any rollout, but before any changes can be made, the stabilization piece must be addressed.

* Successful implementations involve strong working relationships among clinical and operational leaders, clinical informatics teams, and applications teams.

* Don’t underestimate the value of patience — especially in the midst of a major initiative. “You’re not going to be perfect. It’s a new skill you’re learning that will continue to improve over time.”

Q&A with Stacey Johnston, MD, Chief Applications Officer, Baptist Health

Gamble:  Hi Stacey, thanks so much for your time. The first thing I’d like to do is get an overview of Baptist Health. You’re located in Jacksonville, Fla. — what’s the size of the system?

Johnston:  Sure. We are currently a 5-hospital system. One of those is Wolfson Children’s Hospital, which is nationally ranked. We’re building out a sixth hospital that will open sometime this fall, following our Epic go-live.

We have almost 200 ambulatory clinic spaces. We scale into Georgia and all the way toward Tallahassee with our clinics, and we’re continuing to grow.

 

Gamble:  It sounds like it. And it’s a populated area you’re serving, which I’m sure is part of the growth strategy to be able to provide more coverage.

Johnston:  It is. I believe Jacksonville is among the top 10 cities in the country in terms of growth. We’re seeing a lot of that, which gives us a great opportunity to grow our practice.

 

Gamble:  In your role as chief application officer, what do you consider to be your core objectives? Who do you report to?

Johnston:  I report directly to the CIO. I was previously the chief medical information officer. They originally brought me in as the associate chief medical information officer, which is the heir apparent to the CMIO.

I’ve been here for not quite four years. I was the associate CMIO for a little more than a year, and I was CMIO for about four months when the decision was made to move to Epic, and they asked me to be the Epic Program Executive leading the implementation. Interestingly, I cut my teeth as the CMIO at a smaller community hospital, where I worked closely with the analysts to build ou...

More than ever, healthcare IT executives are expected to take costs out of their organizations. One of the main ways they can do so is by rationalizing their application portfolios and sunsetting tools — from EHR to ERP — that no longer make the grade. But the process of doing so efficiently is far from simple. In this important webinar, we’ll hear from leaders who have navigated the rationalization road.

Speakers:

* Stephanie Hines, VP, Peaks Region IT Lead, Intermountain Healthcare

* Nicholas Szymanski, VP/CIO, Signature Healthcare

* Shaman Akhtar, Director of Customer Success, Hospitals and Health Systems, ELLKAY