April 04, 2023

Q&A with St. Joseph Health’s Information Security Officer Jesse Fasolo: Moving Clinical Engineering Under IT Security Has Made a World of Difference

31 minutes

St. Joseph Health Director of Technology Infrastructure & Cyber Security (Information Security Officer) Jesse Fasolo talks with healthsystemCIO Founder and Editor-in-Chief Anthony Guerra at the Vive Conference about the benefits of having clinical engineering report up to IT security; some key points for proper cyber-hygiene; and the importance of developing a process for vetting and approving apps before they come onto the network.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE.

Bold Statements

We understand who’s acquiring medical devices now, where previously organizations struggle because business units buy medical devices without the cybersecurity individuals understanding how to secure them. And then they bring them on the network and then you find out they’re vulnerable and no one’s managing them.

… once cybersecurity is seen as the bane of the organization, that’s a really tall hill to climb back up.

Over the last three years, we’ve gotten to the point where any new acquisition, new hardware acquisition through our purchasing team or value chain team and/or legal contract, has gates that they have to get past. And one of the gates is a cybersecurity assessment, third-party assessment, and a review by me.

Anthony: Tell me a little bit about your organization and your role. We’ll start there.

Jesse: Absolutely. St. Joseph’s Health is a hospital system in New Jersey. We care and dedicate most of our care in clinical teams towards helping the underprivileged, underserved in the community. We’re very large charity care facility. We’re about 1,000-bed system, 40 ambulatory sites, two acute care facilities at the moment. I have a background in multiple industries and I brought all different types of transformational projects that I’ve led in finance, legal and other industries into healthcare. And I’ve been helping them for the last eight years transform not just technology, but innovation and processes and procedures.

Anthony: Very good. I’m going to start with an open-ended question. What are some of the main trends that you’re watching, looking at or trying to position your organization to deal with?

Jesse: I think top of mind as the information security officer of the organization is ensuring safety and confidentiality of data. We had just recently talked about that in the panel of securing your data. So with the risk of ransomware and bad actors attacking healthcare recently, my role more or less keeps me very busy trying to prevent that. And I think communicating to the executive team, communicating to the organization how we need to position ourselves, what products, what technologies, what procedures we need to put in place to allow us to protect the corporate data, patient data specifically, is critical. At the end of the day, the data security is paramount to protecting our patients.

Anthony: When we talk about protecting the data, is that the same thing as medical device security? Meaning that when we can secure our medical devices, we are keeping bad actors from getting to the data.

Jesse: I think it’s an ecosystem. I think when you think of cybersecurity, cybersecurity focuses on the securing of the devices, the securing of the infrastructure. Information security also is a higher level where with information security you’re protecting the data, transmission of the data, the access of data. So when you put both of those together in an environment such as healthcare with legacy devices, and you just mentioned medical devices specifically.

...more

View all episodes

By Anthony Guerra

33 ratings