Until a few short weeks ago, Dale Sanders was VP and CIO of the Chicago-based Northwestern Medical Faculty Foundation in Chicago. Sanders, a very active CIO, is also an esteemed contributor and blogger at Healthcare Informatics. His first day on the job as new CIO of the Cayman Islands Health Services Authority (HSA) turned into a trial by fire, as the Conflicker virus prompted an emergency shutdown of all HSA’s major systems. Sanders spoke with senior associate editor Daphne Lawrence about that experience — and about his new island life.
Daphne Lawrence: Dale, though it seems you’re living a dream, apparently you just lived through a CIO’s worst nightmare — tell me about what happened.
Dale Sanders: I got here on a Sunday morning and spent a relaxing day having someone show me around the island. And unbeknownst to me, the Conflicker virus was starting to take over on Sunday. I came in to work Monday morning expecting to meet my boss, who I had never met in person yet. I was expecting to chat, and she grabbed my arm and said, “I’m so glad to see you. We have a disaster. All of our systems are down. We have to schedule an emergency meeting with senior leadership and figure out how to respond.” And I just kind of broke out laughing and said, “You’ve got to be kidding me.” I literally took my tie off and rolled my sleeves up and said, “OK, this is going to be an exercise in stress management here.”
The first thing was situation assessment. Here I was, completely new. I have no idea what their information systems infrastructure is like, I don’t know who’s responsible, I don’t know any names, I don’t know the organization, and of course they’re using names that were local to the organization that didn’t make any sense to me.
And one of the first things I had to do was drill down on which virus it was. I wanted to make sure it was the right diagnosis. Let’s make absolutely sure that we’re fighting the right war here. And so I spent a good amount of time just focusing to make sure it was a virus. Because a lot of times it’s not unusual for folks to come to a conclusion about a problem and start chasing the wrong problem.
DL: You said you treated it like an epidemic right?
DS: The parallels are so similar it’s striking. We unplugged every devise in the network. So every server, every desktop computer was physically isolated and unplugged from the network because that’s how it spreads. We had to scan, remove and rebuild each of those machines—manually. We worked essentially 24/7 for at least 5 days.
DL: Do you feel many hospitals and hospital systems are vulnerable to what happened to you? What steps could your colleagues take to prevent such an event?
DS: The reality is this was an easily avoidable situation and that’s why it was so new to me. I’ve been working in organizations where we had preventive measures in place and we reacted to these outbreaks in ways so that they never became a calamity. It was like knowing about swine flu and having vaccines in place and not using them—and that’s what really kind of happened here. You have to stay current with all your Microsoft patches and your antivirus profiles and that wasn’t going on here. None of the servers were patched and none of the desktops were patched. It’s a young organization.
I wonder if some of the immature smaller hospitals without sophisticated IT and leadership might suffer the same fate. This is a small hospital, there are only 150 beds and only 200 total in the organization, it’s new to IT and I think this is a profile of an IT organization that’s pretty common to small hospitals. It wouldn’t surprise me as we see more hospitals becoming computerized that we see them suffering from these things.
DL: How did people react to your leadership in crisis — after all, they didn’t even know you yet.
DS: It really helped that the CEO put a lot of faith in me from the very beginning. She said, “Dale is the expert here so he’s the person you need to rally around and support.” I was very impressed with her leadership style. She propped me up organizationally and of course it was up to me then to live up to that — or try to.
DL: What in your past experience prepared you for this crisis?
DS: Two experiences. In the Air Force I flew on a plane called the Looking Glass. And the Looking Glass was responsible for assuming control of all nuclear operations if we ever went to war. And it was a very high profile, very high stress job. And what I quickly learned in that job was there are people who can handle stress and people who can’t handle stress. And because those teams were self selecting you would only get on the best team if you stayed calm in stressful situations. Staying calm is not natural to my personality, but what I quickly learned is you have to be the calm in the storm and that really burned it into me.
There’s an interesting parallel at Northwestern too. Two days before I started there, it got hit with a broadcast storm against its exchange server. And so I got a call from the CEO at Northwestern two days before I was going to start and he said our entire email system is down and we’re infected with some kind of virus, "Can you help resolve it over the phone?"
DL: You’re like the Spinal Tap drummer, apparently. So what have you got over there?