The classic adage that “the devil is in the details” could have been coined just to be used in discussions of the complexities of cybersecurity in healthcare, so challenging those complexities are. Still, the subject makes for a great discussion panel topic, as was evidenced on Friday morning, when a panel of data security experts discussed “Best Practices for Improving Incident Response Strategies and Developing Security Protocols to Prevent Data Loss,” during day two of the Health IT Summit in Dallas. The day two program, under the rubric of Cybersecurity Forum, was devoted entirely to data security issues, as participants pondered major issues facing healthcare, at the Summit, sponsored by Healthcare Informatics, and held at the Dallas Hilton Anatole hotel.
Sriram Bharadwaj, chief information security office and director, information services, at UC Irvine Health in Irvine, California, led the discussion Friday morning. He was joined by a distinguished panel of discussants: Heather Roszkowski, Chief Information Security Officer, University of Vermont Health Network; Alex Veletsos, Vice President and Chief Information Officer, Together Health Network; Heath Renfrow, who until a few weeks ago was Cyber Security Program Manager, Army Medical Command HQ, Department of the Army, and who is now consulting full-time on cybersecurity; and Ray Hillen, Managing Director, Cybersecurity, Agio.
Bharadwaj, who had just presented on the topic of board engagement in cybersecurity strategy, opened the discussion on that topic, asking Roszkowski about her perspectives on board engagement.
“Heather, how do you see board engagement at the top level? Bharadwaj asked. “I’m the CISO for six hospitals, and what I’m doing right now is really building the team that supports all the cybersecurity across two states—Vermont and upstate New York—and to build a program for entities as large as the U of Vermont Medical Center, as well as the small community hospitals, including a 25-bed hospital. A wide range of entities,” Roszkowski said. “Board engagement is absolutely essential in what we’re doing.”
“Heath, you come from a completely different environment,” Bharadwaj said. In response, Renfrow revealed that he had just transitioned from Army Medicine to a consulting role, one that involves consulting on security to all industries. “Healthcare has been the most complex environment, as well as the most rewarding one, that I’ve ever been in,” he said.
“I run cybersecurity services for Agio, and we work in a number of verticals—we’ve been in healthcare since 2010, doing things like risk assessments, doing advanced threat simulation, and the like,” Hillen said. “We work with small practices to large healthcare systems. There’s no one-size-fits-all, but there are elements every organization should have, regardless of size.”
Veletsos, of Together Health network, noted that “We’re a statewide clinically integrated network representing about 30 hospitals and 7,000 physicians, and about one-third of the healthcare resources in Michigan. We’re working on incorporating all the best practices of the three parent organizations, while also working in our new broad environment.”
The challenge of managing external communications
Meanwhile, Bharadwaj said, “One area that has been a topic of conversation for some time now has been that of how to manage the public relations and external communications aspects” of breaches, “when you have an incident; as well as the engagement of the board at the same time. What has been your experience of that?”
“Yes, as part of incident response strategy, we automatically involve marketing folks,” Roszkowski noted. “And we have done preparatory work to have some template language available. Even if you think you’re only communicating internally, it’s highly likely that things will be communicated externally,” she added. “So we’re very careful in how we communicate internally. We give them the information we can; at the same time, we’re communicating with organizational leaders, so that staff members can go to their organizational leader, and that leader has the information they need to make some decisions.”
“Has anybody here heard about Equifax?” Renfrow asked rhetorically. “Yes, that was a PR nightmare.” In the immediate wake of any data breach that affects patients and community members, Renfrow said, “I would make two calls. First, I would call the legal department. And then I would immediately reach out to public relations, once we know we have an incident. Be transparent,” he advised. “Don’t be like Uber; don’t try to cover it up.” Meanwhile, he noted, “When the Equifax incident broke, I logged into their website and saw the message saying that if you registered with the company, you would lose any legal rights to redress. That was a bad move. And so you have to be honest with your customers; admit that it will happen. Look, there are kids now at MIT that are figuring out how to listen into your room based on vibrations from plants. So don’t try to hide; prepare. And what are your public relations plans? NotPetya is a great example of that,” with regard to organizations that needed to concede publicly that they had experienced breaches.
“We were struggling with what happened to Nuance with Petya/NotPetya, and we at first didn’t realize we were affected, but we were, and it was a challenge,” Bharadwaj said. “So you need to be communicating closely with your vendor. And so that’s an important area.”
Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.