- Welcome back to the Becker's Healthcare Podcast,
devoted the people who power US healthcare.
I'm Molly Gamble Becker's,
and delighted to have you join us for another episode filled
with Insights from healthcare leaders.
Today we're spending some time with Sanjeev SA system,
vice President of IT Strategy
and Cyber Fusion Information Technology
with Common Spirit Health.
Sanjeev, welcome. Thanks for joining me today. How are you?
And where does podcast find you?
- Uh, I'm doing great. Uh, thank you for having me, Molly.
Um, I'm really privileged
and honored to be in conversation with Hugh,
and I'm looking forward to any engaging dialogue
on variety of different topics.
- Likewise, me too. I'm excited to learn from you, Sanjeev.
Uh, you know, to start off,
I think most listeners are fully aware
of Common Spirit Health.
So my question for you to kick us off
and just help us better appreciate your perspective in our
conversation today, your role system,
vice President IT strategy
and Cyber Fusion information Technology.
If you had to describe your work to me in, in simple terms,
what would those terms be?
- Yeah, um, sounds great, Molly.
So, with Central Health's merger with Common Spirit,
you know, I joined the Common Spirit family in my role
as system vice president for IT strategy and cyber vigilance
and defense, uh, also called Cyber Fusion.
Uh, in this role, I truly have a fantastic opportunity
to partner with my colleagues, uh, to make a true difference
for patients, families,
and communities by influencing both the technology
and cyber strategy.
Um, in this, uh, model, we are then able
to maximize the value of technology, transform
how care is delivered to patients,
and enhance experience for our clinicians.
Um, so with, um, a digital transformation initiatives
that we have and, uh, workflow enhancements that we are able
to create with this strategy
or a combination of strategies, um, they create efficiency
for our workforce, uh, for our clinicians
and truly improve their satisfaction, um,
ultimately helping us achieve the
quadruple aim in healthcare.
Uh, so this role is really exciting in that way
that it brings together, uh,
capabilities from technology people, um,
and, uh, emerging, uh, technologies
and capabilities in the marketplace to help us achieve
that goal and outcome that we have. Mm-Hmm,
- , that's a really helpful overview.
And then more recently, you know,
where are you spending most of your time
and energy in your work these days?
What's commanding your attention most?
- Yeah, so like, uh, any, uh, new leader, uh,
coming into a big family, uh, I'm spending my time
and efforts in a couple of different ways.
Um, one, it is just, uh, developing
and building relationships, partnerships
and setting priorities, uh, to do that.
Um, you know, I'm, again, spending my time and energy
and, um, uh, developing those partnerships
with my colleagues both in IT
and stakeholders across the enterprise, um, to, you know,
build that collaboration, gaining valuable insights
that they're able to share with me, uh,
developing a comprehensive understanding,
and then leveraging them for, you know, strategy as well as,
uh, tactical perspectives.
I think the second, uh, uh, thing I can highlight in terms
of, uh, how I'm spending, uh, my time at,
at the moment is, uh, looking
after cybersecurity safeguards, controls,
and their effectiveness.
Uh, I have partnered with my colleagues, uh,
in common spirit cyber technology teams
and our external partners
to gimme a really good understanding of the overall context,
evaluate the current state, state of our cyber strategy
and the capabilities, again in terms of people, process
and technology, and then leverage that insight
and understanding to develop immediate next steps, as well
as developing roadmaps to further enhance our cyber posture.
So, you know, in essence, um, it's about taking the time
to learn, uh, taking, uh, the time to gain insights,
and then turning those understanding
and insights into, uh, what our immediate
and long-term plans are.
- You know, I I'm really glad you brought up cybersecurity
because this is something that's been top of mind.
I, I would say more than ever, as of late, the number
of ransomware attacks in, in healthcare
and healthcare settings was reached a high
in 2023.
When, when we talk about cybersecurity from your seat,
what are some of the biggest considerations
that we really need to keep in mind today about the nature
of threats that health systems are facing?
What do we need to be paying more attention
to or more closely?
And then what, if anything, Sanjeev is a distraction?
What maybe is noise that can command attention
but doesn't necessarily take us down productive paths?
Where would you suggest that listeners keep their eyes?
- Yeah, this is, um, a really time, uh,
relevant, uh, question.
Molly. You know, unfortunately,
the US healthcare sector is reeling from cybersecurity
threats, and it has for some time,
and the exposures, um,
at times have had some detrimental consequences.
Uh, if we just look at the data, you know,
hip hop breaches in 23 nearly doubled, um,
since 2018.
Um, in 2023 alone, uh,
ransomware hit 140 plus hospitals, um,
with, um, you know, ransom being demanded in many cases.
Um, so if we are a healthcare provider, uh,
a medical technology firm,
or just an health IT company, um,
we have a responsibility to address
and take care of, um, uh, technology
and technology assets as well as people, uh, uh, interacting
and working, uh, with tools and technologies.
So the couple of recommendations I would have in terms of,
um, best practices would be
monitor for cyber threats.
Uh, really leveraging the threat intelligence
to track new risks, uh, deploying, uh, detective
and preventative tools to what's out for, uh,
suspicious activity.
Uh, and then really developing, uh, plans to be able
to respond to them.
Um, you know, if, if we identify vulnerabilities,
um, remediating them.
The second category of, uh, uh, advice would be, uh,
managing cyber risk, uh,
conducting comprehensive risk assessments regularly.
Uh, this includes, uh, risks associated with third parties,
uh, ensuring that, uh, security safeguards
and controls are, uh, being leveraged in a way, uh,
that is, uh, effective.
Uh, and then really ensuring, um, that
this process of safeguarding
and ensuring safety is a regular, uh, inherent process.
Um, and I think the third area, uh, of suggestion would be
to just enhance response and recovery capabilities.
You know, you never know when it's gonna come handy,
and the best, uh, way to be prepared is to practice, um,
documented plans, um, you know, ensuring
that tabletop exercises take place.
Uh, people have clear understanding of the roles
that they would play and have clear communication channels.
Uh, uh, maybe a, uh, a couple more in terms of,
I highlighted effectiveness, right?
Effecting effectiveness of cyber safeguards controls, um, in
that, uh, it would be important to, um, measure,
uh, their effectiveness, um,
and then, uh, take steps to
enhance effectiveness.
Uh, what I really mean by that is, uh, let's say that, uh,
we evaluate the security control
and it is, um, you know, three fourths effective.
We ought to place efforts to continue to, uh, um,
enhance that and make it even better.
And lastly, um, med tech security.
These are, uh, devices that are used to, uh,
provide care to patients, uh, ensuring that, um,
these devices are safe to operate
and have proper, uh, segmentation
or security measures to, um, address relevant
and related issues.
I think the question about , what may be distracting,
really, there's a lot going on, uh, in the industry from a
cybersecurity threat and, um, threat
and exposure perspectives.
Uh, I think it's being, uh, you know, resolute
and being very focused on ensuring that safe parts
and controls are effective
and that we continue to place our efforts to, uh,
enhance their posture would be my, um, you know,
set of recommendations for, um, all our stakeholders
and all of our audience listening
to our conversation today. Mm-Hmm.
- looking further upstream.
Y you know, as you were walking us
through this jiva I was thinking through,
there's information available to us
that would suggest the nature of a lot of these attacks.
They've, they've grown more cruel, right?
You've children's hospitals affected large sums
of money demanded from
poor safety net hospitals within short windows of time, um,
leaking of photos of patients.
But you know what, I, I was curious if you had any thoughts
about the nature of the risks, too.
When we talk about managing risks, we, we have a sense from
what we've seen about how these attacks,
the way they're played out, has grown more malicious.
Is there anything worth noting about the risks too?
Are they, uh, tougher to detect? Are they more subtle?
Are any trends there that you can share?
- Yeah, so I think, um,
and that's a really good insightful question,
and it would be very helpful for, um, our audience
to have a perspective on that as well.
So if we think about risk, um, I like
to think about in a couple of different ways.
Um, one, um, that is, uh,
operational disruption or service disruption, right?
So no matter it's a cyber related event that causes
that disruption or something else.
I think that risk is
what we have seen in our recent examples being very
real in our industry.
Uh, and then second, uh,
I think you highlighted well in terms of, uh,
protected health information
or personally identifiable information.
This something, uh, information
and data we're entrusted with, uh, you know, data breach,
uh, in itself is, is, is a major concern.
And, uh, and the combination there were two, uh, do pose,
um, exposure, uh, for organization from a variety
of different perspectives.
And so I will say, um, you know, just again, going back to
what should we do about it, right?
Uh, ensuring that we have good protections,
that we have good monitoring in place, we have ability
to respond, uh, when the event does occur.
Uh, we have good communication protocol.
So just enabling, um, yourselves with ourselves, with
capabilities that gives us the best opportunity to prevent
and protect, uh, and safeguard operations.
- Right. Sanjeev, this is a really timely overview
of cybersecurity, and it's a really helpful
and healthy refresher.
But before we, as we wind down here,
before we close, I wanted to also just check in
and see if there's an aspect of your work,
and this may include cybersecurity
or be outside of it, that, that recently really excited you.
- Yeah. Um, this may sound cliche,
but you know, what I'm really, um, excited about
are the opportunities to serve in our mission
of building healthy communities, by advocating for those
who are poor and vulnerable, um,
by innovating from technology and cyber perspectives.
When we enhance how and where healing can happen.
To me, it's a meaningful, uh, journey to be on.
Um, along, uh, the same, um,
way when it comes to cyber, um, uh, I'm engaged
with, uh, and a member
of the health sector coordinate coordinating council,
cyber working group,
and I serve as a member of the executive committee.
Um, and this, uh, forum really
is an exciting public private partnership, um,
thus facilitated by HSCC, um, to then
identify systematic cyber security threats
to critical healthcare infrastructure, uh,
collaborate on guidance and policies
for mitigating those risks and promoting threat preparedness
and incident response awareness
and activities throughout the healthcare industry.
So, uh, in the combination, uh, I'm truly really,
uh, excited about
and look forward to the work, uh,
that we are currently doing and the work that we, um,
and I can look forward to.
Uh, so really exciting times for, for, for me
and for my role and my, my, uh, opportunity to collaborate
and work with my colleagues in the industry.
- Mm-Hmm. , I mean, I think
that response helps me better see that your role, it's, uh,
not only about reducing and controlling harm and risk,
but also about bringing net new value
and creating more value
for technology and reaching more people.
- Yeah, absolutely. Yeah.
Thank you so much for, for that question.
- Well, Sanjeev, thank you for the chance to visit with you.
Any final thoughts for our listeners in closing?
- Yeah, I, I, first
and foremost, I would, uh, I just want to thank you
for the opportunity to share my thoughts with you
and for your audience,
and, you know, just thank you for having me.
Um, I think the, the thought I would like to share
for current context in the industry is really this, um,
cybersecurity concern that we all have.
Mm-Hmm. , it's a, it's a shared responsibility,
and I would like to promote all of us to do our part.
Um, and if anyone is interested in, uh,
finding the right resources, uh, the
hscc website, um, at
health sector council.org, uh,
can serve as a very helpful place
to find just the right resources, uh, for, uh,
anyone needing, um, guidance on cybersecurity matters.
- Great. It's been my episode with Sanjeev SA system,
vice President of IT Strategy
and Cyber Fusion Information Technology
with Common Spirit Health.
Sanjeev, thank you so much for being my guest today.
I hope we can catch up again soon
and check in with you and your work.
- Thank you. My pleasure, .