- Welcome to Becker Healthcare Podcast, made
for the people who power US healthcare.
I am Molly Gamble at Becker's.
Today I'm delighted to spend time with Erin Wiseman,
chief Information Security Officer with Mainline Health.
Erin, welcome back to the podcast.
Thank you for being our guest. Again, h how are you today?
And where does the podcast find you?
- Yeah, thank you for having me. I'm doing fantastic today.
Thank you for asking. And I am in sunny Philadelphia.
- Terrific. And Mainline has a presence there.
For listeners, Erin, who could use a refresher again on
Mainline Health, can you share a bit about the system just
for the listeners who would like
to get reacquainted with it?
- Yeah. We're a community health system in the
Philadelphia suburbs.
We serve the Tri-state area.
We're about five hospitals, a number
of different ambulatory sites,
clinical practices, et cetera.
- Okay, great. Um,
and Aaron, just guess up to speed on the year
so far from you, where are you investing the bulk
of your time and energy as of late in your work?
- Yeah, so in information security, a lot
of my time investment is in mitigating ransomware
and the impact of the ransomware attacks, right?
So all of the downstream cascading effects that we see
as a result of ransomware.
You know, being able to prepare for downtime, thinking about
how we're handling third parties, what we're going to do
for system availability, et cetera.
Uh, really top of mind for me.
- Uh, it's so far this year, I mean,
we have really seen information security.
It has just been escalating to the top
of the fold in the national conversation
and also especially in healthcare, uh, for the leaders
who have been and remain really close to this work.
What, what skill sets
or traits are you seeing as having renewed value right now
for, for the CISO role?
I
- Think there are a few.
One is definitely strategic planning
and, you know, being able
to drive a successful security vision, we're not really able
to actively mitigate threats so much as react
to them very, very quickly.
And I think some of the more successful CISOs are able to do
that at scale, continually
and keep their organization safe as long as they can.
There's also this element to being able to plan for
that downtime and figuring out, okay,
once our organization's hit with ransomware,
how do I make sure I promote my confidence, you know,
in my ability to respond to
that throughout the organization.
And I think a lot of that's being driven by, uh,
another competency, which is being able
to drive collaboration across the organization
and really being able to explain security concepts to
relative lay people when it comes to technology,
and really be able to convince people, okay,
this is a patient safety and a patient dignity issue.
It's not just a technology issue. Mm-Hmm,
- .
Mm-Hmm. . I mean, it's,
I that makes a lot of sense.
It's not the ability to only prevent you,
you mentioned mitigation, but also reaction
and reacting quickly and reporting on these attacks.
It's, you know, it's interesting
because understandably information can be slow
to be released and for a good reason.
But do you feel Aaron, like you have a good community
and there's good guidance out there about if a ransomware
were attack were to occur, how, how best to respond?
Is there more community there among the health system
players than there was maybe five years ago when this type
of attack was still, you know, relatively novel?
- Yeah, I think there's a lot more, what I
consider shared therapy sessions around it, you know,
where folks come together
and talk about this horrible shared plight, right?
You know, the, the threat of ransomware attack
and how health systems are organizing around that.
And then healthcare fortunately, has had through hipaa, uh,
this longstanding obligation to report healthcare breaches,
et cetera, uh, breaches of protected health information.
Some health systems now have the added, uh, difficulty
of responding to SEC regulations, right?
And, and having to report under much
tighter timelines for that.
So I think it's becoming a lot more complex,
but it's also driving a lot more collaboration within the
healthcare industry and trying to figure out what other
industry players are doing in order to keep abreast
of those new regulations and new obligations. Mm-Hmm.
- , that's the answer I was hoping for.
You know, I understand competitive natures,
but also if something like this occurs,
I was hoping there would be some community
and consensus around it
and trying to, like, even if it's like you said in the form
of therapy sessions, but, um,
we've seen these ransomware attacks grow
to affect larger institutions
and even become more cruel, I would say, in nature with,
you know, release of patient photos,
children's hospital safety nets, demanding large sums
of money in 48 hours from safety net hospitals.
Uh, I'm just curious if you have any other thoughts to add,
Aaron, about the, the nature of these
and the characterization of these attacks,
if there's anything that stood out to you.
- Yeah, I I think they're incredibly profitable
because of that brutalism.
So health threat actors are out there, you know,
attacking health systems
because they wanna make money not
necessarily for any other reason.
And the way they maximize those payouts are by, you know,
sort of the heinousness of what they're doing
by locking down children's hospitals, by releasing photos
of cancer patients.
Those are some notable examples over the past few months.
Um, you know, where, where really patient safety
and patient dignity have been pretty critically impacted.
I, I find your commentary about, uh, competition.
Interesting. A lot of the conversations I've had
with my peers have been,
we don't compete on information security.
There's a lot that of other stuff that we compete on.
Information security supports that,
but it's not a competitive
distinction between health systems.
So why would we treat it like that?
I, I, I think that makes it information security a lot more
collaborative than maybe other areas of hospital practice.
Um, although I haven't really seen any of the, you know,
sort of cut throat competition
that you might associate with other industries.
- Mm-Hmm. , - Well, a, as more
and more information continues
to come at us about information security
and threats related to it, Aaron,
can you pinpoint one lesson or,
or one bigger takeaway we should take from 2020 four's
events so far related to information security in healthcare?
Can you kind of boil the ocean for us?
What's one big lesson we should keep in mind here?
- Diversify monolithic vendors,
and I think we keep seeing that lesson repeated over
and over again, 20 22, 20 23, 20 24,
where these large service providers that handle, uh,
you know, either visibility or, uh, office and email
or even claims processing for a large number of systems
when they're impacted very negatively,
that has cascading downstream impacts
that are very significant.
And if you put all your eggs in one basket
and you're relying on one service provider to
effectively manage all that downstream work, that
that is going to lead to problems.
So, you know, I think there's a lot of inefficiency
that's introduced by trying to diversify in specific areas.
And, you know, certainly it takes a lot more work to manage,
but at the same time, you know, even this year,
as we're seeing in the claims processing space, um, very,
very difficult to continue operations
and continue to be profitable as an organization if,
you know, all your eggs are in one basket
and that basket's destroyed, right?
- Mm-Hmm. . Mm-Hmm. ,
- I mean, the way you said that,
diversify monolithic vendors, it sounds like
that's been something top of mind for you.
Uh, I, I'm curious
because there's, seems like
there's two sides of the coin there.
You, you hear from some in the data
and IT world, they'll talk about moving to one platform
or one system and avoiding fragmentation as if it's a,
a the only good thing.
But I think as you just pointed out, Erin, there are a lot
of risks with that too, right?
Um, so I think sometimes the way it's discussed, it's like
that seamlessness is upheld as the universal good,
but as you just helped us remember
and understand that there's a lot of risks that can come
with that if there's frailties with, with that one system
or that one basket.
- Well, and it's ultimately a risk management activity
and how much risk the organization wants to undertake.
Um, I, I think there are a lot
of benefits in minimizing the number of vendors you have.
But you know, then again, the, the risk that any one
of those vendors poses
to your organization becomes much more significant.
And, you know, I mean, even tech giants like Microsoft
and Google and SolarWinds, for example, you know,
can be impacted and have been impacted by cyber attacks.
And it's, it's really difficult to sort of say, okay,
you know, we as an organization are gonna be able
to continue our operations when these large monolithic
organizations that spend, um, in, in incredible amounts
of money on cybersecurity are also impacted.
So it, it, it, it's definitely something to think about
and I think organizations need to take
that into account when they think about their
downstream third party risk.
- Right. Right. Well, Aaron Weissman,
chief Information Security Officer
with Mainline Health, I wanna thank you again.
This has been a, a really dynamic conversation.
I appreciate your thoughts
and expertise on this topic today.
Any final thoughts or closing thoughts you
wanna leave our listeners with?
- I think my final thought would be, you know,
cybersecurity is a collaborative effort, both within
and without, you know, cyber threat.
Actors are working with each other to figure out how
to maximize the impact of their cyber crimes.
We as security practitioners need to be thinking
how we can work within our organizations
to develop cybersecurity strategy
and also across industries to figure out
how we can collectively defend against these attacks.
- Mm-Hmm. , Aaron,
I wanna wish you continued success and luck in your work.
I think you hit so many great points,
and I'm gonna keep in mind the things you said about the
CISO role, just so much emphasis on strategic planning, how
one and one's team reacts,
and then keeping that collaboration alive and well.
Um, so Aaron Weissman, chiefs information Security officer
with Mainline Health, thank you for returning
to the podcast, Aaron, and hope we can
catch up again with you soon.
- Likewise. And thank you so much for having me.