Exciting things are happening at Becker's Healthcare. Stay
ahead of industry trends with the new Becker's
CFO plus Revenue Cycle podcast,
your go to source for insights from top
healthcare finance leaders. Tune in wherever you get
your podcasts.
And don't miss the tenth annual Health IT
plus Digital Health plus RCM conference, happening September
30 to 10/03/2025
in Chicago.
Join thousands of executives,
engage with industry leaders, and explore the future
of health care innovation.
Learn more about our upcoming events at beckershospitalreview.com.
See you there.
This is Laura Dierda with the Becker's Healthcare
podcast. I'm thrilled today to be joined by
Steven Ramirez, chief information security and technology officer
at Renown Health. Steven, it's a pleasure to
have you on the podcast today.
Good morning, Laura. Great to be with you.
Now I'm excited to have you here because
I know you've got a really wide, background
in information technology, security, and a lot of
things that you're doing at renowned are are
really cutting edge in terms of how you're
thinking about AI technology
and keeping things,
secure as well as transforming the health care
and health care delivery system. And
so I'm looking forward to learning more about
what you're doing now and and how you're
thinking about the future. But before we dive
into that, can you tell us a little
bit more about Renown and what makes it
unique? Yeah. Definitely. So, again, good morning. I'm
excited to be with you and, you know,
share the journey that, we're partaking here at
Renown. So,
something really cool and something that we really
kicked off end of last year going into
this year was our CEO made a big
focus on, you know, rebranding our mission, vision,
and value statement. So what's unique about Renown
is that we were actually the first hospital
in Nevada,
which was founded in 1864.
Since then, you know, we've been serving, you
know, the great community,
of Northern Nevada, California,
in that outreaching area. So we serve over
a million people, and cover a hundred square,
mile reach, just from what our services, you
know, reach out to. We're the only regional
level two trauma center. We have an affiliation
with UNR. So really, you know, embracing that
academic medicine and really looking to grow that
partnership,
from the clinical research side to really just,
you know, help us grow our mission to
serve the community.
We've recently rolled out transplant, you know, and
other specialties,
so that people can just really have the
care they need at home. So we're really
excited,
to what you touched on, to really see
how tech can help enable that, across the
organization. So, you know, we've done a lot
of lot of cool things and we're really
kicking off year one of our, strategic plan.
So, you know, working closely with our CIO,
and other executive leaders to really, you know,
execute on that over the coming years.
That's really great to hear. And, you know,
cool to have that opportunity to be right
on the forefront of this type of,
digital transformation.
Now when you look at the last year
or so, can you tell us a little
bit about what you're most proud of? What
project initiative
or or really the things that,
had the most impact on the health system
overall?
Yeah. So I've been at Renown, just a
little over three years now. So when we
came in,
it was really doing a big effort to,
you know, just look at our technical landscape.
I think we were spending a lot of
money in areas that needed to have some
refocus on. So I know under the direction
of our CIO,
and, you know, executive team, Really, we did
a phased approach to stabilization.
So really what was working well, what wasn't,
you know, areas that we needed to focus
on, you know, cybersecurity being a big focus
of that as well as tech debt.
I know a lot of health care organizations
are really looking at how, you know, they
can balance the cost to, you know,
the digital transformation,
in a meaningful way to have what we
need to support, you know, the clinical growth
in a lot of these cool tech, you
know. AI is definitely a big buzzword on,
you know, areas on that that, you know,
we'll share more. So, you know, the stabilization,
modernization,
and then the optimization. So we really tried
to
adhere to those three pillars. So really the
first few years was really looking at, you
know, how can we stabilize things, you know.
Do we have the right people process technology?
And then where do we really need to
strategically focus and modernize our infrastructure,
as well as cybersecurity stack? And then obviously,
optimization.
Like, once we get that, it's, you know,
that ongoing life cycle management. So
as far as what I'm most proud of
is that, you know, through that journey, you
know, I originally started as our chief information
security officer and then that evolved into being
the CISO. So, the chief information security and
technology officer. So,
my CIO tasked me to go through and
really, you know, take a deep dive with
the team to look at everything holistically.
So, you know, really proud of, you know,
where we've come,
over the past three years, you know, as
an organization
culturally.
I mean, really coming up with our IT
tactical and strategic plan to align really where
our CIO wanted us to go as well
as our executive team to, you know, better
support the business. So I think a lot
of the success to that was our governance
strategy. So, again, when you're looking at a
lot of, you know, investment opportunities, you need
to really first hone in on your, you
know, governance.
So we set up a GRC, our governance
risk and compliance
committee, which is co chaired by me and
my compliance officer and then have all of
those key stakeholders across the organization. So we're
able to look at all risk throughout the
organization, which, you know, very, very important,
and, you know, really tied into my CISO
role. But also,
you know, in working with our CIO, they
he set up, you know, with his other
partners on our president's council and SBAR process
to really govern any net new technology and
projects coming into our organization.
So that really, you know, tied into third
party risk management as well. So that, you
know, we had different checks and balances for,
you know, new tech we were gonna look
at that would then, you know, work through
our application rationalization,
you know, going through our intake with our
TMO, PMO office. So really making sure we
had all the the right eyes on any
net new technology,
projects, etcetera,
that to really ensure that success and making
sure that, you know, we're able to,
properly,
you know, roll that out across the organization.
So that governance strategy, you know, is,
super critical to that,
but also
implementing and adhering to various
frameworks. So, you know, really a subset of
overall governance,
that we're a NIST
shop, NIST CSF. We just recently did our
NIST
CSF two point o.
Obviously, do our HIPAA, and we're also,
really starting to take a deeper dive into
the I triple E,
twenty nine thirty three for AI governance.
So, again, that's where,
why governance is so important because there's a
lot of,
my CIO will, you know, famously say shiny
bright objects out there. So really making sure
that, you know, we're we as an organization
make sure that if there is a technology
that makes sense to really supplement
what we're doing, we're able to properly secure
it or roll it out and support it,
and then the business actually gets true value
out of that. So,
I think we've done a good job of,
you know, using that from a governance and
intake process to really make sure that we're
getting the most bang for our buck for
any proposed technology.
That's really helpful to know. And I appreciate
the deep dive into your governance strategy because
I know that's something that health systems
in general are are trying to stand up
and figure out, especially as technology is rapidly
evolving and and truly
wanting to make sure that things are secure,
but also not being left behind
in the AI space and more. So, you
know, this has been a a really helpful,
understanding of what that process looks like for
you. And I'm curious, as you mentioned, you
know, elevating into the
CStow role, I I know the team is
being built up around you. What does that
look like? How are you hoping to continue
to evolve the team that you work with,
your leadership team as well, to make sure
that, you know, it's, prepared and ready to
deliver on the transformation that's occurring?
So yeah. No. That great question. So, again,
my role, again, evolved just, you know, with
the natural synergies between,
cybersecurity
and the technology space. So, again,
we just had so much tech debt and
a lot of just modernization
efforts that we needed to go that it
just made sense to combine,
the technology
group as well as security team. We had
a lot of managed services,
out there. So really looking at, you know,
where we are today and where we wanted
to go,
with a security focus really made that helpful.
And security really helped drive some modernization efforts
on the infrastructure side. So, you know, really
from the identity,
two factor authentication,
you know, driving more single sign on, and
then looking at a lot more of these
zero trust based tools to really enable, like,
a
on the go workforce.
So,
you know, typical VPN and solutions like that
are a little clunky for our end users.
So again, you know, looking at that holistically
and seeing how we can better support our
end users and making a big focus on,
you know, the end user experience. You know,
we're just really scratching the surface on that.
So obviously, that that made a lot of
sense. But again, as we're growing and kicking
off our strategic plan and working with our
CIO, it really made sense to help branch
off my current role. So we're in the
process of bringing on a new VP of,
infrastructure,
data center network,
to really help really,
take us on that journey over the next
few years as part of our strategic plan
because it's a little too much for one
person. So a lot of what we're gonna
focus on in kind of this IT reorg
is gonna be, like, front end technology
versus back end technology,
and then really having those more focus points
so we can better align and support the
business on a lot of our modernization
and and tech debt efforts across the organization.
So,
definitely can use the help on that and,
you know, have an additional partner to really
ensure the success of what we need to
do, you know, sticking to that stabilization, modernization,
and optimization to really help
set ourselves up for the future on technologies
like AI,
etcetera. So
No. It's helpful to know. Thank you so
much, Steven, for digging a little bit deeper
there. Now when you look into the future,
the next twelve months or so, where do
you see the big growth opportunities,
for renowned and your team in general?
So, you know, just starting on the the
cybersecurity side, I think we've done a a
great job, and I touched on that, you
know, a little bit before that, the cybersecurity
side helped drive some modernization
efforts on
the technology side. So, you know, I'm really
proud of the cybersecurity program,
that we built, the team that I have,
and really where we're going. We're just kicking
off our,
three year road map. So,
successfully completed phase one of that and now
really getting into more of the, you know,
fun maturity efforts associated with that. So we
really started with, you know, articulating
risk with the organization, and I think that
helped drive the understanding and importance,
and which in turn drove
the investment. So we got a very big
investment over the next three years. So now
it's about delivering.
And we took a very, you know, simplistic
approach to, you know, we know ransomware is
a problem. We know phishing is a problem.
So what is the core fundamental reason on
why organizations are at risk to that? And
then how do we address that from people
process and technology standpoint? So we put together
a road map and, SBAR,
that we then went up through our various,
you know, governance process. Our CIO took that
up to the board and executive
team to really get the buy off on
that. And, you know, that's really encompassing a
lot of what we're doing.
And, you know, really excited to really be
focusing on identity, you know, really scratching the
surface on that in our first initial plan
that, you know, what makes up identity, getting
those core fundamentals together that really set us
up to then start to do these enhanced
security
practices of, like, zero trust,
and,
enhanced DLP,
and other components to that as well as
deception technology, different automations, and pieces like that.
If you don't have the core framework,
and foundation in place, it's really hard to,
you know, be successful and do some of
those,
level up activities, you know, I'd like to
call it. So really looking forward to doing
a lot of that. And I think that
all goes back to, you know, the ability
to
articulate risk. We have a great security culture
across the organization that our team is very
risk adverse. So I have, you know that
makes my job very easy, and we're able
to execute a lot quicker kind of having
that dual role,
of the c you know, CISO and CTO
role. And I know we're gonna continue to
build off of that momentum
across across the board,
and are really excited to see that. And
also to,
see how we, you know, again, use our
frameworks like IEEE twenty nine thirty three for,
you know, AI, bed device security,
and really just to make sure that we're
being risk agnostic
to a lot of these things, doing the
fundamentals very well. We have the organizational culture.
And then, you know, with a lot of
the geopolitical things going on, the importance of
self governance that Renown and our executives are
you know, we're full steam ahead on, you
know, doing the right thing from a a
cybersecurity and technology standpoint regardless of what's going
on because, you know, our goal is to,
you know, be successful, adhere to our mission,
and really support our end users as we
move forward. So,
cybersecurity is a big focal point to that.
And then, you know, obviously, having the technology,
to really go where we need to to
support a lot of these cool new clinical
innovations across across the, board on that. So,
we're really getting to the
to the point, you know, from a cybersecurity
perspective that, you know, I told my team
that we don't wanna tell people our house
is on fire. That's really have a strategy
to put it out. So I like to
say, like, our smoke detectors are alerting. So
that's what a lot of cybersecurity shops, you
know, will go through and we know something
bad's happening.
But how can we be more
tactical at, you know, automating and getting things
done like fire suppression, for example? Why can't
we have we know something's going on, so
let's put it out as quickly as possible
and isolate it. And then have that incident
response. It's like the firefighters showing up to
that. And then, you know, if there's any
kind of restoration efforts, do we have Servpro?
How quickly can they be there and help
us clean up components of that? So really
hoping tell that story to the business and
making sure again that we're able to not
only know something's going on, but being able
to react quickly. But that also translates into,
you know, what a lot of what we've
been talking about the importance of that close
relationship with the technology
enablement,
to have, you know,
a resilient
infrastructure. So no single points of failure. We
know, you know, inevitably technology fails and or
you know, in the unfortunate event we have
any kind of cybersecurity
event that how quickly can we, you know,
come back. So that's really been a big
focus on, you know, how we architect
and are building out,
and investing in a lot of our core
infrastructure for that modernization effort to really make
sure that, you know, we're we're planning for
any kind of risk that comes, you know,
at us and really embedding that into our,
go forward strategy.
I appreciate,
your insight here. And definitely, you know, it
seems like a lot of opportunity to bring
in new technologies, make sure they're safe. You
have a a great playbook,
in looking at those things and and then
executing on them. You touched on this a
little bit as some of the challenges,
happening in geopolitical landscape as well as, you
know, for for technology evolution. Could you dig
a little bit deeper in there? What are
are the biggest challenges, I guess, as you're
looking ahead? What do you anticipate and and
how are you preparing?
Well, definitely, you know, geopolitical.
So, you know, starting with the cybersecurity
side of the house that, you know, there's
a lot of effort on, you know, ending
the conflict between Russia and Ukraine.
So I actually saw some information yesterday on,
you know, different threat intelligence that some of
the threat actors are now using
countries that are more western friendly like the
Germany's and and others to really start to,
spawn their attacks from there. So, like, our
whole geofencing
and, external blocking strategies have to really be
a little bit more,
strategic on,
you know, people taking advantage of the the
old ways to,
you know, make sure that we're doing right
by the organization and staying up on those,
conflicts.
As well as, you know,
the HIPAA security rule, which is, you know,
out there for, you know, comment, etcetera.
With the new administration, what will that look
like?
As well as, you know, some funding changes
that are are out there on Capitol Hill.
So that's, you know, really why I touched
on, you know, self governance that, you know,
we have these industry frameworks that we're gonna
adhere to regardless of that to really protect
the mission and,
really stick to the fundamentals on what we
need to do,
moving forward. So I think those will be
some of the the biggest challenges as well
as, you know, our continued dependence on third
party partners,
and fourth party partners.
You know, Change Healthcare was the one that,
you know, really burnt in our minds and
memories on, you know, what can happen from
that. So just how we better protect our
organization on,
looking at partnerships
like that and then having backups to a
lot of that. So I think that's gonna
be the biggest challenges as well as just,
you know, cost controls and, you know, making
sure that we stay the course. Because, again,
there's a ton of shiny bright objects and
things that you need, you know, that are
coming out and, you know, people are pitching
that, you know, will fix burnout, will fix,
you know, solve world hunger. But again, there's
a lot of these pieces that you need
to have foundationally in place from, you know,
an infrastructure,
security, and data,
perspective, or you're never gonna be successful in
using some of these more modernized
technologies
and kinda similar to what we did with
security. We have to have those foundational elements
in place,
on the technology side, on the data side
to then, you know, enable some of these
cooler advanced technologies.
So
That's amazing to hear. You know? And certainly,
fascinating to understand everything you have to keep
your finger on the pulse on and learn
about and know about,
in your role as the, you know, chief
information security as well as technology officer at
Renown.
Just fascinating.
I'm curious before we wrap up here, what
is the number one most important thing that
you're doing right now to set up Renown
for long term success?
I think being risk agnostic, you know, which
I spoke to, sticking to the fundamentals,
having that organizational
culture and buy in as well as self
governance. So from an IT perspective, you know,
doing what we say and and saying what
we do, you know, so delivering and being
good partners to the business.
So I think those are really fundamental. And
something that, you know, I'm really excited that
we're kicking off this year is, you know,
we always talk about the cybersecurity
shortage,
that we have, but we have the great
opportunity
with, you know, being partnered with,
UNR,
to kick off an internship for a pipeline
with,
cybersecurity
talent that they have there. So,
this is the first year that we're gonna
start to have an internship
program with, their cyber program over there.
So really gonna see how that can not
only benefit the up and coming talent,
out there, but also benefit, you know, our
team from a lot of what we're trying
to do. So really building
for the future on what we can do,
with cybersecurity
shortages and knowing that, you know, those kinds
of risks aren't gonna go away anywhere. And
again, you know, there's just so much going
on to just really stay in touch with
our business and our strategic plan to really
give us that road map to making sure
we're delivering,
and not getting off track, on where we
need to go as an organization.
That makes a lot of sense. Steven, thank
you so much for joining us on the
podcast today. This has been a fascinating conversation,
and I look forward to connecting with you
again soon as well as seeing you at
our health IT, digital health, and revenue cycle
event in October. I know you'll be speaking,
on cybersecurity, and I can imagine just continuing
to follow this conversation and how the situation
evolves. And so I'm really looking forward to
that, and,
thank you again for your time.
Thank you.