This is Laura Dirdo with the Becker's Healthcare
podcast.
I'm thrilled today to be joined by Steven
Ramirez, chief information security and tech officer for
Renown Health. Steven, it's a pleasure to have
you on the podcast today. Hey, Laura. Great
to be with you. Absolutely. Now I know
it's always fascinating to speak with you because
you've got such a great big picture and
and future focused view of technology, cybersecurity,
considering all the different things that are happening
in health care today,
AI, as well as government policy changes and
more. So, you know, I'm looking forward to
this conversation.
But before we begin, for those who are
just starting to listen to the Becker's Healthcare
podcast, can you introduce yourself and tell us
a little bit more about your background?
Yes.
Again, good to be with you. My name
is Steven Ramirez, and I'm the chief information
security and tech officer at Renown Health. I've
been there for almost four years.
Renown Health is up in Northern Nevada, so
it covers the Reno, Tahoe area. We're a
integrated health system,
four different locations and
fresh transplant center, you know, urgent care. We're
the area trauma center. So really a lot
of different service lines that we have that
are to serve our community and looking to
grow different components of that moving forward.
That's great to hear. And, you know,
I am excited to kinda talk to you
because I I think there's such a diverse
patient population that you serve and certainly a
lot of, key considerations in that when you
think about cybersecurity. So, can you give us
a little lay of the land? What's happening
right now? What are you is top of
mind for you, the opportunities and headwinds that
you have your eye on?
Well, there's a lot in cybersecurity.
I think that just, you know, AI is
continuing to be
a buzzword, but a lot more of that's,
coming to fruition that we saw
over the weekend that
there was news that the Chinese government did
the first ever AI autonomous attack on some
various interests.
So, you know, we've been talking for it
a long time to really say how is
AI gonna be used for the, you know,
good, bad, and the ugly. We finally saw
how threat actors can leverage it
to target various organizations. So that's something that
is we're continuing to look at our cybersecurity
posture, hygiene,
and emerging threats to really keep front and
center of mind that AI is only gonna
get more sophisticated
in tactics and techniques, but also
somebody that might not have a lot of
technical acumen is gonna be able to do
a lot more with getting up to speed
and becoming more sophisticated
just on AI being able to enable their
overall tech
ability that they used to not be able
to do, and really just help fast track
a lot of the attacks
from, you know, phishing to social engineering to,
you know, being able to do reconnaissance. You
know, before threat actors would look at your
organization for weeks, months, etcetera, they can learn
so much about the organization, you know, leadership,
players, service lines, partners, and all of that
in a click of a button or a
phrase. So that's really where
we're having to stay up to speed and,
you know, continue to evolve and make sure
that we're, you know, addressing these risks as
we move forward.
That makes a lot of sense and is,
you know, really fascinating to hear about,
the Chinese government that first ever autonomous attack
using AI.
When you look at AI, you know, within
the health care space,
in particular,
thinking through, you know, on the organization side,
what are some of the things that,
chief information security officers and just any leaders
within the health care space need to think
about and
and understand when it comes to AI, and
they're trying to look at their strategy, trying
to be safe, but
at the same time, wanting to be, you
know, on the forefront of the technology
in leveraging it to the best of their
capabilities.
So what do you really have to watch
out for if you're a leader,
of the health care system trying to figure
out, you know, what AI is gonna make
sense for you?
Well, it's really critical to,
have strong governance because
there's a lot of different AI
buzzwords and what is AI and not AI.
So it's like there's machine learning. There's,
you know, just using it for searching. There's
autonomous AI that use, you know, machine learning.
Like, there's there's different components that make up
AI. So it's like, you first need to
be educated on
what is and isn't AI,
how it's used in the organization or as
a subset of a variant of another
application and or system. But it's also important
to understand the build versus buy question as
part of this governance structure that you really
need to understand. Is this something that you
wanna go with a tried and true partner?
So like the Microsofts of the world, the
epics that, you know, have embedded and road
maps with AI versus, you know, thinking that
we're gonna try to build it, create a
lot of these components ourselves, that it's a
lot more
mean time to maturity,
easier to implement, easier to manage, easier to
secure if it's with one of your partners.
So that's really very important to that, but
also having strong data governance because, again, like
a lot of different tools, it's dependent on
data. If it's either,
you know, from a machine learning, you know,
looking at activities and components over time or
actually leveraging the data to make decisions, because
I know there's a lot of opportunity
on that on both sides of the house
on looking at, you know, those two different
types of AI. So it's again, that's the
importance of AI use cases, the
crawl, run, walk, and, you know, also doing
due diligence
to really make sure that you you are
protecting your organization from a data protection standpoint,
that there's a lot of different security tools
that we can leverage to make sure that
we're keeping everything in house, making sure that
data isn't being misused, and that we're really
just supporting the clinicians in the intended use.
Absolutely. A 100. I I think that's such
helpful advice and and really, great bullet points
to take back and understand and apply to,
your own organization.
Now I think when you look at the
future, you're thinking about growth, from an organizational
strategic standpoint. I know there's a lot of
initiatives out there,
trying to, you know, continue to expand access
to care and apply technology.
What does it look like for you when
you're thinking about growth and adding value to
the organization overall? What's important,
for you to do in a part to
your, executive team,
to make sure that on the cybersecurity side,
everything is in top shape?
It's important for us to make sure that
we're
aligning to the strategy and growth of the
organization
just because of how technology is enabled and
the digital front door that we're continuing
to grow,
optimize, and expand to really, you know, support
our patients is that that's just expanding your
risk
your risk profile,
and it's really just important that everybody understands
that when we're looking at various technology that,
you know, we're able to always use good
cybersecurity
hygiene,
good
good practices in place, and I think that
that all goes into the cybersecurity culture, just
the mindset. So it's really, again, important that
as a CISO of the organization
that we we have various committees. So it's
always important that we're, I always say, being
storytellers. So we need to understand about
educating people. Like, we had just spoke to
the first autonomous AI attack. You know, that's
gonna go out on being a blitz in,
you know, my governance risk and compliance, our
audit and compliance steering committee, our operational compliance
meetings, like, really helping say, guys, this is
a lot of what we've been focusing on,
building the foundation,
putting our investments and controls to help protect
about this.
So it's, again, building in that layered
approach to really just make sure that,
we're protecting
against today's threats and the threats of tomorrow
with how technology is just continuing to evolve.
So, again, being a good partner,
educating staff on what's going on in the
world because, again, they're looking at, you know,
headwinds and other strategic components on their side
of the house. So it's really just important
that if it's ingrained into people's DNA,
they know cybersecurity is an important pillar to
what we need to do as an organization,
that it just helps become naturally. So that's
just where, again, my role to help really
just spread the gospel, I like to say,
internally to really make sure that we're we're
partnering with our business, that they understand what
we're here to do, how we're here to
help, and then abound around the frameworks and
foundations that we're doing to make sure we're
securing the organization.
That makes a lot of sense, and it's
just really helpful to understand. I'm thinking from
that lens of,
being you know, setting up the governance, the
right committees,
compliance, and more. And, you know, from your
perspective, as you see the landscape changing with
AI and and just becoming more sophisticated
technologically,
is there anything that you have to do
differently,
with your teams or the the cybersecurity
and and IT folks working with you? You
know, are you looking for any skills, expertise,
or or something that, you know, you're more
often partnering with other organizations again to, you
know, make sure that you're in a great
place?
No. I think that's a great question that
I think
the hype of AI
really makes people think that we have to
change our approach.
But from cybersecurity
practice that if we focus on the fundamentals,
I've always said that, that it'll set us
up to
be successful in any net new technology, emerging
risk, etcetera. Because if you really think about
looking at phishing, social engineering, that's gonna, you
know, be some something that threat actors are
using,
you know, to try
to target our organizations. If you're thinking about
vulnerability management and patching,
that's gonna, you know, apply to AI and
technologies as well.
If you're talking about data governance and data
management, that applies to that as well. Data
loss prevention, that just becomes a little bit
more paramount on, you know, the fast pace
of data, it needing more data,
looking at monitoring and alerting. So if you
know, I can go on and on a
lot of about this access controls. But, again,
if we're doing a lot of that very
well,
can really mature in some of these key
areas, that it'll set us up for success
for, you know, how we wanna use AI,
how we can protect about
protect our organization from threat actors, but also
mishandling internally. So, again,
it's really sticking to those fundamentals will help
us grow,
holistically regardless of what technology is out there.
So it's it's really important to, you know,
just articulate that, make sure that your cybersecurity
strategy
is sound and more focused on
practices and principles than trying to nip off
every net new tech and or risk that
rolls around the corner.
Kind of like emergency management, I like to
have an all hazard approach that, you know,
we can't spend all day just thinking about,
you know, what if this, what if that.
It needs to just be like, we're gonna
focus on identity. Regardless of a type of
attack, we're gonna have, you know, alerting,
isolation,
etcetera,
associated with that. So, again, really, any cybersecurity
hygiene practice
approach can apply to technologies like AI and
and enable us to protect the organization
just organically,
if we're doing our jobs well.
That's a great philosophy and just fascinating to
think about having that true north and, you
know, finding a way that you can really,
stay grounded no matter what happens.
I'm curious too, you know, in looking at
the next year or so, I know a
lot of organizations are seeing some financial challenges,
potentially,
funding cuts and those kinds of things. And
so, you know, for those who may be
tightening the belt straps a little bit, what
is one risk or investment that's really still
worth making this year, especially given,
you know, how quickly things are changing the
technology as well as the cybersecurity space?
Well, governance is free. So I think that
it's always important. Strong governance goes a long
way within the organization,
being creative
in how you can attack different components. Like,
for example, we see, you know, a rise
in phishing,
you know, targeting various players. We've been invested
a lot in, you know, technologies, awareness, training,
etcetera, but have also just looked at blocking
certain
roles from having external email. So it's like,
that's a no low cost
concept. So I think that as we continue
to look at the headwinds and potentially needing
to, as you said, you know, look at
cost reductions, you know, staying flat from our
overall budgets, it's really important to think outside
of the box, do a lot of the
foundational elements, do those very well versus chasing
all the shiny bright objects within
IT. I think focusing on identity access managements
are the most critical component. I consider myself
an identity junkie that 80% of all cybersecurity
events and attacks stem from
an identity based attack. So if you think
about multifactor authentication, privileged access management,
identity governance, looking at, you know, into service
accounts, looking into more than just those components,
building a defense in-depth strategically
on
identity
will go a long way for organizations. So
I think any way that you can better
focus on identity access management versus people coming
and going from the organization,
that that's of the utmost importance. And then
having data in analytics
help drive decisions moving forward that I like
to use. The example of the movie Moneyball,
you know, that they had the strategic and
analytics guy that was going in to make,
you know, different decisions on that. That that
really having analytics, we've talked about it for
a long time. I think AI is where
that can help us look at things on
what's working well, you know, other areas that
we can focus on,
and really just help us drive and be
more tactical,
in this. And I think that, again,
yeah, just
will go a long way in a good
organizational culture as well because,
it takes everybody in the organization to be
successful.
And by having
your end users
fully trained, aware, and, you know,
drinking the Kool Aid on what we need
to do. I like to say that it's
really really goes a long way because there
are are some of our bigger risk items
we need to look at, but also our
first line of defense. So always leveraging them
to really help us fight our good fight,
for what we're doing at Renault.
Absolutely. I love that. And, you know, when
you speak about governance being so important and
actually, you know,
being
a no cost, way you can be preventative,
on some of the cybersecurity and attack fronts.
Is there anything unique that you do at
Renown that's worked particularly well and or, you
know, looking into next year, anything you're trying
to do a little bit differently to meet
the needs of the day?
Well, we're always trying to
we wanna not be Swiss cheese on our
intake process, so I think that building layers
to that's super important. So our
our president's council
team has final approval of a lot a
lot of the various projects that are coming
in. We have a phase gate process as
well. So that's a multifaceted group that has
finance,
IT,
legal, you know, various stakeholders throughout the organization
to look at different pieces. So that's, you
know, a good governance structure. We also have
an intake of doing cybersecurity
assessments,
AI assessments that we've rolled that out,
and looking at various subsets of that as
well. So I think that that's very important
to, you know, make sure a technology that's
coming in does or doesn't have AI capabilities
so that once you have it,
you're not dealing with the problem after the
fact. So getting that much information upfront and
then understanding how that tech's gonna work in
your ecosystem is part
of a onboarding and review session. So, again,
as you're saying, we have various layers, and
then, ultimately,
I sign off on our DocuSign process before
anything's purchased,
because then that's ensuring that we did do
a security review.
Again, that's a lot more work, but puts
the accountability on us to make sure that
we're actually reviewing,
looking at the cybersecurity
posture,
looking at any risk that some technologies might
be bringing into the organization.
But just again,
multiple committees seems like it can be tiresome,
but, you know, having different targeted components like
us having a governance risk and compliance that
we can speak more to compliance, privacy, and
security aspects, as well as data governance,
which is a key component to that. And
then having our, you know, committees on onboarding
and looking at new technology from a strategic
perspective, and then thinking about our audit and
compliance committee, and then thinking about our business
continuity and disaster recovery committee,
and then our emergency management committee. So it's
like we have so many various committees that
are centralized on, you know, driving their strategic
work streams, but there's always such a big
subset on data protection, cybersecurity,
and that that that enables us to make
sure that we have that seat at the
table and we're partnering with the organization to
really make sure that, you know, we have
an understanding of, you know, where we're going,
what we're currently doing, and being able to
have those discussions as needed.
That's so helpful to understand. Thank you for
digging a little bit deeper there. Now before
we wrap up, I'm curious, what do you
see as some of the best opportunities for
growth in the future?
Well, I think to what you said before,
I think that we're getting to a point
that technology and AI will be able to
help
push the envelope on
doing some, you know, maybe level one, level
two stuff. I think voice
calling and AI
is gonna be a huge opportunity for driving
costs down from a service desk perspective. Because
if you think about it, you know, we've
come a long way in just that evolution
of
calling
a service desk. You talk to the live
agent, then we've gone to, like, the IVR
perspective where you can press 1 for this
issue, press 2 for this, to now to
the point that we have autonomous AI that
you're seeing, like, with Alexa and Siri's, who's
probably gonna turn on as I say your
name. But really that conversational
component. That if you think about being able
to build knowledge base
for some of the key areas that we're
seeing in IT from, you know, reporting an
incident to I need my password reset to
how how do I do this, how do
I do that. There's some very high level
pieces that we could start to look at
building into that that can help drive down
the necessity of
having
a service desk fully staffed to that and
be able to scale up and down to,
you know, some more basic elements to that.
So I think that's where AI can do
that as well
as meeting and note taking and, you know,
research
and, you know, decision analytics, you know, once
we get to that point. So I think
that there's a lot of opportunity
just in the progression that we're seeing AI
and being able
to actually start to deliver in some of
these key areas, as well as I've seen,
you know, night and day
expansions and actual usability with on the clinical
side for how they're gonna be able to
use it to, you know,
help curb physician burnout that we've been talking
about forever more process optimization,
you know, real time
data analytic and,
you know, a lot of different opportunities to
that. So it's really exciting to be in
technology right now. Also, it's kind of scary,
on the cybersecurity side. But, again, that I
think this is a great time for us
to be able to leverage that, and that'll
challenge a lot of health systems
moving forward with us seeing some of these
headwinds on how we can better leverage that,
that technology to help us out, kind of
on curbing expenses of staffing.
Fantastic.
That you know, it seems like a really
great opportunity and something that I know a
lot of organizations would welcome the technology,
to do more of that on on the
call desk, especially, and then how else they
can leverage AI out in a smart and
meaningful way. Steven, thank you so much for
joining us on the podcast today. This has
been such a fascinating and informative conversation, and
I look forward to connecting with you again
soon.
Look forward to it. Thank you so much.