This is Laura Dierda with the Becker's Healthcare
Podcast. I'm thrilled today to be joined by
Greg Sieg, chief information security officer at University
of Michigan Health Regional Network. Greg, it's a
pleasure to have you on the podcast today.
Thank you, Laura. It's a pleasure to be
here with you.
Absolutely. Now I'm excited for our conversation because
I know, cybersecurity is such an important topic
in health care right now and certainly,
will continue to be as things change and
and we have more in technology and AI
than ever before. But before we dive into
the broader discussion, can you tell me a
little bit more about yourself, your background, and
the organization?
Yeah.
Been with, with the University of Michigan Health
Center for,
about three and a half years now. I
have a background in, in IT and and
networking security. Kinda worked my way up through
the through the rankings,
starting in health care at help desk and
then moving into,
different support roles and and into leadership and
spent quite a bit of time at a
rural health facility,
where, you know, we wear we wear quite
a few hats, not just not just one,
before I moved over to to the university
here. And
where now I get to, you know, focus
on security and,
you know, really kinda, you know, dig into
it.
That's great to hear. And, you know, when
you think about the last year in particular,
were there any great initiatives that you led?
What did you do, and what were the
results?
Yeah.
We've, last year, we've been working on,
an acquisition that, we've purchased about two years
ago. That's what, I've been supporting
as well as another affiliate,
that that we acquired as well
and working on bringing them together.
So there's been a lot of different pieces
to that, to that work in the last
year. So I I wouldn't really pinpoint,
you know, say one thing,
from from that standpoint. But,
I would say that, as we've been bringing
them over, we've been trying to align to
a cybersecurity framework that
will work across the organizations regardless
of size and be more of a standard.
That work has helped us lay the groundwork,
if you will,
for moving tooling,
you know, our our people, all the work
all the work that we've kind of been,
bringing together.
The the the work's been you know, the
results have been good, but it it's it's
a lot of work there. It's not just
about tools. It's about people and and, you
know, communication with the different departments,
and and building up, you know, a culture,
if you will. So it's been,
satisfying,
to see
the where we've come in the last year
and and the work that we've done,
as we've moved through it.
Absolutely. I I think, you know, you have
the two things that you talked through right
there and just looking at the cybersecurity, the
technology side of it, and then the the
people side too, which I know is no
easy task to make sure everybody is practicing
the proper
cyber hygiene and being a good spot of
communication and culture as you put it. So,
you know, when you think through,
what you've been able to accomplish over the
last year and then look ahead, what are
you kind of focused on? What are some
of the priorities and headwinds that are,
top of mind for you in 2026?
Yeah. The the the fun thing with
with SauerScure is it's it's ever changing. You
know? The last few years, we were hyper
focused on AI,
in in the industry with the changes that
came out of that and and the speed
that it that it goes at. But,
I would say right now, our focus,
from an overall is really looking at our
identity. So whether that is,
a person, whether, a machine identity,
really kind of across the gamut, looking and
making vendors
and so on, making sure that we've got
the the correct structure around, the correct governance
around it. We're doing the correct auditing with
it. You know? And,
we're we're keeping track of of those identities
as they as they come through the system.
So,
working with,
multiple systems, multiple HR systems that they come
through,
and making sure that we're deduping
those identities
and that, you know, again, we get a
nice clean clean look at them. So
there's,
there's a lot of work that goes in
Dendy, and there's,
it hits pretty pretty much every facet of
cybersecurity.
So it's one of those areas that,
if you don't have your Dendy right, a
lot of your tools are you know, it's
hard just to say that they're working right.
You know, the
a bad actor
that gets a a good identity. It's very
hard to track,
that town and, you know, determine that you
have something in your system. So,
having a good secure program around that is
is really our focus right now.
It makes a lot of sense. And, you
know, I I think it's especially critical to
have that type of governance in place,
in something a lot of health systems are
focused on right now and continuing to evolve.
And so, you know, I'm curious if you
could dig a little bit deeper and share
a little bit more about how you're structuring
the governance process at,
University of Michigan. That would be helpful to
understand. I think, you know, anything that you
might do differently or uniquely because of the
last year,
of how, you know, things that are evolving
at such a rapid pace.
Yeah.
So one of the things that, I would
say we're focused on right now is,
trying to align
the entities.
So
working through through m and a, you typically
are working through multiple tools in in in
different environments.
So
we're working on doing alignment and,
visibility across those organizations.
Right now, we have it in in tool
sets, but we're looking to get it into
a single pane of glass
and make it a little bit, easier for
us to to view those.
And then,
as I mentioned,
the machine identity, that's something that I I'm,
you know, very, you know, intrigued with, you
know, getting into more,
as we go through through items,
because a lot of times your machine identities
are
items that,
they're they're created for a server,
an application, a device.
And, you know, those those have a life
cycle that,
is a little different than than, say, a
human account.
You know, typically, you know, not having the
same,
password reset functions on them and and items.
So there's things you can do with with
certificates and and different work to better secure
those accounts and
and also, you know, allow us to change
those passwords on the fly with automation.
And those are some things that we're we're
keenly looking at to,
try to be better along those lines.
That's helpful to know. Thank you for digging
a little bit deeper there. Now looking into
the next year as well, what do you
think the hardest thing you'll have to do
will be?
So as we talk to your you know,
cybersecurity
is not just about
deploying a tool,
you know, to secure yourselves.
There is a very large,
you know, people process technology
piece to it, you know, working together. You
know? And and the people side is very
subjective.
You know, that's where,
coming in, you know, we still see a
lot of social engineering, a lot of fishing.
You know? It's not something that, like I
said, that you can just put a tool
in place and and be fixed.
So when you look at that and then
you look at health care, which is an
area that, you know, we're also having to
balance with, you know, patient safety and regulatory
requirements,
it it gives us, you know, a lot
of work to do, I guess, is the
best way to say it.
So, you know, the next year,
as I mentioned, we're gonna continue to work
with with identity,
but also looking at ways that, we can
make sure that we're doing a good balance
of of our, communications
out to,
staff and and and
even our patients on, you know, how to
keep themselves secure and how to keep our
environment secure,
while they're there,
as well as continuing to look at our
technologies and our processes,
to make sure that,
that they're going in the right direction.
Cyber is really a very continuous,
life cycle at the end of the day.
It's we don't get to go and put
a tool in and then walk away and
say, okay. The job's done. Let's move on
to the next.
So, the moment that tool goes in and
gets configured,
we're going right back and tweaking and adjusting,
you know, as we learn new things.
And, you know, a lot of that comes
through,
what we call cyber threat intelligence,
working on that to,
try to make sure that, the the tools
and the processes that we have in place
and the education that we're doing with the
with our employees
is the right stuff for our environment,
and that we're, you know, protecting the right
way. So we utilize a lot of that
intelligence information to help us make those decisions
and, to, you know, move forward in the
right way.
That makes a lot of sense. And, you
know, I appreciate you talking through everything that
goes into, the process, not only technology, but
how you wanna make sure that the processes
are there and everyone understands
the importance of following them because it it
just makes such a big difference. And the
the data you have too, I can imagine,
you know, really helps you,
keep track of all of these things in
a way that you weren't able to in
the past.
Absolutely.
Now, before we wrap up here, I wanna
talk about growth too. Where do you see
some of the best opportunities for organizational growth
in the future?
Yeah. So this one,
you know, health care is expanding, you know,
pretty rapidly right now, but it's it's expanding
outside of the hospital walls.
You know,
yes, we're seeing we're seeing expansion hospitals too,
but a lot of it is we're seeing
new ambulatory clinics, we're seeing a lot of
virtual health,
we're seeing
AI playing a role in in this as
well,
you know, bringing a lot more care direct
to the patient even even in their home.
And,
that makes it, you know, it we don't
have that footprint of, you know, within the
hospital walls like we once did. And for
cybersecurity, that makes it, a little bit harder
because, you know, you don't have a
set line, you know, that that you're looking
at. So as we go through and and
we look at that,
we we have to grow and and and
adjust with them. And,
in cybersecurity, we've gotta be able to be
flexible to allow the the facility to grow
as well. The other point that didn't point
out there is, as I mentioned earlier, we're
we're doing mergers and acquisitions.
That helps accelerate this. You know, we're still
seeing that fairly heavy in the health care
industry right now. But,
from the cyber side, I look at our
job as as making sure that as we
do these, we're we're doing the right pieces
to keep us secure,
to allow the business to to do that
organizational growth,
and feel, you know, confident that we're that
we're putting the right steps in place as
we do those. We're doing the risk assessments
on the sites and and bring everything up.
That makes a lot of sense. And, you
know, it it's cool to hear, especially the
way that you can integrate into that whole
growth process. And when you are bringing on
new sites to new facilities,
amidst some of the the larger m and
a and the integration of those kind of
things, What are some of the the challenges
that arise or the things that you have
to troubleshoot as you're trying to, you know,
get everything up to speed so you're bringing,
you know, the new facilities or organizations into
the fold?
Yeah. I would say,
you know, health care is very, very keen
on on people and relationships.
And,
I think that's one of the biggest things
that you that you have to focus on,
when you go when you go into these
events.
You have organizations that, you know, may have
may have been there for
for fifty years, you know, or or or
more and you've got people that
might have spent their careers there that they
know their way of doing things and they
might have ways of doing things better. You
know, they might have ways of doing things
that are different.
And it's
looking at those, validating those and reviewing the
risk
and determining, you know, what the next step
is.
But, you know, at the end of the
day,
you know, there's a it's it's all people
centric, you know, when you get into that.
So, you know, like I said, it's very
easy to to think, oh, I'll just go
deploy a tool and and and get a
score,
but,
that doesn't tell the whole story. So
working,
with with staff, working with, the the departments,
it's not just I'm not just working with,
with a IT department or or or security
department.
I'm working with with, you know, clinical departments,
with financial departments,
to
make sure that we're
there
assisting them getting the right steps that they
need,
to
really to get the next process going,
you know, and make sure that they're doing
it, you know, in in a right and
secure way and that they understand what we're
there for. The, you know, the last thing
I want is,
to be looked at as as a barrier,
you know, to what the business is trying
to do. I want to be looked as
a partner that,
can come in and help,
because when you're a barrier, people look to
go around you,
versus,
when you're a partner, people will come to
you and ask you how they can proceed
to the next step and get and get
around a barrier that's in front of them.
I love that analogy. Greg, thank you so
much for joining us on the podcast today.
This has been such a a fun and
informative conversation.
I really appreciate your time, and I'm excited
to see you as well at our annual
meeting coming up in April. I know you'll
be speaking on a panel and and definitely
digging deeper into some of the things we
talked about today, and so it'll be great
to get your expertise and to see you
in person.
I'm I'm absolutely looking forward to it. Thank
you for your time again today as well,
and we appreciate this.