Speaker 0: This is Laura Dierda with the Becker's Healthcare Podcast. I'm thrilled today to be joined by Greg Sieg, chief information security officer at University of Michigan Health Regional Network. Greg, it's a pleasure to have you on the podcast today.

Speaker 1: Thank you, Laura. It's a pleasure to be here with you.

Speaker 0: Absolutely. Now I'm excited for our conversation because I know, cybersecurity is such an important topic in health care right now and certainly, will continue to be as things change and and we have more in technology and AI than ever before. But before we dive into the broader discussion, can you tell me a little bit more about yourself, your background, and the organization?

Speaker 1: Yeah. Been with, with the University of Michigan Health Center for, about three and a half years now. I have a background in, in IT and and networking security. Kinda worked my way up through the through the rankings, starting in health care at help desk and then moving into, different support roles and and into leadership and spent quite a bit of time at a rural health facility, where, you know, we wear we wear quite a few hats, not just not just one, before I moved over to to the university here. And where now I get to, you know, focus on security and, you know, really kinda, you know, dig into it.

Speaker 0: That's great to hear. And, you know, when you think about the last year in particular, were there any great initiatives that you led? What did you do, and what were the results?

Speaker 1: Yeah. We've, last year, we've been working on, an acquisition that, we've purchased about two years ago. That's what, I've been supporting as well as another affiliate, that that we acquired as well and working on bringing them together. So there's been a lot of different pieces to that, to that work in the last year. So I I wouldn't really pinpoint, you know, say one thing, from from that standpoint.

But, I would say that, as we've been bringing them over, we've been trying to align to a cybersecurity framework that will work across the organizations regardless of size and be more of a standard. That work has helped us lay the groundwork, if you will, for moving tooling, you know, our our people, all the work all the work that we've kind of been, bringing together. The the the work's been you know, the results have been good, but it it's it's a lot of work there. It's not just about tools. It's about people and and, you know, communication with the different departments, and and building up, you know, a culture, if you will.

So it's been, satisfying, to see the where we've come in the last year and and the work that we've done, as we've moved through it.

Speaker 0: Absolutely. I I think, you know, you have the two things that you talked through right there and just looking at the cybersecurity, the technology side of it, and then the the people side too, which I know is no easy task to make sure everybody is practicing the proper cyber hygiene and being a good spot of communication and culture as you put it. So, you know, when you think through, what you've been able to accomplish over the last year and then look ahead, what are you kind of focused on? What are some of the priorities and headwinds that are, top of mind for you in 2026?

Speaker 1: Yeah. The the the fun thing with with SauerScure is it's it's ever changing. You know? The last few years, we were hyper focused on AI, in in the industry with the changes that came out of that and and the speed that it that it goes at. But, I would say right now, our focus, from an overall is really looking at our identity.

So whether that is, a person, whether, a machine identity, really kind of across the gamut, looking and making vendors and so on, making sure that we've got the the correct structure around, the correct governance around it. We're doing the correct auditing with it. You know? And, we're we're keeping track of of those identities as they as they come through the system. So, working with, multiple systems, multiple HR systems that they come through, and making sure that we're deduping those identities and that, you know, again, we get a nice clean clean look at them.

So there's, there's a lot of work that goes in Dendy, and there's, it hits pretty pretty much every facet of cybersecurity. So it's one of those areas that, if you don't have your Dendy right, a lot of your tools are you know, it's hard just to say that they're working right. You know, the a bad actor that gets a a good identity. It's very hard to track, that town and, you know, determine that you have something in your system. So, having a good secure program around that is is really our focus right now.

Speaker 0: It makes a lot of sense. And, you know, I I think it's especially critical to have that type of governance in place, in something a lot of health systems are focused on right now and continuing to evolve. And so, you know, I'm curious if you could dig a little bit deeper and share a little bit more about how you're structuring the governance process at, University of Michigan. That would be helpful to understand. I think, you know, anything that you might do differently or uniquely because of the last year, of how, you know, things that are evolving at such a rapid pace.

Speaker 1: Yeah. So one of the things that, I would say we're focused on right now is, trying to align the entities. So working through through m and a, you typically are working through multiple tools in in in different environments. So we're working on doing alignment and, visibility across those organizations. Right now, we have it in in tool sets, but we're looking to get it into a single pane of glass and make it a little bit, easier for us to to view those.

And then, as I mentioned, the machine identity, that's something that I I'm, you know, very, you know, intrigued with, you know, getting into more, as we go through through items, because a lot of times your machine identities are items that, they're they're created for a server, an application, a device. And, you know, those those have a life cycle that, is a little different than than, say, a human account. You know, typically, you know, not having the same, password reset functions on them and and items. So there's things you can do with with certificates and and different work to better secure those accounts and and also, you know, allow us to change those passwords on the fly with automation. And those are some things that we're we're keenly looking at to, try to be better along those lines.

Speaker 0: That's helpful to know. Thank you for digging a little bit deeper there. Now looking into the next year as well, what do you think the hardest thing you'll have to do will be?

Speaker 1: So as we talk to your you know, cybersecurity is not just about deploying a tool, you know, to secure yourselves. There is a very large, you know, people process technology piece to it, you know, working together. You know? And and the people side is very subjective. You know, that's where, coming in, you know, we still see a lot of social engineering, a lot of fishing.

You know? It's not something that, like I said, that you can just put a tool in place and and be fixed. So when you look at that and then you look at health care, which is an an area that, you know, we're also having to balance with, you know, patient safety and regulatory requirements, it it gives us, you know, a lot of work to do, I guess, is the best way to say it. So, you know, the next year, as I mentioned, we're gonna continue to work with with identity, but also looking at ways that, we can make sure that we're doing a good balance of of our, communications out to, staff and and and even our patients on, you know, how to keep themselves secure and how to keep our environment secure, while they're there, as well as continuing to look at our technologies and our processes, to make sure that, that they're going in the right direction. Cyber is really a very continuous, life cycle at the end of the day.

It's we don't get to go and put a tool in and then walk away and say, okay. The job's done. Let's move on to the next. So, the moment that tool goes in and gets configured, we're going right back and tweaking and adjusting, you know, as we learn new things. And, you know, a lot of that comes through, what we call cyber threat intelligence, working on that to, try to make sure that, the the tools and the processes that we have in place and the education that we're doing with the with our employees is the right stuff for our environment, and that we're, you know, protecting the right way.

So we utilize a lot of that intelligence information to help us make those decisions and, to, you know, move forward in the right way.

Speaker 0: That makes a lot of sense. And, you know, I appreciate you talking through everything that goes into, the process, not only technology, but how you wanna make sure that the processes are there and everyone understands the importance of following them because it it just makes such a big difference. And the the data you have too, I can imagine, you know, really helps you, keep track of all of these things in a way that you weren't able to in the past.

Speaker 1: Absolutely.

Speaker 0: Now, before we wrap up here, I wanna talk about growth too. Where do you see some of the best opportunities for organizational growth in the future?

Speaker 1: Yeah. So this one, you know, health care is expanding, you know, pretty rapidly right now, but it's it's expanding outside of the hospital walls. You know, yes, we're seeing we're seeing expansion hospitals too, but a lot of it is we're seeing new ambulatory clinics, we're seeing a lot of virtual health, we're seeing AI playing a role in in this as well, you know, bringing a lot more care direct to the patient even even in their home. And, that makes it, you know, it we don't have that footprint of, you know, within the hospital walls like we once did. And for cybersecurity, that makes it, a little bit harder because, you know, you don't have a set line, you know, that that you're looking at.

So as we go through and and we look at that, we we have to grow and and and adjust with them. And, in cybersecurity, we've gotta be able to be flexible to allow the the facility to grow as well. The other point that didn't point out there is, as I mentioned earlier, we're we're doing mergers and acquisitions. That helps accelerate this. You know, we're still seeing that fairly heavy in the health care industry right now.

But, from the cyber side, I look at our job as as making sure that as we do these, we're we're doing the right pieces to keep us secure, to allow the business to to do that organizational growth, and feel, you know, confident that we're that we're putting the right steps in place as we do those. We're doing the risk assessments on the sites and and bring everything up.

Speaker 0: That makes a lot of sense. And, you know, it it's cool to hear, especially the way that you can integrate into that whole growth process. And when you are bringing on new sites to new facilities, amidst some of the the larger m and a and the integration of those kind of things, What are some of the the challenges that arise or the things that you have to troubleshoot as you're trying to, you know, get everything up to speed so you're bringing, you know, the new facilities or organizations into the fold?

Speaker 1: Yeah. I would say, you know, health care is very, very keen on on people and relationships. And, I think that's one of the biggest things that you that you have to focus on, when you go when you go into these events. You have organizations that, you know, may have may have been there for for fifty years, you know, or or or more and you've got people that might have spent their careers there that they know their way of doing things and they might have ways of doing things better. You know, they might have ways of doing things that are different.

And it's looking at those, validating those and reviewing the risk and determining, you know, what the next step is. But, you know, at the end of the day, you know, there's a it's it's all people centric, you know, when you get into that. So, you know, like I said, it's very easy to to think, oh, I'll just go deploy a tool and and and get a score, but, that doesn't tell the whole story. So working, with with staff, working with, the the departments, it's not just I'm not just working with, with a IT department or or or security department. I'm working with with, you know, clinical departments, with financial departments, to make sure that we're there assisting them getting the right steps that they need, to really to get the next process going, you know, and make sure that they're doing it, you know, in in a right and secure way and that they understand what we're there for.

The, you know, the last thing I want is, to be looked at as as a barrier, you know, to what the business is trying to do. I want to be looked as a partner that, can come in and help, because when you're a barrier, people look to go around you, versus, when you're a partner, people will come to you and ask you how they can proceed to the next step and get and get around a barrier that's in front of them.

Speaker 0: I love that analogy. Greg, thank you so much for joining us on the podcast today. This has been such a a fun and informative conversation. I really appreciate your time, and I'm excited to see you as well at our annual meeting coming up in April. I know you'll be speaking on a panel and and definitely digging deeper into some of the things we talked about today, and so it'll be great to get your expertise and to see you in person.

Speaker 1: I'm I'm absolutely looking forward to it. Thank you for your time again today as well, and we appreciate this.