Would you like to exchange best practices and ideas to improve care,
enhance operational efficiency,
and address financial challenges with your peers?
Becker's Healthcare is facilitating these conversations at their eighth annual
health, it digital health and R C M meeting.
You can check your eligibility for complimentary attendance at the link in the
description. We are excited to welcome you in October.
This is Laura Dedo with the Becker's Healthcare Podcast.
I'm thrilled today to be joined by Ani Santiago,
chief Information Security Officer at Christiana Care. Ani,
it's a pleasure to have you on the podcast today. Thanks.
For having me.
Now, I know we've got a lot to talk about.
There's so much happening within the healthcare space and information security
in general, but before we dive into my questions,
can you tell us a little bit more about yourself and your background?
Sure. Uh, so I, um, I have, I,
I'm the CISO at Christiana Care. Um,
Christiana is the largest health system in Delaware, um, also serving,
um, in New Jersey, Maryland, and Pennsylvania.
I had been there for eight years, a little over eight years.
Prior to that,
I spent 10 and a half years at Einstein Healthcare Network in North Philadelphia
as their information security and privacy officer. So, um,
little over, well,
almost 19 years of cybersecurity leadership, healthcare experience.
Amazing. Yeah. Wow,
that's a lot of time that you've spent in the healthcare industry and, you know,
from your perspective,
where do you see some of the big opportunities today in the headwinds that you
have your eye on?
Uh, so, so I think that, you know, there,
there are a lot of opportunities to really transform the way that healthcare's
delivered through technology. You know, over the years,
the industry has adapted electronic medical records,
medical devices, um, you know, after the pandemic, um,
many were pushed into, uh, telehealth. Um,
we're now looking at hospital at home initiatives and really, you know,
pushing care out to where the patients really wanna consume it,
which is closer to their home. And,
and I think that the opportunities there are to be able to really accomplish
these things through the, through innovative solutions and,
and technological solutions. Um, in terms of the headwind, uh,
certainly, uh, um, as,
as the proliferation of technology takes place in the healthcare
industry. So it does the expansion of the, uh,
threat landscape because, you know, each of,
of those components of technology carries cybersecurity risk with it.
And, and so as cybersecurity professionals, I,
I think where we're seeing the headwinds beyond just the traditional,
uh, threats, um, across industries is really in, um,
being able to secure devices, um, more,
more and more devices as they, you know,
as their usage and adoption increases in the industry.
Absolutely. I can imagine it's, uh, a lot to take in, especially as the,
as the information security officer to stay on top of all the different devices
that are coming through for medical, especially reasons, um, in,
in making sure that they're secure as well as the partnerships that you have
with the companies, um, whether it's vendors or, uh, device companies. So,
you know, as time time goes on and things evolve, how do you keep track of that?
How do you really make sure that the, um,
organizations you're working with and devices that you're using are as secure as
possible?
I mean, it, it, it, it takes a methodology. Um, and,
and so for us and consistency, some good prophecies and for us,
um, you know, no new technology or partnership that,
that our organization wants to adopt, um, all all of that technology,
I should say, goes through our security risk assessment process.
And so before we even engage in contracting,
the expectation is that our team is reaching out to the vendors,
um, assessing their security programs, uh, developing,
um, you know, documentation and, uh,
identification of risks that are then, um,
they're shared with me. Um,
and then I engage with the clinical leaders and business leaders and dialogue
around risk treatment options, risk management capabilities.
And once we agree on the overall risk management for any particular technology,
uh, then we move to contracting at which time we, um,
add a set of security contractual requirements that the vendors have to
adhere to. Um, and, and then we get agreement on,
on how they're going to employ security before we, you know,
before we execute the contracts and then deploy the technology.
So it's a rigorous process that that enables us to really, um,
identify, uh,
where we're introducing potential risk into the organization and how we're going
to manage those risks. Uh, and then, you know, from a,
from a team perspective,
our team has technology that we leverage, um,
to document all of this work and to manage the risks that we
ultimately agree, uh, agree on. So it's, you know, it's,
it's a life cycle. Um, it's incredibly time consuming,
but it really does add value to the overall conversation and to the healthcare
delivery system.
That's such a great point.
Thank you so much for going through that and really breaking down the process.
Now, given what we've been talking about on the information security side,
how do you think about growth and adding value to the organization?
I know that cybersecurity is so important,
information security is so important and changing on a daily basis. Um,
so from your perspective, what are you doing kind of constantly,
consistently to make sure that, you know, the,
the skills you bring to the table and, um,
the investments in health it are really adding value to the overall health
system?
I think that's a great question. I, I would say it,
it starts with really having a strong partnership with the
clinical and business leaders and really aligning the information security
program with the overall organizational strategies.
So it starts with dialoguing with our stakeholders,
understanding, you know, what, what, what are the areas where the,
where the organization wants to grow, how, what are the strategies for, for,
for that growths?
And then building an information security program that facilitates those,
those initiatives. So, um,
think about it less about building a security program
in a silo,
but more wrapping that security program around the overall
organizational strategy. And in that way, you know, our,
um,
our vision mission can be carried out with a
frictionless model that doesn't have security sort of getting in the way,
but actually carrying the overall organizational strategy.
I love that. I think that makes so much sense, you know,
and really is very intuitive when you're trying to, um,
that make sure that you're able to serve patients while you're able to keep
their information safe. You're able to, uh,
continue operationally running effectively without some of the challenges that
come, um, with a cybersecurity incident. So I,
I love that kind of way of looking at cybersecurity and,
and I information security as well. Um, you know, I,
I know in healthcare right now, cybersecurity obviously is very important and,
you know,
a lot of organizations would love to put a lot of resources towards that. Um,
you know, there's never too much security that you can have,
but right now a lot of hospitals and health systems too are experiencing a
challenging financial year, uh,
staffing shortages and inflation continues to make the budgets, you know,
challenging for right now. So from your perspective,
where do you see as it still being important to make investments within, uh,
cybersecurity con security and information security?
What is really important if you've got a limited resource pool.
You know, making sure that you're prioritizing the basics.
Cybersecurity can be very expensive,
but basic cyber hygiene is something that doesn't cost a lot of money.
And so I'm, I'm speaking in terms of vulnerability management,
uh, patch management, uh,
really having strong security operations, having, you know,
building a efficiency into your processes,
all of that actually can save money. Um,
in terms of, you know, the,
the limited budgets that I think we're all seeing across the industry, uh,
just underline the importance of really finding a balance between, uh,
care delivery, uh, and patient safety and cybersecurity.
And, and so everything, everything we do is about risk management.
It's about looking at the risk to the organization,
prioritizing where we want to focus our, our, you know, our budget and,
and our resources. And then ensuring that we're, you know,
constantly putting our best foot forward. Uh, that,
that doesn't change with constrained budgets.
So it's still really looking at where does the organization wanna move, um,
care delivery, and then what are the steps and,
and the investments that we need to make in order to advance that work.
And then dialoguing with our leadership to demonstrate, um, where,
where we have risk,
where we need to address risk and partnering with them on making decisions about
priorities and investments.
Got it. I love that. I think that makes a lot of sense, you know,
and indefinitely is helpful to think about and understand,
especially like you said, uh, having that good cyber hygiene really, um,
can make a big difference in your vulnerability levels.
So thank you so much for going through that. Now,
before we wrap up our conversation,
I'm wondering if you could talk about some of the best opportunities that you're
seeing for growth and development in the future,
both for yourself as well as the teams that you work with.
So we are, uh, uh,
Christiana Care is a very technology forward organization,
meaning we, um,
we really believe that through the digital means,
we will be able to transform patient care and, and deliver better care.
And so for, uh, from that perspective, we are doing, you know,
things like hospital at home where we are, you know,
admitting patients to their home as opposed to into a hospital room. Um,
and if you think about, uh,
if you've ever been in a hospital and you've visited somebody in a hospital, uh,
on average inside a patient's room, there's about 17 different,
um, medical devices that are attached to the patient or to the walls. Um,
we're delivering all of that now to a patient's home, um,
with the need to still, uh, secure all of that information.
So that, that's one area where I'm really focused. I think that, you know,
I agree with our organization's vision that this is the way to really improve
patient care and grow our capabilities by expanding beyond the Ford Walls.
Um,
and the opportunity there is that we still have to secure all of those devices.
I still need to do all that cyber hygiene that I referenced, um,
whether it's inside the hospital or in somebody's home. So for me,
the opportunities are really to be able to, um,
be a leader in the healthcare cybersecurity space by identifying the
architectures that are gonna be needed to do this kind of, you know, to, to,
to meet the kind, the new care delivery model that, that,
that I'm describing. It's not something that has been massively adapted.
So from a cybersecurity perspective,
there's still a lot of opportunity to be able to figure out how to do this and
do this well. And what's exciting for me in my role is that I get to do it.
I get to figure it out and hopefully, uh, hopefully, um,
be able to then deliver a security architecture that healthcare organizations of
the future, um, can, can adopt to, um,
meet these new care delivery models.
That's amazing. I I love that. What a,
a great time to be in healthcare and in such a fun and interesting challenge,
I'm sure. Honey, thank you so much for joining us on the podcast today, today.
This has been a really awesome discussion. I've learned a lot,
and I'm looking forward to meeting you in person as well at our Health IT
Digital Health and Revenue Cycle event in October,
where I know we'll just be able to continue this discussion, um, and,
and really talk about a lot more as well. Well.
It's been a true pleasure. Thank you for having me on this podcast,
and I too am looking forward to continuing the conversation this fall and
meeting you in person.
It's so important for leaders at the top of organizations to keep learning,
stay sharp, grow their networks,
help our audience better do this in a more simplified, personalized,
and meaningful way. Becker's Healthcare has launched my bhc,
it's your trusted Becker's healthcare experience and more with content,
connections, events and learning opportunities.
Join the community free of charge@www.my dot becker's hospital
review.com, and we'll see you there.