hey everyone welcome back to Tech Talk I'm Juliet Beauchamp I am here with Jason
James the CIO of net health today we're talking about healthcare security so be
sure to stick around all right JJ thank you so much for calling in really
appreciate it so you are the CIO of a net health could you tell us a little
bit first of all about what you do and then why healthcare security is so
important to your organization sure so I am CIO of Net Health. Net Health is
headquartered out of Pittsburgh I'm actually in Atlanta I live in Atlanta I
have teams throughout the United States we're in multiple states and we do
everything from wound care and patient care all the way through what's called
the post-acute continuum post-acute is everything outside the hospital so think
of visit assisted living rehab skilled nursing facilities and hospice so when
we deal with patient data we were dealing with patient data all the way
from the hospital to end-of-life care and so that affects millions of
Americans and so there's so much that goes into making sure that you're
obviously securing all of your patients data because the way that I think about
medical data is that it's not just your securing someone's browsing history or
not securing their passwords which are obviously important things to secure but
your securing their intimate personal medical records and there's obviously
regulations you have to follow like HIPAA but could you tell us why exactly
it's so important to secure this data and how you go about that
sure and so from from a legal or compliance perspective health care
organizations do fall with under a fall under HIPAA which outlines the the legal
ramifications of protecting patient data what makes a little bit different than
protecting credit card data is that the fines and penalties can be not only
monetary in in fines but also jail time and so none of us wants to go to jail
first of all so we definitely want to protect that data but we also have
a different kind of obligation we're protecting people's most valuable most
sensitive information from getting out in the hands of others that data can be
used for nefarious purposes and if you if you look at the ecosystem
if you look at the the world we live in right now unfortunately in the United
States has a massive opioid epidemic and as a result people are taking pain pills
there they're resorting to illegal means to get those pain pills and one way they
do it are through stolen health care records and so if you look at a 2018
study by Trustwave healthcare records fetch as much as $250 apiece
some kind of comparison your social security number on the dark web only
goes for about 10 to 25 cents and those records are so valuable on the dark web
is because someone through nefarious means could to take a prescription open
up a refill say it's a 90 day supply of painkillers go to South Dakota get that
filled move over to Louisiana get it filled move over to another stay and get
it filled those pills can sometimes go for 10 to 25 dollars a piece on the
black market and so what had been a 250 dollar record could easily equate to ten
thousand dollars of illegal drugs and so we have an obligation to not only stop
that criminal trade so to speak but also have a responsibility to try to stem the
opioid addiction in America by limiting what people can get access to and the
way healthcare providers actually secure that data is through multiple levels
you know we everything from data that it's encrypted at rest whether it be on
cloud storage or traditional hosting models using multiple layers of security
to protect everything from the web browser to data encryption at rest and
in flight to also restrict even the IT organization that has access
to those records even a CIO I don't have access into servers within our data
center there's no need for it and so we go by least neat right in terms of
privilege so if you look at privilege who needs it do they need it to do their
job how often do they need it and how is that audited you know if you look at a
lot of our product lines or a login capability takes up a lion's share of
our total storage because we need that granularity to say okay who looked at it
why did they look at it when did they look at it whether it's needed to you
know support a case with a department of justice or even to support claims
records sure that's really interesting I think it's obvious to me upon first
glance that if this is something that people would want that hackers would
want health care data but I think it's interesting we've talked before about
sort of health care as a hugely targeted vertical when it comes to attacks why
are people choosing the healthcare industry to attack over other more
traditional industry as anything else sure and give you some kind of insight
right according to McAfee ransomware attacks just on the healthcare sector
were up a hundred percent just in the first quarter of this year that has not
slowed down they're going after hospitals are going after small
providers for the simple fact is those records are number one so valuable if
they can get their hands in a ransomware attack the idea is to not necessarily
take that data but prevent those providers from getting to the data and
so if you look at ransomware attacks in the United States not only the United
States but elsewhere the idea is if you target healthcare if you target
utilities if you target cities they're more likely to respond because they have
to be up and online that makes total sense now I'm thinking about how instead
of you obviously are have all this data about your patients how are you if you
are are you ever using that data in-house to sort of help with patient
outcome or are you using any sort of program
that doesn't necessarily you still want to obviously keep that data secure but
you still want to be able to use that for your own help well part of it has to
be used for patient outcomes so if you look at a regulatory change they if you
look at a regulatory change that occurred earlier this year called PD
p.m. it was the largest regulatory change in post-acute in the last 20
years and part of that was not to just build by minute but bill by outcome and
so tools have to look at is the patient receiving the right amount of treatment
improving through that treatment it's not just about prescribing the number of
minutes and hoping there's an outcome but actually doing the work in order to
get a positive outcome for the patient that makes sense and I think it's also
something that it's you're not necessarily always thinking about it as
you're a patient that all of this data is being used for obviously good reason
you just think you're telling your doctor yeah my headache went away after
I took some ibuprofen no big deal so I want to maybe shift gears a little bit
still in the healthcare security realm obviously a really big story that Brooke
recently was Google's moved to work with Ascension which is I believe one of the
largest hospital providers in the United States I there's obviously some concern
about this because ascension basically handed over their patient's medical
records to Google and of course Google still has to be HIPAA compliant but I'm
curious your thoughts on how a huge company like Google which is sure used
to handling data but not necessarily medical data how might that be a
challenge for them well you know the good thing is Google has the means to
meet that challenge right yeah and let's just say I have no insider information
on that deal so there's nothing I could share this is just me as a technologist
observing the deal and so what Google's trying to do is also build some form of
barricade against the challenge of healthcare from Amazon
so Amazon there's a the last year the year before bought pill pack and pill
pack enables them to distribute medicine and healthcare to all patients the
United States there-there's no mistake that they want to move into that world
and so with Google looking at that data with Ascension it gives them the ability
to bring a I to bear in into those records and look at using artificial
intelligence to either look for outcomes either look for you know overlaps over
charge there's so much that could be brought to bear especially with those
number of records keep in mind it was a big surprise to everyone so much so that
the federal government is now looking at an investigation you know how they're
protecting it Google does claim that they do have the means and resources to
protect it you know they the part of their Google compute cloud is HIPAA
compliant I don't know where they're going to store this data I assumed it
would be there but with that is what you're going to see is the largest
players and the world will be moving into healthcare they are moving in the
healthcare whether it be Amazon or Google or even Microsoft solving the
healthcare problem in the United States is a trillion dollar industry right and
when I mean solving that there's so many problems within the industry and the
problems are how are patients getting care what other systems are being used
you know I went to the doctor last year and you know while a lot of things are
on electronic medical records they still have me fill out a lot of paperwork and
that's just something that you know can be solved that something companies are
solving that's something we as a company isn't that health or solving but other
organizations like the were are going to push into that industry because it's
such a large industry to disrupt and with it you know it's going to be
interesting to see how players are frankly what players are left at the end
of it absolutely I'm thinking from a patient perspective that for the most
part they didn't necessarily obviously they might have known that
their healthcare provider has their health care data but they might not
necessarily know that all of a sudden Google now has their health care data do
you think that patients should be concerned
should they be frustrated and how is how is essentially able to just give their
patients data to Google sure well within any healthcare organization their their
privacy documents you sign and I don't I don't know what those privacy documents
said for Ascension patients but you know I think a lot of patients were surprised
you know if you see the the sort of Twitterverse light up when the when the
news broke is that people they didn't know it was happening they weren't aware
it was happening with it I think is going to become quite a few challenges
from a legal perspective it's far from over I think when you do look at it you
know a syndrome was hoping and again I have no insider knowledge they were
hoping to use an industry leader like Google to bring about innovation and
disruption into the healthcare industry to provide better care for their
patients better analytics you know when you look at the use of AI it's not about
just speeding up outcomes or better pattern recognition but to look for
innovative ways you know it might be everything from and again this is purely
speculative but if you took that patient data and you also offset it with what
was happening in terms of weather patterns did you did they need more
walkers in place when temperatures dropped in the Northeast by 20 degrees
and if so did they have the right inventory in place did they move their
their logistics in into place you know when when temperatures rise in the
southeast by five degrees is there also any kind of in
Riis in mosquito-borne illnesses you know these are things that you need AI
to be able to determine and having such a large data footprint like a sentient
being brought to bear with AI leads to the potential of looking for outcomes
and looking for pattern recognitions in a way that had been very difficult to do
in the past sure so do you see this as a really
important step in using AI for much more patient many more patients treatment
plans it was AI on the up-and-up or is this just sort of the beginning it's
just sort of the beginning I think what we're gonna see are more and more health
care providers looking at AI to do everything from the analysis like I
spoke about to do everything from patient care if you look at you know
what can be done even in you know neonatal right what happens when you
know a child's temperature rises to degrees post-surgery and what's that
mean for infection avoidance or even long-term care and having that amount of
data will ultimately get us better care if you look at AI that can be brought to
bear even from an individual perspective like you know I'm wearing an Apple watch
right now you know the the latest generation has an ECG built-in that was
proven little government there's all these instances of people avoiding
massive heart attacks because their watch said your heart looks funny maybe
should get that checked out and they have and they've avoided you know
catastrophic heart attacks I think when you start looking at AI being brought to
the individual level it's not only about disease avoidance but improving
healthcare whether it be you know simply to say look you know we we noticed what
you're eating maybe you should not eat that and maybe should get up and walk a
little more you know since I've been sitting here my watch is tell these
people to stand up a couple times before I let you go JJ I just have one more
question for you as a CIO of a healthcare organization I'm curious how
you and your they are trying to strike a balance
between being innovative working hard to use technology to improve patient
treatment patient outcomes but also maintaining the highest level of
security over that sensitive data how do you reconcile the two you know first and
foremost security is paramount with that we also have to strike that balance of
delivering solutions for people you know if you look at the security issue not
only in healthcare but other industries history is a people problem and so we
have to do a better job as an industry of educating our people at net health
what we've done is we've taken a very hands-on security reports into me and so
we do everything from our own simulated phishing attacks to educate our
workforce and you know reduce the risk of these issues happening because if you
take email into consideration no organizational block single but all
these security threats we talked about they all come in free email right and so
you know if you're in if you're an IT organization and you're running office
365 you should probably make sure you're subscribing to office 365 advanced
threat protection that the highest here right and making sure you're looking at
you know the threats that are coming in through look into a like proof point and
know before and train your users on how to spot phishing and how to spot you
know other threats and so it has to be taking them holistically so when you
look at these challenges it's it's more than just tools you know it's it's like
the ultimate goal of IT is people process technology in that order and in
order to maintain a level of performance and security we start first and foremost
with the people they're our most important asset but they're also within
a organization our largest risk and so we have to make sure they're aware of
what's happening everything from changes in the environments like how to spot
cryptocurrency to how to avoid phishing attacks - how to look for
ransomware and how to best protect not only corporate data but their own
personal data and so as a as an industry we've got to solve these issues by
focusing first and foremost on our people great thank you so much JJ I
really appreciate it here learned a lot and I guess we'll be seen in the coming
days coming weeks months honestly probably years how this Google ascension
deal works out so I'll be keeping it in mind end this conversation mind I really
appreciate it thank you thank you sir today thank you and thank you all for
watching this episode of tech talk if you liked this video be sure to give it
a thumbs up and subscribe to our channel we will be happy to answer any questions
that you have in the comments so be sure to leave one and I'll see you next time