As cyber-attacks and cyber disasters become more common, healthcare organizations are intensifying efforts to protect their systems and patients. One key figure in this battle is Hugo Lai, Chief Information Security Officer (CISO) at Temple Health in Philadelphia. Lai recently shared his perspectives on the current cybersecurity landscape in healthcare with Healthcare Innovation Editor-in-Chief Mark Hagland.
Key Issues in Cybersecurity
Lai highlights third-party risks as a significant concern. Referring to recent incidents like the Change Healthcare breach, he emphasizes the importance of evaluating how breaches can affect both upstream and downstream partners. For example, issues could arise with claims processing, electronic health record (EHR) vendors like Epic or Cerner, or medication services connected to Surescripts. Lai stresses the need for healthcare organizations to prepare for these scenarios by considering backup options and how to respond if a vendor partner becomes unavailable.
Adopting Advanced Cybersecurity Strategies
In terms of advanced cybersecurity practices, Lai confirms that his team is actively engaged in several key areas: auditing backups, behavioral monitoring, advanced network micro-segmentation, and utilizing security operations centers (SOCs). He believes that every organization should incorporate these strategies to improve their resilience against cyber incidents. Lai notes that effective execution of these practices enhances an organization’s ability to withstand attacks.
Challenges with Backup Audits
One critical area Lai addresses is backup auditing. Many organizations struggle with this due to a lack of visibility into their assets and incomplete business impact analyses. Proper auditing is essential for understanding what needs attention and for preparing alternate processes and equipment.
Network Micro-Segmentation
Lai also discusses network micro-segmentation, particularly around EHR systems. He acknowledges that while achieving full micro-segmentation across all systems might be challenging, organizations should start by identifying key areas to segment, such as EHRs, PACS systems, or endpoint workstations. Implementing segmentation selectively and strategically can provide additional protection, especially for IoT and medical devices.
Lai concludes that a strategic, tailored approach is crucial. Each organization must assess its own needs and vulnerabilities to determine the best starting points for implementing these cybersecurity measures.
