Dickon Smart-Gill, CIO and chief information security officer at managed security services provider Proficio in Carlsbad, Calif., shares the big cybersecurity threats he thinks hospitals need to be on the lookout for as well as how technology is keeping up with changes in cyberattacks.
Responses have been lightly edited for clarity and length.
Question: How does your background in hospital information technology inform your work as Proficio's CIO/CISO?
Dickon Smart-Gill: I've worked in healthcare IT for more than 20 years, most recently as CIO at Brumrungrad International Hospital in Southeast Asia, and I have seen firsthand the unique security challenges hospitals have. These challenges range from protecting patient health information to monitoring healthcare applications and devices to maintaining HIPAA compliance in the face of increasing cyber threats. From that experience, I know that a one-size-fits-all approach to cybersecurity simply doesn't work for hospitals. At Proficio, I have the opportunity to work with healthcare organizations to create custom cybersecurity programs that are tailored to each hospital's unique security environment.
Q: What do you see as the next big cybersecurity threat hospitals should look out for and why?
DSG: Unfortunately, in 2019, hospitals will need to continue to contend with a range of attacks, including ransomware, credential stuffing and insider threats. As healthcare organizations migrate their applications and infrastructure to the cloud, we can expect more cyberattacks from within public clouds and data breaches associated with cloud-based applications. Hospitals have large numbers of connected devices, including infusion pumps, CTs, MRIs, ultrasound scanners and patient bedside monitors as well as cameras and label printers. Monitoring these devices and ensuring they are not compromised has been a persistent issue for healthcare IT organizations. In 2019, the risk of patient harm from cyberattacks on medical devices will increase. In such a challenging environment, it is more important than ever for hospital IT teams to have a holistic way of managing their security posture and to identify and secure gaps immediately.
Q: What advice would you give hospital CISOs to get staff on the same page in the aftermath of a cyberattack?
DSG: The immediate aftermath of a breach discovery is a difficult and anxious time. Ideally, there is an incident response plan in place that is understood and documented to guide the team. It is important to quickly and methodically understand the scope of the attack and determine if the attacker is still actively exfiltrating data. The CISO must exert leadership and quickly bring together key team members and third parties. This team must maintain operational security. Once the breach is under control, the next step is prevention — hospital CISOs should discuss the attack and what can be done to prevent a future attack from occurring. By establishing protocols and a playbook in advance, it will be easier to get hospital staff on the same page and working together in the event of another attack.
Q: How is technology keeping up with changes in the healthcare landscape in terms of cybersecurity?
DSG: Between the increased use of mobile devices, hospitals' often limited expertise and personnel, potential exposure in medical devices, and the digitization of healthcare records, hospitals are challenged on many fronts to secure their environment and protect patients and their information. Luckily, many cybersecurity solutions have evolved at the pace of cyberattacks. We're now able to use threat intelligence to go beyond simply detecting indicators of an attack or compromise to proactively identifying gaps in security controls. We also can address malware attacks with automated alerts and incident response services. The hospitals that can harness these new innovations effectively, whether through an in-house team or the combined efforts of an in-house team and an external security operations center, will be better equipped to maintain the safety of theirs and their patient's data.
To learn more about clinical informatics and health IT, register for the Becker's Hospital Review 2nd Annual Health IT + Clinical Leadership Conference May 2-4, 2019 in Chicago. Click here to learn more and register.
To participate in future Becker's Q&As, contact Jackie Drees at jdrees@beckershealthcare.com.