Latest / CareTalk: Healthcare. Unfiltered. / Change Breach & Healthcare's Cyber Threats w/ Greg Garcia

Transcript

Change Breach & Healthcare's Cyber Threats w/ Greg Garcia · CareTalk: Healthcare. Unfiltered.

• 0:00
  Change Healthcare, which processes 15 billion healthcare claims per year, was knocked out by a cyber attack in February.
• 0:07
  And it's still not back online.
• 0:09
  Providers aren't getting paid, prior authorizations aren't happening, and the Biden administration is stepping in.
• 0:15
  How vulnerable is healthcare to cyber attacks?
• 0:18
  And can anything be done?
• 0:27
  Welcome to Care Talk, America's home for incisive debate about healthcare business and policy.
• 0:32
  I'm David Williams, president of Health Business Group.
• 0:35
  And I'm John Driscoll, a senior advisor at Walgreens Health.
• 0:38
  Well, I'm pleased to welcome Greg Garcia.
• 0:40
  He's executive director at the Health Sector Coordinating Council Cybersecurity Working Group.
• 0:45
  And I hope everyone will join the ever-growing Care Talk community on LinkedIn, where you can dig deep into healthcare business and policy topics, access Care Talk content, and interact with the hosts and our guests.
• 0:57
  And please be sure to leave us a rating or review on Apple and Spotify while you're at it.
• 1:03
  And David, we are now the highest ranked Apple business healthcare podcast.
• 1:09
  Let's not mess that up.
• 1:10
  Thank you listeners.
• 1:12
  Greg, thank you for joining in and thanks for helping us unpack the change hack.
• 1:18
  Uh, it, uh, maybe first, I mean, we all know that change healthcare, or most of us know is one of the backbones.
• 1:27
  of defining eligibility, which is elemental to actually getting paid.
• 1:31
  You know, at Walgreens, we obviously got noticed it because change clears eligibility transactions for over 67,000 pharmacies in America.
• 1:42
  And actually I had one friend whose time sensitive neurosurgery was postponed because Mass General Hospital and David's home in the People's Republic of Massachusetts.
• 1:55
  couldn't determine whether she was covered by UnitedHealthcare.
• 2:00
  So this really was damaging and slowed down and put a lot of small providers, as well as individual patients at risk, but maybe step back and say, what happened?
• 2:12
  Yeah, thanks, John.
• 2:14
  And first of all, gentlemen, it's a privilege to be on this podcast, the Most Listened Health Care Podcast.
• 2:20
  And what happened?
• 2:22
  I mean, you...
• 2:24
  summarized, John, this is an existential threat.
• 2:28
  Cyber attacks on the healthcare system and the change healthcare event was the most palpable manifestation of the threat that we face across the healthcare industry.
• 2:41
  And the fact that a ransomware attack can get into a major healthcare infrastructure utility.
• 2:52
  which is change healthcare, locking it up and disabling the critical functions, the critical services that it provides to the health sector makes a direct line from cyber attack, cyber threats to patient safety.
• 3:09
  And one of the organizing principles of the health sector coordinate council is that cyber safety is patient safety.
• 3:15
  So this is a clear example of a major choke point that if disabled has a rippling cascading effect across the entire healthcare system.
• 3:27
  I guess when you knock out the backbone, it's like it's turned the system into a snake from something that could actually stand up as pretty significant.
• 3:35
  I mean, your metaphors are terrible.
• 3:37
  Thank you, Joe.
• 3:37
  It's not didn't affect the veterinary claims, right?
• 3:39
  John, but the, you know, but the impact, like this is far more than sort of like defacing a website and asking United to pay $5 million.
• 3:46
  I mean, what, what is John mentioned, you know, I think broadly and on a specific level.
• 3:51
  kind of some of the impacts, but you know, what was the initial impact and what is the impact that it's still having?
• 3:56
  Cause I actually talk to people outside of healthcare, they're not even aware of it.
• 3:59
  I mean, is this, it's like sort of one and done and it's over.
• 4:02
  I mean, what's the, what's the, not just ripple effect, but what's the long-term impact or medium term?
• 4:08
  Well, I mean, I think in the short term, can't get my prescriptions.
• 4:12
  If my pharmacy is using change healthcare, if I need to get some procedure and need to get that approved by the insurance company as a prior authorization, You're out of luck.
• 4:22
  If you're a hospital system, small clinic, if you're a doctor, you're a group practice, you might not get paid because the reimbursement function from Change Healthcare has been cut off.
• 4:38
  So this creates a solvency issue for for health providers that not only do the hospitals not get paid, but the doctors, the nurses, everyone else is not going to be paid when you go to a small provider and they say, boss, we have, we have two days of cashflow left.
• 4:56
  Okay.
• 4:56
  That that's forcing some very serious decisions about the short-term future of that organization.
• 5:04
  Over the, over the long-term, this really puts into start relief.
• 5:08
  As I've said earlier, what are, what are the broader.
• 5:13
  systemic vulnerabilities in the healthcare system that can be exploited, that would disrupt patient care on a massive scale.
• 5:26
  And we've seen this in sort of smaller regional areas where a major cyber attack, a ransomware attack on a Southern California health system.
• 5:39
  resulted in, for example, the diversion of ambulances that were headed to the hospital, but when the EMR goes down, when scheduling system goes down, when medical devices and patient records are no longer available, ambulance needs to be diverted to a hospital up the road and that hospital is not ready for the surge of patients coming in to its smaller facility.
• 6:08
  and patients are on gurneys in the hallway because they don't have enough bed space now for patients in need.
• 6:17
  So you have that kind of a rippling effect just within a region.
• 6:21
  So this is the kind of existential threat we have to really bear down with our government as industry and government working together to map out what is that.
• 6:35
  What is that healthcare critical infrastructure?
• 6:37
  What are the essential nodes, services, um, serving that infrastructure that we need to protect, particularly if there is no redundancy or low redundancy of those, of those systems.
• 6:52
  Of those utilities, uh, then, then we're in deep trouble.
• 6:56
  It's massive.
• 6:57
  I mean, you know, I've talked to hospitals that have had the revolutionary guards, the Iranian revolutionary guards actually.
• 7:04
  prying through their intellectual property so that they could then take that and sell that to other medical device manufacturers.
• 7:12
  I've talked to cancer hospitals that have had all of their scans locked up so it prevented any surgery the next day.
• 7:20
  They had to hire external NSA decoder packers to basically unpack their system.
• 7:28
  I talked to one hospital that did a real-time exercise and realized they had no paper.
• 7:34
  Or, uh, they had no ability to actually immediately go to physical documentation because they'd taken all the paper out of the hospital and they had removed that slush and so they, in a critical moment, if everything went down, the hospital would not, it would be severely impaired.
• 7:51
  So this is a, this is a, uh, you know, obviously a healthcare problem, but to Greg's point, it's a social problem because everything we unconsciously and consciously have transferred a lot of the ways we work to digital form that when they go down, stopped, impaired or stolen, really can destroy the underlying infrastructure.
• 8:16
  I think in healthcare, it's particularly dangerous because it directly affects patients' lives, like my friend who needs exploratory neurosurgery to determine whether she has got a very serious mass.
• 8:31
  growing and that's multiplied times thousands of people.
• 8:35
  And I think we're also, Greg, you should comment on this.
• 8:38
  This feels to me a little bit in the cyber world with North Korea, Iran, Russia, and China playing, equivalent to sort of what's happening in the Middle East where people use proxies to poke and probe, whether it's Houthis and drones or the Iranians through Hezbollah and Lebanon.
• 9:01
  to create a constant set of low-level conflict that doesn't actually turn into cyber war, but can transition to a fair amount of cyber pain that can affect us financially and physically.
• 9:15
  If you think about the exposures in the banking system and the healthcare system, I think we're in a totally new phase of international conflict.
• 9:23
  I don't know, Greg, whether you think that's overstating it.
• 9:27
  And not, not at all.
• 9:29
  It, you know, it was shortly before the, um, shortly before the, uh, change healthcare attack that also, uh, as you recall, AT&T suffered a major national connectivity outage for anyone using a cell phone, I was included in that several hours, um, of, of outage.
• 9:54
  You think, well, This can happen where we have nation states that are waging or probing for opportunities for cyber warfare.
• 10:08
  First, take out the telecommunication system, cause lack of connectivity, lack of communication, little bits of panic.
• 10:17
  Then take out major portions of the healthcare system, which will choke points like change healthcare.
• 10:24
  And then you have.
• 10:25
  cyber warfare, psychological warfare, critical infrastructure warfare.
• 10:29
  And there really are not good international norms yet that sort of like the Geneva Convention of War.
• 10:39
  We don't have that for cybersecurity.
• 10:43
  And so it is a little bit of a wild west and all major nations, major industrialized nations with good cybersecurity capabilities.
• 10:54
  are all doing it to each other, whether it's your basic spying or critical infrastructure probing and pinging.
• 11:05
  You know, the FBI director was in front of Congress a couple of weeks ago and talking about Chinese infiltration of critical infrastructure.
• 11:12
  And I think the focus that we heard on there were things like, you know, water, you know, electric utilities and that kind of thing.
• 11:18
  And I think that's what people think of with critical infrastructure.
• 11:21
  What you're pointing out with both the AT&T attack and then change healthcare is that critical infrastructure in an electronic world is actually a lot more than just the water, which of course is pretty fundamental.
• 11:32
  So if we talk about healthcare's role in that, what is it that makes healthcare a target?
• 11:39
  How is it different from just any other sector of the economy?
• 11:43
  Well, healthcare is critical infrastructure.
• 11:45
  There are 17 designated.
• 11:48
  government designated critical infrastructure sectors.
• 11:50
  You mentioned water and there's electricity and transportation and telecommunications, financial services.
• 11:59
  Health care is the care and sustaining of life.
• 12:05
  I can't think of any critical infrastructure more important than the care of life.
• 12:14
  And of course, water feeds into that.
• 12:15
  Can't do healthcare without water.
• 12:16
  Can't do healthcare without communications or electricity.
• 12:19
  Um, but, uh, you know, we are as designated as critical infrastructure, given a special, uh, status as a partner with the government.
• 12:31
  Even though we are regulated, we have this public private partnership, which is what the sector coordinating council does works with the government and with ourselves to identify.
• 12:42
  and mitigate systemic threats to the healthcare sector, not through regulation, but through creativity and resourcefulness and resiliency against evolving threats.
• 12:56
  So healthcare in and of itself is important, but then you think of healthcare as a function to sustain life of...
• 13:09
  first responders and other people that are important to running the government and running other critical infrastructures.
• 13:16
  If we don't have that system in place or it's, uh, or it is debilitated by some cyber attack, then healthcare ceases to become, um, a sustaining, uh, system for, for the, for the United States in the public.
• 13:32
  Hey, Greg, my sense is that, and it may be unfair that the banking system is held to a higher standard.
• 13:39
  of cyber protection, effectively digital hardening than healthcare.
• 13:46
  In your experience, you've worked in the federal government.
• 13:49
  Thank you for your service.
• 13:50
  You've worked in Bank of America.
• 13:52
  Can you please reduce my credit card late fees?
• 13:56
  And you're now pulling together organizations to help kind of protect us through a public-private partnership.
• 14:04
  But maybe you could level set on how...
• 14:09
  the financial system is set up to be protected versus health care.
• 14:16
  That's a really good point, John.
• 14:17
  So yes, the financial sector has traditionally been much more vigorously regulated in cybersecurity.
• 14:26
  And one of the areas I think that is telling here, the issue with the...
• 14:37
  a change healthcare attack.
• 14:38
  It was essentially a third party.
• 14:43
  Yes, United Health Group owns them, but it is a third party resource.
• 14:46
  Well, we don't have in the healthcare industry very rigorous standards or regulations about how, for example, a hospital can assess and attest to the security of their third party providers, whether it's a software company, a service provider.
• 15:06
  a medical device manufacturer.
• 15:09
  The financial services sector, in contrast, not only is required to assess their third parties, their third party service providers and technology providers, but they also need to have the attestation of their fourth party.
• 15:23
  So you got a service provider working for your bank.
• 15:27
  You need to know that service provider is also ensuring the security of their service providers.
• 15:35
  and their technology providers.
• 15:37
  So it's fourth party attestation.
• 15:40
  And that's an important piece.
• 15:41
  It is trying to build out a culture of security that supports the financial system in a way that won't lead to catastrophic meltdown of the global economy.
• 15:55
  You know, often what happens in hacks is there's either a breakdown of protocol around two factor authentication.
• 16:04
  It could be some low level tech person like Mark Zuckerberg making his password to Facebook password, which is actually true, that people just make mistakes or they don't follow protocol.
• 16:23
  But the critical thing in any system of security is having a closed hardened loop.
• 16:28
  And I feel like that is...
• 16:31
  better regulated and required in financial services than in healthcare.
• 16:36
  In healthcare, David, there are all kinds of access points because healthcare, both directly and indirectly through the infrastructure that supports it, where your scans go, how your eligibility is defined, who pays whom and how, are all points of potential digital access, digital failure, digital penetration.
• 17:01
  They're there.
• 17:02
  One is healthcare is porous where at least theoretically, Greg, clinic, the financial services is more of a closed loop.
• 17:09
  But I, I just, I don't, I don't know how we got there, but I think that's one of the reasons why it's not just change.
• 17:15
  It's Sancora.
• 17:16
  It's a whole, it's all these hospitals and physician systems that are getting, that are getting access because honestly, you knock over the easy targets as a criminal.
• 17:27
  Yeah.
• 17:28
  And you know, you're exactly right, John.
• 17:29
  We have this porous healthcare system.
• 17:33
  We have thousands of hospitals that are small, rural, critical access, urban, underserved.
• 17:39
  They are operating at zero to negative margins.
• 17:44
  Already heavily regulated where they have to meet all manner of conditions of participation to actually, you know, operate as a hospital.
• 17:55
  And we talk about, we know that they...
• 17:57
  fight administration will be coming out soon with more minimum mandatory controls on health systems.
• 18:05
  How are those smaller systems going to actually be able to comply if they have to make a decision between hiring a nurse or hiring an IT security person or outsourcing some managed security services?
• 18:18
  That becomes some very difficult trade-off decisions.
• 18:24
  So those regulations really can't happen without.
• 18:27
  some financial support from the administration.
• 18:30
  But again, it is a sort of a network system.
• 18:32
  There are the third parties.
• 18:34
  It is more than just the hospital system.
• 18:36
  You cannot always blame the victim.
• 18:39
  You have to look outside to other elements in the ecosystem.
• 18:44
  We are an interdependence, interconnected ecosystem in healthcare with plans and payers and health IT and medical devices, pharmaceuticals and the providers.
• 18:56
  And every hop along the way introduces a vulnerability.
• 18:59
  So we need to kind of look at this in a, in a holistic, comprehensive way, the way that the financial system has matured, you know, in 30 years ago, 20 years ago, uh, cyber attacks against the financial sector were rife because that's where the money is said Willie Horton.
• 19:17
  Well, now the money is against the health care system, easy money.
• 19:22
  And, um, we need to catch up.
• 19:24
  we need to catch up with the adversaries.
• 19:27
  So it sounds like on a change healthcare to me, seems like the sort of issue that you could remedy by following some of what's done in the banking industry.
• 19:35
  I mean, it is more of a, you know, it's electronic clearing house, you're paying money.
• 19:39
  Some of those same principles, you know, could apply.
• 19:42
  And it may be that the regulations on standards can be helpful there.
• 19:45
  When we get into hospitals, it is a little bit different.
• 19:49
  And I would argue that it is a little more complicated.
• 19:51
  So...
• 19:51
  If you think about hospital has both the regular sort of information technology, but then it also has these operational technology.
• 19:57
  So if you're an MRI machine and a variety of devices that are in there, that also can be hacked or harder to protect.
• 20:04
  And if I'm in a factory that has these sort of devices, I've got a fence around it.
• 20:08
  You have to have a badge to come in.
• 20:09
  There's armed security, et cetera.
• 20:11
  Now hospital people are coming and going, you know, all the time scheduled, unscheduled and the ambulance bringing somebody in.
• 20:16
  So what I wonder about is whether, you know, is it, is it hopeless to secure hospitals with these sort of environments.
• 20:24
  And we should just, you know, is that the case?
• 20:27
  Or what should we do about that?
• 20:29
  Because I think we can handle the change health cares of the world by emulating the financial services model, but I'm not sure we can do it with the physical sites of hospitals.
• 20:37
  No, it isn't.
• 20:39
  It isn't hopeless.
• 20:41
  And by the way, when are we going to stop crime?
• 20:43
  I mean, so crime is never going to stop.
• 20:45
  But there's still good, I can lock all my doors and windows in this house and they're still going to break it, right?
• 20:51
  But we do know that, I mean, for the hospital systems, a lot of the way, we did a study with the government, called it the landscape analysis.
• 20:59
  How are we getting beat?
• 21:00
  How are hospitals getting beat?
• 21:02
  What are the vulnerabilities that are most frequently exploited for a successful cyber attack?
• 21:07
  And it isn't complicated.
• 21:09
  There are some basic, there's three major things that happen most frequently.
• 21:14
  One of them is email phishing.
• 21:17
  Getting in through email because somebody has been tricked.
• 21:20
  Click on that link to open that attachment and in comes the attack.
• 21:28
  That's basic cyber hygiene.
• 21:30
  Secondly is vulnerabilities of devices and applications that are internet facing.
• 21:37
  Vulnerability hasn't been patched.
• 21:39
  Hacker is able to exploit that vulnerability, get into the hospital network and the third most frequent form of attack is third party, like change healthcare.
• 21:50
  And some of that is just not preventable.
• 21:53
  You remember SolarWinds?
• 21:55
  SolarWinds is a software program, a software utility that thousands of governments and companies use.
• 22:04
  The one update of a SolarWinds over the air, over the network update, pushed out to you, just like every Microsoft update, that software update was corrupted by a cyber attack.
• 22:17
  And with one mouse.
• 22:18
  that goes out to thousands of customers.
• 22:21
  Stoler wins was sending them a corrupted file.
• 22:25
  So one click thousands of corruptions.
• 22:28
  I want to, I want to just correct one thing.
• 22:31
  It was Willie Sutton, the bank robber who said that, uh, you know, you robbed banks.
• 22:36
  Oh, that's right.
• 22:37
  Well, who would I say Willie?
• 22:38
  And I think the Willie Sutton reference is actually really interesting because he famously at one point tried to rob a bank by going in the front door.
• 22:46
  I believe he was a postman or a policeman.
• 22:48
  someone noticed it and he was foiled.
• 22:50
  And then he had an accomplice actually ended up robbing the same bank later by going through the skylight.
• 22:55
  And that's kind of what we're doing in cyber, but I guess, it was a right perspective.
• 23:00
  There's a lot of stuff we can do to actually prevent this, but it's not just, you know, I just want to make, make clear this isn't just random criminals.
• 23:11
  A lot of the sophisticated hacks, but I believe change is going to play out that way.
• 23:16
  The, the whisper on it is it's.
• 23:18
  Black Cat, which is the name of a Russian state sponsored criminal organization that was involved with the Colonial Pipeline Hack, which if the people recall a few years ago, that caused a lot of damage and distress around the energy infrastructure in a big region in the country.
• 23:39
  The United States responded by directly confronting the Russians and taking down a couple of their institutions because we have the ability to respond.
• 23:48
  You know, as of changes in legislation and jurisdiction, we actually now, we now are, we, the United States are aggressively pursuing forward penetrations of foreign actors who are attacking us.
• 24:02
  This is an ongoing thing.
• 24:03
  And I really, I mean, there's a pretty significant possibility that if it was the Russian state sponsored actor it happened quickly after the United States responded to the Navalny murder with sanctions.
• 24:16
  This is going to be a call and response international problem that to your point, Greg, we're not going to get out of.
• 24:23
  So I think we have to kind of build some form of digital hardening.
• 24:29
  And maybe you could talk a little bit about the private public work you've done.
• 24:32
  You started, you worked in government in the cyber area, you've worked in banking, and now you're helping teach, collaborate, and connect a lot of the private actors in healthcare to...
• 24:45
  to leverage best practices to improve what's effectively, I think again, an ongoing low level war about money and I think international policy.
• 24:58
  Yeah, it's a great point, John, on that sort of international stage that you teed up.
• 25:06
  Yes, at some point, you know, that's this tip for tap that you were talking about.
• 25:12
  We need to have very clear rules about what is that red line.
• 25:16
  When does a cyber attack with kinetic impact, like colonial pipeline, when does that constitute an act of war?
• 25:30
  We're no longer, it's just cyber warfare.
• 25:32
  But when is it the same thing as dropping a bomb on another country?
• 25:36
  We don't have that yet.
• 25:37
  So for now, we've got this.
• 25:41
  uh, you know, sort of low level cyber warfare.
• 25:43
  But when you think about the health sector, we can, we are the victims of that.
• 25:49
  So how do we work with the government?
• 25:51
  As you asked, uh, to try, how do we protect ourselves knowing there's a limit to what the government can do is a limit what we can do.
• 25:59
  Um, so health sector council is here to try to bring together the cyber security working group is almost 150 organizations of industry and government from across the healthcare spectrum.
• 26:10
  As I mentioned earlier before, working together to identify and mitigate those threats and what we have done over the past five to six years is to develop a library of healthcare specific cybersecurity best practices, whether it's better cybersecurity hygiene in hospitals, whether it's how do we build security in a medical device is from the ground up.
• 26:32
  How do we do better incident response when something does happen?
• 26:37
  How about a checklist for operational continuity when, for example, University of Vermont health system back in 2022, they were off the grid for six weeks because of a ransomware attack, no email, no, no EMR, no scheduling.
• 26:53
  How did they maintain operational continuity patient care?
• 26:58
  Um, we've, we've produced publications on third party risk management supply chain, you know, how do you assess your your third parties.
• 27:07
  So a whole range of things and right down to a video training series for fiber security for the clinician.
• 27:13
  So it's not just the IT security person's job.
• 27:17
  Uh, the doctor, the nurse, um, the surgeon, they're touching patients and technology and data like it or not.
• 27:25
  They need to know what they should be doing and what they shouldn't be doing to help protect, uh, the data and systems, um, in the, uh, clinical environment.
• 27:35
  So.
• 27:35
  Um, these are, these are resources that we have developed, um, by the sector for the sector.
• 27:41
  I mean, who knows better than, than the chief information security officer, uh, whose job is on the line every day about how to better protect the data and systems.
• 27:50
  So we're bringing that to bear free resources for the rest of the sector.
• 27:54
  I'm still nervous, but David, any, any final question?
• 27:58
  Well, John, since we brought, you know, say, You know, if we got the Willys, I'll say, why don't we add with, uh, you know, we Willie Keeler, he said, uh, you know, hit them where they ain't and that's where, uh, it makes it easy hitting over 300.
• 28:08
  So I think some of the simple things that you're describing, Greg, you know, we, we hear about these sophisticated, everyone, when they get hit, they say, you know, sophisticated adversary, sophisticated attack, but sometimes it was just that they did the simple thing.
• 28:18
  So I think that there is the possibility of doing, uh, you know, some of you are more straightforward kind of cyber hygiene and we can get there.
• 28:26
  Well, I'll say.
• 28:27
  That's it for yet another episode of Care Talk.
• 28:29
  We've been talking today with Greg Garcia.
• 28:31
  He's executive director at the Health Sector Coordinating Council Cybersecurity Working Group.
• 28:35
  We've been talking about the Change Healthcare Attack and much more.
• 28:39
  I'm David Williams, president of Health Business Group.
• 28:41
  And I'm John Driscoll, senior advisor at Walgreens Health.
• 28:44
  If you like what you heard or you didn't, we hope you subscribe on your favorite service.
• 28:49
  And thanks, Greg, for helping us unpack the hack.
• 28:52
  Thank you very much.