Latest / Becker’s Healthcare Digital Health + Health IT / Steven Ramirez, Chief Information Security Officer at Renown Health
Transcript
- 0:00Exciting things are happening at Becker's Healthcare. Stay
- 0:04ahead of industry trends with the new Becker's
- 0:06CFO plus Revenue Cycle podcast,
- 0:08your go to source for insights from top
- 0:11healthcare finance leaders. Tune in wherever you get
- 0:14your podcasts.
- 0:15And don't miss the tenth annual Health IT
- 0:18plus Digital Health plus RCM conference, happening September
- 0:2230 to 10/03/2025
- 0:24in Chicago.
- 0:25Join thousands of executives,
- 0:27engage with industry leaders, and explore the future
- 0:30of health care innovation.
- 0:32Learn more about our upcoming events at beckershospitalreview.com.
- 0:36See you there.
- 0:38This is Laura Dierda with the Becker's Healthcare
- 0:40podcast. I'm thrilled today to be joined by
- 0:42Steven Ramirez, chief information security and technology officer
- 0:46at Renown Health. Steven, it's a pleasure to
- 0:48have you on the podcast today.
- 0:50Good morning, Laura. Great to be with you.
- 0:53Now I'm excited to have you here because
- 0:54I know you've got a really wide, background
- 0:57in information technology, security, and a lot of
- 1:00things that you're doing at renowned are are
- 1:01really cutting edge in terms of how you're
- 1:03thinking about AI technology
- 1:05and keeping things,
- 1:07secure as well as transforming the health care
- 1:09and health care delivery system. And
- 1:12so I'm looking forward to learning more about
- 1:13what you're doing now and and how you're
- 1:14thinking about the future. But before we dive
- 1:17into that, can you tell us a little
- 1:18bit more about Renown and what makes it
- 1:19unique? Yeah. Definitely. So, again, good morning. I'm
- 1:23excited to be with you and, you know,
- 1:24share the journey that, we're partaking here at
- 1:27Renown. So,
- 1:29something really cool and something that we really
- 1:31kicked off end of last year going into
- 1:33this year was our CEO made a big
- 1:35focus on, you know, rebranding our mission, vision,
- 1:38and value statement. So what's unique about Renown
- 1:41is that we were actually the first hospital
- 1:43in Nevada,
- 1:44which was founded in 1864.
- 1:48Since then, you know, we've been serving, you
- 1:50know, the great community,
- 1:51of Northern Nevada, California,
- 1:54in that outreaching area. So we serve over
- 1:57a million people, and cover a hundred square,
- 2:00mile reach, just from what our services, you
- 2:03know, reach out to. We're the only regional
- 2:05level two trauma center. We have an affiliation
- 2:08with UNR. So really, you know, embracing that
- 2:10academic medicine and really looking to grow that
- 2:12partnership,
- 2:14from the clinical research side to really just,
- 2:16you know, help us grow our mission to
- 2:18serve the community.
- 2:20We've recently rolled out transplant, you know, and
- 2:22other specialties,
- 2:24so that people can just really have the
- 2:25care they need at home. So we're really
- 2:27excited,
- 2:28to what you touched on, to really see
- 2:30how tech can help enable that, across the
- 2:33organization. So, you know, we've done a lot
- 2:35of lot of cool things and we're really
- 2:37kicking off year one of our, strategic plan.
- 2:40So, you know, working closely with our CIO,
- 2:44and other executive leaders to really, you know,
- 2:46execute on that over the coming years.
- 2:51That's really great to hear. And, you know,
- 2:53cool to have that opportunity to be right
- 2:56on the forefront of this type of,
- 2:58digital transformation.
- 3:00Now when you look at the last year
- 3:01or so, can you tell us a little
- 3:03bit about what you're most proud of? What
- 3:05project initiative
- 3:06or or really the things that,
- 3:09had the most impact on the health system
- 3:11overall?
- 3:12Yeah. So I've been at Renown, just a
- 3:14little over three years now. So when we
- 3:16came in,
- 3:18it was really doing a big effort to,
- 3:20you know, just look at our technical landscape.
- 3:23I think we were spending a lot of
- 3:25money in areas that needed to have some
- 3:27refocus on. So I know under the direction
- 3:29of our CIO,
- 3:31and, you know, executive team, Really, we did
- 3:33a phased approach to stabilization.
- 3:36So really what was working well, what wasn't,
- 3:38you know, areas that we needed to focus
- 3:40on, you know, cybersecurity being a big focus
- 3:42of that as well as tech debt.
- 3:44I know a lot of health care organizations
- 3:46are really looking at how, you know, they
- 3:48can balance the cost to, you know,
- 3:51the digital transformation,
- 3:53in a meaningful way to have what we
- 3:55need to support, you know, the clinical growth
- 3:57in a lot of these cool tech, you
- 3:58know. AI is definitely a big buzzword on,
- 4:00you know, areas on that that, you know,
- 4:02we'll share more. So, you know, the stabilization,
- 4:05modernization,
- 4:06and then the optimization. So we really tried
- 4:08to
- 4:09adhere to those three pillars. So really the
- 4:12first few years was really looking at, you
- 4:14know, how can we stabilize things, you know.
- 4:16Do we have the right people process technology?
- 4:19And then where do we really need to
- 4:20strategically focus and modernize our infrastructure,
- 4:24as well as cybersecurity stack? And then obviously,
- 4:27optimization.
- 4:28Like, once we get that, it's, you know,
- 4:30that ongoing life cycle management. So
- 4:32as far as what I'm most proud of
- 4:34is that, you know, through that journey, you
- 4:36know, I originally started as our chief information
- 4:38security officer and then that evolved into being
- 4:41the CISO. So, the chief information security and
- 4:44technology officer. So,
- 4:46my CIO tasked me to go through and
- 4:48really, you know, take a deep dive with
- 4:50the team to look at everything holistically.
- 4:52So, you know, really proud of, you know,
- 4:54where we've come,
- 4:55over the past three years, you know, as
- 4:57an organization
- 4:58culturally.
- 4:59I mean, really coming up with our IT
- 5:01tactical and strategic plan to align really where
- 5:04our CIO wanted us to go as well
- 5:06as our executive team to, you know, better
- 5:08support the business. So I think a lot
- 5:10of the success to that was our governance
- 5:12strategy. So, again, when you're looking at a
- 5:15lot of, you know, investment opportunities, you need
- 5:17to really first hone in on your, you
- 5:19know, governance.
- 5:21So we set up a GRC, our governance
- 5:23risk and compliance
- 5:24committee, which is co chaired by me and
- 5:27my compliance officer and then have all of
- 5:28those key stakeholders across the organization. So we're
- 5:31able to look at all risk throughout the
- 5:34organization, which, you know, very, very important,
- 5:37and, you know, really tied into my CISO
- 5:39role. But also,
- 5:41you know, in working with our CIO, they
- 5:43he set up, you know, with his other
- 5:46partners on our president's council and SBAR process
- 5:49to really govern any net new technology and
- 5:52projects coming into our organization.
- 5:54So that really, you know, tied into third
- 5:56party risk management as well. So that, you
- 5:58know, we had different checks and balances for,
- 6:01you know, new tech we were gonna look
- 6:03at that would then, you know, work through
- 6:04our application rationalization,
- 6:07you know, going through our intake with our
- 6:09TMO, PMO office. So really making sure we
- 6:11had all the the right eyes on any
- 6:14net new technology,
- 6:16projects, etcetera,
- 6:17that to really ensure that success and making
- 6:19sure that, you know, we're able to,
- 6:21properly,
- 6:23you know, roll that out across the organization.
- 6:25So that governance strategy, you know, is,
- 6:28super critical to that,
- 6:29but also
- 6:31implementing and adhering to various
- 6:34frameworks. So, you know, really a subset of
- 6:37overall governance,
- 6:39that we're a NIST
- 6:41shop, NIST CSF. We just recently did our
- 6:43NIST
- 6:44CSF two point o.
- 6:47Obviously, do our HIPAA, and we're also,
- 6:50really starting to take a deeper dive into
- 6:52the I triple E,
- 6:53twenty nine thirty three for AI governance.
- 6:57So, again, that's where,
- 6:59why governance is so important because there's a
- 7:01lot of,
- 7:02my CIO will, you know, famously say shiny
- 7:05bright objects out there. So really making sure
- 7:07that, you know, we're we as an organization
- 7:09make sure that if there is a technology
- 7:11that makes sense to really supplement
- 7:13what we're doing, we're able to properly secure
- 7:15it or roll it out and support it,
- 7:19and then the business actually gets true value
- 7:21out of that. So,
- 7:22I think we've done a good job of,
- 7:24you know, using that from a governance and
- 7:26intake process to really make sure that we're
- 7:27getting the most bang for our buck for
- 7:30any proposed technology.
- 7:33That's really helpful to know. And I appreciate
- 7:35the deep dive into your governance strategy because
- 7:38I know that's something that health systems
- 7:40in general are are trying to stand up
- 7:42and figure out, especially as technology is rapidly
- 7:45evolving and and truly
- 7:47wanting to make sure that things are secure,
- 7:49but also not being left behind
- 7:52in the AI space and more. So, you
- 7:54know, this has been a a really helpful,
- 7:57understanding of what that process looks like for
- 7:59you. And I'm curious, as you mentioned, you
- 8:01know, elevating into the
- 8:03CStow role, I I know the team is
- 8:05being built up around you. What does that
- 8:07look like? How are you hoping to continue
- 8:09to evolve the team that you work with,
- 8:11your leadership team as well, to make sure
- 8:14that, you know, it's, prepared and ready to
- 8:17deliver on the transformation that's occurring?
- 8:20So yeah. No. That great question. So, again,
- 8:23my role, again, evolved just, you know, with
- 8:25the natural synergies between,
- 8:28cybersecurity
- 8:29and the technology space. So, again,
- 8:31we just had so much tech debt and
- 8:33a lot of just modernization
- 8:34efforts that we needed to go that it
- 8:36just made sense to combine,
- 8:38the technology
- 8:40group as well as security team. We had
- 8:42a lot of managed services,
- 8:44out there. So really looking at, you know,
- 8:46where we are today and where we wanted
- 8:47to go,
- 8:48with a security focus really made that helpful.
- 8:51And security really helped drive some modernization efforts
- 8:55on the infrastructure side. So, you know, really
- 8:57from the identity,
- 8:59two factor authentication,
- 9:01you know, driving more single sign on, and
- 9:03then looking at a lot more of these
- 9:05zero trust based tools to really enable, like,
- 9:08a
- 9:09on the go workforce.
- 9:10So,
- 9:11you know, typical VPN and solutions like that
- 9:14are a little clunky for our end users.
- 9:16So again, you know, looking at that holistically
- 9:19and seeing how we can better support our
- 9:21end users and making a big focus on,
- 9:24you know, the end user experience. You know,
- 9:26we're just really scratching the surface on that.
- 9:28So obviously, that that made a lot of
- 9:30sense. But again, as we're growing and kicking
- 9:32off our strategic plan and working with our
- 9:35CIO, it really made sense to help branch
- 9:38off my current role. So we're in the
- 9:40process of bringing on a new VP of,
- 9:45infrastructure,
- 9:46data center network,
- 9:48to really help really,
- 9:51take us on that journey over the next
- 9:52few years as part of our strategic plan
- 9:54because it's a little too much for one
- 9:56person. So a lot of what we're gonna
- 9:58focus on in kind of this IT reorg
- 10:00is gonna be, like, front end technology
- 10:03versus back end technology,
- 10:06and then really having those more focus points
- 10:08so we can better align and support the
- 10:10business on a lot of our modernization
- 10:12and and tech debt efforts across the organization.
- 10:15So,
- 10:16definitely can use the help on that and,
- 10:18you know, have an additional partner to really
- 10:20ensure the success of what we need to
- 10:22do, you know, sticking to that stabilization, modernization,
- 10:26and optimization to really help
- 10:29set ourselves up for the future on technologies
- 10:32like AI,
- 10:33etcetera. So
- 10:36No. It's helpful to know. Thank you so
- 10:38much, Steven, for digging a little bit deeper
- 10:40there. Now when you look into the future,
- 10:42the next twelve months or so, where do
- 10:43you see the big growth opportunities,
- 10:45for renowned and your team in general?
- 10:49So, you know, just starting on the the
- 10:50cybersecurity side, I think we've done a a
- 10:52great job, and I touched on that, you
- 10:54know, a little bit before that, the cybersecurity
- 10:57side helped drive some modernization
- 10:59efforts on
- 11:00the technology side. So, you know, I'm really
- 11:02proud of the cybersecurity program,
- 11:05that we built, the team that I have,
- 11:07and really where we're going. We're just kicking
- 11:09off our,
- 11:10three year road map. So,
- 11:13successfully completed phase one of that and now
- 11:15really getting into more of the, you know,
- 11:17fun maturity efforts associated with that. So we
- 11:20really started with, you know, articulating
- 11:22risk with the organization, and I think that
- 11:24helped drive the understanding and importance,
- 11:27and which in turn drove
- 11:29the investment. So we got a very big
- 11:31investment over the next three years. So now
- 11:33it's about delivering.
- 11:35And we took a very, you know, simplistic
- 11:36approach to, you know, we know ransomware is
- 11:39a problem. We know phishing is a problem.
- 11:41So what is the core fundamental reason on
- 11:43why organizations are at risk to that? And
- 11:46then how do we address that from people
- 11:48process and technology standpoint? So we put together
- 11:51a road map and, SBAR,
- 11:54that we then went up through our various,
- 11:56you know, governance process. Our CIO took that
- 11:59up to the board and executive
- 12:02team to really get the buy off on
- 12:03that. And, you know, that's really encompassing a
- 12:05lot of what we're doing.
- 12:07And, you know, really excited to really be
- 12:09focusing on identity, you know, really scratching the
- 12:12surface on that in our first initial plan
- 12:14that, you know, what makes up identity, getting
- 12:17those core fundamentals together that really set us
- 12:19up to then start to do these enhanced
- 12:22security
- 12:23practices of, like, zero trust,
- 12:26and,
- 12:28enhanced DLP,
- 12:29and other components to that as well as
- 12:32deception technology, different automations, and pieces like that.
- 12:35If you don't have the core framework,
- 12:38and foundation in place, it's really hard to,
- 12:40you know, be successful and do some of
- 12:42those,
- 12:43level up activities, you know, I'd like to
- 12:45call it. So really looking forward to doing
- 12:47a lot of that. And I think that
- 12:48all goes back to, you know, the ability
- 12:50to
- 12:51articulate risk. We have a great security culture
- 12:54across the organization that our team is very
- 12:56risk adverse. So I have, you know that
- 12:59makes my job very easy, and we're able
- 13:01to execute a lot quicker kind of having
- 13:03that dual role,
- 13:05of the c you know, CISO and CTO
- 13:07role. And I know we're gonna continue to
- 13:09build off of that momentum
- 13:11across across the board,
- 13:14and are really excited to see that. And
- 13:16also to,
- 13:18see how we, you know, again, use our
- 13:20frameworks like IEEE twenty nine thirty three for,
- 13:23you know, AI, bed device security,
- 13:27and really just to make sure that we're
- 13:28being risk agnostic
- 13:30to a lot of these things, doing the
- 13:32fundamentals very well. We have the organizational culture.
- 13:35And then, you know, with a lot of
- 13:36the geopolitical things going on, the importance of
- 13:38self governance that Renown and our executives are
- 13:42you know, we're full steam ahead on, you
- 13:44know, doing the right thing from a a
- 13:46cybersecurity and technology standpoint regardless of what's going
- 13:49on because, you know, our goal is to,
- 13:51you know, be successful, adhere to our mission,
- 13:54and really support our end users as we
- 13:56move forward. So,
- 13:57cybersecurity is a big focal point to that.
- 14:00And then, you know, obviously, having the technology,
- 14:03to really go where we need to to
- 14:05support a lot of these cool new clinical
- 14:07innovations across across the, board on that. So,
- 14:11we're really getting to the
- 14:13to the point, you know, from a cybersecurity
- 14:15perspective that, you know, I told my team
- 14:18that we don't wanna tell people our house
- 14:20is on fire. That's really have a strategy
- 14:22to put it out. So I like to
- 14:24say, like, our smoke detectors are alerting. So
- 14:27that's what a lot of cybersecurity shops, you
- 14:29know, will go through and we know something
- 14:30bad's happening.
- 14:32But how can we be more
- 14:34tactical at, you know, automating and getting things
- 14:37done like fire suppression, for example? Why can't
- 14:39we have we know something's going on, so
- 14:41let's put it out as quickly as possible
- 14:43and isolate it. And then have that incident
- 14:45response. It's like the firefighters showing up to
- 14:48that. And then, you know, if there's any
- 14:50kind of restoration efforts, do we have Servpro?
- 14:52How quickly can they be there and help
- 14:54us clean up components of that? So really
- 14:56hoping tell that story to the business and
- 14:58making sure again that we're able to not
- 15:00only know something's going on, but being able
- 15:02to react quickly. But that also translates into,
- 15:05you know, what a lot of what we've
- 15:06been talking about the importance of that close
- 15:09relationship with the technology
- 15:11enablement,
- 15:12to have, you know,
- 15:14a resilient
- 15:15infrastructure. So no single points of failure. We
- 15:17know, you know, inevitably technology fails and or
- 15:21you know, in the unfortunate event we have
- 15:23any kind of cybersecurity
- 15:25event that how quickly can we, you know,
- 15:27come back. So that's really been a big
- 15:29focus on, you know, how we architect
- 15:31and are building out,
- 15:33and investing in a lot of our core
- 15:35infrastructure for that modernization effort to really make
- 15:38sure that, you know, we're we're planning for
- 15:41any kind of risk that comes, you know,
- 15:43at us and really embedding that into our,
- 15:46go forward strategy.
- 15:51I appreciate,
- 15:52your insight here. And definitely, you know, it
- 15:54seems like a lot of opportunity to bring
- 15:57in new technologies, make sure they're safe. You
- 15:59have a a great playbook,
- 16:01in looking at those things and and then
- 16:03executing on them. You touched on this a
- 16:05little bit as some of the challenges,
- 16:07happening in geopolitical landscape as well as, you
- 16:10know, for for technology evolution. Could you dig
- 16:13a little bit deeper in there? What are
- 16:14are the biggest challenges, I guess, as you're
- 16:16looking ahead? What do you anticipate and and
- 16:19how are you preparing?
- 16:20Well, definitely, you know, geopolitical.
- 16:23So, you know, starting with the cybersecurity
- 16:26side of the house that, you know, there's
- 16:28a lot of effort on, you know, ending
- 16:30the conflict between Russia and Ukraine.
- 16:34So I actually saw some information yesterday on,
- 16:37you know, different threat intelligence that some of
- 16:39the threat actors are now using
- 16:41countries that are more western friendly like the
- 16:44Germany's and and others to really start to,
- 16:48spawn their attacks from there. So, like, our
- 16:50whole geofencing
- 16:51and, external blocking strategies have to really be
- 16:55a little bit more,
- 16:56strategic on,
- 16:58you know, people taking advantage of the the
- 17:01old ways to,
- 17:02you know, make sure that we're doing right
- 17:04by the organization and staying up on those,
- 17:06conflicts.
- 17:07As well as, you know,
- 17:09the HIPAA security rule, which is, you know,
- 17:11out there for, you know, comment, etcetera.
- 17:14With the new administration, what will that look
- 17:16like?
- 17:17As well as, you know, some funding changes
- 17:19that are are out there on Capitol Hill.
- 17:21So that's, you know, really why I touched
- 17:23on, you know, self governance that, you know,
- 17:25we have these industry frameworks that we're gonna
- 17:27adhere to regardless of that to really protect
- 17:31the mission and,
- 17:33really stick to the fundamentals on what we
- 17:35need to do,
- 17:36moving forward. So I think those will be
- 17:38some of the the biggest challenges as well
- 17:40as, you know, our continued dependence on third
- 17:43party partners,
- 17:45and fourth party partners.
- 17:47You know, Change Healthcare was the one that,
- 17:49you know, really burnt in our minds and
- 17:51memories on, you know, what can happen from
- 17:53that. So just how we better protect our
- 17:55organization on,
- 17:57looking at partnerships
- 17:59like that and then having backups to a
- 18:01lot of that. So I think that's gonna
- 18:02be the biggest challenges as well as just,
- 18:04you know, cost controls and, you know, making
- 18:07sure that we stay the course. Because, again,
- 18:10there's a ton of shiny bright objects and
- 18:11things that you need, you know, that are
- 18:13coming out and, you know, people are pitching
- 18:15that, you know, will fix burnout, will fix,
- 18:18you know, solve world hunger. But again, there's
- 18:20a lot of these pieces that you need
- 18:22to have foundationally in place from, you know,
- 18:24an infrastructure,
- 18:26security, and data,
- 18:28perspective, or you're never gonna be successful in
- 18:30using some of these more modernized
- 18:32technologies
- 18:33and kinda similar to what we did with
- 18:35security. We have to have those foundational elements
- 18:37in place,
- 18:39on the technology side, on the data side
- 18:41to then, you know, enable some of these
- 18:43cooler advanced technologies.
- 18:45So
- 18:46That's amazing to hear. You know? And certainly,
- 18:48fascinating to understand everything you have to keep
- 18:51your finger on the pulse on and learn
- 18:53about and know about,
- 18:55in your role as the, you know, chief
- 18:57information security as well as technology officer at
- 19:00Renown.
- 19:01Just fascinating.
- 19:02I'm curious before we wrap up here, what
- 19:04is the number one most important thing that
- 19:06you're doing right now to set up Renown
- 19:08for long term success?
- 19:10I think being risk agnostic, you know, which
- 19:13I spoke to, sticking to the fundamentals,
- 19:16having that organizational
- 19:18culture and buy in as well as self
- 19:20governance. So from an IT perspective, you know,
- 19:23doing what we say and and saying what
- 19:25we do, you know, so delivering and being
- 19:27good partners to the business.
- 19:29So I think those are really fundamental. And
- 19:32something that, you know, I'm really excited that
- 19:34we're kicking off this year is, you know,
- 19:35we always talk about the cybersecurity
- 19:37shortage,
- 19:38that we have, but we have the great
- 19:40opportunity
- 19:40with, you know, being partnered with,
- 19:43UNR,
- 19:45to kick off an internship for a pipeline
- 19:47with,
- 19:48cybersecurity
- 19:49talent that they have there. So,
- 19:51this is the first year that we're gonna
- 19:53start to have an internship
- 19:55program with, their cyber program over there.
- 19:58So really gonna see how that can not
- 20:00only benefit the up and coming talent,
- 20:03out there, but also benefit, you know, our
- 20:05team from a lot of what we're trying
- 20:07to do. So really building
- 20:09for the future on what we can do,
- 20:11with cybersecurity
- 20:12shortages and knowing that, you know, those kinds
- 20:14of risks aren't gonna go away anywhere. And
- 20:17again, you know, there's just so much going
- 20:19on to just really stay in touch with
- 20:21our business and our strategic plan to really
- 20:23give us that road map to making sure
- 20:26we're delivering,
- 20:27and not getting off track, on where we
- 20:29need to go as an organization.
- 20:33That makes a lot of sense. Steven, thank
- 20:35you so much for joining us on the
- 20:36podcast today. This has been a fascinating conversation,
- 20:38and I look forward to connecting with you
- 20:40again soon as well as seeing you at
- 20:42our health IT, digital health, and revenue cycle
- 20:44event in October. I know you'll be speaking,
- 20:46on cybersecurity, and I can imagine just continuing
- 20:49to follow this conversation and how the situation
- 20:51evolves. And so I'm really looking forward to
- 20:53that, and,
- 20:55thank you again for your time.
- 20:56Thank you.