Latest / Becker’s Healthcare Podcast / Steven Ramirez, Chief Information Security Officer at Renown Health

Transcript

Steven Ramirez, Chief Information Security Officer at Renown Health · Becker’s Healthcare Podcast

0:00
This is Laura Dirdo with the Becker's Healthcare
0:02
podcast.
0:03
I'm thrilled today to be joined by Steven
0:05
Ramirez, chief information security and tech officer for
0:08
Renown Health. Steven, it's a pleasure to have
0:09
you on the podcast today. Hey, Laura. Great
0:12
to be with you. Absolutely. Now I know
0:14
it's always fascinating to speak with you because
0:16
you've got such a great big picture and
0:18
and future focused view of technology, cybersecurity,
0:22
considering all the different things that are happening
0:24
in health care today,
0:25
AI, as well as government policy changes and
0:28
more. So, you know, I'm looking forward to
0:29
this conversation.
0:31
But before we begin, for those who are
0:33
just starting to listen to the Becker's Healthcare
0:35
podcast, can you introduce yourself and tell us
0:37
a little bit more about your background?
0:39
Yes.
0:40
Again, good to be with you. My name
0:41
is Steven Ramirez, and I'm the chief information
0:44
security and tech officer at Renown Health. I've
0:46
been there for almost four years.
0:49
Renown Health is up in Northern Nevada, so
0:52
it covers the Reno, Tahoe area. We're a
0:55
integrated health system,
0:57
four different locations and
0:59
fresh transplant center, you know, urgent care. We're
1:03
the area trauma center. So really a lot
1:05
of different service lines that we have that
1:07
are to serve our community and looking to
1:09
grow different components of that moving forward.
1:13
That's great to hear. And, you know,
1:15
I am excited to kinda talk to you
1:17
because I I think there's such a diverse
1:19
patient population that you serve and certainly a
1:22
lot of, key considerations in that when you
1:24
think about cybersecurity. So, can you give us
1:27
a little lay of the land? What's happening
1:29
right now? What are you is top of
1:30
mind for you, the opportunities and headwinds that
1:33
you have your eye on?
1:34
Well, there's a lot in cybersecurity.
1:36
I think that just, you know, AI is
1:38
continuing to be
1:40
a buzzword, but a lot more of that's,
1:42
coming to fruition that we saw
1:45
over the weekend that
1:47
there was news that the Chinese government did
1:49
the first ever AI autonomous attack on some
1:52
various interests.
1:54
So, you know, we've been talking for it
1:55
a long time to really say how is
1:58
AI gonna be used for the, you know,
1:59
good, bad, and the ugly. We finally saw
2:01
how threat actors can leverage it
2:05
to target various organizations. So that's something that
2:08
is we're continuing to look at our cybersecurity
2:10
posture, hygiene,
2:12
and emerging threats to really keep front and
2:14
center of mind that AI is only gonna
2:16
get more sophisticated
2:17
in tactics and techniques, but also
2:20
somebody that might not have a lot of
2:22
technical acumen is gonna be able to do
2:24
a lot more with getting up to speed
2:26
and becoming more sophisticated
2:27
just on AI being able to enable their
2:31
overall tech
2:32
ability that they used to not be able
2:34
to do, and really just help fast track
2:36
a lot of the attacks
2:37
from, you know, phishing to social engineering to,
2:40
you know, being able to do reconnaissance. You
2:42
know, before threat actors would look at your
2:44
organization for weeks, months, etcetera, they can learn
2:47
so much about the organization, you know, leadership,
2:50
players, service lines, partners, and all of that
2:52
in a click of a button or a
2:54
phrase. So that's really where
2:56
we're having to stay up to speed and,
2:58
you know, continue to evolve and make sure
3:00
that we're, you know, addressing these risks as
3:02
we move forward.
3:04
That makes a lot of sense and is,
3:05
you know, really fascinating to hear about,
3:08
the Chinese government that first ever autonomous attack
3:11
using AI.
3:12
When you look at AI, you know, within
3:14
the health care space,
3:16
in particular,
3:17
thinking through, you know, on the organization side,
3:20
what are some of the things that,
3:23
chief information security officers and just any leaders
3:25
within the health care space need to think
3:27
about and
3:29
and understand when it comes to AI, and
3:30
they're trying to look at their strategy, trying
3:32
to be safe, but
3:33
at the same time, wanting to be, you
3:34
know, on the forefront of the technology
3:37
in leveraging it to the best of their
3:38
capabilities.
3:39
So what do you really have to watch
3:41
out for if you're a leader,
3:43
of the health care system trying to figure
3:44
out, you know, what AI is gonna make
3:46
sense for you?
3:48
Well, it's really critical to,
3:50
have strong governance because
3:53
there's a lot of different AI
3:55
buzzwords and what is AI and not AI.
3:58
So it's like there's machine learning. There's,
4:01
you know, just using it for searching. There's
4:04
autonomous AI that use, you know, machine learning.
4:07
Like, there's there's different components that make up
4:10
AI. So it's like, you first need to
4:12
be educated on
4:14
what is and isn't AI,
4:16
how it's used in the organization or as
4:19
a subset of a variant of another
4:21
application and or system. But it's also important
4:24
to understand the build versus buy question as
4:27
part of this governance structure that you really
4:29
need to understand. Is this something that you
4:31
wanna go with a tried and true partner?
4:33
So like the Microsofts of the world, the
4:34
epics that, you know, have embedded and road
4:37
maps with AI versus, you know, thinking that
4:40
we're gonna try to build it, create a
4:42
lot of these components ourselves, that it's a
4:44
lot more
4:45
mean time to maturity,
4:47
easier to implement, easier to manage, easier to
4:50
secure if it's with one of your partners.
4:52
So that's really very important to that, but
4:55
also having strong data governance because, again, like
4:58
a lot of different tools, it's dependent on
5:00
data. If it's either,
5:02
you know, from a machine learning, you know,
5:04
looking at activities and components over time or
5:07
actually leveraging the data to make decisions, because
5:09
I know there's a lot of opportunity
5:11
on that on both sides of the house
5:13
on looking at, you know, those two different
5:15
types of AI. So it's again, that's the
5:17
importance of AI use cases, the
5:20
crawl, run, walk, and, you know, also doing
5:23
due diligence
5:24
to really make sure that you you are
5:26
protecting your organization from a data protection standpoint,
5:29
that there's a lot of different security tools
5:31
that we can leverage to make sure that
5:33
we're keeping everything in house, making sure that
5:35
data isn't being misused, and that we're really
5:38
just supporting the clinicians in the intended use.
5:41
Absolutely. A 100. I I think that's such
5:44
helpful advice and and really, great bullet points
5:46
to take back and understand and apply to,
5:49
your own organization.
5:51
Now I think when you look at the
5:52
future, you're thinking about growth, from an organizational
5:56
strategic standpoint. I know there's a lot of
5:57
initiatives out there,
5:59
trying to, you know, continue to expand access
6:02
to care and apply technology.
6:05
What does it look like for you when
6:06
you're thinking about growth and adding value to
6:08
the organization overall? What's important,
6:11
for you to do in a part to
6:12
your, executive team,
6:14
to make sure that on the cybersecurity side,
6:16
everything is in top shape?
6:18
It's important for us to make sure that
6:21
we're
6:22
aligning to the strategy and growth of the
6:25
organization
6:25
just because of how technology is enabled and
6:28
the digital front door that we're continuing
6:31
to grow,
6:32
optimize, and expand to really, you know, support
6:35
our patients is that that's just expanding your
6:38
risk
6:39
your risk profile,
6:40
and it's really just important that everybody understands
6:43
that when we're looking at various technology that,
6:46
you know, we're able to always use good
6:48
cybersecurity
6:49
hygiene,
6:50
good
6:51
good practices in place, and I think that
6:53
that all goes into the cybersecurity culture, just
6:56
the mindset. So it's really, again, important that
6:59
as a CISO of the organization
7:01
that we we have various committees. So it's
7:04
always important that we're, I always say, being
7:07
storytellers. So we need to understand about
7:10
educating people. Like, we had just spoke to
7:11
the first autonomous AI attack. You know, that's
7:14
gonna go out on being a blitz in,
7:16
you know, my governance risk and compliance, our
7:18
audit and compliance steering committee, our operational compliance
7:21
meetings, like, really helping say, guys, this is
7:23
a lot of what we've been focusing on,
7:25
building the foundation,
7:27
putting our investments and controls to help protect
7:29
about this.
7:31
So it's, again, building in that layered
7:33
approach to really just make sure that,
7:36
we're protecting
7:37
against today's threats and the threats of tomorrow
7:40
with how technology is just continuing to evolve.
7:44
So, again, being a good partner,
7:47
educating staff on what's going on in the
7:49
world because, again, they're looking at, you know,
7:51
headwinds and other strategic components on their side
7:54
of the house. So it's really just important
7:56
that if it's ingrained into people's DNA,
7:59
they know cybersecurity is an important pillar to
8:02
what we need to do as an organization,
8:03
that it just helps become naturally. So that's
8:06
just where, again, my role to help really
8:09
just spread the gospel, I like to say,
8:12
internally to really make sure that we're we're
8:14
partnering with our business, that they understand what
8:16
we're here to do, how we're here to
8:18
help, and then abound around the frameworks and
8:21
foundations that we're doing to make sure we're
8:22
securing the organization.
8:25
That makes a lot of sense, and it's
8:26
just really helpful to understand. I'm thinking from
8:29
that lens of,
8:31
being you know, setting up the governance, the
8:33
right committees,
8:34
compliance, and more. And, you know, from your
8:36
perspective, as you see the landscape changing with
8:39
AI and and just becoming more sophisticated
8:41
technologically,
8:42
is there anything that you have to do
8:44
differently,
8:45
with your teams or the the cybersecurity
8:48
and and IT folks working with you? You
8:50
know, are you looking for any skills, expertise,
8:52
or or something that, you know, you're more
8:54
often partnering with other organizations again to, you
8:57
know, make sure that you're in a great
8:59
place?
9:01
No. I think that's a great question that
9:03
I think
9:04
the hype of AI
9:06
really makes people think that we have to
9:08
change our approach.
9:11
But from cybersecurity
9:12
practice that if we focus on the fundamentals,
9:15
I've always said that, that it'll set us
9:18
up to
9:19
be successful in any net new technology, emerging
9:22
risk, etcetera. Because if you really think about
9:26
looking at phishing, social engineering, that's gonna, you
9:29
know, be some something that threat actors are
9:31
using,
9:32
you know, to try
9:33
to target our organizations. If you're thinking about
9:36
vulnerability management and patching,
9:38
that's gonna, you know, apply to AI and
9:41
technologies as well.
9:42
If you're talking about data governance and data
9:44
management, that applies to that as well. Data
9:47
loss prevention, that just becomes a little bit
9:49
more paramount on, you know, the fast pace
9:51
of data, it needing more data,
9:54
looking at monitoring and alerting. So if you
9:57
know, I can go on and on a
9:58
lot of about this access controls. But, again,
10:01
if we're doing a lot of that very
10:03
well,
10:04
can really mature in some of these key
10:06
areas, that it'll set us up for success
10:08
for, you know, how we wanna use AI,
10:11
how we can protect about
10:13
protect our organization from threat actors, but also
10:15
mishandling internally. So, again,
10:18
it's really sticking to those fundamentals will help
10:20
us grow,
10:22
holistically regardless of what technology is out there.
10:25
So it's it's really important to, you know,
10:28
just articulate that, make sure that your cybersecurity
10:31
strategy
10:32
is sound and more focused on
10:34
practices and principles than trying to nip off
10:37
every net new tech and or risk that
10:40
rolls around the corner.
10:42
Kind of like emergency management, I like to
10:44
have an all hazard approach that, you know,
10:46
we can't spend all day just thinking about,
10:48
you know, what if this, what if that.
10:50
It needs to just be like, we're gonna
10:52
focus on identity. Regardless of a type of
10:54
attack, we're gonna have, you know, alerting,
10:57
isolation,
10:59
etcetera,
11:00
associated with that. So, again, really, any cybersecurity
11:03
hygiene practice
11:04
approach can apply to technologies like AI and
11:07
and enable us to protect the organization
11:10
just organically,
11:12
if we're doing our jobs well.
11:14
That's a great philosophy and just fascinating to
11:17
think about having that true north and, you
11:20
know, finding a way that you can really,
11:22
stay grounded no matter what happens.
11:25
I'm curious too, you know, in looking at
11:26
the next year or so, I know a
11:28
lot of organizations are seeing some financial challenges,
11:32
potentially,
11:33
funding cuts and those kinds of things. And
11:35
so, you know, for those who may be
11:37
tightening the belt straps a little bit, what
11:38
is one risk or investment that's really still
11:41
worth making this year, especially given,
11:44
you know, how quickly things are changing the
11:46
technology as well as the cybersecurity space?
11:49
Well, governance is free. So I think that
11:52
it's always important. Strong governance goes a long
11:54
way within the organization,
11:56
being creative
11:58
in how you can attack different components. Like,
12:00
for example, we see, you know, a rise
12:03
in phishing,
12:05
you know, targeting various players. We've been invested
12:08
a lot in, you know, technologies, awareness, training,
12:11
etcetera, but have also just looked at blocking
12:13
certain
12:14
roles from having external email. So it's like,
12:17
that's a no low cost
12:19
concept. So I think that as we continue
12:23
to look at the headwinds and potentially needing
12:25
to, as you said, you know, look at
12:27
cost reductions, you know, staying flat from our
12:30
overall budgets, it's really important to think outside
12:33
of the box, do a lot of the
12:34
foundational elements, do those very well versus chasing
12:38
all the shiny bright objects within
12:40
IT. I think focusing on identity access managements
12:44
are the most critical component. I consider myself
12:47
an identity junkie that 80% of all cybersecurity
12:50
events and attacks stem from
12:53
an identity based attack. So if you think
12:56
about multifactor authentication, privileged access management,
13:00
identity governance, looking at, you know, into service
13:03
accounts, looking into more than just those components,
13:06
building a defense in-depth strategically
13:09
on
13:10
identity
13:11
will go a long way for organizations. So
13:13
I think any way that you can better
13:16
focus on identity access management versus people coming
13:19
and going from the organization,
13:21
that that's of the utmost importance. And then
13:23
having data in analytics
13:26
help drive decisions moving forward that I like
13:29
to use. The example of the movie Moneyball,
13:31
you know, that they had the strategic and
13:33
analytics guy that was going in to make,
13:35
you know, different decisions on that. That that
13:37
really having analytics, we've talked about it for
13:39
a long time. I think AI is where
13:42
that can help us look at things on
13:44
what's working well, you know, other areas that
13:46
we can focus on,
13:47
and really just help us drive and be
13:50
more tactical,
13:51
in this. And I think that, again,
13:54
yeah, just
13:55
will go a long way in a good
13:57
organizational culture as well because,
13:59
it takes everybody in the organization to be
14:02
successful.
14:03
And by having
14:04
your end users
14:06
fully trained, aware, and, you know,
14:09
drinking the Kool Aid on what we need
14:10
to do. I like to say that it's
14:12
really really goes a long way because there
14:14
are are some of our bigger risk items
14:17
we need to look at, but also our
14:18
first line of defense. So always leveraging them
14:21
to really help us fight our good fight,
14:23
for what we're doing at Renault.
14:26
Absolutely. I love that. And, you know, when
14:28
you speak about governance being so important and
14:30
actually, you know,
14:32
being
14:33
a no cost, way you can be preventative,
14:36
on some of the cybersecurity and attack fronts.
14:39
Is there anything unique that you do at
14:41
Renown that's worked particularly well and or, you
14:43
know, looking into next year, anything you're trying
14:45
to do a little bit differently to meet
14:47
the needs of the day?
14:48
Well, we're always trying to
14:50
we wanna not be Swiss cheese on our
14:52
intake process, so I think that building layers
14:55
to that's super important. So our
14:58
our president's council
15:00
team has final approval of a lot a
15:02
lot of the various projects that are coming
15:04
in. We have a phase gate process as
15:06
well. So that's a multifaceted group that has
15:09
finance,
15:10
IT,
15:12
legal, you know, various stakeholders throughout the organization
15:14
to look at different pieces. So that's, you
15:16
know, a good governance structure. We also have
15:19
an intake of doing cybersecurity
15:22
assessments,
15:23
AI assessments that we've rolled that out,
15:26
and looking at various subsets of that as
15:28
well. So I think that that's very important
15:30
to, you know, make sure a technology that's
15:32
coming in does or doesn't have AI capabilities
15:35
so that once you have it,
15:37
you're not dealing with the problem after the
15:39
fact. So getting that much information upfront and
15:42
then understanding how that tech's gonna work in
15:44
your ecosystem is part
15:46
of a onboarding and review session. So, again,
15:48
as you're saying, we have various layers, and
15:50
then, ultimately,
15:51
I sign off on our DocuSign process before
15:54
anything's purchased,
15:56
because then that's ensuring that we did do
15:58
a security review.
16:00
Again, that's a lot more work, but puts
16:02
the accountability on us to make sure that
16:04
we're actually reviewing,
16:07
looking at the cybersecurity
16:08
posture,
16:09
looking at any risk that some technologies might
16:11
be bringing into the organization.
16:13
But just again,
16:15
multiple committees seems like it can be tiresome,
16:17
but, you know, having different targeted components like
16:20
us having a governance risk and compliance that
16:22
we can speak more to compliance, privacy, and
16:24
security aspects, as well as data governance,
16:27
which is a key component to that. And
16:29
then having our, you know, committees on onboarding
16:32
and looking at new technology from a strategic
16:34
perspective, and then thinking about our audit and
16:36
compliance committee, and then thinking about our business
16:39
continuity and disaster recovery committee,
16:41
and then our emergency management committee. So it's
16:43
like we have so many various committees that
16:45
are centralized on, you know, driving their strategic
16:48
work streams, but there's always such a big
16:51
subset on data protection, cybersecurity,
16:53
and that that that enables us to make
16:56
sure that we have that seat at the
16:57
table and we're partnering with the organization to
17:00
really make sure that, you know, we have
17:01
an understanding of, you know, where we're going,
17:04
what we're currently doing, and being able to
17:06
have those discussions as needed.
17:09
That's so helpful to understand. Thank you for
17:11
digging a little bit deeper there. Now before
17:13
we wrap up, I'm curious, what do you
17:15
see as some of the best opportunities for
17:16
growth in the future?
17:19
Well, I think to what you said before,
17:21
I think that we're getting to a point
17:22
that technology and AI will be able to
17:25
help
17:26
push the envelope on
17:28
doing some, you know, maybe level one, level
17:30
two stuff. I think voice
17:33
calling and AI
17:34
is gonna be a huge opportunity for driving
17:36
costs down from a service desk perspective. Because
17:39
if you think about it, you know, we've
17:40
come a long way in just that evolution
17:42
of
17:43
calling
17:44
a service desk. You talk to the live
17:45
agent, then we've gone to, like, the IVR
17:48
perspective where you can press 1 for this
17:49
issue, press 2 for this, to now to
17:52
the point that we have autonomous AI that
17:54
you're seeing, like, with Alexa and Siri's, who's
17:57
probably gonna turn on as I say your
17:58
name. But really that conversational
18:01
component. That if you think about being able
18:03
to build knowledge base
18:05
for some of the key areas that we're
18:07
seeing in IT from, you know, reporting an
18:09
incident to I need my password reset to
18:12
how how do I do this, how do
18:13
I do that. There's some very high level
18:15
pieces that we could start to look at
18:17
building into that that can help drive down
18:19
the necessity of
18:21
having
18:22
a service desk fully staffed to that and
18:24
be able to scale up and down to,
18:26
you know, some more basic elements to that.
18:28
So I think that's where AI can do
18:30
that as well
18:32
as meeting and note taking and, you know,
18:34
research
18:35
and, you know, decision analytics, you know, once
18:38
we get to that point. So I think
18:39
that there's a lot of opportunity
18:41
just in the progression that we're seeing AI
18:44
and being able
18:45
to actually start to deliver in some of
18:47
these key areas, as well as I've seen,
18:49
you know, night and day
18:51
expansions and actual usability with on the clinical
18:54
side for how they're gonna be able to
18:56
use it to, you know,
18:58
help curb physician burnout that we've been talking
19:00
about forever more process optimization,
19:03
you know, real time
19:04
data analytic and,
19:06
you know, a lot of different opportunities to
19:08
that. So it's really exciting to be in
19:10
technology right now. Also, it's kind of scary,
19:13
on the cybersecurity side. But, again, that I
19:16
think this is a great time for us
19:17
to be able to leverage that, and that'll
19:19
challenge a lot of health systems
19:22
moving forward with us seeing some of these
19:24
headwinds on how we can better leverage that,
19:27
that technology to help us out, kind of
19:30
on curbing expenses of staffing.
19:33
Fantastic.
19:34
That you know, it seems like a really
19:36
great opportunity and something that I know a
19:38
lot of organizations would welcome the technology,
19:41
to do more of that on on the
19:42
call desk, especially, and then how else they
19:44
can leverage AI out in a smart and
19:46
meaningful way. Steven, thank you so much for
19:48
joining us on the podcast today. This has
19:50
been such a fascinating and informative conversation, and
19:53
I look forward to connecting with you again
19:54
soon.
19:55
Look forward to it. Thank you so much.