Latest / Becker’s Healthcare - Clinical Leadership Podcast / Anahi Santiago, Chief Information Security Officer at ChristianaCare

Transcript

Anahi Santiago, Chief Information Security Officer at ChristianaCare · Becker’s Healthcare - Clinical Leadership Podcast

• 0:00
  Would you like to exchange best practices and ideas to improve care,
• 0:03
  enhance operational efficiency,
• 0:05
  and address financial challenges with your peers?
• 0:08
  Becker's Healthcare is facilitating these conversations at their eighth annual
• 0:12
  health, it digital health and R C M meeting.
• 0:15
  You can check your eligibility for complimentary attendance at the link in the
• 0:19
  description. We are excited to welcome you in October.
• 0:22
  This is Laura Dedo with the Becker's Healthcare Podcast.
• 0:25
  I'm thrilled today to be joined by Ani Santiago,
• 0:28
  chief Information Security Officer at Christiana Care. Ani,
• 0:31
  it's a pleasure to have you on the podcast today. Thanks.
• 0:34
  For having me.
• 0:36
  Now, I know we've got a lot to talk about.
• 0:38
  There's so much happening within the healthcare space and information security
• 0:42
  in general, but before we dive into my questions,
• 0:44
  can you tell us a little bit more about yourself and your background?
• 0:48
  Sure. Uh, so I, um, I have, I,
• 0:52
  I'm the CISO at Christiana Care. Um,
• 0:55
  Christiana is the largest health system in Delaware, um, also serving,
• 1:01
  um, in New Jersey, Maryland, and Pennsylvania.
• 1:04
  I had been there for eight years, a little over eight years.
• 1:09
  Prior to that,
• 1:10
  I spent 10 and a half years at Einstein Healthcare Network in North Philadelphia
• 1:15
  as their information security and privacy officer. So, um,
• 1:19
  little over, well,
• 1:21
  almost 19 years of cybersecurity leadership, healthcare experience.
• 1:29
  Amazing. Yeah. Wow,
• 1:31
  that's a lot of time that you've spent in the healthcare industry and, you know,
• 1:34
  from your perspective,
• 1:36
  where do you see some of the big opportunities today in the headwinds that you
• 1:40
  have your eye on?
• 1:42
  Uh, so, so I think that, you know, there,
• 1:45
  there are a lot of opportunities to really transform the way that healthcare's
• 1:49
  delivered through technology. You know, over the years,
• 1:53
  the industry has adapted electronic medical records,
• 1:57
  medical devices, um, you know, after the pandemic, um,
• 2:01
  many were pushed into, uh, telehealth. Um,
• 2:05
  we're now looking at hospital at home initiatives and really, you know,
• 2:10
  pushing care out to where the patients really wanna consume it,
• 2:13
  which is closer to their home. And,
• 2:16
  and I think that the opportunities there are to be able to really accomplish
• 2:20
  these things through the, through innovative solutions and,
• 2:25
  and technological solutions. Um, in terms of the headwind, uh,
• 2:30
  certainly, uh, um, as,
• 2:32
  as the proliferation of technology takes place in the healthcare
• 2:38
  industry. So it does the expansion of the, uh,
• 2:41
  threat landscape because, you know, each of,
• 2:44
  of those components of technology carries cybersecurity risk with it.
• 2:50
  And, and so as cybersecurity professionals, I,
• 2:52
  I think where we're seeing the headwinds beyond just the traditional,
• 2:57
  uh, threats, um, across industries is really in, um,
• 3:02
  being able to secure devices, um, more,
• 3:07
  more and more devices as they, you know,
• 3:09
  as their usage and adoption increases in the industry.
• 3:14
  Absolutely. I can imagine it's, uh, a lot to take in, especially as the,
• 3:18
  as the information security officer to stay on top of all the different devices
• 3:22
  that are coming through for medical, especially reasons, um, in,
• 3:26
  in making sure that they're secure as well as the partnerships that you have
• 3:29
  with the companies, um, whether it's vendors or, uh, device companies. So,
• 3:34
  you know, as time time goes on and things evolve, how do you keep track of that?
• 3:39
  How do you really make sure that the, um,
• 3:41
  organizations you're working with and devices that you're using are as secure as
• 3:45
  possible?
• 3:47
  I mean, it, it, it, it takes a methodology. Um, and,
• 3:51
  and so for us and consistency, some good prophecies and for us,
• 3:57
  um, you know, no new technology or partnership that,
• 4:01
  that our organization wants to adopt, um, all all of that technology,
• 4:06
  I should say, goes through our security risk assessment process.
• 4:10
  And so before we even engage in contracting,
• 4:14
  the expectation is that our team is reaching out to the vendors,
• 4:19
  um, assessing their security programs, uh, developing,
• 4:24
  um, you know, documentation and, uh,
• 4:28
  identification of risks that are then, um,
• 4:33
  they're shared with me. Um,
• 4:35
  and then I engage with the clinical leaders and business leaders and dialogue
• 4:40
  around risk treatment options, risk management capabilities.
• 4:44
  And once we agree on the overall risk management for any particular technology,
• 4:50
  uh, then we move to contracting at which time we, um,
• 4:55
  add a set of security contractual requirements that the vendors have to
• 5:00
  adhere to. Um, and, and then we get agreement on,
• 5:04
  on how they're going to employ security before we, you know,
• 5:07
  before we execute the contracts and then deploy the technology.
• 5:11
  So it's a rigorous process that that enables us to really, um,
• 5:16
  identify, uh,
• 5:17
  where we're introducing potential risk into the organization and how we're going
• 5:21
  to manage those risks. Uh, and then, you know, from a,
• 5:25
  from a team perspective,
• 5:27
  our team has technology that we leverage, um,
• 5:31
  to document all of this work and to manage the risks that we
• 5:36
  ultimately agree, uh, agree on. So it's, you know, it's,
• 5:41
  it's a life cycle. Um, it's incredibly time consuming,
• 5:44
  but it really does add value to the overall conversation and to the healthcare
• 5:49
  delivery system.
• 5:51
  That's such a great point.
• 5:52
  Thank you so much for going through that and really breaking down the process.
• 5:56
  Now, given what we've been talking about on the information security side,
• 6:01
  how do you think about growth and adding value to the organization?
• 6:05
  I know that cybersecurity is so important,
• 6:08
  information security is so important and changing on a daily basis. Um,
• 6:13
  so from your perspective, what are you doing kind of constantly,
• 6:17
  consistently to make sure that, you know, the,
• 6:19
  the skills you bring to the table and, um,
• 6:22
  the investments in health it are really adding value to the overall health
• 6:26
  system?
• 6:28
  I think that's a great question. I, I would say it,
• 6:32
  it starts with really having a strong partnership with the
• 6:38
  clinical and business leaders and really aligning the information security
• 6:42
  program with the overall organizational strategies.
• 6:46
  So it starts with dialoguing with our stakeholders,
• 6:50
  understanding, you know, what, what, what are the areas where the,
• 6:54
  where the organization wants to grow, how, what are the strategies for, for,
• 6:59
  for that growths?
• 7:00
  And then building an information security program that facilitates those,
• 7:06
  those initiatives. So, um,
• 7:08
  think about it less about building a security program
• 7:13
  in a silo,
• 7:14
  but more wrapping that security program around the overall
• 7:19
  organizational strategy. And in that way, you know, our,
• 7:24
  um,
• 7:24
  our vision mission can be carried out with a
• 7:29
  frictionless model that doesn't have security sort of getting in the way,
• 7:34
  but actually carrying the overall organizational strategy.
• 7:40
  I love that. I think that makes so much sense, you know,
• 7:42
  and really is very intuitive when you're trying to, um,
• 7:45
  that make sure that you're able to serve patients while you're able to keep
• 7:49
  their information safe. You're able to, uh,
• 7:51
  continue operationally running effectively without some of the challenges that
• 7:55
  come, um, with a cybersecurity incident. So I,
• 7:59
  I love that kind of way of looking at cybersecurity and,
• 8:02
  and I information security as well. Um, you know, I,
• 8:06
  I know in healthcare right now, cybersecurity obviously is very important and,
• 8:10
  you know,
• 8:11
  a lot of organizations would love to put a lot of resources towards that. Um,
• 8:15
  you know, there's never too much security that you can have,
• 8:17
  but right now a lot of hospitals and health systems too are experiencing a
• 8:22
  challenging financial year, uh,
• 8:24
  staffing shortages and inflation continues to make the budgets, you know,
• 8:29
  challenging for right now. So from your perspective,
• 8:31
  where do you see as it still being important to make investments within, uh,
• 8:36
  cybersecurity con security and information security?
• 8:39
  What is really important if you've got a limited resource pool.
• 8:44
  You know, making sure that you're prioritizing the basics.
• 8:49
  Cybersecurity can be very expensive,
• 8:51
  but basic cyber hygiene is something that doesn't cost a lot of money.
• 8:56
  And so I'm, I'm speaking in terms of vulnerability management,
• 9:01
  uh, patch management, uh,
• 9:04
  really having strong security operations, having, you know,
• 9:09
  building a efficiency into your processes,
• 9:12
  all of that actually can save money. Um,
• 9:17
  in terms of, you know, the,
• 9:19
  the limited budgets that I think we're all seeing across the industry, uh,
• 9:24
  just underline the importance of really finding a balance between, uh,
• 9:29
  care delivery, uh, and patient safety and cybersecurity.
• 9:34
  And, and so everything, everything we do is about risk management.
• 9:38
  It's about looking at the risk to the organization,
• 9:41
  prioritizing where we want to focus our, our, you know, our budget and,
• 9:46
  and our resources. And then ensuring that we're, you know,
• 9:51
  constantly putting our best foot forward. Uh, that,
• 9:54
  that doesn't change with constrained budgets.
• 9:56
  So it's still really looking at where does the organization wanna move, um,
• 10:01
  care delivery, and then what are the steps and,
• 10:04
  and the investments that we need to make in order to advance that work.
• 10:09
  And then dialoguing with our leadership to demonstrate, um, where,
• 10:14
  where we have risk,
• 10:15
  where we need to address risk and partnering with them on making decisions about
• 10:19
  priorities and investments.
• 10:23
  Got it. I love that. I think that makes a lot of sense, you know,
• 10:25
  and indefinitely is helpful to think about and understand,
• 10:28
  especially like you said, uh, having that good cyber hygiene really, um,
• 10:33
  can make a big difference in your vulnerability levels.
• 10:36
  So thank you so much for going through that. Now,
• 10:39
  before we wrap up our conversation,
• 10:40
  I'm wondering if you could talk about some of the best opportunities that you're
• 10:43
  seeing for growth and development in the future,
• 10:45
  both for yourself as well as the teams that you work with.
• 10:49
  So we are, uh, uh,
• 10:51
  Christiana Care is a very technology forward organization,
• 10:55
  meaning we, um,
• 10:57
  we really believe that through the digital means,
• 11:01
  we will be able to transform patient care and, and deliver better care.
• 11:05
  And so for, uh, from that perspective, we are doing, you know,
• 11:09
  things like hospital at home where we are, you know,
• 11:13
  admitting patients to their home as opposed to into a hospital room. Um,
• 11:17
  and if you think about, uh,
• 11:20
  if you've ever been in a hospital and you've visited somebody in a hospital, uh,
• 11:24
  on average inside a patient's room, there's about 17 different,
• 11:29
  um, medical devices that are attached to the patient or to the walls. Um,
• 11:34
  we're delivering all of that now to a patient's home, um,
• 11:38
  with the need to still, uh, secure all of that information.
• 11:43
  So that, that's one area where I'm really focused. I think that, you know,
• 11:47
  I agree with our organization's vision that this is the way to really improve
• 11:52
  patient care and grow our capabilities by expanding beyond the Ford Walls.
• 11:57
  Um,
• 11:58
  and the opportunity there is that we still have to secure all of those devices.
• 12:02
  I still need to do all that cyber hygiene that I referenced, um,
• 12:06
  whether it's inside the hospital or in somebody's home. So for me,
• 12:10
  the opportunities are really to be able to, um,
• 12:13
  be a leader in the healthcare cybersecurity space by identifying the
• 12:18
  architectures that are gonna be needed to do this kind of, you know, to, to,
• 12:22
  to meet the kind, the new care delivery model that, that,
• 12:26
  that I'm describing. It's not something that has been massively adapted.
• 12:31
  So from a cybersecurity perspective,
• 12:33
  there's still a lot of opportunity to be able to figure out how to do this and
• 12:37
  do this well. And what's exciting for me in my role is that I get to do it.
• 12:41
  I get to figure it out and hopefully, uh, hopefully, um,
• 12:46
  be able to then deliver a security architecture that healthcare organizations of
• 12:51
  the future, um, can, can adopt to, um,
• 12:55
  meet these new care delivery models.
• 12:59
  That's amazing. I I love that. What a,
• 13:01
  a great time to be in healthcare and in such a fun and interesting challenge,
• 13:05
  I'm sure. Honey, thank you so much for joining us on the podcast today, today.
• 13:09
  This has been a really awesome discussion. I've learned a lot,
• 13:12
  and I'm looking forward to meeting you in person as well at our Health IT
• 13:15
  Digital Health and Revenue Cycle event in October,
• 13:18
  where I know we'll just be able to continue this discussion, um, and,
• 13:21
  and really talk about a lot more as well. Well.
• 13:24
  It's been a true pleasure. Thank you for having me on this podcast,
• 13:28
  and I too am looking forward to continuing the conversation this fall and
• 13:32
  meeting you in person.
• 13:37
  It's so important for leaders at the top of organizations to keep learning,
• 13:41
  stay sharp, grow their networks,
• 13:43
  help our audience better do this in a more simplified, personalized,
• 13:46
  and meaningful way. Becker's Healthcare has launched my bhc,
• 13:51
  it's your trusted Becker's healthcare experience and more with content,
• 13:54
  connections, events and learning opportunities.
• 13:57
  Join the community free of charge@www.my dot becker's hospital
• 14:01
  review.com, and we'll see you there.