Latest / Becker’s Healthcare Digital Health + Health IT / Sanjeev Sah, System Vice President of IT Strategy & Cyber Fusion Information Technology at CommonSpirit Health

Transcript

Sanjeev Sah, System Vice President of IT Strategy & Cyber Fusion Information Technology at CommonSpirit Health · Becker’s Healthcare Digital Health + Health IT

• 0:00
  - Welcome back to the Becker's Healthcare Podcast,
• 0:02
  devoted the people who power US healthcare.
• 0:04
  I'm Molly Gamble Becker's,
• 0:05
  and delighted to have you join us for another episode filled
• 0:08
  with Insights from healthcare leaders.
• 0:10
  Today we're spending some time with Sanjeev SA system,
• 0:13
  vice President of IT Strategy
• 0:15
  and Cyber Fusion Information Technology
• 0:17
  with Common Spirit Health.
• 0:19
  Sanjeev, welcome. Thanks for joining me today. How are you?
• 0:22
  And where does podcast find you?
• 0:25
  - Uh, I'm doing great. Uh, thank you for having me, Molly.
• 0:29
  Um, I'm really privileged
• 0:30
  and honored to be in conversation with Hugh,
• 0:33
  and I'm looking forward to any engaging dialogue
• 0:36
  on variety of different topics.
• 0:39
  - Likewise, me too. I'm excited to learn from you, Sanjeev.
• 0:42
  Uh, you know, to start off,
• 0:43
  I think most listeners are fully aware
• 0:46
  of Common Spirit Health.
• 0:47
  So my question for you to kick us off
• 0:50
  and just help us better appreciate your perspective in our
• 0:53
  conversation today, your role system,
• 0:55
  vice President IT strategy
• 0:57
  and Cyber Fusion information Technology.
• 1:00
  If you had to describe your work to me in, in simple terms,
• 1:03
  what would those terms be?
• 1:06
  - Yeah, um, sounds great, Molly.
• 1:08
  So, with Central Health's merger with Common Spirit,
• 1:12
  you know, I joined the Common Spirit family in my role
• 1:15
  as system vice president for IT strategy and cyber vigilance
• 1:20
  and defense, uh, also called Cyber Fusion.
• 1:24
  Uh, in this role, I truly have a fantastic opportunity
• 1:28
  to partner with my colleagues, uh, to make a true difference
• 1:32
  for patients, families,
• 1:35
  and communities by influencing both the technology
• 1:40
  and cyber strategy.
• 1:42
  Um, in this, uh, model, we are then able
• 1:47
  to maximize the value of technology, transform
• 1:52
  how care is delivered to patients,
• 1:55
  and enhance experience for our clinicians.
• 1:59
  Um, so with, um, a digital transformation initiatives
• 2:04
  that we have and, uh, workflow enhancements that we are able
• 2:08
  to create with this strategy
• 2:11
  or a combination of strategies, um, they create efficiency
• 2:16
  for our workforce, uh, for our clinicians
• 2:19
  and truly improve their satisfaction, um,
• 2:24
  ultimately helping us achieve the
• 2:27
  quadruple aim in healthcare.
• 2:29
  Uh, so this role is really exciting in that way
• 2:33
  that it brings together, uh,
• 2:36
  capabilities from technology people, um,
• 2:40
  and, uh, emerging, uh, technologies
• 2:43
  and capabilities in the marketplace to help us achieve
• 2:46
  that goal and outcome that we have. Mm-Hmm,
• 2:49
  - , that's a really helpful overview.
• 2:52
  And then more recently, you know,
• 2:54
  where are you spending most of your time
• 2:56
  and energy in your work these days?
• 2:59
  What's commanding your attention most?
• 3:02
  - Yeah, so like, uh, any, uh, new leader, uh,
• 3:05
  coming into a big family, uh, I'm spending my time
• 3:09
  and efforts in a couple of different ways.
• 3:11
  Um, one, it is just, uh, developing
• 3:14
  and building relationships, partnerships
• 3:16
  and setting priorities, uh, to do that.
• 3:20
  Um, you know, I'm, again, spending my time and energy
• 3:24
  and, um, uh, developing those partnerships
• 3:27
  with my colleagues both in IT
• 3:30
  and stakeholders across the enterprise, um, to, you know,
• 3:34
  build that collaboration, gaining valuable insights
• 3:38
  that they're able to share with me, uh,
• 3:41
  developing a comprehensive understanding,
• 3:43
  and then leveraging them for, you know, strategy as well as,
• 3:47
  uh, tactical perspectives.
• 3:50
  I think the second, uh, uh, thing I can highlight in terms
• 3:53
  of, uh, how I'm spending, uh, my time at,
• 3:57
  at the moment is, uh, looking
• 4:00
  after cybersecurity safeguards, controls,
• 4:03
  and their effectiveness.
• 4:05
  Uh, I have partnered with my colleagues, uh,
• 4:07
  in common spirit cyber technology teams
• 4:11
  and our external partners
• 4:13
  to gimme a really good understanding of the overall context,
• 4:18
  evaluate the current state, state of our cyber strategy
• 4:21
  and the capabilities, again in terms of people, process
• 4:25
  and technology, and then leverage that insight
• 4:28
  and understanding to develop immediate next steps, as well
• 4:32
  as developing roadmaps to further enhance our cyber posture.
• 4:37
  So, you know, in essence, um, it's about taking the time
• 4:41
  to learn, uh, taking, uh, the time to gain insights,
• 4:46
  and then turning those understanding
• 4:48
  and insights into, uh, what our immediate
• 4:52
  and long-term plans are.
• 4:55
  - You know, I I'm really glad you brought up cybersecurity
• 4:58
  because this is something that's been top of mind.
• 5:01
  I, I would say more than ever, as of late, the number
• 5:04
  of ransomware attacks in, in healthcare
• 5:06
  and healthcare settings was reached a high
• 5:10
  in 2023.
• 5:12
  When, when we talk about cybersecurity from your seat,
• 5:17
  what are some of the biggest considerations
• 5:18
  that we really need to keep in mind today about the nature
• 5:22
  of threats that health systems are facing?
• 5:25
  What do we need to be paying more attention
• 5:27
  to or more closely?
• 5:29
  And then what, if anything, Sanjeev is a distraction?
• 5:32
  What maybe is noise that can command attention
• 5:35
  but doesn't necessarily take us down productive paths?
• 5:39
  Where would you suggest that listeners keep their eyes?
• 5:42
  - Yeah, this is, um, a really time, uh,
• 5:46
  relevant, uh, question.
• 5:48
  Molly. You know, unfortunately,
• 5:50
  the US healthcare sector is reeling from cybersecurity
• 5:53
  threats, and it has for some time,
• 5:56
  and the exposures, um,
• 5:59
  at times have had some detrimental consequences.
• 6:03
  Uh, if we just look at the data, you know,
• 6:05
  hip hop breaches in 23 nearly doubled, um,
• 6:10
  since 2018.
• 6:12
  Um, in 2023 alone, uh,
• 6:16
  ransomware hit 140 plus hospitals, um,
• 6:21
  with, um, you know, ransom being demanded in many cases.
• 6:26
  Um, so if we are a healthcare provider, uh,
• 6:29
  a medical technology firm,
• 6:32
  or just an health IT company, um,
• 6:36
  we have a responsibility to address
• 6:41
  and take care of, um, uh, technology
• 6:45
  and technology assets as well as people, uh, uh, interacting
• 6:49
  and working, uh, with tools and technologies.
• 6:53
  So the couple of recommendations I would have in terms of,
• 6:56
  um, best practices would be
• 7:00
  monitor for cyber threats.
• 7:02
  Uh, really leveraging the threat intelligence
• 7:05
  to track new risks, uh, deploying, uh, detective
• 7:10
  and preventative tools to what's out for, uh,
• 7:13
  suspicious activity.
• 7:16
  Uh, and then really developing, uh, plans to be able
• 7:20
  to respond to them.
• 7:22
  Um, you know, if, if we identify vulnerabilities,
• 7:25
  um, remediating them.
• 7:27
  The second category of, uh, uh, advice would be, uh,
• 7:32
  managing cyber risk, uh,
• 7:34
  conducting comprehensive risk assessments regularly.
• 7:37
  Uh, this includes, uh, risks associated with third parties,
• 7:41
  uh, ensuring that, uh, security safeguards
• 7:45
  and controls are, uh, being leveraged in a way, uh,
• 7:50
  that is, uh, effective.
• 7:52
  Uh, and then really ensuring, um, that
• 7:57
  this process of safeguarding
• 8:00
  and ensuring safety is a regular, uh, inherent process.
• 8:05
  Um, and I think the third area, uh, of suggestion would be
• 8:08
  to just enhance response and recovery capabilities.
• 8:13
  You know, you never know when it's gonna come handy,
• 8:16
  and the best, uh, way to be prepared is to practice, um,
• 8:21
  documented plans, um, you know, ensuring
• 8:24
  that tabletop exercises take place.
• 8:28
  Uh, people have clear understanding of the roles
• 8:30
  that they would play and have clear communication channels.
• 8:36
  Uh, uh, maybe a, uh, a couple more in terms of,
• 8:39
  I highlighted effectiveness, right?
• 8:41
  Effecting effectiveness of cyber safeguards controls, um, in
• 8:46
  that, uh, it would be important to, um, measure,
• 8:51
  uh, their effectiveness, um,
• 8:53
  and then, uh, take steps to
• 8:57
  enhance effectiveness.
• 8:59
  Uh, what I really mean by that is, uh, let's say that, uh,
• 9:03
  we evaluate the security control
• 9:04
  and it is, um, you know, three fourths effective.
• 9:08
  We ought to place efforts to continue to, uh, um,
• 9:13
  enhance that and make it even better.
• 9:15
  And lastly, um, med tech security.
• 9:19
  These are, uh, devices that are used to, uh,
• 9:24
  provide care to patients, uh, ensuring that, um,
• 9:27
  these devices are safe to operate
• 9:30
  and have proper, uh, segmentation
• 9:34
  or security measures to, um, address relevant
• 9:38
  and related issues.
• 9:40
  I think the question about , what may be distracting,
• 9:43
  really, there's a lot going on, uh, in the industry from a
• 9:48
  cybersecurity threat and, um, threat
• 9:50
  and exposure perspectives.
• 9:53
  Uh, I think it's being, uh, you know, resolute
• 9:56
  and being very focused on ensuring that safe parts
• 9:59
  and controls are effective
• 10:01
  and that we continue to place our efforts to, uh,
• 10:05
  enhance their posture would be my, um, you know,
• 10:09
  set of recommendations for, um, all our stakeholders
• 10:13
  and all of our audience listening
• 10:16
  to our conversation today. Mm-Hmm.
• 10:18
  - looking further upstream.
• 10:20
  Y you know, as you were walking us
• 10:22
  through this jiva I was thinking through,
• 10:24
  there's information available to us
• 10:26
  that would suggest the nature of a lot of these attacks.
• 10:29
  They've, they've grown more cruel, right?
• 10:32
  You've children's hospitals affected large sums
• 10:35
  of money demanded from
• 10:37
  poor safety net hospitals within short windows of time, um,
• 10:41
  leaking of photos of patients.
• 10:44
  But you know what, I, I was curious if you had any thoughts
• 10:47
  about the nature of the risks, too.
• 10:49
  When we talk about managing risks, we, we have a sense from
• 10:52
  what we've seen about how these attacks,
• 10:54
  the way they're played out, has grown more malicious.
• 10:58
  Is there anything worth noting about the risks too?
• 11:00
  Are they, uh, tougher to detect? Are they more subtle?
• 11:05
  Are any trends there that you can share?
• 11:08
  - Yeah, so I think, um,
• 11:09
  and that's a really good insightful question,
• 11:12
  and it would be very helpful for, um, our audience
• 11:16
  to have a perspective on that as well.
• 11:18
  So if we think about risk, um, I like
• 11:20
  to think about in a couple of different ways.
• 11:22
  Um, one, um, that is, uh,
• 11:27
  operational disruption or service disruption, right?
• 11:31
  So no matter it's a cyber related event that causes
• 11:35
  that disruption or something else.
• 11:38
  I think that risk is
• 11:39
  what we have seen in our recent examples being very
• 11:43
  real in our industry.
• 11:45
  Uh, and then second, uh,
• 11:46
  I think you highlighted well in terms of, uh,
• 11:48
  protected health information
• 11:50
  or personally identifiable information.
• 11:53
  This something, uh, information
• 11:56
  and data we're entrusted with, uh, you know, data breach,
• 12:00
  uh, in itself is, is, is a major concern.
• 12:04
  And, uh, and the combination there were two, uh, do pose,
• 12:08
  um, exposure, uh, for organization from a variety
• 12:12
  of different perspectives.
• 12:13
  And so I will say, um, you know, just again, going back to
• 12:17
  what should we do about it, right?
• 12:19
  Uh, ensuring that we have good protections,
• 12:22
  that we have good monitoring in place, we have ability
• 12:25
  to respond, uh, when the event does occur.
• 12:29
  Uh, we have good communication protocol.
• 12:32
  So just enabling, um, yourselves with ourselves, with
• 12:37
  capabilities that gives us the best opportunity to prevent
• 12:41
  and protect, uh, and safeguard operations.
• 12:45
  - Right. Sanjeev, this is a really timely overview
• 12:48
  of cybersecurity, and it's a really helpful
• 12:51
  and healthy refresher.
• 12:53
  But before we, as we wind down here,
• 12:54
  before we close, I wanted to also just check in
• 12:56
  and see if there's an aspect of your work,
• 12:57
  and this may include cybersecurity
• 12:59
  or be outside of it, that, that recently really excited you.
• 13:03
  - Yeah. Um, this may sound cliche,
• 13:06
  but you know, what I'm really, um, excited about
• 13:10
  are the opportunities to serve in our mission
• 13:15
  of building healthy communities, by advocating for those
• 13:18
  who are poor and vulnerable, um,
• 13:21
  by innovating from technology and cyber perspectives.
• 13:25
  When we enhance how and where healing can happen.
• 13:30
  To me, it's a meaningful, uh, journey to be on.
• 13:35
  Um, along, uh, the same, um,
• 13:40
  way when it comes to cyber, um, uh, I'm engaged
• 13:45
  with, uh, and a member
• 13:47
  of the health sector coordinate coordinating council,
• 13:51
  cyber working group,
• 13:52
  and I serve as a member of the executive committee.
• 13:56
  Um, and this, uh, forum really
• 13:59
  is an exciting public private partnership, um,
• 14:03
  thus facilitated by HSCC, um, to then
• 14:08
  identify systematic cyber security threats
• 14:11
  to critical healthcare infrastructure, uh,
• 14:14
  collaborate on guidance and policies
• 14:16
  for mitigating those risks and promoting threat preparedness
• 14:20
  and incident response awareness
• 14:23
  and activities throughout the healthcare industry.
• 14:26
  So, uh, in the combination, uh, I'm truly really,
• 14:30
  uh, excited about
• 14:32
  and look forward to the work, uh,
• 14:35
  that we are currently doing and the work that we, um,
• 14:39
  and I can look forward to.
• 14:41
  Uh, so really exciting times for, for, for me
• 14:43
  and for my role and my, my, uh, opportunity to collaborate
• 14:48
  and work with my colleagues in the industry.
• 14:51
  - Mm-Hmm. , I mean, I think
• 14:53
  that response helps me better see that your role, it's, uh,
• 14:56
  not only about reducing and controlling harm and risk,
• 15:01
  but also about bringing net new value
• 15:04
  and creating more value
• 15:05
  for technology and reaching more people.
• 15:09
  - Yeah, absolutely. Yeah.
• 15:11
  Thank you so much for, for that question.
• 15:15
  - Well, Sanjeev, thank you for the chance to visit with you.
• 15:17
  Any final thoughts for our listeners in closing?
• 15:22
  - Yeah, I, I, first
• 15:23
  and foremost, I would, uh, I just want to thank you
• 15:25
  for the opportunity to share my thoughts with you
• 15:28
  and for your audience,
• 15:30
  and, you know, just thank you for having me.
• 15:33
  Um, I think the, the thought I would like to share
• 15:37
  for current context in the industry is really this, um,
• 15:42
  cybersecurity concern that we all have.
• 15:44
  Mm-Hmm. , it's a, it's a shared responsibility,
• 15:48
  and I would like to promote all of us to do our part.
• 15:52
  Um, and if anyone is interested in, uh,
• 15:56
  finding the right resources, uh, the
• 16:00
  hscc website, um, at
• 16:03
  health sector council.org, uh,
• 16:07
  can serve as a very helpful place
• 16:10
  to find just the right resources, uh, for, uh,
• 16:15
  anyone needing, um, guidance on cybersecurity matters.
• 16:20
  - Great. It's been my episode with Sanjeev SA system,
• 16:24
  vice President of IT Strategy
• 16:25
  and Cyber Fusion Information Technology
• 16:27
  with Common Spirit Health.
• 16:29
  Sanjeev, thank you so much for being my guest today.
• 16:31
  I hope we can catch up again soon
• 16:34
  and check in with you and your work.
• 16:36
  - Thank you. My pleasure, .