Latest / StartUp Health NOW Podcast / Cybersecurity: How Startups Can Stay Secure as Healthcare Ransomware Attacks Skyrocket

Transcript

Cybersecurity: How Startups Can Stay Secure as Healthcare Ransomware Attacks Skyrocket · StartUp Health NOW Podcast

• 0:00
  Healthcare is the most targeted industry by cyber attackers, so the, the threats are, are real and, and they are growing.
• 0:09
  And we've seen, uh, unfortunately quite a number of successful attacks on healthcare over the past several years.
• 0:18
  And, and the rate of those attacks has been growing, uh, especially as we've had an increase in the number of solutions that are being, uh, really helpful-- helping in many, many ways the healthcare industry to deliver better and more effective, uh, and more cost-effective patient care.
• 0:36
  [upbeat music] Welcome to Startup Health NOW, the podcast where we celebrate the entrepreneurs and innovators who are transforming health. I'm your host, Logan Plaster.
• 0:46
  According to multiple news sources, cyber attacks surged in twenty twenty-two.
• 0:51
  That doesn't necessarily surprise me, but what did surprise me was learning that healthcare was the most targeted sector in the market for cyber attacks.
• 1:00
  Turns out patient records have a high resale value, and ransomware attacks on hospitals can be quite profitable.
• 1:07
  This increase in cyber attacks coincides with waves of new companies making data more accessible to patients.
• 1:13
  So on one hand, you've got a groundswell of startups fighting the good fight of leveraging patient data and new technology to improve lives.
• 1:21
  On the other hand, we have an increasingly aggressive and sophisticated network of cyber criminals who are constantly a threat to our healthcare system and ultimately patient lives.
• 1:30
  Bridging these two worlds is my guest today, Steve Cagle, CEO at Clearwater. Here's how he explains Clearwater. Clearwater, we're a healthcare-focused cybersecurity, privacy, and compliance solutions firm.
• 1:44
  In this episode, Steve helps us understand the magnitude of the cybersecurity threat in healthcare, but more importantly, gives us practical strategies that founders can employ in order to keep patient data safe and keep their company compliant with current regs.
• 1:59
  Steve also explains how by making a few smart moves, a startup can turn cybersecurity from a business threat to a competitive advantage, particularly as they pitch to wary health systems and payers. Stick around.
• 2:13
  [upbeat music] Steve, great to have you on the podcast. Uh, nice to have this follow-up since you and I got to talk at HLTH in Las Vegas.
• 2:23
  This is a chance for us to kinda dive a little deeper than we were able to do in that short interview. Let's start by understanding the magnitude of the problem of cyber threats in healthcare.
• 2:32
  I think it's something that many of the entrepreneurs in our portfolio don't give a ton of time to because they just have a lot that they're thinking about.
• 2:42
  And so to really level set on how big of an issue this is, how often are we seeing credible threats and ransomware attacks in healthcare today?
• 2:52
  Well, healthcare is the most targeted industry by cyber attackers, so the, the threats are, are real and, and they are growing.
• 3:02
  And we've seen, uh, unfortunately quite a number of successful attacks on healthcare over the past several years.
• 3:10
  And, and the rate of those attacks has been growing, uh, especially as we've had an increase in the number of solutions that are being, uh, really helpful-- helping in many, many ways the healthcare industry to deliver better and more effective, uh, and more cost-effective patient care.
• 3:27
  But with all that, uh, new technology that's been adopted, uh, unfortunately, that's created significant risks as well- Mm.... uh, creating data at a, a massive, uh, rate.
• 3:39
  And that data, uh, that's very sensitive data, electronic protected health information and other sensitive data, it's being shared with more third parties, more partners, more affiliates, uh, and, and at a much faster rate again than ever before.
• 3:54
  So, uh, you know, healthcare has, uh, extremely valuable information. It's, uh, very personal.
• 4:01
  It's, it's very, uh, very valuable in the fact that it can be used for things like not only identity theft but also insurance fraud. Mm.
• 4:10
  It can be used to, uh, potentially acquire, uh, prescription medication that can be sold, uh, illegally on the black market. So- Yeah...
• 4:20
  all this, yeah, all this is creating a, you know, a very, uh, difficult situation and, and certainly one that is becoming extremely important for any organization that is serving, uh, the healthcare industry or serving patients.
• 4:33
  I, I wanna clarify one thing that you said which surprised me. You said there are more cyber attacks coming into healthcare as an industry than any other industry? That's correct.
• 4:43
  Uh, the FBI came out last year and, uh, specifically around ransomware and, uh, looking at all the ransomware attacks a-against critical infrastructure and, uh, found that, uh, the majority of, uh, of cyber attacks, uh, or at least more than any other industry are being targeted at healthcare.
• 5:01
  So, you know, if you think about the, um, uh, result of a ransomware attack, for example, on a, on a hospital or, or on a, a provider of healthcare services, it, it can be a very, very impactful event that can, uh, heavily impact, uh, patients.
• 5:20
  So patients are not able to, uh, you know, get emergency care. In some cases, there, there have been ambulances that have been diverted from emergency rooms.
• 5:28
  Uh, there's been, uh, a delay- Wait, Steve, sorry, but unpack that for me a s-- in a second just so people can understand the real world, uh, implications of a ransomware attack.
• 5:38
  I think it can, it can feel very abstract. So how do you connect the dots between a cyber attack and, like, not being able to get the ambulance that you need? Yeah, that's a great point.
• 5:47
  So, you know, during a ransomware attack, uh, you know, the objective of, of the attacker is to, uh, make the systems, uh, that are, you know, being used by the target, uh, unavailable, right?
• 6:01
  So that's their first primary target.
• 6:04
  Uh, a second, uh, objective, excuse me, a secondary objective would be to gain access to...Uh, the information and, and, and really the ransom is the attacker saying if you want to bring your systems back online, or if you wanna get your data back, you're going to need to pay me this amount of money to get a, uh, to get a, uh, you know, key to, to, uh, to decrypt the, uh, the ransomware.
• 6:29
  Um, so the attack basically can cripple an organization because if, again, when you think about how dependent healthcare has become on using technology to deliver care, it's, it's extremely important.
• 6:41
  Now, of course, most organizations, uh, should and, and all organiz-- or all organizations should, and most organizations do have business continuity plans and contingency plans to continue to deliver care.
• 6:56
  But, you know, the reality is that those backup plans are not going to be as effective as, uh, you know, having your normal systems available.
• 7:08
  So when you have a, a ransomware attack, most hospitals, health systems, uh, they're not going to be able to handle the same volume, or they're not going to be able to deliver care in the same way, and that might mean that there are delays, uh, they, they may decide that they want to, for some period of time, send emergency care to another hospital that might be eight or ten minutes away, and those are precious minutes.
• 7:31
  It might mean that if you have a test, uh, that you're waiting for results that are going to be used to determine what type of procedure you need, you might need to wait another day to get those, or you might not be able to have that procedure or have that procedure in the location.
• 7:46
  You know, if you're in a, if you're in a big city and you're in an area that might be, there may be other options, but, you know, a lot of, a lot of our country is not in that situation, and, you know, getting, getting that particular care that you, you need, um, a-and having it delayed can be extremely, um, you know, impactful to the quality of care.
• 8:02
  So, uh, it's a, it's a real issue, and it's not only the healthcare providers that are facing that issue, it's the third parties that are providing technologies and solutions.
• 8:11
  So anyone who's in the healthcare IT or digital health industry, uh, is in that because we're trying to provide technology to help the providers or help the payers be better at, uh, you know, doing what they do in, in our healthcare ecosystem.
• 8:25
  They're relying on those technologies, and when those technologies go down, and they might be outside of their control now, they're in the control of the, of the vendor, uh, that's a significant concern.
• 8:34
  It's, it's a significant risk, and it's, um, one that's becoming more and more, uh, common with, uh, with cyber attacks, uh, these days in healthcare. Yeah.
• 8:46
  That connection between the, the hospital system and those third-party vendors is such a crucial one because at Startup Health, we work with, you know, four hundred and fifty companies from twenty-nine countries.
• 8:56
  They're more likely to be these third-party, um, players who are plugging into a big system, and yet they need to have this on the front of their minds as well.
• 9:06
  So I'm wondering what kinds of questions should a, a founder of a startup that is dealing in interoperability, dealing with da-- hospital data, what should they be asking and thinking about as they enter into a partnership with a hospital system?
• 9:22
  Yeah. So I, I think the, you know, first it's important as a leader or founder, uh, of a digital health, health IT company to understand the state of mind of their customer.
• 9:33
  And, you know, last year there were fifty million individual records exposed, uh, in healthcare as a result of a breach.
• 9:41
  In the second half of last year, business associates, which are the vendors, uh, they were r-responsible for more records being breached than from the healthcare providers themselves. Yeah.
• 9:53
  So a significant amount of, of data that's the healthcare provider's ultimate responsibility or other coveren-covered entity's ultimate responsibility from a compliance perspective is in the ha-- is, is being breached in the hands of their, of their third party.
• 10:07
  So they've, they've gone through this pain, and they understand the impact and cost, and it, it's, it's very risky for them to, uh, to really trust this third party. So what, what are they asking?
• 10:20
  What, you know, what, what should we be asking ourselves? Well, what they want to know and understand is how well are you protecting that sensitive data?
• 10:29
  What are you doing if, if you're going to be a, a, a technology or you're providing a service that's critical to their operations that they're now relying on in order to deliver care, uh, or run their operations, they're going to want to know how you can, uh, assure them that you're going to be resilient, that you're going to, uh, manage risk, you're going to understand where your risks are, that you have an ongoing program.
• 10:53
  So, um, you can expect to receive a, uh, a very detailed security questionnaire that asks you about that security program, and things they'll wanna know are things like who, who's running that program, you know, at your organization?
• 11:08
  Who's in charge of it? What are their qualifications? How much time do they spend on that? How important is it, uh, from a leadership perspective? What's the governance around that?
• 11:19
  What frameworks do you use to build your security program? Uh, what are your baseline security controls? And they'll probably ask about specific types of controls.
• 11:28
  And what they ask might depend on, you know, how much data they're giving you, uh, or what type of technology, or is it, you know, is it a cloud-based technology?
• 11:37
  If it's, you know, if it's, it's an AWS, for example, it's not enough to say, "Hey, we're using a, an AWS HIPAA-compliant, you know, uh, environment," because we should all know and understand that you have to configure the security controls in AWS, and you have to configure your own or create your own security and your own application in addition to that.
• 11:57
  So they're gonna wanna go much deeper than having a very superficial answer like that. We've seen that quite a bit.
• 12:03
  Um, they're going to under-understand how well you, uh, tech, uh, technically test your, your application and the environment. If you have a mobile device, are you doing mobile app testing?
• 12:14
  Uh, are you doing vulnerability and threat monitoring?And are you doing that on an ongoing basis? And, uh, very importantly, how well are you equipped to respond and recover from a security incident?
• 12:26
  So if there is an incident, how are you going to handle it? How are you gonna notify them? How are you gonna work with them? What are your, uh, capabilities to be resilient under that attack?
• 12:37
  Um, and, and that's, that's really for any type of partner.
• 12:40
  And if you're receiving electronic protected health information, then you're going to be asked questions about your HIPAA compliance program, and they're likely going to wanna see evidence that, um, you know, that that's a, that's a real, uh, you know, a real implementation and those, those procedures are being, are being followed.
• 12:58
  Um, and then if you're hand- Yeah.
• 12:59
  Yeah, if you're handing a lot of data or if your software is deemed to be very important to their operations, uh, you may be asked for a SOC, a SOC two type two, uh, attestation or a, or a HITRUST certification.
• 13:11
  So it, it goes on and on. I mean, there's a lot of different things they can ask for, and, uh, that's, that's, you know, something that typically health customers work through. Yeah.
• 13:20
  What, what I'm hearing is that there's a, there's a spectrum on-- in each of those questions that you answered, there is sort of the,
• 13:27
  uh, there's the, you know, extensive, uh, strategy for security, and then there's sort of the, the red flag. We, we haven't thought through this enough.
• 13:38
  And, a-and they're look-- and they're looking for where you're all-- where you're at on that spectrum.
• 13:43
  I wonder if there are common red flags that you see from startups, uh, thinking through that list, that there's things that just are common missteps for a founder. Absolutely.
• 13:57
  Um, yeah, I think some common misstep or some common red flags would be, for example,
• 14:03
  if you're, if you're going to be receiving EPHI, electronic protected health information, and you don't have a, a program that is designed to comply with, with HIPAA, um, that, that's gonna be a problem right out of the gate, right?
• 14:18
  So for...
• 14:19
  And, and not just, you know, that's a very broad statement, comply with HIPAA, but there are specific things that, uh, are extremely critical to your HIPAA compliance program, such as having documented policies and procedures, performing a security risk analysis, which is something that is very often, uh, misunderstood and misinterpreted, uh, doing technical testing and doing that on an ongoing basis.
• 14:45
  Uh, so those are just some examples more on the HIPAA front.
• 14:48
  From a security perspective, um, you know, certainly, uh, multi-factor authentication has become a, uh, almost a requirement for any type of application that can be acce-accessed outside the traditional, uh, you know, network and firewalls because so much of the, uh, cyber-- so many of the cyber attacks that we've seen have been coming through a vector of, uh, social engineering, uh, or phishing, if you will, through people.
• 15:15
  Um, so you really need to have those types of controls in place. Um, there's new, uh, recognized security practices that have been made available, uh, over the last, uh, several years.
• 15:31
  In particular, there's the, uh, 405d Health Industry Cybersecurity Practices guide that's becoming very rapidly adopted across the industry.
• 15:41
  Um, that's a, uh, set of, of ten practices which address the five most, uh, critical cybersecurity threats to healthcare.
• 15:52
  Uh, so it's a very good place to start to build a program if you haven't built a program, or if you're building a program and you're trying to maybe not boil the ocean, but really focus on the things that are, what are the most critical controls I need to have in place in healthcare to address the most critical threats?
• 16:10
  Um, you know, that's, that's readily, freely available. Uh, the challenge is that, you know, many, many organizations just don't have the, the experience, time, or resources to, to do those things. Mm-hmm.
• 16:21
  And especially if you're a smaller company going out and, and trying to hire, you know, a full-time chief information security officer, uh, or even, you know, even somebody who's maybe not at that level, which, you know, provides some risk, uh, it's very hard to find those people.
• 16:36
  They're, they're, they're not inexpensive. Yeah. And, um, and, you know, there's a lot of churn. You know, people, people leave, and then you've got to start all over.
• 16:44
  So, um, you know, really it doesn't change the problem.
• 16:48
  The, the, [chuckles] the, the objective is you still need to have all those things ultimately to do business, and as you start doing business with larger organizations, they're going to ask for more because the risks are higher.
• 16:59
  Is there, is there a stage of company development when you think they really need to invest in that personnel?
• 17:05
  Obviously, you know, without sort of teeing you up with your business, at, in the early stage, you probably wanna work with more of a consultant, more of a part-time, um, strategist.
• 17:15
  At what point in your development do you need to go all in on this? Well, you know, that, that's a great question.
• 17:22
  I think what we've seen is a bit of a shift in the approach, and if I go back, you know, several years ago, the, you know, the common way that, that we see a lot of our customers work with us and other consulting firms is you'd hire us or you'd hire a consulting firm to do some of these activities, uh, you know, and, and kind of do some of the pieces.
• 17:44
  And, uh, that, you know, that's an approach that, that could work, but it, it leaves some holes, it leaves some gaps.
• 17:50
  And I think with the level of complexity that organizations face today and the rapid rate of change in cybersecurity and compliance, you really need to have a, a more strategic approach.
• 18:05
  So, um, you know, one option, of course, is to build it on your own. Um, even for very large organizations, that can, that can be very tough to do, uh, because it's not their core business.
• 18:15
  You know, security and compliance is not what they're really good at, and building it can be, uh, you know, take a long time. It's not just build it to b-b-but become good at it.
• 18:24
  So-Working with our customers, what we did was, uh, we developed a, uh, managed services program
• 18:32
  which is, uh, an alternative to the traditional approach where, uh, our customers outsource these, uh, needs to Clearwater and we, uh, at any stage, you know, of a company's life cycle can begin building that program,
• 18:50
  running the program, and maturing it over a, a period of time, uh, at least over a three-year period, let's say.
• 18:57
  And by doing that, um, you know, we can provide that, that CISO, that experienced security and compliance leader that can understand the customer's needs and objectives, understand their customer's needs and objectives, their compliance requirements, their risk tolerance, and we build out a long-term roadmap that's reasonable and appropriate for them, because different organizations have different needs and, and then bring in the various resources or solutions or services from Clearwater at different stages to execute on those, those types of activities.
• 19:31
  So they get access to all those different things and more that I mentioned, and we do that all at a fixed fee, monthly fee- Yeah... which is very predictable and very affordable for smaller companies.
• 19:41
  Now to answer your question- Yeah. We've got early stage companies, and we've got some of the largest software companies in the world that are, that are now subscribing to that program.
• 19:50
  That's, that's interesting to me because I feel like it falls in line with a trend, and, and, and maybe you've seen this, of moving towards fractional C-level, uh, employees, fractional CFOs, fractional chief marketing officers, this idea of getting scalable help when you need it, uh- Right...
• 20:08
  from the ear- from the earliest stage all the way through, which is an interesting mindset for our portfolio to think about, um, how do you build a top-tier scalable team? Correct. Yeah, no, it, it's exactly right on...
• 20:23
  it's on that same or in that same vein.
• 20:26
  Um, you know, I think probably the, the, the difference in where we think there's some innovation here from, from the what we call the Clear Advantage program is that in addition to that, that one resource which, you know, you, you are getting as a program leader, as a virtual CISO, as an advisor, um, and as a manager of the program, you're, you're also getting all those other resources.
• 20:49
  So, you know, for example, you, if you need to do penetration testing, we're bringing in folks from our technical testing team.
• 20:56
  If you need somebody to help you, advise you on how to configure your cloud environment, uh, we bring in somebody from our cloud security team.
• 21:04
  If you need policies and procedures, we bring in somebody from our compliance team.
• 21:08
  So you, you basically tap into over a hundred consultants with different domain expertise, 'cause organizations that are in healthcare, they need that support in those different areas, not only initially, but on an ongoing basis.
• 21:22
  So it's a great resource to a smaller company to know that they can talk to their virtual CISO, and they've got-- they're about to land this new customer, and the new customer is asking them questions about their mobile app testing, and they're saying, "Well, we, you know, we haven't really done that extensive mobile app testing."
• 21:38
  And it's, "That's okay. We can bring in so and so from our technical testing team-" Yeah. "... and we can do that for you."
• 21:43
  That's just, you know, it just really helps to bring those companies through that, through that challenge and, and help them advance their s- Yeah...their strategic goals. Yeah. Uh, very interesting.
• 21:54
  I mean, obviously, we're talking about your company a-and a product that you offer, but there really is a bigger lesson here in terms of extrapolating to how do you wrap around your startup w-with scalable services that can understand complex problems, uh, even when you're an initial team of two or three people.
• 22:13
  There, there are these tools available in the market. Okay. We're running out of time, so last question. I wanna know where are we heading with this, with, with cyber threats, cyber security for healthcare?
• 22:25
  We've seen a ramp up in attacks. We've seen, you know, an increase in the value of patient records on the dark web and just the, just the, the threats are increasing. Where are we going with this?
• 22:37
  Are we seeing more and more vulnerabilities, or are we actually gaining some ground?
• 22:44
  Um, what, what we're definitely seeing, you know, as, as long as technology continues to advance, um, we're going to see more vulnerabilities, right?
• 22:53
  But there's more, there's more points of access, again, more, um, you know, more, uh, people are using that data, so all that creates more vulnerabilities. Um, and cyber attacks are, are not slowing down.
• 23:07
  Um, and again, it's, you know, constantly we're, we're seeing new groups coming out and targeting healthcare. So that, that's gonna, that's gonna stay the same.
• 23:15
  I think what, what has changed, what is changing is more of a focus and an awareness from business leaders that cybersecurity is a business problem, not an IT problem. It's not just a compliance problem. Mm.
• 23:30
  It's something that needs to, uh, have a strategy and needs to have the appropriate amount of investment. Our, our government is, is, I think, taking more action in this area.
• 23:41
  Um, there's been, uh, recent activity from, um, uh, the Biden administration and, and, uh, very likely there's going to be, uh, additional, uh, you know, regulation a-and as well as incentive for, uh, you know, for industry to, uh, to bolster,
• 24:01
  uh, security. So, uh, it's r- it's becoming much more recognized, I think, as a area that needs, uh, focus.
• 24:09
  Um, so I think it'll, it'll take some time to get there in terms of, you know, government action, but, you know, we're seeing signs of that, and we are, I think, definitely seeing a lot, lot more, uh, engagement from our, from our business leaders, from investors.
• 24:23
  I mean, investors are becoming much more educated.
• 24:27
  Um, uh, you know, we're having, we're having constant calls with VCs and private equity investors where they've had-uh, portfolio companies that have had breaches and that have had ransomware attacks, and it's extremely painful.
• 24:41
  So, you know, they're, they're, they're gonna wanna protect their investment.
• 24:43
  They're very good at managing risk, and, um, you know, hopefully that, that will translate to more support, uh, and to more resilience in, in healthcare. Steve, I appreciate you taking the time with us today.
• 24:56
  What I really like about this is the idea of turning something that is a, a risk and a vulnerability into actually a competitive advantage for a startup who takes it seriously, who understands what the questions are that are gonna come down from a potential partner from a hospital, turns that around and says, "If I'm the one who, um, gathers this information and is handling it correctly, I'm actually gonna come out on top in the market."
• 25:22
  Yeah, absolutely.
• 25:23
  I mean, that's been our, our philosophy for a long time is, is really turning a, a liability into a competitive advantage, and we've seen, you know, many of our customers, uh, do that and be very, very successful in taking that message to the market, and it's been very well received.
• 25:38
  So- Well- I appreciate the, uh, yeah, appreciate the great questions. Yeah, Steve, great talking to you today. Keep up the great work, and, uh, we'll be checking with, in with you in the future. All right, great.
• 25:49
  Thanks so much. All right. Be well. [upbeat music] Thanks for listening to Startup Health Now. Startup Health invests in health transformers around the world who are dedicated to achieving audacious health moonshots.
• 26:04
  If you wanna learn how you can join this community of entrepreneurs, or if you wanna connect with one of our four hundred and fifty companies, go to startuphealth.com.
• 26:12
  If you'd like to learn how you can invest in our Health Moonshot Impact Fund, go to healthmoonshots.com. Thanks for listening to Startup Health Now. We'll be back again with another episode next week. [upbeat music]