Latest / I Am Wiser Podcast with Dr. Laura Purdy / Ignorance Is a Vulnerability

Transcript

Ignorance Is a Vulnerability · I Am Wiser Podcast with Dr. Laura Purdy

• 0:00
  SPEAKER_00: The one piece of foundational wisdom that I give to people is you have to educate yourself.
• 0:05
  SPEAKER_00: Don't be naive to the fact of saying, hey, I'm just an individual, no one's gonna come after me.
• 0:12
  SPEAKER_00: Those type of people are actually the ones that are actually more highly targeted because um say people think that they're not educated and they're gonna be a little bit more naive.
• 0:24
  SPEAKER_00: And and my one advice is you've got to pay attention to this and you know, do a little reading, listen to a podcast on security.
• 0:33
  SPEAKER_00: Um, you know, there's a lot of great resources out there.
• 0:36
  Dr. Laura Purdy: Welcome to the I Am Wise Podcast, with the biggest questions in healthcare and wellness, meet the collective wisdom of industry leaders and innovators.
• 0:45
  Dr. Laura Purdy: I'm Dr.
• 0:46
  Dr. Laura Purdy: Mark Burke, and here we explore the intersections of AI, care delivery, telephony, and the lens of those who are reshaping healthcare.
• 0:58
  Dr. Laura Purdy: This is not just about theory, it's about lived experience and real industry insight.
• 1:04
  Dr. Laura Purdy: Let's dive in and get wiser together.
• 1:07
  Dr. Laura Purdy: Welcome to today's episode of the I Am Wiser Podcast with Dr.
• 1:11
  Dr. Laura Purdy: Lara Purdy, where we explore the moments of breakthrough, resilience, and reinvention that shape the way we live, lead, and care.
• 1:20
  Dr. Laura Purdy: I am thrilled today to welcome Tom Barberio, Chief Information Officer at Think Forward.
• 1:27
  Dr. Laura Purdy: Tom has spent more than 20 years safeguarding patients, organizations, and leaders as technology continues to evolve, sometimes faster than we can even keep up.
• 1:37
  Dr. Laura Purdy: He believes that security and healthcare is not just about protecting our data, it's also about protecting trust, dignity, and people's most vulnerable moments.
• 1:47
  Dr. Laura Purdy: As AI reshapes what's possible in clinical care and business operations, Tom is here to help us understand the massive shift happening beneath the surface and how we can prepare wisely without slowing innovation.
• 2:03
  Dr. Laura Purdy: Welcome, Tom.
• 2:05
  SPEAKER_00: Well, thank you very much for having me.
• 2:07
  Dr. Laura Purdy: I'm excited that you're here.
• 2:08
  Dr. Laura Purdy: We were talking off-camera just before we got started, that healthcare information security is near and dear to my heart.
• 2:17
  Dr. Laura Purdy: So before we get to that, let's set the stage.
• 2:20
  Dr. Laura Purdy: Tell us who are you and what do you do?
• 2:23
  SPEAKER_00: Yeah, thank you.
• 2:24
  SPEAKER_00: So as you mentioned, um I'm the CIO of a uh healthcare information uh security MSSP, which stands for um master service security provider.
• 2:36
  SPEAKER_00: So um I oversee all the security aspects, and our customers come to us.
• 2:42
  SPEAKER_00: Um, they're in the healthcare sector to essentially protect their data um as well as their systems and their processes for all of their security needs.
• 2:53
  SPEAKER_00: And that across multiple uh venues of healthcare.
• 2:57
  Dr. Laura Purdy: Wow.
• 2:57
  Dr. Laura Purdy: I that feels really intimidating to me because I don't do what you do and I don't know what you know.
• 3:02
  Dr. Laura Purdy: How did you where how did you progress through your career to the point where you feel comfortable entrusting yourself with other people's healthcare information?
• 3:13
  SPEAKER_00: Yeah, it's actually a really interesting story, right?
• 3:16
  SPEAKER_00: So I started my career actually um in the banking industry, which was a very highly uh heavily regulated industry, and over time um migrated into healthcare because one of the things that was noticed is I was always looking for, hey, where are people underserved, right?
• 3:35
  SPEAKER_00: And healthcare historically has always been an underserved market um when it comes to technology in general, as um, and then as the advent of technology became more prevalent within healthcare, um, security became a major factor, right?
• 3:51
  SPEAKER_00: So we started really seeing a need there, and I personally always uh my background has always been in information security.
• 3:59
  SPEAKER_00: So the two kind of married up very nicely to be able to work together to be able to provide a service that is uh very much needed.
• 4:07
  Dr. Laura Purdy: I get that.
• 4:08
  Dr. Laura Purdy: So healthcare and banking, so health information, financial information, are they equally regulated?
• 4:14
  Dr. Laura Purdy: Is one more regulated than the other from your experience?
• 4:18
  SPEAKER_00: So what we've noticed is banking actually is a much more um, we'll say historical um type of industry, right?
• 4:26
  SPEAKER_00: So they've had regulations for many, many years, 25, 30 years as technology started going into that.
• 4:33
  SPEAKER_00: We've only started seeing more regulations in healthcare as of recent, right?
• 4:38
  SPEAKER_00: As people are probably familiar with the acronym of uh HIPAA.
• 4:42
  SPEAKER_00: Um that actually started um back in the early 2000s.
• 4:46
  SPEAKER_00: However, as technology is advented, um, healthcare has become more regulated.
• 4:52
  SPEAKER_00: And as of 20 end of 2024, as we went into 2025, it is actually one of the most regulated industries now that is out there as far as uh security and information goes.
• 5:05
  Dr. Laura Purdy: As it should be, right?
• 5:06
  Dr. Laura Purdy: When you talk about people's most vulnerable moments, their health data, it is just as, if not even more, private and personal than their financial data.
• 5:16
  Dr. Laura Purdy: So I'm glad that that's the direction it's gone in.
• 5:19
  SPEAKER_00: 100%.
• 5:20
  SPEAKER_00: Because if you think about it, right, if your banking data is a bunch of numbers, essentially, right?
• 5:25
  SPEAKER_00: So that's not per that, yes, that's personal to people because it's you know, how much you know, money do I have or what's my net worth, but that information um of you know what medical conditions do you have, or very private things that, you know, that's personal information to you as an individual.
• 5:43
  SPEAKER_00: You, you, you and you alone are entitled to that information and should be the one who's dictating who has that information, not um not it being publicly out there, um, which unfortunately in today's society, and we can where I get into that a little later with a lot of things going on in cyber, um that's a big, a big problem, right?
• 6:04
  SPEAKER_00: And you should be able to control that as an individual.
• 6:07
  Dr. Laura Purdy: I agree completely.
• 6:08
  Dr. Laura Purdy: I mean, this is something we've been talking about in healthcare for a long time.
• 6:11
  Dr. Laura Purdy: You having the control over who owns your records.
• 6:16
  Dr. Laura Purdy: So this is actually a very common conversation that we have in the digital health tech startup industry because we're all cash pay.
• 6:23
  Dr. Laura Purdy: Everybody that I work with and all of the jobs I've done for the last 10 years have 99% of them have been entirely cash pay, which means institutions don't really own our records.
• 6:37
  Dr. Laura Purdy: It's not the insurance companies that own our patients' records, I should say.
• 6:41
  Dr. Laura Purdy: Um, but in the real world, the hospital andor the insurance company is really the custodian of record.
• 6:49
  Dr. Laura Purdy: And for me as a patient, if I want to get my medical record or if I want to get my child's medical record, I actually have to go ask permission from the hospital or the institution or the insurance company to be given my information, which might take it, might never happen.
• 7:07
  Dr. Laura Purdy: I mean, I guess it's a little better now that they've put some laws into place that says they have to give you your record if you ask for it and they can get in trouble if they don't give it to you.
• 7:16
  Dr. Laura Purdy: But I've always thought it was strange that we aren't the owners of our medical records and it has to be given to us from the institution and not the other way around.
• 7:27
  Dr. Laura Purdy: Do you agree?
• 7:28
  SPEAKER_00: Well, I do.
• 7:29
  SPEAKER_00: And it's kind of a very interesting topic, right?
• 7:32
  SPEAKER_00: Because if you think about it, um, it is one of the industries that even though it's highly regulated as to who can do what, what a lot of people don't realize is the amount of information sharing um that goes on in that space, um, you would think is um a lot.
• 7:48
  SPEAKER_00: And in some cases it is, because people don't realize, hey, I go to the hospital, right?
• 7:54
  SPEAKER_00: They actually might be sharing that record with five, 10, 15, 20 different entities that are affiliated with those healthcare systems and things like that.
• 8:03
  SPEAKER_00: People don't understand that on the fine print when you sign the forms.
• 8:07
  SPEAKER_00: Now, however, on the flip side of that, though, you would say, well, there's not a national database or one place for me to go to see all my health records.
• 8:16
  SPEAKER_00: My dentist has my dental records, my general physician who's probably affiliated with the hospital system there.
• 8:23
  SPEAKER_00: But now, if I go down the street, um, that record is not there, right?
• 8:28
  SPEAKER_00: So, to your point, I agree 100% that us as the individuals should be the owner of it.
• 8:34
  SPEAKER_00: Unfortunately, we're the recipient, and there's not a what we call in the space a uniform, um, uniform space for that, right?
• 8:42
  SPEAKER_00: So every entity is pretty much entitled to do whatever they want with it and structure that data however they want.
• 8:51
  SPEAKER_00: There's not a standard, right, that goes across the industry to allow one spot.
• 8:56
  SPEAKER_00: Now, outside of this country, when you go into like the European Union and things like that, if you have any international uh listeners, um, they're actually a little bit ahead of us in the United States than we are in the United States in that um juncture because they set some standards that are kind of uniform throughout the country, but in the United States of North America, that's not the case.
• 9:17
  Dr. Laura Purdy: It's not at all.
• 9:18
  Dr. Laura Purdy: And the way that I've told this story is imagine if you didn't own your credit card or debit card.
• 9:26
  Dr. Laura Purdy: And every time you go somewhere to make a purchase, let's say you go to the grocery store and you're going to the grocery store to make a purchase, and the grocery store says, hold on, before you make a purchase, I must contact your bank to find out what your credit card number is.
• 9:40
  Dr. Laura Purdy: And only once they've given me your credit card number, uh, I'll give you a copy of your credit card number.
• 9:47
  Dr. Laura Purdy: But uh you can't give me your credit card number.
• 9:49
  Dr. Laura Purdy: It has to come from the bank.
• 9:51
  Dr. Laura Purdy: And oh, by the way, you can't make your purchase until the bank has the time to send me your credit card number.
• 9:57
  Dr. Laura Purdy: And that's exactly how it works in healthcare.
• 10:00
  Dr. Laura Purdy: And and you have to sign a piece of paper that says, yes, I give the bank permission to give the grocery store my credit card number so that I can make a purchase at the grocery store where I'm trying to use my credit card to buy something.
• 10:12
  Dr. Laura Purdy: Can you imagine?
• 10:14
  Dr. Laura Purdy: I mean, that's crazy.
• 10:15
  Dr. Laura Purdy: And then in the future, you go somewhere to buy something, and let's say they have they can't communicate with your bank and they say, Okay, what's your credit card number?
• 10:24
  Dr. Laura Purdy: And what was your credit card number five years ago?
• 10:26
  Dr. Laura Purdy: And what was your credit card number three years ago?
• 10:29
  Dr. Laura Purdy: And can you tell us every credit card number that you've ever had?
• 10:32
  Dr. Laura Purdy: That's what it's like in healthcare.
• 10:34
  SPEAKER_00: Yes, and it and it's worse than that too, because with uh all the cyber incidents and everything going on, um, it's very, very, very fragmented, right?
• 10:44
  SPEAKER_00: And and you don't even realize, and there's pieces of that information that's living in multiple spots and it's not in a uh in one spot in a standardized format, and it makes it very difficult as the consumers of those types of things.
• 10:58
  SPEAKER_00: It's not product friendly in any in any way.
• 11:01
  Dr. Laura Purdy: Not at all, not even remotely.
• 11:03
  Dr. Laura Purdy: And unfortunately, again, I come from the digital health tech startup industry, and in the immediate post-COVID, so 2021, 2022, 23, all of the GWS kind of bright and up-and-coming founders, this is what everybody was talking about.
• 11:17
  Dr. Laura Purdy: Everybody wanted to talk about putting medical records on the blockchain and interoperability and creating, I don't know, APIs, I guess.
• 11:25
  Dr. Laura Purdy: I'm not a tech person, that all these systems would talk to everyone about, and your medical record could live in your maybe we'll say digital wallet, and then you can boop, like you can boop it.
• 11:35
  Dr. Laura Purdy: I don't know what the tech word for booping is, but you know what I mean when I say boop.
• 11:38
  Dr. Laura Purdy: You can contact lists, share it.
• 11:40
  Dr. Laura Purdy: And I don't really hear people talking about that anymore.
• 11:43
  Dr. Laura Purdy: Now they're all talking about AI, but that's what they talked about before they talked about AI.
• 11:47
  Dr. Laura Purdy: From your vantage point, what happened with all of that?
• 11:51
  Dr. Laura Purdy: Is that still a thing?
• 11:52
  Dr. Laura Purdy: Is it a dream?
• 11:53
  Dr. Laura Purdy: Is it not gonna happen?
• 11:56
  SPEAKER_00: Yeah, so that's a really good question.
• 11:58
  SPEAKER_00: And in technology, that's there's kind of what we call the utopia of that, right?
• 12:03
  SPEAKER_00: Of where we want to try to get to in order to get to that.
• 12:07
  SPEAKER_00: The problem that we see with that is um that's not really attainable today.
• 12:14
  SPEAKER_00: And the reason that that's not attainable is it comes down to a cost factor.
• 12:19
  SPEAKER_00: There are so many different systems, and not to beat a broken record or be a dead horse on this, is because there's no standards across the industry, it is not obtainable to have a standard where each person would be able to carry that record in like a digital wallet.
• 12:37
  SPEAKER_00: And then when you went from organization A to organization B to do like what you do with photos, right?
• 12:43
  SPEAKER_00: Or people who have an iPhone to be able to transfer it.
• 12:47
  SPEAKER_00: The reason that that kind of um, the reason that that kind of works is because the um because those devices have standards.
• 12:57
  SPEAKER_00: So when you're going from one phone to another, you can do that transfer.
• 13:01
  SPEAKER_00: When you're dealing with medical records, when you're going from one system to another, they're not standardized, so they don't um allow that information to do that.
• 13:10
  SPEAKER_00: Now, 10 years down the road, do we hope something like that could change?
• 13:13
  SPEAKER_00: Yes, but there has to be an appetite for it, right?
• 13:16
  SPEAKER_00: Unfortunately, in that space, it's a um consumer-driven um space that you have to have the consumer say, Hey, I really want this, and then they have to be able to push uh to do that.
• 13:29
  SPEAKER_00: Healthcare has become such a commoditized space of unfortunately, even though it's people's health, you should say you're looking out for the best interest of the patient.
• 13:39
  SPEAKER_00: That's not necessarily the case.
• 13:41
  SPEAKER_00: Some of these organizations are so focused on the bottom line and the dollars and cents that they have to say, well, is there really a demand for that?
• 13:50
  SPEAKER_00: That they would, you know, essentially, uh, essentially want that.
• 13:54
  Dr. Laura Purdy: So would it have to be driven then from the regulatory level?
• 13:57
  Dr. Laura Purdy: Would the government have to decide that now they're mandating that everybody owns their own health data and now all of a sudden the solutions have to be created?
• 14:04
  Dr. Laura Purdy: Like with the FHIR, I don't know if I'm saying that if you pronounce it or if you say it, but with the with the FHIR format of the health records, right?
• 14:14
  Dr. Laura Purdy: We have to store our records in that format so that if patients ask for them, we must release them in that format.
• 14:20
  Dr. Laura Purdy: Do I have that right?
• 14:21
  Dr. Laura Purdy: Yeah.
• 14:21
  SPEAKER_00: You do.
• 14:22
  SPEAKER_00: You do.
• 14:22
  SPEAKER_00: You you you hit the nail right on the head.
• 14:24
  SPEAKER_00: Um, that is exactly what would have to happen at the federal level.
• 14:28
  SPEAKER_00: They would have to be a mandate to say this is the standard that everybody has to follow.
• 14:34
  SPEAKER_00: Um, and then there'd be a very long adoption period of that, right?
• 14:38
  SPEAKER_00: It goes back to you might remember um when people were doing prescriptions, right?
• 14:43
  SPEAKER_00: I I use this as a classic example.
• 14:46
  SPEAKER_00: They left that unfortunately to the state level.
• 14:49
  SPEAKER_00: So every state had different laws of when you could do electronic prescribing or otherwise known as e-prescribed versus when you used to get the prescription on uh a prescription pad.
• 15:00
  SPEAKER_00: Um, they never actually were able to get that over the finish line at the federal level beyond um regulated um certain things that are uh DEA regulated for you know class three narcotics.
• 15:12
  SPEAKER_00: But beyond that, um, they weren't able.
• 15:15
  SPEAKER_00: So every state has their own laws and timeline of when electronic prescribing had to go into place.
• 15:20
  SPEAKER_00: And shockingly, out of the 50 states, not all of them even are on electronic prescribing today.
• 15:26
  SPEAKER_00: There's still a handful, I believe 15 or so, that it is not uh actually a little bit more, that that is not the the law.
• 15:34
  SPEAKER_00: Now, a lot of systems do it, but it is not they're not required.
• 15:38
  Dr. Laura Purdy: I have actually never had a paper prescription pad.
• 15:42
  Dr. Laura Purdy: And occasionally, but I don't need it.
• 15:43
  Dr. Laura Purdy: What am I gonna do with that?
• 15:44
  Dr. Laura Purdy: Right?
• 15:45
  Dr. Laura Purdy: I and I would feel at this point in time, I would feel irresponsible.
• 15:49
  Dr. Laura Purdy: I would feel reckless going like this and ripping it off and saying, here, take this somewhere and maybe you'll get a prescription.
• 15:55
  Dr. Laura Purdy: I sometimes people ask me for it, and I say, No, I'm gonna send you an electronic prescription, and I'm there, there's no paper.
• 16:03
  Dr. Laura Purdy: There's no paper here.
• 16:05
  SPEAKER_00: Well, you'd be surprised.
• 16:06
  SPEAKER_00: We still see it.
• 16:07
  SPEAKER_00: You go to your dentists, a lot of dentists still write, uh, you know, are still writing paper scripts.
• 16:13
  SPEAKER_00: Um, it's it it it it it's ripe for fraud, right?
• 16:17
  SPEAKER_00: I I it's just it's not a good situation, and in this day and age, with the advent of technology, it really shouldn't be happening.
• 16:25
  SPEAKER_00: But unfortunately, um it still it still is.
• 16:28
  Dr. Laura Purdy: Well, we'll get there.
• 16:29
  Dr. Laura Purdy: So what I'm hearing from you, we'll we'll look for that little piece of wisdom.
• 16:34
  Dr. Laura Purdy: What I'm hearing is, especially when it comes to tech and innovation in tech, good ideas are sometimes only that good ideas, especially if they're in regulated industries that require the state or federal or local uh legislations, statutes, laws, and regulations to be in alignment and be supportive of that innovation.
• 16:56
  Dr. Laura Purdy: And if it's not, then the ideas that we sit around at the conferences networking, networking groups talking about are just that.
• 17:03
  Dr. Laura Purdy: They're great ideas that aren't going anywhere anytime soon.
• 17:06
  SPEAKER_00: Yeah, unfortunately, it but although that is correct, although, but you got it, there has to be a push, right?
• 17:14
  SPEAKER_00: If if that's what people want and those focus groups and you know those special interest groups, they they have to push that fortunately and fortunately or unfortunately in government, that's how things get done, right?
• 17:26
  SPEAKER_00: So it has to be a push from below to say this is something we want, and then enough people, squeaky wheel gets gets things done.
• 17:35
  SPEAKER_00: But until that gets done, I uh on its own organically, um, something like that just will not happen until there is a standard across the industry.
• 17:45
  Dr. Laura Purdy: Well, all right.
• 17:46
  Dr. Laura Purdy: I mean, well, I'm sure we'll talk about it at the conferences in the upcoming year, but you're right, we should have it, we should be interested in it, we should be future thinking, but we don't we should also be wise to what the current regulatory environment allows so that we don't get in trouble.
• 18:02
  Dr. Laura Purdy: Speaking of getting in trouble, let's shift gears just a little bit.
• 18:05
  Dr. Laura Purdy: So uh we talked about innovation, healthcare, health information, privacy.
• 18:10
  Dr. Laura Purdy: I want to take a step back and be a little bit more broad and talk about just systems and privacy in general, right?
• 18:17
  Dr. Laura Purdy: So I'm a business owner, I have a digital health tech startup, and I've had a lot of employees, I've had a lot of vendors, and I've had a lot of contractors over the last eight years.
• 18:27
  Dr. Laura Purdy: And I have had to learn the hard way that I have to take security, not even just patient data security, not even PHI, not even HIPAA.
• 18:38
  Dr. Laura Purdy: I'm just talking about things like policies, SLPs, workflows, emails, back office systems, things that over the years I've allowed people to have access and control over that maybe I shouldn't have.
• 18:50
  Dr. Laura Purdy: I've had entire domains shut down with years of emails lost by people who called themselves my director of technology.
• 18:59
  Dr. Laura Purdy: I've had clinical workflows disrupted, pharmacy orders tampered with, patient contact lists taken by people who were supposed to be my head of product operations.
• 19:12
  Dr. Laura Purdy: And I've had to learn the hard way that the only person who should ever really own anything in my business is me.
• 19:20
  Dr. Laura Purdy: How common is that problem from your vantage point?
• 19:24
  SPEAKER_00: So that's a very common problem, right?
• 19:28
  SPEAKER_00: Now, on the I'll add another dynamic to that, right?
• 19:32
  SPEAKER_00: The problem is that um this is not a problem just in the startup space.
• 19:37
  SPEAKER_00: This type of problem um runs rampant throughout um the whole sector, right?
• 19:44
  SPEAKER_00: The issue comes down to um trust factor, costs, and knowledge.
• 19:50
  SPEAKER_00: Because what people don't realize is that they say, hey, I don't want to trust in one individual or an individual um having that level of access to do that.
• 20:02
  SPEAKER_00: So, which is totally understandable, particularly in a in a medical or a tech startup, because IP is king, right?
• 20:10
  SPEAKER_00: That's that's things that it's your name, it's your brand.
• 20:14
  SPEAKER_00: Um, that's that that's your lifeblood of how you're making money.
• 20:18
  SPEAKER_00: Where that becomes challenging, though, is that the cyber landscape is evolving so quickly.
• 20:24
  SPEAKER_00: And when I say quickly, it literally changes on a daily basis of what some of the new tactics and things like that are.
• 20:31
  SPEAKER_00: And people that are not formally trained or staying up on that become victimized a lot easier, even unintentionally.
• 20:40
  SPEAKER_00: Um, because you could have the best of intentions and say, hey, I'm smart enough to know this is a phishing email.
• 20:46
  SPEAKER_00: That's not real.
• 20:47
  SPEAKER_00: I shouldn't click on that, right?
• 20:49
  SPEAKER_00: And give out my passport.
• 20:50
  SPEAKER_00: However, there's new techniques and new attacks that are happening daily of things that you may never even think of because you're busy running the business or doing other things, and people that are focused uh 100% on the cyber are staying more up to date on that.
• 21:08
  SPEAKER_00: So, what we're trying to see as an industry as a whole of the advent of more user-friendly tooling to be able to allow that control so that you don't have to um entrust into one person to do that because to your exact point, because then that person has to one person should never have that much control, right?
• 21:29
  SPEAKER_00: So that is uh kind of a classic chicken before the egg type of syndrome that is going on today in that that in that space.
• 21:37
  Dr. Laura Purdy: And when you say cyber, just because I I'm not in the industry, you mean crime, cybercrime.
• 21:42
  Dr. Laura Purdy: You're talking about people who use the cyber environment to be nefarious, cybercrime.
• 21:47
  SPEAKER_00: Correct, correct.
• 21:48
  SPEAKER_00: We're talking about it, it is a it is they're criminals.
• 21:51
  SPEAKER_00: They're essentially cyber criminals.
• 21:53
  SPEAKER_00: Uh, you call them criminals, you know, terrorists, foreign actors, whatever term you want to use for.
• 22:00
  SPEAKER_00: It's right, but they're literally people that are stealing your personal information or your business information, committing a crime and then selling it um in illegal fashion uh on the on the dark web and on the internet.
• 22:14
  Dr. Laura Purdy: And they're hard to find, I would imagine.
• 22:16
  Dr. Laura Purdy: They're hard to pick up.
• 22:17
  SPEAKER_00: They're very hard to find because these people are not they're they're usually people sitting, they could be sitting halfway across the globe and they're underground somewhere.
• 22:27
  SPEAKER_00: And it is it it's it's virtually sometimes impossible to track these, uh to track this down.
• 22:32
  SPEAKER_00: I mean, there's the the statistics are astounding of how much of this goes on on a daily basis.
• 22:38
  Dr. Laura Purdy: Wow.
• 22:39
  Dr. Laura Purdy: But what I'm hearing you say is that nowadays, nowadays, there are systems, maybe programs, maybe software that can be implemented.
• 22:48
  Dr. Laura Purdy: And by the way, thank you for telling me that it's not just us poor little digital health tech startups that have these problems.
• 22:54
  Dr. Laura Purdy: Because I I, you know, coming from healthcare where in healthcare, most people know better.
• 23:01
  Dr. Laura Purdy: And most people who work in healthcare don't dare do anything with their patient data because we've had ingrained to us since day one that you don't do this, and usually they're not that stupid, if I can say.
• 23:14
  Dr. Laura Purdy: But coming into, you know, shifting a little into this kind of startup world, I'm just happy to hear that it's not just me.
• 23:23
  SPEAKER_00: No, it is, it runs from the startups up to the multi-billion dollar corporations, right?
• 23:28
  SPEAKER_00: Everybody, as people have to understand when you're talking about these types of things, is that it does not matter if you're a multi-billion dollar corporation or a startup.
• 23:39
  SPEAKER_00: A patient record is a patient record.
• 23:41
  SPEAKER_00: That value of that individual record in the what we call the dark web, which is the illegal space where this stuff is sold, is the same value if I'm taking that from a startup or I'm taking that from one of the biggest healthcare companies in the world.
• 23:57
  SPEAKER_00: It doesn't matter.
• 23:58
  SPEAKER_00: That one patient value has that same exact value to those criminals.
• 24:04
  Dr. Laura Purdy: Huh.
• 24:05
  Dr. Laura Purdy: So how do we get wise then?
• 24:06
  Dr. Laura Purdy: How do I how excuse me?
• 24:09
  Dr. Laura Purdy: How do I know?
• 24:10
  Dr. Laura Purdy: Let's say I've decided because I've been burned five or six times by the wrong people with the wrong access in the wrong place, that I want to shift to using a system or a technology or a program to help me safeguard my IP and my patient data, because I do need to safeguard both of those things.
• 24:27
  Dr. Laura Purdy: Um, for example, these podcasts are stored on my drive and there's people that have access to them and they cannot delete them because I took away that access.
• 24:36
  Dr. Laura Purdy: But what sort of how do I vet these technologies in order to pick one that's gonna help me?
• 24:44
  SPEAKER_00: So that's a very good, very good question.
• 24:46
  SPEAKER_00: The best way to do that is you gotta have some self-education, right?
• 24:50
  SPEAKER_00: There's there's tools out there, there's educational websites.
• 24:55
  SPEAKER_00: Um, you really need to, um, there's videos, you really as a as a business owner, as a startup, you really need to look at what cyber tools are out there.
• 25:04
  SPEAKER_00: Um, there's certain products that that do a better job that are very good in that space.
• 25:11
  SPEAKER_00: And there's there's educational sites out there um that you can actually go.
• 25:15
  SPEAKER_00: And actually, one of the really good spots to start when we say where the government tried to put something together, you could go to the CISA, um, the SISA website, which is uh, and they have a bunch of links to education out there that's the cyber, um, the National Cyber Institute.
• 25:31
  SPEAKER_00: And it gives some really good advice to do that.
• 25:33
  SPEAKER_00: And then you could start to learn, you know, what are some of the tools and things that are out there?
• 25:38
  SPEAKER_00: Um, you know, and there's companies out there and consultants that can help you learn as your company grows.
• 25:44
  SPEAKER_00: You say, hey, I probably want to get the um advice of somebody who's in that space who could tell me, you know, I don't have a budget of, you know, millions of dollars to do this, but I want to spend X and what are the core things that I need to make sure that I'm basically protected at a level?
• 26:00
  SPEAKER_00: So as a business and as a startup, we always encourage uh going uh to the resources out there that can help with that.
• 26:07
  Dr. Laura Purdy: I think that's fantastic.
• 26:08
  Dr. Laura Purdy: So if the government's working on it, does that mean that cybercrime is a federal, is a is a is a federal crime?
• 26:15
  Dr. Laura Purdy: Is it also a state crime?
• 26:17
  Dr. Laura Purdy: It's a federal crime, I'm guessing?
• 26:19
  SPEAKER_00: It's a federal crime.
• 26:20
  SPEAKER_00: It's actually a federal crime.
• 26:21
  SPEAKER_00: If you get convicted, it's uh it it's it's equivalent to doing uh you know what they would call wire fraud and money laundering, right?
• 26:29
  SPEAKER_00: If you actually get caught um doing um doing a cybercrime, that is, that is you can be prosecuted uh federally for that and and in and internationally in some cases, depending on where the crime is actually occurring.
• 26:43
  Dr. Laura Purdy: Oh wow.
• 26:44
  Dr. Laura Purdy: Okay, so it even can cross borders and you can be located somewhere else, which you mentioned, underground on another side of the world, doing cybercrime in a different country and still get in trouble from another country.
• 26:56
  SPEAKER_00: Yes, you can.
• 26:57
  SPEAKER_00: Yes, you can.
• 26:58
  Dr. Laura Purdy: I'm happy to hear that.
• 26:59
  Dr. Laura Purdy: Actually, I I'm really happy to hear that, and I hope they continue in their efforts to evolve that enforcement.
• 27:05
  SPEAKER_00: They do, and there's actually a lot of been a lot of things in the news recently where so there's been a lot of uh entities, um, you know, cross uh nation entities kind of coming together in the cyberspace to try to take down these crime rings and things like that to be able to do that because it is very, very difficult when you're dealing with people in you know places that are not um, you know, not they're not Western civilizations all of the time, right?
• 27:30
  SPEAKER_00: So it becomes difficult, but it is definitely something that is on the forefront um and is becoming more and more prevalent.
• 27:39
  Dr. Laura Purdy: I'd love to hear that.
• 27:40
  Dr. Laura Purdy: And that that actually brings me a great sense of comfort knowing that people are working on it.
• 27:44
  Dr. Laura Purdy: Okay.
• 27:45
  Dr. Laura Purdy: Well, let's shift gears just a little bit.
• 27:47
  Dr. Laura Purdy: I want to hear about the company that you work for, the business that you're in right now.
• 27:51
  Dr. Laura Purdy: What sort of service do you provide to people and how how are you helping folks and making the world a better place every day?
• 27:59
  SPEAKER_00: Yeah, absolutely.
• 28:00
  SPEAKER_00: So, as I kind of mentioned, one of the things we specialize in um is in cyber and security, right?
• 28:06
  SPEAKER_00: So we get brought in all of the time um in consultative roles, um, particularly in regulated industries such as healthcare, we're primarily healthcare, to do just that.
• 28:17
  SPEAKER_00: Um, and that is everything from your larger entities in the medical, dental, uh, physical therapy space, all the way down into that startup space.
• 28:27
  SPEAKER_00: What we actually do look at is we look at, okay, what are you offering your customers and how can we help make sure we're educating you and providing proper services and um tools to be able to protect that?
• 28:41
  SPEAKER_00: And then that depends on what your line of business is.
• 28:44
  SPEAKER_00: And then we have a full plethora of uh offerings that we offer to be able to protect your data, your patients' data, your customers' data, whatever it is, um, as well as the process of the people to help uh implement those and secure those down.
• 29:01
  Dr. Laura Purdy: Wow.
• 29:01
  Dr. Laura Purdy: I I only understood about like this much of what you actually said, which is great because it tells me that you really know what you're talking about.
• 29:10
  Dr. Laura Purdy: Because my assumption is that anybody can say that they are anything today, and anybody can profess to be someone, but really only somebody who talks like you do about these things can be an expert.
• 29:22
  Dr. Laura Purdy: So, what sets you apart?
• 29:23
  Dr. Laura Purdy: What makes you qualified and equipped to be able to properly legally uh advise these people with value on these things?
• 29:33
  SPEAKER_00: Yeah.
• 29:33
  SPEAKER_00: Um, one of the things to be able to do that is um myself and our organization, we have to stay up to the latest on what's going on in the space, right?
• 29:44
  SPEAKER_00: We spend a lot of time making sure we're educating ourselves on what the latest threats are that are out there and what's the latest products and services that can be offered to make sure we're combating those threats for our customers.
• 29:59
  SPEAKER_00: So we spend a lot of time making sure we stay up to date on all the new rules and regulations for compliance, um, not only in the HIPAA space in healthcare, um, but there's a lot of different changing laws, uh, particularly in different states and also at the federal level, to make sure that we're staying up on that so that when we're advising our customers that we're advising from a place of, hey, here's not only best practice, but here's also what you're legally obligated to do as well, right?
• 30:30
  SPEAKER_00: Um, and here's what this is gonna cost you, and here's what this will cost you if you don't do it.
• 30:36
  SPEAKER_00: That's probably the biggest key thing that people don't realize is that no one knows they have a problem until they have a problem, right?
• 30:43
  SPEAKER_00: And it's like I talk to people all the time, they're like, hey, well, I've never gotten hacked or I've never had a security issue, so I don't want to spend any money on it.
• 30:51
  SPEAKER_00: And it's like, well, it's not a matter of if, it's a matter of when, right?
• 30:56
  SPEAKER_00: It's it's the unfortunate world we live in today that you have to be proactive in those types of uh scenarios.
• 31:03
  Dr. Laura Purdy: You really do.
• 31:04
  Dr. Laura Purdy: Actually, I remember one time a few months ago, I was having dinner with one of my friends who also owns a digital health tech startup, and he starts getting into his phone and going like this and taking calls and stepping away, and he's like, our uh our our website's getting hacked.
• 31:21
  Dr. Laura Purdy: Hold on, I'll be back.
• 31:23
  Dr. Laura Purdy: And and it just happened in real time.
• 31:25
  Dr. Laura Purdy: You know, whatever it was that the people were doing on the front end of his website, they had loaded it so much that it caused the site to crash and patients couldn't log in, they couldn't use their portal, they couldn't place orders and chat with customer service.
• 31:38
  Dr. Laura Purdy: And it's a very real thing, right?
• 31:40
  Dr. Laura Purdy: And he has a relatively you know small company too.
• 31:42
  Dr. Laura Purdy: And I see this happen all the time.
• 31:45
  Dr. Laura Purdy: I mean, we've had clients or people that I've worked for who've had their systems broken into, their information like their patient uh data downloaded, their CRMs hacked into.
• 31:56
  Dr. Laura Purdy: It happens all the time.
• 31:58
  Dr. Laura Purdy: And sometimes it happens from the inside, which is what's happened to me before, where people who are internal to your organization are able to obtain your data and then try to use it in some kind of a unsavory way.
• 32:09
  SPEAKER_00: Yeah, inside there's a term for that.
• 32:11
  SPEAKER_00: It's called insider threat.
• 32:13
  SPEAKER_00: That's kind of the uh insider threat.
• 32:15
  SPEAKER_00: The night insider threat is the buzzword, right?
• 32:18
  SPEAKER_00: That people like to use.
• 32:19
  SPEAKER_00: And unfortunately, um, insider threats are actually, I would say they're prevalent across all organizations, but particularly in smaller organizations, it's a bigger problem because there typically is not the um budget or the tooling to necessarily sniff that out.
• 32:35
  SPEAKER_00: And there tends to be a higher level of trust of certain individuals in a smaller organization compared to if you're an organization that has 10,000 employees, um, you're gonna be handling that a little bit differently when you may have three or four or five, right?
• 32:50
  SPEAKER_00: So, and that that trust factor tends to be a lot greater in the smaller organizations, and unfortunately, some people have um nefarious means that they want to get to, and they'll take and take that trust and be able to capitalize on that for uh unsavory actions, unfortunately.
• 33:08
  Dr. Laura Purdy: Well, to the person who says, but we've never been hacked or had security issues before, I will return my response to that would be well, you've also never had astronomical legal bills before, have you either?
• 33:20
  Dr. Laura Purdy: And let me tell you how high your legal bills get when you do get hacked and have these problems happen.
• 33:27
  Dr. Laura Purdy: Well, here's another question for you is it unrecoverable?
• 33:31
  Dr. Laura Purdy: Like, have you worked with clients or interacted with individuals who've been victims of these cyber crimes that it is not possible to recover and the things that they've lost are lost forever or they've sustained unrecoverable damage?
• 33:45
  Dr. Laura Purdy: Hi, Angela.
• 33:46
  Dr. Laura Purdy: We'll be on with you in just a second.
• 33:49
  SPEAKER_00: Yeah.
• 33:50
  SPEAKER_00: So um, yes.
• 33:52
  SPEAKER_00: And unfortunately, what we've actually seen happen now is it's recovering the data is only half the battle.
• 34:01
  SPEAKER_00: What people don't realize is the reputational harm of having that data resold on the dark web.
• 34:09
  SPEAKER_00: And what the dark web is, is the illegal space where that that is uh that stuff is traded.
• 34:15
  SPEAKER_00: And that being the case, that is actually more damaging to organizations than the fact of being able to get the data.
• 34:21
  SPEAKER_00: Most organizations have some sort of backup, and if you got, you know, encrypted data where you where they go in and you can't get it.
• 34:29
  SPEAKER_00: Um, people now, um, and this has been a pivot in the last probably year and a half to two years, are more worried about the data being resold than they are of not being able to recover the data.
• 34:39
  SPEAKER_00: But both are very important things to consider when you're looking at your strategy.
• 34:45
  Dr. Laura Purdy: So, okay, I I'm a lay person for the most part when it comes to this.
• 34:48
  Dr. Laura Purdy: So I'm gonna ask you a couple of probably very silly basic questions, but probably people who are listening to this have the same questions as me because they don't come from your industry.
• 34:56
  Dr. Laura Purdy: So what you're saying is that people hack in or whatever it is they do with cybercrime and they obtain the data.
• 35:03
  Dr. Laura Purdy: You can probably get your data back.
• 35:04
  Dr. Laura Purdy: But when you're talking about the dark web, you're essentially saying there's this underground um market where people, bad actors, criminals, nefarious individuals, are going to buy and sell our company's data.
• 35:23
  Dr. Laura Purdy: It's like a it's a commodity that people specifically go there to buy these things, and people specifically go there to sell these things.
• 35:32
  Dr. Laura Purdy: Where where is this happening?
• 35:34
  Dr. Laura Purdy: Is it like websites?
• 35:35
  Dr. Laura Purdy: Is it forums?
• 35:37
  Dr. Laura Purdy: Is it is there a Google workspace?
• 35:40
  Dr. Laura Purdy: Like, I don't know.
• 35:40
  Dr. Laura Purdy: Like where like where is I I think of like Harry Potter or something, you know, like the the dark web.
• 35:45
  Dr. Laura Purdy: Like where where is this happening and why is it still happening?
• 35:51
  SPEAKER_00: It's happening because they're because as we mentioned a little earlier in the in the podcast, is because these this is happening in foreign foreign countries where there's little to no regulation, and it's exactly that.
• 36:04
  SPEAKER_00: It's an underground space where people are buying this data, and what they do is then they come to you and say, Hey, I have your data.
• 36:13
  SPEAKER_00: I'll give it back to you if you give me X amount of millions of dollars, right?
• 36:18
  SPEAKER_00: That's exactly how this works.
• 36:20
  SPEAKER_00: And some people have insurance policies and things like that.
• 36:23
  SPEAKER_00: You may have heard of cyber insurance that will pay these millions of dollars to get the data back.
• 36:28
  SPEAKER_00: And then they say, okay, if you don't pay me, it's literally a ransom.
• 36:33
  SPEAKER_00: And if you don't pay this ransom, I'm then gonna go sell your data to the highest bidder in this illegal underground space.
• 36:40
  SPEAKER_00: And because this is happening um across the ocean in, you know, in unregulated space, there is no uh, there's no way to uh to fix that problem, unfortunately.
• 36:53
  SPEAKER_00: And that it is a huge, I mean, there's billions and billions of dollars.
• 36:56
  SPEAKER_00: Last year alone, it was the highest year ever of billions of dollars of ransom money was paid for people to say not to sell the data.
• 37:04
  SPEAKER_00: But here's the catch you can pay the money and they can tell you they're not gonna sell it, but these are criminals and they're gonna sell it anyway, right?
• 37:11
  SPEAKER_00: So it's uh, citizens.
• 37:16
  Dr. Laura Purdy: I mean, they're not doing it because they're gonna do what they say they're gonna do.
• 37:20
  Dr. Laura Purdy: So it sounds like you're talking about in other countries where the governments are not regulating their uh spaces like ours are being regulated.
• 37:29
  Dr. Laura Purdy: So it's basically like 1980s or early 1990s internet where it's kind of a wild, wild west free-for-all, and everybody's out there just do it because we can't really relate to that in America.
• 37:41
  Dr. Laura Purdy: It's not like that anymore.
• 37:43
  Dr. Laura Purdy: And you can't just open up a website that says I sell people's healthcare data and www.darkweb.com.
• 37:50
  Dr. Laura Purdy: Like it does, it doesn't.
• 37:51
  Dr. Laura Purdy: We we can't do that here because the laws prevent it, but in other parts of the world, it is still very unsophisticated, primitive, unregulated.
• 38:00
  Dr. Laura Purdy: And so it's actually pretty easy for them to do that.
• 38:03
  SPEAKER_00: Yes, and in some parts of the world, unfortunately, the government actually funds some of that activity in some of these countries.
• 38:11
  SPEAKER_00: Um it's not not great, but it is the truth.
• 38:14
  Dr. Laura Purdy: Well, I didn't know that.
• 38:15
  Dr. Laura Purdy: Nobody's ever told me that before.
• 38:17
  Dr. Laura Purdy: And so I guess I, you know what?
• 38:18
  Dr. Laura Purdy: I guess I'm getting a little bit of uh street street wisdom and like worldly wisdom right now, and maybe a little bit of disillusionment that there are other parts of the world that actively want to hurt us when it comes to data and privacy.
• 38:31
  Dr. Laura Purdy: And it's a hard pill to swallow, but it is a reality of the world that we live in.
• 38:35
  Dr. Laura Purdy: And we we, as doctors, as tech people, as uh business owners, as startup founders, as huge company owners, we need to know this because we have to understand that we do need to protect our data.
• 38:49
  SPEAKER_00: Absolutely.
• 38:51
  Dr. Laura Purdy: My goodness.
• 38:52
  Dr. Laura Purdy: Well, I'm happy that you are an expert in the field.
• 38:56
  Dr. Laura Purdy: I'm happy that you know what you're talking about and that you really care about providing meaningful solutions for the companies that you work with, because I would imagine, just like in all industries, there may be some people who do the same thing that you do, but don't do it with as much of a conscience as you do.
• 39:16
  Dr. Laura Purdy: Is that the case?
• 39:17
  Dr. Laura Purdy: Are there people out there providing these services that can't really deliver like you can?
• 39:21
  SPEAKER_00: There is.
• 39:22
  SPEAKER_00: Unfortunately, you know, you see this all the time where, you know, it's the the the the flavor of the day, right?
• 39:29
  SPEAKER_00: And people say, hey, I'm the best, I'm gonna charge you, or I'm gonna do it either at a bargain rate to try to get quantity.
• 39:36
  SPEAKER_00: You it it really you have to be compassionate, you have to understand you're not dealing with intangible assets, people's healthcare information that's very personal to people, right?
• 39:46
  SPEAKER_00: So you really have to think of, hey, would I want my information, you know, broadcast around the world and people, it's very violating.
• 39:53
  SPEAKER_00: It's very violating to people's rights and the and their personality.
• 39:57
  SPEAKER_00: So I train my staff and kind of our company core values of thinking of, hey, you have to think about would you want your your mother or your father's or your personal or your kids' data doing it?
• 40:09
  SPEAKER_00: And you have to kind of approach the business in that fashion because if you don't do it and you're doing it just for dollars and cents, um it's you're not gonna have a good outcome from that.
• 40:18
  SPEAKER_00: You have to add the human element to it.
• 40:21
  Dr. Laura Purdy: Well, thank you for caring.
• 40:22
  Dr. Laura Purdy: Uh, you know, I've been on the receiving end of over-promising, under-delivering, unqualified vendors because I was ignorant and I didn't have my self-education, right?
• 40:31
  Dr. Laura Purdy: I didn't do what you recommended and educate myself first.
• 40:34
  Dr. Laura Purdy: And I know that it means a lot.
• 40:36
  Dr. Laura Purdy: It means a lot to the company, to the business owner, to the person on the other side of that client agreement for you to do right by us.
• 40:43
  Dr. Laura Purdy: Uh, that's that there's a lot of value to that.
• 40:46
  Dr. Laura Purdy: So thank you for that.
• 40:48
  SPEAKER_00: Yeah, absolutely.
• 40:49
  SPEAKER_00: Thank you.
• 40:50
  SPEAKER_00: Thank you for caring.
• 40:52
  Dr. Laura Purdy: It means a lot.
• 40:53
  Dr. Laura Purdy: Like I like I said, I've been on the other side of that.
• 40:55
  Dr. Laura Purdy: So we have just a few minutes left.
• 40:57
  Dr. Laura Purdy: And I want to see if I can ask you one more question.
• 41:00
  Dr. Laura Purdy: And my one more question is this if you had to give one fundamental or foundational piece of wisdom as it pertains to security to people, what is that one piece of foundational wisdom that you have to offer?
• 41:18
  SPEAKER_00: Yeah, I would say the one day the one piece of foundational wisdom that I give to people is you have to educate yourself.
• 41:26
  SPEAKER_00: Um, you have to, you don't be naive to the fact of saying, hey, I'm just an individual, no one's gonna come after me.
• 41:34
  SPEAKER_00: Um, you know, I'm a nobody, right?
• 41:37
  SPEAKER_00: You have to think about it that unfortunately those type of people are actually the ones that are actually more highly targeted because um of they people think that they're not educated and they're gonna be a little bit more naive.
• 41:52
  SPEAKER_00: And I and my one advice is you gotta pay attention to this and you know, do a little reading, listen to a podcast on security.
• 42:01
  SPEAKER_00: Um, you know, there's a lot of great resources out there on our website.
• 42:05
  SPEAKER_00: Um, www.thinkforward.com t-h-in-c, we have a lot of links um that free educational material where you can read, you can listen to things, uh, and we update it quite frequently just to keep people updated for that because we really do feel that it's very important um for them to be able to know what's going on in the world and stay updated.
• 42:27
  Dr. Laura Purdy: Thank you so much, Tom.
• 42:28
  Dr. Laura Purdy: So, in summary, knowledge is power, wisdom is power, but when it comes to the security of you, your business, and your patients, innocence and ignorance can be a vulnerability.
• 42:39
  Dr. Laura Purdy: So thank you for being here today, Tom.
• 42:42
  Dr. Laura Purdy: Thank you so much for doing what you do.
• 42:44
  Dr. Laura Purdy: Thank you for the wisdom that you've shared with us today.
• 42:47
  Dr. Laura Purdy: I wish you all the best in your endeavors.
• 42:50
  SPEAKER_00: Thank you very much, and we appreciate it.
• 42:52
  SPEAKER_00: And to you and your audience, so we hope this was informative and thank you very much for having us.
• 42:57
  Dr. Laura Purdy: I know I learned a lot.
• 42:58
  Dr. Laura Purdy: Take care, Tom.
• 42:59
  Dr. Laura Purdy: Bye-bye.
• 43:00
  SPEAKER_00: Thank you.
• 43:00
  SPEAKER_00: Bye-bye.
• 43:01
  Dr. Laura Purdy: Thank you for tuning in to the I Am Wiser Podcast, where each episode brings us closer to a wiser, more human approach to healthcare.
• 43:10
  Dr. Laura Purdy: If today's conversation inspired you or sparked new ideas, share it with someone who's ready to rethink healthcare.
• 43:18
  Dr. Laura Purdy: And if you have a story or innovation that could light the way for others, reach out.
• 43:23
  Dr. Laura Purdy: We'd love to hear from you.
• 43:24
  Dr. Laura Purdy: This space is yours too.
• 43:26
  Dr. Laura Purdy: Don't forget to follow, rate, and review us on your favorite platform.
• 43:31
  Dr. Laura Purdy: Until next time, stay curious, stay courageous, and stay wiser.