Latest / Pharmacy Podcast Network / Cybersecurity in LTC: Today’s Threat Landscape & Practical Defense | FrameworkFocus™

Transcript

Cybersecurity in LTC: Today’s Threat Landscape & Practical Defense | FrameworkFocus™ · Pharmacy Podcast Network

• 0:05
  Speaker 1: You are listening to the global network of podcasters dedicated
• 0:09
  Speaker 1: to the pharmacy profession. Welcome to the Pharmacy Podcast Network.
• 0:30
  Speaker 2: You are listening to Framework Focus, the podcast that explores trends, innovations,
• 0:35
  Speaker 2: and insights in the long term care pharmacy industry. Join
• 0:39
  Speaker 2: us as we connect the entire LTC ecosystem.
• 0:43
  Speaker 3: Welcome back to Framework Focus.
• 0:45
  Speaker 4: My name is Todd.
• 0:46
  Speaker 3: You're a founder of the Pharmacy Podcast Network. It's a
• 0:49
  Speaker 3: new year and I'm excited to be here. I am
• 0:52
  Speaker 3: at the headquarters of Softwriters in downtown Pittsburgh, Pennsylvania, my
• 0:57
  Speaker 3: favorite city. Even though the weather outside it is frightful
• 1:00
  Speaker 3: still Scott Batty, how are you.
• 1:02
  Speaker 4: I'm excellent, Thank you. How are you?
• 1:04
  Speaker 3: I'm doing great. We have a special guest. This is
• 1:07
  Speaker 3: no stranger to the Pharmacy Podcast Network. This is Chris
• 1:11
  Speaker 3: Callahan's follow up. This is your bringing it back and
• 1:15
  Speaker 3: we're talking about cybersecurity today.
• 1:17
  Speaker 4: Chris, welcome, pleasure to be here. Excited for the conversation.
• 1:21
  Speaker 3: All right, Softwriters was the first organization that I went
• 1:28
  Speaker 3: to a conference that you designed your team, Scott, all around.
• 1:34
  Speaker 3: How is artificial intelligence going to impact long term care?
• 1:39
  Speaker 3: Effectiveness and pharmacy. How are we going to care better
• 1:42
  Speaker 3: for our patients? How are we going to be more
• 1:44
  Speaker 3: efficient in operations? And it was a sandbox of fifty
• 1:50
  Speaker 3: people that came to Pittsburgh, sat down and really started thinking,
• 1:54
  Speaker 3: how are we going to map this out?
• 1:56
  Speaker 4: What was that like two years ago? That's right, Yeah,
• 1:58
  Speaker 4: it was two years ago. We did a mastermind and
• 2:00
  Speaker 4: collected a whole host of really exciting ideas and thoughts.
• 2:04
  Speaker 3: When I think about that, the aspect that I'm excited
• 2:07
  Speaker 3: to kind of bolt on what we learned at that
• 2:10
  Speaker 3: session with what Chris brings to the show is the
• 2:14
  Speaker 3: element of cybersecurity and how I know, as we're sitting
• 2:18
  Speaker 3: here in Pittsburgh right now, there is organizations throughout the
• 2:23
  Speaker 3: world that is concentrating on finding ways to break in
• 2:28
  Speaker 3: to networks and metal with software and take people's systems hostage. Chris,
• 2:35
  Speaker 3: it's good to have you here because now with the
• 2:37
  Speaker 3: acceleration of artificial intelligence being leveraged in pharmacy operations and
• 2:42
  Speaker 3: more specific today our senior care, long term care kind
• 2:46
  Speaker 3: of set the groundwork for us today and what we're
• 2:48
  Speaker 3: going to be talking about.
• 2:50
  Speaker 5: Yeah, so I think that right now, AI is very exciting, right,
• 2:54
  Speaker 5: there is a huge rush to leverage this new superintelligence.
• 2:58
  Speaker 5: New technology that's availed makes organizations faster, more efficient. At
• 3:04
  Speaker 5: the same time, we can't lose sight of security, we
• 3:07
  Speaker 5: can't lose sight of data privacy. And the organizations that
• 3:11
  Speaker 5: are going to be winning are going to be the
• 3:13
  Speaker 5: organizations that have strong AI governance in place. They're leveraging
• 3:19
  Speaker 5: governance as an accelerator, not a break to their AI adoption.
• 3:24
  Speaker 4: Right.
• 3:25
  Speaker 5: So the organizations that are approaching this in a thoughtful
• 3:29
  Speaker 5: way that has strong leadership and accountability for AI risk,
• 3:33
  Speaker 5: they're going to be able to step into these solutions
• 3:35
  Speaker 5: and leverage them for their benefit in a much more
• 3:38
  Speaker 5: meaningful way than the organizations that are simply rushing forward
• 3:42
  Speaker 5: with what would be considered unmanaged AI or shadow it
• 3:49
  Speaker 5: use cases of AI.
• 3:51
  Speaker 3: Scott, give us just an overview, knowing that you've been
• 3:56
  Speaker 3: tracking this before even the symposium. Well, you your team
• 4:01
  Speaker 3: has been thinking how's artificial intelligence going to impact the
• 4:05
  Speaker 3: effectiveness of softwriters, the effectiveness of framework LTC and the expansion.
• 4:10
  Speaker 3: We're going to talk a little bit about insights and
• 4:12
  Speaker 3: how the data comes out of that set the stage
• 4:15
  Speaker 3: for our listeners today and talk about someone who's leading
• 4:19
  Speaker 3: the largest software company in the long term care pharmacy space.
• 4:22
  Speaker 3: What do you see as the major threats when it
• 4:25
  Speaker 3: comes to AI and cybersecurity?
• 4:28
  Speaker 4: Well, thank you. I think there's exciting opportunities that are
• 4:34
  Speaker 4: represented through AI. So we have to talk about both
• 4:37
  Speaker 4: sides of the ledger and why are those so important
• 4:41
  Speaker 4: right now? Todd? I know you're intimately aware of the
• 4:45
  Speaker 4: various things happening in long term care pharmacy, the Inflation
• 4:48
  Speaker 4: Reduction Act and the impact of drug price changes. These
• 4:53
  Speaker 4: things are creating quite a bit of turbulence and heartache
• 4:57
  Speaker 4: for long term care pharmacy operators. That erosion happening in
• 5:01
  Speaker 4: their margin and what's the offset? How do we thrive
• 5:05
  Speaker 4: in this environment where we have uncontrollable changes to our
• 5:09
  Speaker 4: economic model. And AI can be a great leveler of
• 5:14
  Speaker 4: the playing field, if you will, can bring efficiency, can
• 5:16
  Speaker 4: make them more effective. So it's really exciting. At the
• 5:20
  Speaker 4: same time, AI is being used by the bad actors
• 5:24
  Speaker 4: as well, and there's a lot that we don't know
• 5:28
  Speaker 4: about AI, the infrastructure, how things are changing and evolving.
• 5:32
  Speaker 4: You know, we started this process years ago, as you
• 5:35
  Speaker 4: alluded to. We opened up a conversation with thought leaders
• 5:40
  Speaker 4: in our industry. We brought technologists in, We brought in experts,
• 5:43
  Speaker 4: technical experts who are at the forefront of this in
• 5:46
  Speaker 4: Silicon Valley, and we've been studying and experimenting for literally
• 5:51
  Speaker 4: years now, right, and it still continues to evolve at
• 5:55
  Speaker 4: such a rapid rate. So your studying is never done.
• 6:00
  Speaker 4: And I think the key thing here for us to
• 6:02
  Speaker 4: open a dialogue around is how do you make sure
• 6:06
  Speaker 4: as a person who wants to adopt and embrace these
• 6:08
  Speaker 4: new technologies, how do you ensure that the partners that
• 6:11
  Speaker 4: you're selecting that the tools that you're utilizing have the
• 6:14
  Speaker 4: appropriate governance, security reliability, Because at the end of the day,
• 6:19
  Speaker 4: you want to rely on these technologies to help you
• 6:21
  Speaker 4: do your job better. But at the end of the day,
• 6:24
  Speaker 4: there's a patient in a bed who's depending on you
• 6:27
  Speaker 4: to deliver care and they don't. We can't afford for
• 6:32
  Speaker 4: them to have care erosion because a system that we
• 6:37
  Speaker 4: didn't fully understand was implemented and it broke right or
• 6:42
  Speaker 4: it represented a new entrant for nefarious actors to go
• 6:47
  Speaker 4: in and capture data or hold customers ransom. As you
• 6:51
  Speaker 4: alluded to these things are actually happening, and I think
• 6:54
  Speaker 4: bringing Chris here, he's an expert who spends all of
• 6:57
  Speaker 4: his time obsessing over how do I I support my
• 7:01
  Speaker 4: clients and keep them safe from this threat surface area
• 7:05
  Speaker 4: that's continuously evolving.
• 7:07
  Speaker 3: Chris, let's talk about responsibility for a second, because Scott
• 7:11
  Speaker 3: just got done saying the most important person in healthcare
• 7:14
  Speaker 3: is the patient in us surrounding them with services. They
• 7:17
  Speaker 3: have no idea what's going on behind the scenes, but
• 7:21
  Speaker 3: there has to be some kind of standard that our
• 7:26
  Speaker 3: customers are more aware of today than they were ten
• 7:30
  Speaker 3: twenty years ago because of artificial intelligence accelerating things in
• 7:34
  Speaker 3: the nefarious actors, like Scott was saying, in the hands
• 7:37
  Speaker 3: of those people, talk to us about the responsibility level
• 7:42
  Speaker 3: and what that means for operations.
• 7:45
  Speaker 5: Yeah, so it's a great, great topic to dive into,
• 7:48
  Speaker 5: and I'm going to dive straight into it. There is
• 7:52
  Speaker 5: a certain framework that you'd want to see any provider
• 7:56
  Speaker 5: bringing AI into a patient care setting. Following ISO forty
• 8:01
  Speaker 5: two thousand and one would be the AI risking governance
• 8:05
  Speaker 5: framework that you would want to see that vendor adhering to.
• 8:08
  Speaker 5: There is another one as well that is still developing.
• 8:11
  Speaker 5: But when you are dealing with different technologies that are
• 8:16
  Speaker 5: now bringing AI into the patient care setting, the vendors
• 8:21
  Speaker 5: that you're working with should be able to have a
• 8:24
  Speaker 5: proven track record of security and data privacy. These should
• 8:29
  Speaker 5: be trusted partners from your organization that you have long
• 8:32
  Speaker 5: standing relationships with that you can ask for a security
• 8:35
  Speaker 5: questionnaire to be completed in a timely fashion and they're
• 8:38
  Speaker 5: able to turn around that information to you. If you
• 8:41
  Speaker 5: are rushing out to market and there's a fear of
• 8:44
  Speaker 5: missing out right the fomo effect that's taking place, and
• 8:48
  Speaker 5: you are contracting with organizations that may have spun up
• 8:54
  Speaker 5: very recently based on funding from various organizations, and they
• 9:00
  Speaker 5: are now training their models on your patient data information,
• 9:06
  Speaker 5: that organization is very susceptible to being purchased by another organization,
• 9:12
  Speaker 5: at which point you no longer have control over your
• 9:16
  Speaker 5: data and how it's being used. And this is how
• 9:19
  Speaker 5: data leakage can take place. This is how data can
• 9:22
  Speaker 5: actually lose the ability to be governed by US data sovereignty,
• 9:26
  Speaker 5: and these are things that organizations need to protect themselves
• 9:29
  Speaker 5: from by really engaging with providers that again have that
• 9:33
  Speaker 5: proven track record that have long standing relationships that they
• 9:37
  Speaker 5: know are going to be able to prove out their
• 9:40
  Speaker 5: AI risk and governance strategy.
• 9:43
  Speaker 3: The industry that we're in is all based on evidence
• 9:48
  Speaker 3: based information. The medications that our patients are taking have
• 9:52
  Speaker 3: been put through clinical trials and they continue to be
• 9:56
  Speaker 3: put through additional trials to ensure efficacy and how well
• 10:00
  Speaker 3: they're working. And then I think if pharmacogenomics, don't even
• 10:02
  Speaker 3: get me into that, that's a whole nother podcast. I know,
• 10:07
  Speaker 3: Scott that Softwriters has an entire division that does nothing
• 10:11
  Speaker 3: but tests what is happening within the software. You even
• 10:15
  Speaker 3: have people that try to break it so that you
• 10:18
  Speaker 3: can you can see, hey, if this is in operations
• 10:21
  Speaker 3: and something's happening at the database level or the code level,
• 10:24
  Speaker 3: let's try to break this to make it foolproof so
• 10:27
  Speaker 3: that we can make sure that that doesn't happen. I
• 10:31
  Speaker 3: don't know who to ask this, Sue, Chris or Scott,
• 10:33
  Speaker 3: but are we building environments that we're testing people attacking
• 10:38
  Speaker 3: our networks so that we can say and putting AI
• 10:41
  Speaker 3: on top of it. Where you're saying we're acting as
• 10:44
  Speaker 3: a cybersecurity or a cyber stocking organization, that's trying to
• 10:49
  Speaker 3: break in talk to us about that aspect.
• 10:52
  Speaker 4: Yeah, let me let me kick it off, because there's
• 10:54
  Speaker 4: a lot to unpack with what you just described. First
• 10:57
  Speaker 4: is just the quality, you know, sort of mindsets, disciplines, processes,
• 11:02
  Speaker 4: and tools in everything that you create as a software provider,
• 11:06
  Speaker 4: and so we've continuously invested in growing our quality footprint.
• 11:11
  Speaker 4: It's a pretty large team, but more importantly, they now
• 11:15
  Speaker 4: are leveraging pretty sophisticated tools to emulate or simulate different
• 11:21
  Speaker 4: situations or customer environments. We also are in the process
• 11:26
  Speaker 4: of building out with a third party out of Silicon Valley,
• 11:29
  Speaker 4: an entire AI test bench that's going to be able
• 11:32
  Speaker 4: to simulate at scale, leveraging different lms. Basically, the way
• 11:37
  Speaker 4: things are being built today allows you to swap out
• 11:41
  Speaker 4: components of your AI tech stack, but you need to
• 11:45
  Speaker 4: be able to test those things. And so I think
• 11:48
  Speaker 4: what Chris was kind of describing a little bit with
• 11:50
  Speaker 4: this trade off of speed and quality, right this FOMO
• 11:55
  Speaker 4: that you described, if you want to get to market fast,
• 11:58
  Speaker 4: or certainly if you want to get to a prototype,
• 12:00
  Speaker 4: proof of concept, or demo fast, it's easier now than
• 12:03
  Speaker 4: it ever has been. It is just so easy. You
• 12:06
  Speaker 4: can vibe code. You could build a software product todd
• 12:10
  Speaker 4: with little development experience and show it to somebody and
• 12:14
  Speaker 4: make it look interesting. That's not hard to do. What's
• 12:17
  Speaker 4: incredibly difficult to do is to build in production scale capabilities,
• 12:23
  Speaker 4: enterprise grade production scale capabilities, to have a security posture,
• 12:28
  Speaker 4: to have clinical grade AI meaning hallucination rates that might
• 12:32
  Speaker 4: work perfectly well in helping people match their you know,
• 12:36
  Speaker 4: their T shirt color to their hair color. Right, you
• 12:40
  Speaker 4: can afford to have a twenty percent illucination rate, what's
• 12:43
  Speaker 4: our standard. Can we afford for ten percent of patients
• 12:47
  Speaker 4: to get the wrong medications? Absolutely not in the not
• 12:50
  Speaker 4: with the frigility of the patient at the end of
• 12:53
  Speaker 4: this continuum. And so you have to really be willing
• 12:56
  Speaker 4: to take the longer road. The longer road means that
• 13:00
  Speaker 4: you're going to build in quality from the start, that
• 13:03
  Speaker 4: you're going to do so, and you're not going to
• 13:05
  Speaker 4: sort of pass things to the next stage of rollout
• 13:08
  Speaker 4: until you're completely comfortable with achieving or exceeding your high
• 13:15
  Speaker 4: quality thresholds. And so that's what we've said is our standard.
• 13:18
  Speaker 4: That's why we've been at this for years and we're
• 13:21
  Speaker 4: really happy that we're reaching the point now we have
• 13:24
  Speaker 4: an AI solution that's in beta tests, and so we've
• 13:29
  Speaker 4: only gotten there through passing several stage gates. So Chris mentioned,
• 13:34
  Speaker 4: you know, picking partners who have a security posture. If
• 13:38
  Speaker 4: folks in the industry don't know how to ask the
• 13:41
  Speaker 4: right questions, then they need a partner like what Chris's
• 13:44
  Speaker 4: organization does to help them ask those questions. Because if
• 13:48
  Speaker 4: a company you're relying on to build these solutions doesn't
• 13:52
  Speaker 4: have these quality standards in their DNA, they are gonna
• 13:55
  Speaker 4: make mistakes. And AI is incredibly good at going fast.
• 14:00
  Speaker 4: It can go fast at making mistakes just like it
• 14:03
  Speaker 4: can go fast at bringing value. And so you really
• 14:06
  Speaker 4: have to understand that equation. And maybe Chris can talk
• 14:09
  Speaker 4: to a little bit of how do you do that
• 14:11
  Speaker 4: really well as an organization?
• 14:13
  Speaker 5: Yeah, and Scott, I think it's you know, no coincidence
• 14:17
  Speaker 5: that you understand AI risk and governance and you lead
• 14:21
  Speaker 5: an organization right that is the industry leading LTC pharmacy
• 14:26
  Speaker 5: software and you hear from the leadership at this company
• 14:29
  Speaker 5: how seriously they're taking AI risk and governance right. And
• 14:33
  Speaker 5: when you have that type of mindset, you have accountability
• 14:36
  Speaker 5: that's in place to the quality standards that they're going
• 14:39
  Speaker 5: to adhere to. Other organizations that don't have that leadership
• 14:44
  Speaker 5: level accountability are falling victim to that FOMO that I
• 14:48
  Speaker 5: had mentioned, where at the managerial and director level they're
• 14:51
  Speaker 5: rushing out to try to prove efficiency, prove speed, accelerate
• 14:56
  Speaker 5: certain workflow processes. But if there is not a hullist
• 15:00
  Speaker 5: approach to how AI is going to be utilized within
• 15:03
  Speaker 5: an organization, it can very quickly go awry, and it
• 15:06
  Speaker 5: can scale awry very quickly. Right. I mean AI is
• 15:11
  Speaker 5: not good nor evil, right, it can simply be managed
• 15:14
  Speaker 5: or unmanaged, and if you have the right guardrails in place,
• 15:18
  Speaker 5: people can be incredibly effective at utilizing the technology. I
• 15:22
  Speaker 5: will say though, on the flip side of the coin,
• 15:25
  Speaker 5: there are bad actors right that are leveraging the technology
• 15:29
  Speaker 5: for nefarious purposes, and they are able to speed up
• 15:33
  Speaker 5: their actions at trying to exploit US businesses on a
• 15:39
  Speaker 5: monetary basis. So things that used to take a lot
• 15:42
  Speaker 5: of manual effort to do port scanning and things of
• 15:45
  Speaker 5: that nature to find vulnerabilities within an organization, you can
• 15:50
  Speaker 5: leverage AI to do that. And there are people doing
• 15:53
  Speaker 5: that today right on other parts of the world. I've
• 15:58
  Speaker 5: mentioned to Scott before, people woke up and went to
• 16:01
  Speaker 5: their office and Badge scanned in and sat down at
• 16:04
  Speaker 5: their desk, and they are tracked, right. Their metrics are
• 16:08
  Speaker 5: tracked by how much money they can extract from US
• 16:11
  Speaker 5: businesses on a daily, weekly and monthly basis, right, And
• 16:14
  Speaker 5: it's a big business for them. Things that used to
• 16:18
  Speaker 5: be very manually intensive, they're now able to leverage AI
• 16:21
  Speaker 5: to move even faster. So we are on the cybersecurity
• 16:25
  Speaker 5: side leveraging AI to thwart those efforts, right, So there
• 16:29
  Speaker 5: is a battle between both sides, but AI at the
• 16:32
  Speaker 5: end of the day, it's not good nor evil. It
• 16:34
  Speaker 5: simply is it managed or unmanaged within your organization.
• 16:38
  Speaker 4: One of the things that you touched on at our conference,
• 16:41
  Speaker 4: which I thought was really profound, is that security is
• 16:45
  Speaker 4: a leadership problem. And why is cybersecurity or security more
• 16:50
  Speaker 4: broadly a leadership problem? One It never stops. So we
• 16:56
  Speaker 4: have this cybersecurity maturity process and matrix that we track
• 16:59
  Speaker 4: as organization. We wanted to get way past a passing
• 17:03
  Speaker 4: score to a top Descyle score. You get there, and
• 17:08
  Speaker 4: if you just stand still and stop investing and stop
• 17:10
  Speaker 4: continuously improving your cyber posture. You will go backwards when
• 17:15
  Speaker 4: you test yourself next year, because why, this is not
• 17:18
  Speaker 4: a static environment. This is a very complex environment where
• 17:22
  Speaker 4: things continue to change and the pace of change is
• 17:24
  Speaker 4: only accelerating. So it becomes a leadership problem or challenge,
• 17:30
  Speaker 4: meaning you have to make this part of your organization's DNA.
• 17:34
  Speaker 4: It has to become part of every single employee's expectation,
• 17:38
  Speaker 4: right and everyone has to step on that treadmill and
• 17:42
  Speaker 4: start investing in learning and understanding where are the threat
• 17:47
  Speaker 4: vectors and what can we do to fortify our organization
• 17:51
  Speaker 4: and our clients' organizations and their data to insulate them
• 17:55
  Speaker 4: from risk. And then, Todd, in your question that you
• 17:59
  Speaker 4: asked like seven minutes ago, we get really excited about
• 18:03
  Speaker 4: this topic. So we go. You asked, well, so do
• 18:07
  Speaker 4: you simulate things going wrong? You bet you do. We
• 18:12
  Speaker 4: run those simulations, We run tabletop exercises. And by the way,
• 18:17
  Speaker 4: the moment, the moment you actually go and test what
• 18:20
  Speaker 4: happens if someone is able to penetrate our environment and
• 18:26
  Speaker 4: take data or take access to your machines, you realize
• 18:29
  Speaker 4: how quickly this is not an it issue that you
• 18:31
  Speaker 4: delegated to one person in your technology organization. This is
• 18:35
  Speaker 4: a leadership issue that affects every single facet of the company,
• 18:40
  Speaker 4: and how you communicate to your teams and to other
• 18:43
  Speaker 4: various stakeholders is so incredibly important. And what you're doing
• 18:46
  Speaker 4: when you're running these simulations is you're making sure you're ready, right,
• 18:50
  Speaker 4: You're making sure that you can recover things in minutes,
• 18:54
  Speaker 4: not hours or days. You're making sure that all of
• 18:57
  Speaker 4: your teams know exactly what to do should those situations
• 19:01
  Speaker 4: come to fruition, so that there's no time spent. Time
• 19:04
  Speaker 4: is very precious when you're in these situations. I'm sure
• 19:07
  Speaker 4: Chris can attest to you're not spending any time trying
• 19:10
  Speaker 4: to figure out, well, who's going to do what? No,
• 19:12
  Speaker 4: that's all spelled out in advance. We know exactly you're
• 19:15
  Speaker 4: triggering a code read, you know exactly who's responsible for what,
• 19:20
  Speaker 4: and you're just in execution mode. And that's how you
• 19:23
  Speaker 4: really could create this as a discipline and a leadership
• 19:27
  Speaker 4: mindset that every member of a company carries on a
• 19:30
  Speaker 4: daily basis.
• 19:31
  Speaker 5: Yeah, and Scott, it is so refreshing to hear, you know,
• 19:36
  Speaker 5: leadership within an organization really taking cybersecurity so seriously and
• 19:40
  Speaker 5: making it part of your DNA. I'm just going to
• 19:42
  Speaker 5: double click real quick on the tabletop exercises, obviously. That's
• 19:46
  Speaker 5: that's something that we do at Echelon Risk and cyber
• 19:48
  Speaker 5: all day, every day, and we don't just design a
• 19:52
  Speaker 5: generic scenario for our clients. We will go in and
• 19:56
  Speaker 5: get a very deep, granular understanding of their business, their industry,
• 20:02
  Speaker 5: then go through a minor attack framework to see what
• 20:04
  Speaker 5: is going to be the most likely attack that would
• 20:07
  Speaker 5: take place in their environment. We will then take the
• 20:10
  Speaker 5: executive team for an executive tabletop and we will role
• 20:14
  Speaker 5: play the scenario through several injections of information that take
• 20:18
  Speaker 5: place over time. So it is really strengthening the muscle
• 20:22
  Speaker 5: memory within an organization so that when a cyber incident,
• 20:26
  Speaker 5: god forbid it ever does take place, everybody knows exactly
• 20:30
  Speaker 5: how to react, and they even know how to react
• 20:33
  Speaker 5: if certain key players are unavailable. So in certain scenarios,
• 20:38
  Speaker 5: I mean I know that Scott here takes cybersecurity incredibly
• 20:40
  Speaker 5: seriously and is going to have a very active role
• 20:43
  Speaker 5: in that response, we may design a scenario where Scott
• 20:46
  Speaker 5: is actually on a cruise with his family, and now
• 20:49
  Speaker 5: the rest of the team has to navigate the scenario
• 20:52
  Speaker 5: on their own so that they have the muscle memory
• 20:54
  Speaker 5: in place to be able to come back from an
• 20:57
  Speaker 5: incident like that in a very timely fashion. We don't
• 21:01
  Speaker 5: want to ever see a team learning in real time
• 21:05
  Speaker 5: how to respond to a cyber incident. They should have
• 21:08
  Speaker 5: that all rehearsed down to a t. And we do
• 21:11
  Speaker 5: that continually on a quarterly basis with our clients to
• 21:14
  Speaker 5: make sure again that they're always improving that muscle memory.
• 21:18
  Speaker 3: Is there a top five shout outs to our long
• 21:22
  Speaker 3: term care pharmacy operators that you could say, here's a
• 21:26
  Speaker 3: good place to start to re establish or maybe I
• 21:31
  Speaker 3: hope that this isn't your first time a shout out
• 21:34
  Speaker 3: to all of you long term care pharmacy operators out there.
• 21:36
  Speaker 3: I hope that this isn't your first time. You're thinking
• 21:38
  Speaker 3: about this, But is there something that we can give
• 21:42
  Speaker 3: our listeners today to say, hey, here's a bullet point,
• 21:45
  Speaker 3: here's a checklist of things that you should be thinking
• 21:47
  Speaker 3: about to get ready to improve upon your cybersecurity plan.
• 21:51
  Speaker 5: So we traditionally start our engagements with either a cybersecurity
• 21:56
  Speaker 5: risk assessment or a hippo security risk assessment based on
• 22:01
  Speaker 5: the organization's needs. Obviously, larger organizations we have much more
• 22:05
  Speaker 5: advanced frameworks where we map certain controls towards regulatory frameworks
• 22:10
  Speaker 5: for them, But for a lot of the smaller mid
• 22:13
  Speaker 5: sized organizations, there are more pragmatic frameworks for them to
• 22:17
  Speaker 5: step into that will at least give them a baseline
• 22:20
  Speaker 5: understanding of their cybersecurity posture that will identify the gaps
• 22:25
  Speaker 5: and areas for optimization. We often refer to it as
• 22:29
  Speaker 5: being able to identify where you're going to get the
• 22:31
  Speaker 5: best bang for your buck, whereas the low hanging fruit
• 22:34
  Speaker 5: that if we can true up these gaps, you will
• 22:37
  Speaker 5: be in a much stronger position. So based off of
• 22:41
  Speaker 5: that initial assessment, that's often where we would recommend tabletop exercises,
• 22:45
  Speaker 5: penetration tests. We can even get into more specific AI
• 22:49
  Speaker 5: risk and governance. If they do have AI deployed, we
• 22:52
  Speaker 5: can go through a very in depth discovery and analysis
• 22:56
  Speaker 5: of the AI technologies that are in place and then
• 22:59
  Speaker 5: all so weighing out the different risk factors associated with
• 23:02
  Speaker 5: them to see if some of them maybe should not
• 23:06
  Speaker 5: be allowed to operate in their environment and need to
• 23:08
  Speaker 5: be decommissioned. But it really starts with that initial assessment.
• 23:13
  Speaker 4: What I've observed is that there's a bit of a
• 23:16
  Speaker 4: fear factor of it's overwhelming. I think everybody knows and
• 23:23
  Speaker 4: understands how complex the apparatus is of cybersecurity and the
• 23:29
  Speaker 4: proliferation of new cybersecurity tools and services and third party providers.
• 23:34
  Speaker 4: It can be overwhelming. And so where do I start?
• 23:38
  Speaker 4: And I think getting that baseline assessment. I know we
• 23:41
  Speaker 4: did that. We did a really thorough baseline assessment in
• 23:44
  Speaker 4: twenty sixteen. I was here at that time, and there
• 23:48
  Speaker 4: were quite a few things that needed to be addressed.
• 23:50
  Speaker 4: And you start a systematic process of identify top threat area, remediate,
• 23:57
  Speaker 4: move on to the next one. This is a journe
• 24:00
  Speaker 4: but you can't let the fear of what it's going
• 24:04
  Speaker 4: to cost and how complicated their mediation will be prevent
• 24:08
  Speaker 4: you from taking that first step. And you know, I
• 24:11
  Speaker 4: think for some of the less resourced organizations, think the
• 24:14
  Speaker 4: smaller pharmacy operators, Todd, I know you know many of
• 24:17
  Speaker 4: these folks by name. You know, sometimes remediation can be
• 24:22
  Speaker 4: swifter than you think. You can fix one or two
• 24:25
  Speaker 4: dominoes and it does create quite a bit of an
• 24:27
  Speaker 4: improvement in your maturity profile, and so I wouldn't let
• 24:31
  Speaker 4: that fear of what is this going to look like?
• 24:35
  Speaker 4: How hard or complicated will this be prevent you from
• 24:38
  Speaker 4: taking the first step. And it's better if you have
• 24:41
  Speaker 4: a third party alongside you to help you interpret those results.
• 24:44
  Speaker 4: Prioritization and sequencing is incredibly important, but you've got to
• 24:49
  Speaker 4: start somewhere. And I think most of our customers they're
• 24:53
  Speaker 4: doing this today. They've got, you know, some steps taken.
• 24:58
  Speaker 4: It's just that the environment is transforming, changing, evolving, getting harder,
• 25:06
  Speaker 4: and so it's are we keeping pace right? And do
• 25:08
  Speaker 4: you have somebody you know, Chris and we have other
• 25:13
  Speaker 4: partners of ours that we have this fluid conversation because
• 25:17
  Speaker 4: you know that things are changing and evolving, you want
• 25:19
  Speaker 4: the experts to help guide you towards where you need
• 25:22
  Speaker 4: to continue to invest. Yep.
• 25:25
  Speaker 5: Yeah, And Scott you mentioned a key point there right
• 25:27
  Speaker 5: where it can feel a little bit overwhelming for certain organizations,
• 25:32
  Speaker 5: right that maybe haven't practice solid cybersecurity hygiene in a while,
• 25:36
  Speaker 5: and they know that they may be deficient, and rather
• 25:39
  Speaker 5: than engaging and doing a thorough cybersecurity risk assessment. You know,
• 25:43
  Speaker 5: sometimes they fall victim to simply buying a product that
• 25:47
  Speaker 5: they think this product is going to solve all my challenges, right,
• 25:51
  Speaker 5: and the advertising and marketing it reassures them that it
• 25:56
  Speaker 5: surely will. And I'm here to say there is no
• 25:59
  Speaker 5: single product that you can buy to achieve security. It
• 26:03
  Speaker 5: is a journey over time, and it's going to take
• 26:06
  Speaker 5: small steps that can put you in a very different
• 26:09
  Speaker 5: place in a relatively short compressed timeframe. Right. If you
• 26:13
  Speaker 5: do prioritize the risks across your organization and you address them,
• 26:18
  Speaker 5: you can see an eighty to ninety percent reduction in
• 26:21
  Speaker 5: vulnerabilities within a three to six month period. That is
• 26:25
  Speaker 5: a huge difference than when you started and you had
• 26:28
  Speaker 5: an incredibly vulnerable environment to actually having significant defensive hardening
• 26:33
  Speaker 5: in place. Right. But that does take that first step
• 26:37
  Speaker 5: of engaging with the cybersecurity professional team that can come
• 26:41
  Speaker 5: in and understand your business, your operations, and where you're
• 26:45
  Speaker 5: really going to be able to achieve the best bang
• 26:46
  Speaker 5: for your buck in terms of remediation.
• 26:50
  Speaker 3: So we always talk about people technology process mapping. It's
• 26:58
  Speaker 3: almost the way off writers talks almost about everything. The
• 27:02
  Speaker 3: way that you structure the communications that Chris just talked about.
• 27:07
  Speaker 3: How often are we bringing our entire team together at
• 27:10
  Speaker 3: our long term care pharmacies and sitting everybody down and saying, hey, listen,
• 27:16
  Speaker 3: from the simple thing of getting a text that says, hey,
• 27:19
  Speaker 3: could you go buy me five prepaid phone cards? This
• 27:23
  Speaker 3: is Scott Batty and you know, and everybody's like, we
• 27:25
  Speaker 3: know that that's you know, just a phishing scam or
• 27:29
  Speaker 3: an email that looks suspicious. I mean, there's how often
• 27:33
  Speaker 3: are we bringing our teams together to just give them
• 27:36
  Speaker 3: a heads up? Because I think the people part of
• 27:38
  Speaker 3: what I just said people technology processes. I think people
• 27:42
  Speaker 3: is the is always the.
• 27:46
  Speaker 4: Link that's going to might break. Yeah, we think the
• 27:51
  Speaker 4: fallacy is we think we need better locks on our
• 27:55
  Speaker 4: doors and windows, and you know it's usually your people
• 28:00
  Speaker 4: that open the door up and invite in the bad actor.
• 28:05
  Speaker 4: Now they do so willingly, of course not, that's not
• 28:08
  Speaker 4: not if you have the right people. So why does
• 28:11
  Speaker 4: it happen. It happens when you're in a rush. It
• 28:15
  Speaker 4: happens when you're you have a momentary lapse in judgment.
• 28:19
  Speaker 4: You're you're not focused or thinking with a security first mindset,
• 28:22
  Speaker 4: which is why a lot of the tools that that
• 28:26
  Speaker 4: are available in the market that do cybersecurity training and awareness,
• 28:31
  Speaker 4: they do ongoing rolling tests. Now, what good is a test?
• 28:35
  Speaker 4: While the organization and leadership need to make sure people
• 28:38
  Speaker 4: take it really seriously, so seriously that if people violate
• 28:43
  Speaker 4: and click on the phishing campaigns two to three times,
• 28:46
  Speaker 4: that they're going to have an adverse impact on their
• 28:50
  Speaker 4: performance assessment right that they it has to hit home.
• 28:55
  Speaker 4: If you want it to be top of mind, there
• 28:58
  Speaker 4: has to be a level of frequency with which you're
• 29:02
  Speaker 4: testing their aptitude. And to be honest that you use
• 29:05
  Speaker 4: this prepaid phone card thing. I feel like it used
• 29:10
  Speaker 4: to be very easy to detect fraudulent activity. It is
• 29:16
  Speaker 4: getting harder, it is, and I think the solutions that
• 29:20
  Speaker 4: leverage AI, the design, the capability. I mean, when you
• 29:23
  Speaker 4: look at it in your mobile device, at times, it
• 29:26
  Speaker 4: can look incredibly real, and so it's gotten you know
• 29:33
  Speaker 4: that we just have to keep in mind, and it's
• 29:35
  Speaker 4: gotten harder to decipher, you know, what's valid from what's nefarious.
• 29:40
  Speaker 4: And so that's really the reason why it has to
• 29:43
  Speaker 4: become a process that is frequent so that people keep
• 29:48
  Speaker 4: it front and center. It's that momentary lapse in judgment
• 29:51
  Speaker 4: is when the door gets opened down. Yeah.
• 29:54
  Speaker 5: I mean, look, we've all been around a little while.
• 29:58
  Speaker 5: I think that we remember when the emails use to
• 30:00
  Speaker 5: come to us that were carpet bombed with typos and
• 30:03
  Speaker 5: grammatical errors, and you knew that you should probably not
• 30:09
  Speaker 5: wire transfer money to this account, right, But they have
• 30:14
  Speaker 5: gotten so much better. Okay, So yes, the bad actors
• 30:18
  Speaker 5: are certainly leveraging AI, and they're able to do it
• 30:21
  Speaker 5: at scale, so they can go out and use their
• 30:24
  Speaker 5: tools now to gather a list of all of the
• 30:27
  Speaker 5: CEOs of businesses in a certain industry. They can then
• 30:31
  Speaker 5: go out and find out this is a real world
• 30:33
  Speaker 5: example of where the what private schools their children may
• 30:38
  Speaker 5: go to, then sending an email that says police report
• 30:43
  Speaker 5: from the school. Please click this link. This is the
• 30:46
  Speaker 5: video to the incident from your child's side. What they're
• 30:49
  Speaker 5: doing is trying to get an emotional response to take
• 30:52
  Speaker 5: place where that person will now have an adrenaline dump
• 30:55
  Speaker 5: in their body. They think that they are in a
• 30:58
  Speaker 5: fight or flight scenario and they are trying to elicit
• 31:01
  Speaker 5: the response to get them to click that link by
• 31:05
  Speaker 5: any means necessary and the only way to prevent people
• 31:09
  Speaker 5: from falling victim to these different scenarios is with ongoing
• 31:13
  Speaker 5: security awareness training and letting them know this isn't how
• 31:17
  Speaker 5: you would be contacted by a police department. If there
• 31:20
  Speaker 5: is a true incident that took place, right, a phone
• 31:23
  Speaker 5: call is going to take place, you would be hearing
• 31:25
  Speaker 5: from them directly. But it's that ongoing monthly security awareness
• 31:31
  Speaker 5: training that improves that muscle memory within your user RaSE
• 31:35
  Speaker 5: over time. We have tools where we can actually track
• 31:38
  Speaker 5: the efficiency of the training. Anybody that is still falling
• 31:43
  Speaker 5: victim to one of these types of attempts can get
• 31:48
  Speaker 5: some additional training, right. We have found that over time,
• 31:53
  Speaker 5: longer training sessions are typically not as well absorbed. We
• 31:58
  Speaker 5: try to keep them shorter, keeping it top of mind,
• 32:02
  Speaker 5: keeping it focused. There's even scenarios now where we do
• 32:06
  Speaker 5: gamification of the cybersecurity awareness training, so that's somebody who
• 32:11
  Speaker 5: is really excelling at it actually wins a prize at
• 32:14
  Speaker 5: the end of the year.
• 32:15
  Speaker 4: Right.
• 32:16
  Speaker 5: So it's something where there can be points systems associated
• 32:19
  Speaker 5: with it. You know, it doesn't want to you don't
• 32:21
  Speaker 5: want to always fall into the character the stick and
• 32:24
  Speaker 5: use the se but really using the character to keep
• 32:26
  Speaker 5: people interested in what might be waiting for them around
• 32:31
  Speaker 5: the corner and how to protect against that.
• 32:35
  Speaker 4: In some respects is almost the most distracted population of
• 32:40
  Speaker 4: humans probably in human history right now, right with this
• 32:44
  Speaker 4: emergence of cell phones and other devices, it just feels like,
• 32:48
  Speaker 4: I don't know about you, guys, but there's this constant
• 32:51
  Speaker 4: stock ticker reel of information coming at me, right and
• 32:54
  Speaker 4: that's everybody. And so what you want to do with
• 32:58
  Speaker 4: these trainings and with these simulations is get people to
• 33:02
  Speaker 4: slow down and think before they click. And you do
• 33:07
  Speaker 4: that through you know, short form and active learning, meaning
• 33:14
  Speaker 4: you're not just clicking a link and then moving it
• 33:17
  Speaker 4: off to a separate monitor and letting it play and
• 33:19
  Speaker 4: then okay, I completed my training. No, you have to
• 33:22
  Speaker 4: click through. You have to you have to scan through
• 33:24
  Speaker 4: this email and identify what are the points that show
• 33:27
  Speaker 4: you that it's a potential threat. It's an active learning.
• 33:30
  Speaker 4: It's the same way we've built Framework Academy to be
• 33:33
  Speaker 4: testing our users and learners who are trying to learn
• 33:37
  Speaker 4: new facets of our application. It's a very active learning
• 33:40
  Speaker 4: posture that people need to have, and that's how you
• 33:42
  Speaker 4: make sure that they're they're not just putting in his
• 33:46
  Speaker 4: background noise, but that are actually digesting the content material.
• 33:50
  Speaker 3: What organizations Chris are Is it the boards of pharmacy
• 33:55
  Speaker 3: or is it something state federal that impose fines for
• 34:00
  Speaker 3: the breach of patient health care information? PHI talk to
• 34:04
  Speaker 3: our listeners and I don't want to scare our listeners.
• 34:06
  Speaker 3: This is not to be a scary podcast, but we
• 34:09
  Speaker 3: do want to think about this. Talk to us about
• 34:12
  Speaker 3: the fine side of things and what they're looking for
• 34:14
  Speaker 3: and what audits or how they're testing them.
• 34:17
  Speaker 5: Yeah, so it's HHS that would do an OCR audit
• 34:20
  Speaker 5: that can lead to find based on data security and
• 34:25
  Speaker 5: privacy rules that may or may not have been broken
• 34:27
  Speaker 5: during a breach. What we do as part of our
• 34:30
  Speaker 5: hyper security risk assessments is we actually do a mock
• 34:32
  Speaker 5: OCR audit at the onset. So we'll come into an
• 34:36
  Speaker 5: organization and actually have our cybersecurity advisors show up unannounced
• 34:41
  Speaker 5: to take an organization through an OCR audit to see
• 34:45
  Speaker 5: where are the gaps right, if this actually did take
• 34:48
  Speaker 5: place in real time, what needs to be addressed and
• 34:52
  Speaker 5: after our initial mock OCR audit, those are the gaps
• 34:56
  Speaker 5: that we very quickly address to make sure that they
• 34:59
  Speaker 5: aren't a defense position. I will say this in terms
• 35:02
  Speaker 5: of the fines, yes, that we have seen some very
• 35:05
  Speaker 5: large ones, you know in the LTC pharmacy community, where
• 35:09
  Speaker 5: there was egregious behavior, maybe almost wilful negligence when it
• 35:13
  Speaker 5: came to cybersecurity.
• 35:14
  Speaker 3: Right.
• 35:15
  Speaker 5: What they really do want to see is a collaborative
• 35:19
  Speaker 5: nature between the organization and their auditing body, and they
• 35:24
  Speaker 5: want to see that an organization is attempting to improve
• 35:28
  Speaker 5: their cybersecurity posture over time.
• 35:31
  Speaker 4: Right.
• 35:31
  Speaker 5: So, as Scott mentioned, it's not something that you achieve
• 35:33
  Speaker 5: one time and you are good to go for ten years.
• 35:37
  Speaker 5: But they want to see that a pen test is
• 35:39
  Speaker 5: being done on an annual basis, that you have a
• 35:42
  Speaker 5: valid security awareness training program that's in place, that you
• 35:45
  Speaker 5: are monitoring the vulnerabilities that exists across your organization, and
• 35:49
  Speaker 5: by showing them that you are taking action to move
• 35:53
  Speaker 5: forward in that direction, it greatly reduces the probability of
• 35:59
  Speaker 5: actually incurring a fine.
• 36:02
  Speaker 4: And honestly, I think the fine itself is less of
• 36:08
  Speaker 4: a concern than the impact to business operations. This concept
• 36:14
  Speaker 4: of business continuity, right, it's that you want to make
• 36:17
  Speaker 4: sure that you can deliver on the expectation for your customers,
• 36:22
  Speaker 4: and that's first and foremost. You deal with the consequences
• 36:26
  Speaker 4: and fines down the road. But we got to get
• 36:28
  Speaker 4: operational so that patients get their meds right. And so
• 36:32
  Speaker 4: I think that's where these these simulations and exercises just
• 36:37
  Speaker 4: improve your confidence and help you kind of build that
• 36:41
  Speaker 4: muscle memory so that if you're ever found in that situation,
• 36:47
  Speaker 4: you're able to operate without as much planning and contemplation.
• 36:51
  Speaker 4: It's just part of your process discipline.
• 36:53
  Speaker 5: Yeah, resilience is a competitive advantage, right. Organizations that are
• 36:59
  Speaker 5: dealing with this options in their business, they're going to
• 37:01
  Speaker 5: have massive reputational damage and they're going to lose the
• 37:05
  Speaker 5: trust of their clientele. Right, So being able to be
• 37:10
  Speaker 5: able to very quickly rebound from any type of incident
• 37:14
  Speaker 5: that that may occur puts that organization in a position
• 37:18
  Speaker 5: to truly have a competitive advantage over time as opposed
• 37:21
  Speaker 5: to their peers in their own marketplace.
• 37:25
  Speaker 4: Can I break parliamentary procedure and ask Chris a question Todd,
• 37:29
  Speaker 4: you're the host. Absolutely, I don't know. If you had
• 37:32
  Speaker 4: like a zapper, you're gonna hit a mutton and Zemi.
• 37:35
  Speaker 3: I'm still feeling guilty about the word treadmill and muscle
• 37:38
  Speaker 3: memory because it's the new year and I'm not even
• 37:41
  Speaker 3: on my regimen as I should be, So please, I
• 37:44
  Speaker 3: don't divert my guilty feelings.
• 37:48
  Speaker 4: So, Chris, you talked a little bit about the importance
• 37:52
  Speaker 4: of you know, understanding your your risk posture, understanding the
• 37:58
  Speaker 4: sources of risk. And I know you're intimately familiar with
• 38:02
  Speaker 4: LTC pharmacy. This is a very connected ecosystem where to
• 38:06
  Speaker 4: deliver this complex care equation, you'd rely on third party
• 38:10
  Speaker 4: vendors for a whole host of you know, both hardware
• 38:15
  Speaker 4: and software needs. And so you know that this is
• 38:19
  Speaker 4: a booming era of entrepreneurship and you have new, uh
• 38:24
  Speaker 4: you know, partners emerging on a pretty frequent cadence now,
• 38:27
  Speaker 4: So any advice you could offer to a pharmacy operator
• 38:32
  Speaker 4: who's trying to vet or evaluate or think through who
• 38:37
  Speaker 4: they partner with and how they evaluate sort of new
• 38:42
  Speaker 4: potential sources of opportunity but also risk, it's a great question.
• 38:47
  Speaker 5: So I would say, when doing vendor due diligence that
• 38:52
  Speaker 5: these organizations should really have a security questionnaire that has
• 38:56
  Speaker 5: been designed to vet out partners that are going to
• 39:00
  Speaker 5: be introduced into their supply chain, which is really what
• 39:04
  Speaker 5: they're doing by allowing them within the four walls of
• 39:06
  Speaker 5: their organization, they are going to be reliant on that
• 39:10
  Speaker 5: partner for software, hardware, manufacturing of goods, delivery of said goods,
• 39:17
  Speaker 5: and they all need to adhere to a certain set
• 39:20
  Speaker 5: of criteria when it comes to their ability to determine resiliency.
• 39:27
  Speaker 5: So all of these organizations should be able to provide
• 39:30
  Speaker 5: the uptime and availability metrics that they're going to be
• 39:34
  Speaker 5: able to deliver to that LTC pharmacy. This should not
• 39:37
  Speaker 5: be information that would be difficult for them to ascertain
• 39:42
  Speaker 5: asking these questions. They should have a standard document that
• 39:46
  Speaker 5: they are able to turn around to prove that they
• 39:50
  Speaker 5: are in a defensible position. If that does not occur,
• 39:55
  Speaker 5: it may be time to look and see if there
• 39:57
  Speaker 5: might be a competitive alternative just to make sure that
• 40:00
  Speaker 5: the LTC pharmacy operator remains in a resilient possession.
• 40:04
  Speaker 4: So I think with this boom and startup entrepreneurship new entrants,
• 40:11
  Speaker 4: there aren't dedicated histories that they could point to. Reliability
• 40:16
  Speaker 4: up time hard to call that when you don't have
• 40:20
  Speaker 4: an operating history that's robust, and I think this is
• 40:24
  Speaker 4: something that really should be top of mind for somebody
• 40:28
  Speaker 4: in a heavily regulated industry that does important work like
• 40:33
  Speaker 4: healthcare and like long term care pharmacies. Is that you're
• 40:37
  Speaker 4: taking a chance with any partner who you choose to pursue,
• 40:42
  Speaker 4: and you need to understand the questions to ask, to
• 40:47
  Speaker 4: Chris's point, and you can't just accept, well, I don't
• 40:51
  Speaker 4: have data because I'm new, well okay, and even just
• 40:56
  Speaker 4: asking exploratory questions about you showed me this demo of
• 41:00
  Speaker 4: this really exciting AI thing. What models is it utilizing
• 41:04
  Speaker 4: and how do you train those models? How are you testing,
• 41:07
  Speaker 4: what's your hallucination rates? All these things that if they're
• 41:11
  Speaker 4: approaching it with appropriate care and consideration, these are not
• 41:15
  Speaker 4: difficult conversations to have. If they've been cavalier, or maybe
• 41:21
  Speaker 4: they're forsaking quality for speed, then these are going to
• 41:24
  Speaker 4: be very uncomfortable conversations. They're not going to have an answer.
• 41:27
  Speaker 4: You might actually hear a click on the other side
• 41:29
  Speaker 4: of the phone. It doesn't click anymore.
• 41:31
  Speaker 5: It just ends, and it may be helpful to ask
• 41:36
  Speaker 5: for you know, three to five customer references of other
• 41:40
  Speaker 5: LTC pharmacy operators of similar size that have benefited from
• 41:44
  Speaker 5: leveraging that technology. Right, And I would always go back,
• 41:47
  Speaker 5: especially with the AI LLM and agentic AI you know
• 41:53
  Speaker 5: ARENA asking where their cloud repositories reside, right, understanding where
• 41:59
  Speaker 5: is your data act actually going? How is it being utilized?
• 42:02
  Speaker 5: You need to be able to track that down and
• 42:04
  Speaker 5: prove that out. If somebody else comes in to audit
• 42:06
  Speaker 5: your organization and you don't have those answers, that would
• 42:10
  Speaker 5: show a severe lack of accountability at the leadership level.
• 42:14
  Speaker 4: That's right, and it's you are responsible for that data,
• 42:19
  Speaker 4: that patient information that is entrusted to you. And so
• 42:25
  Speaker 4: that's why it's just super important to understand and keep
• 42:28
  Speaker 4: that front and center. Last I checked, you can't take
• 42:31
  Speaker 4: AI uh to jail. You can't take AI, you can't
• 42:35
  Speaker 4: find AI. So what's going to happen is it's going
• 42:38
  Speaker 4: to They're going to look at the people that are
• 42:39
  Speaker 4: utilizing these tools. True.
• 42:43
  Speaker 5: Yeah, the risk and accountability resides with the leadership of
• 42:46
  Speaker 5: the organization, right, It does not go outside of their
• 42:50
  Speaker 5: four walls. It is it is their responsibility as the
• 42:54
  Speaker 5: leader of that organization to understand the AI technologies that
• 42:58
  Speaker 5: are in place and the risk that comes with it.
• 43:01
  Speaker 5: But again with strong governance, again it's an accelerator in
• 43:06
  Speaker 5: terms of adopting and leveraging the AI for good right
• 43:10
  Speaker 5: and if you have strong guardrails, you have a strong
• 43:12
  Speaker 5: program in place, you can be faster to market and
• 43:16
  Speaker 5: more efficient, which is ultimately what everybody is looking to achieve.
• 43:20
  Speaker 5: So again, embracing governance at the leadership level will put
• 43:25
  Speaker 5: an organization in a significantly They will have a competitive
• 43:29
  Speaker 5: advantage over anybody that is simply deploying AI, chasing a
• 43:34
  Speaker 5: buzzword and thinking that they're going to achieve a certain
• 43:37
  Speaker 5: efficiency rate. Having a pragmatic, programmatic approach is really going
• 43:44
  Speaker 5: to be who defines the winners.
• 43:46
  Speaker 4: I think there's another interesting point here, which is any
• 43:51
  Speaker 4: AI solution or just most of the new emerging technologies
• 43:56
  Speaker 4: are built upon a corpus of data. To the extent
• 44:00
  Speaker 4: that that data is of a high quality, it's going
• 44:03
  Speaker 4: to improve the efficacy of the outputs of whatever that
• 44:07
  Speaker 4: process or system is. If you have data quality problems
• 44:11
  Speaker 4: and you don't have that center of excellence around the
• 44:14
  Speaker 4: data sets that you're pouring into a model, all you're
• 44:18
  Speaker 4: going to do is teach the model how to make mistakes,
• 44:21
  Speaker 4: how to generate right. These are predictive models that are
• 44:24
  Speaker 4: predicting what comes next based upon learning on previous data sets.
• 44:30
  Speaker 4: So those flaws that were inherent in that initial corpus
• 44:34
  Speaker 4: of data will simply accelerate the mistake making that happens.
• 44:40
  Speaker 4: So that's where there's more to this than just tools
• 44:43
  Speaker 4: and vendors. It's also the corpus of data and how
• 44:48
  Speaker 4: what are your procedures around cleansing and evaluating? Do you
• 44:52
  Speaker 4: even have the skill sets on staff to make sure
• 44:56
  Speaker 4: that that data is of a high quality. These are
• 44:59
  Speaker 4: all questions that should be a front and center for
• 45:02
  Speaker 4: business people leaders before they introduce a new solution. Is
• 45:07
  Speaker 4: how do we really make sure not just that the
• 45:09
  Speaker 4: infrastructure is sound, that the product is reliable, but that
• 45:13
  Speaker 4: it's trained on the right data sets?
• 45:15
  Speaker 5: Sure, and how often are you doing that quality checking?
• 45:19
  Speaker 5: How often are you checking for bias taking place within
• 45:24
  Speaker 5: the AI model?
• 45:25
  Speaker 4: Right?
• 45:25
  Speaker 5: These are things that can take place over time due
• 45:28
  Speaker 5: to the data that is being ingested. If there is
• 45:31
  Speaker 5: not ongoing testing and quality assurance of the AI model,
• 45:36
  Speaker 5: there will be drift over time. We will train it
• 45:39
  Speaker 5: to be biased and that can certainly create different outcomes
• 45:43
  Speaker 5: than we're originally intended.
• 45:46
  Speaker 3: Hey, I'd like to extend an invitation to our listeners,
• 45:50
  Speaker 3: our long term care pharmacists, our pharmacy operators, even our
• 45:54
  Speaker 3: supertexts out there. We love you. You're the right hand
• 45:57
  Speaker 3: of our pharmacists helping. Our operation is to run reach
• 46:01
  Speaker 3: out to the Softwriters team and ask a lot of questions.
• 46:04
  Speaker 3: Reach out to Chris and his team, ask a lot
• 46:08
  Speaker 3: of questions. If you're wondering how your cybersecurity policy is
• 46:13
  Speaker 3: standing up to the industry standard and what you should
• 46:16
  Speaker 3: do next.
• 46:17
  Speaker 4: Do not go this alone.
• 46:18
  Speaker 3: There's experts out there that do nothing but dig into this,
• 46:22
  Speaker 3: and Chris is one of those. Chris, would you give
• 46:24
  Speaker 3: our listeners a way to reach out to you?
• 46:28
  Speaker 4: Sure?
• 46:29
  Speaker 5: I can be reached at Chris dot Callahan at echeloncyber
• 46:33
  Speaker 5: dot com. Happy to certainly connect with any of the
• 46:38
  Speaker 5: listeners on LinkedIn. You can certainly find me there, Chris
• 46:42
  Speaker 5: Callahan at Echelon Risk and Cyber.
• 46:46
  Speaker 4: In the show notes.
• 46:47
  Speaker 3: If you're driving, jogging, walking, do not worry. This information
• 46:50
  Speaker 3: will be in our show notes. Also, you can go
• 46:52
  Speaker 3: to Framework LTC dot com reach out to their team
• 46:56
  Speaker 3: who has access to these people in this team, Softwriters
• 46:59
  Speaker 3: is surround to themselves with partners that are vetted constantly.
• 47:03
  Speaker 3: I think you have a new partner's director that's actually
• 47:06
  Speaker 3: managing all of these relationships of Scott. I want to
• 47:09
  Speaker 3: say thank you to Chris for being our special guest
• 47:11
  Speaker 3: here on Framework Focus and Scott. This has been so
• 47:14
  Speaker 3: much fun being here at Softwriters headquarters in my favorite city, Pittsburgh, Pennsylvania,
• 47:20
  Speaker 3: and I'm having hallucinations of myself of the Pittsburgh Steelers
• 47:24
  Speaker 3: going to the super Bowl, and it's all hallucination. So
• 47:27
  Speaker 3: just leave me, leave me in my hallucination.
• 47:29
  Speaker 4: That's right. Immediately following this podcast, we're running a support
• 47:32
  Speaker 4: group for a very depressed group of Pittsburgh Steeler fans
• 47:36
  Speaker 4: here in our office and we'll heal one another through
• 47:40
  Speaker 4: this process.
• 47:41
  Speaker 3: Hey, I want to thank you for listening to our
• 47:43
  Speaker 3: latest episode of Framework Focus, and once again, don't go
• 47:46
  Speaker 3: it along, reach out to Softwriters, reach out to the
• 47:49
  Speaker 3: team here at Framework LTC. And we thank you for
• 47:51
  Speaker 3: listening to Framework Focus.
• 47:53
  Speaker 4: Thank you, thank you.