Health-ISAC media mention in the Journal of Cyber Policy
The shuttering of Saint Margaret’s also made an impression on David Anderson, Chief Information Security Officer at Ensemble Health Partners, a healthcare revenue cycle management company. Anderson, who is a nurse by training, spent 27 years in cybersecurity roles in the US military and intelligence community.
Anderson grew up in a rural area, so he understands the devastating consequences of a hospital closure. To him, the challenges facing Saint Margaret’s are common throughout the industry, but particularly difficult for facilities located outside of urban areas. He said, “We have a massive shortage in staffing. It’s very difficult to find and maintain qualified staff. And, when you’ve got the tight budgets that these smaller hospitals have, they have to make a choice between security and care.”
As he put it, “If it comes down to it, are you going to buy another CT scanner so you can provide care or are you going to put your money in something that still might be a little bit more nebulous, and you’re not certain what kind of impact you’re going to have?”
Anderson thinks the reality of Saint Margaret’s may change that calculus for other healthcare providers. As he said, “It comes down to a question of what’s our what’s our primary mission is patient care? Security is often viewed as a cost center rather than essentially insurance against an existential threat.” Now, the existential nature of the threat is manifest.
One relatively easy step for small, rural hospitals to take, according to Anderson, is to join the Health Information Sharing and Analysis Center (Health-ISAC). This non-profit organization offers healthcare organizations a community and forum for coordinating physical and cyber threat intelligence. It costs $2,400, but that’s a tiny investment considering the potential benefits. “Joining Health-ISAC can bring smaller facilities up to speed on the latest incident response playbooks,” Anderson added.