In reply to Stuart Broderick.

It’s improving but as you say Stuart, Board - CISO conversations are no where near where they need to be. Larger healthcare payers and providers seem to be leading the way, but the boards of smaller entities are still very much myopically focused on patient care and patient risks and keeping the business afloat in the midst of declining revenues and increasing costs. That being said, the recent ransomware attacks targeting healthcare, although executed by cyber criminals, are having a direct impact upon patient care and safety, and this is waking up healthcare leadership to the convergence of cybersecurity and patient safety, and hopefully the need to do something about it.

As they say, there’s nothing like an attack or a breach to focus leadership’s eyes to solving a problem immediately in their faces. We are seeing that many of those that suffer a breach, for a short period at least, have the absolute attention of senior leadership and the Board, and have an opportunity to ‘make good’ on 20 years of under-spending on security controls, tools, resources and services.

I agree with you that digitalization of the healthcare industry will further drive the need for improved cybersecurity, but lets hope that leadership includes security in its plans for new digital services at the outset rather than as an 11th hour ‘strap-on’ as the service goes live. Cybersecurity is after all, an ENABLER of new riskier digital services, and in turn an enabler of new revenue sources for healthcare organizations.

Here’s a question for you and others….Just how fickle are healthcare consumers? Its widely acknowledged that Target, Home Depot, and others suffered a decline in customers following their massive credit card breaches in 2014, but if my medical records were stolen, or my local hospital had to reduce services for a period, or even turn patients away as the result of a ransomware attack, how willing would I be to go to that hospital again? How worried would I be as a patient of a hospital that their under-protected information systems might succumb to a cyber-attack – perhaps while I was under the knife in surgery?

Companies typically sign year-long contracts with their medical plan providers so are locked into that contract, but how would a cyber-attack against one of their plan providers, play into the selection of insurers the following year? To what degree would employee dissatisfaction at the breach of their medical records play into corporate decision making in this respect?