One of the most significant points of discussion currently taking place in the healthcare sector is how patient care organization leaders are responding and reacting to the growing cybersecurity threat throughout the industry. Indeed, one quick look at the monthly Protenus “Breach Barometer” report— a snapshot of reported or disclosed breaches impacting the healthcare industry, with data compiled and provided by DataBreaches.net—reveals that the trend of cyber attacks in healthcare is certainly not slowing down; in March, the number of breached records was 2.5 times the number of records breached in January and February combined.
The level of sophistication at which healthcare organizations are responding to this problem varies across the U.S., but there does seem to still be a gap in funds allocated to data security. For instance, a HIMSS Analytics and Symantec study released in February found that even though cybersecurity budgets are increasing, 65 percent of surveyed healthcare organizations are still spending less than 6 percent of funds on security. What’s more, those survey findings indicate that the majority of healthcare organizations still have five or fewer employees allocated to IT security, although two-thirds of participating organizations do have a chief information security officer (CISO), which most often report to the CIO.
Indeed, CISOs within healthcare organizations—not too long ago a position with a limited role—have now become a part of the broader senior leadership team, experts say. Nick Giannas, consultant in search firm Witt/Kieffer’s IT practice, and who specializes in executive searches for CISOs in healthcare and education specifically, notes that “There needs to be an executive to oversee security across all of the organization’s business areas and to encourage a culture of information security.”
He adds that organizations are looking for someone who can build that culture, someone who is a strong communicator, and someone who not only has the cybersecurity expertise, but also the business acumen. “You need to have better alignment between cybersecurity and the business so it doesn’t hinder operations,” Giannas says. “All of this together requires a senior executive; it’s an executive level position, so it’s about having those soft skills such as being able to build a relationship, communicate effectively, and translating those cybersecurity concepts in a way that business leaders can understand. The [CISO] has become a trusted advisor,” he says.
However, while the CISO role is clearly now evolving, Giannas does note that there is an industry-wide gap in terms of skilled candidates. “The demand for qualified CISOs far exceeds the supply of top talent for these positions,” he says. And, he adds, “There is a need to expand and look beyond healthcare to find top talent in other industries who can make a difference and who might be coming from much more secure information security environments. Now that’s not to say that there are not strong individuals in this space in healthcare—because there are—but there are just not enough.”
Nick Giannas
Throughout his searches, Giannas does find that organizations are now truly realizing the need for a talented executive leading their information security program. And beyond recognizing and recruiting that top talent, there are also other factors to consider in the hiring process, such as compensation and the actual commitment that an organization will make in terms of dollars to information security. “Gaps do remain in [budget allocation for information security], but if you look at the reports out there, with the threats continuing to evolve, we’re starting to pour more money into cybersecurity. Regarding data breaches, it’s not a matter of if, but when. So making sure you have the right tools and programs in place is important,” he says.
Certainly, these are responsibilities that fall on the CISO, and Giannas says that the forward-thinking provider organizations are starting to deploy advanced technologies such as machine learning intelligence software and predictive analytics to help protect their environments. He notes that the commitment and investment that C-suite leaders are now making in security are actually better than what many people think. “If not for organizations dedicating the resources that they are righty now, we could really be much worse off. And that’s not to say that they aren’t still behind, because they are, but the commitment is starting to pay off,” he says, adding that the pressure is on both CIOs and CISOs to look at new tools in this space. “You hear CIOs saying that cybersecurity is both the first and second thing on the list that keeps them up at night. So it really helps when you have a strong CISO in place that you can rely on. I think there is inherent pressure involved with this position, and the talented CISOs out there are really up to that challenge,” he says.
While Giannas says that in most places, the CISO is reporting to the CIO—a trend that’s in line with what the above-mentioned HIMSS Analytics survey reported—he is hearing organizations talk about moving the reporting structure to someone outside of the IT part of the organization. “I think just as cybersecurity incidences and threats evolve, thus forcing cybersecurity programs to evolve, the CISO position will also evolve. It’s an enterprise function, so you could see a trend in the future that the position will not be reporting into IT. That makes logical sense; it’s the evolution of the position. But that isn’t happening yet,” he says.
As the CISO position indeed continues to grow, a key to that evolution will be how the person in this role establishes a culture of security within the patient care environment. Adam Tallinger, vice president at consulting firm Impact Advisors, says that creating a culture of security carries equal weight to everything else that an organization dedicates culture to. He says, “If you have a culture where someone feels comfortable to reporting some [wrongdoing] or a breach in security, then you will be able to mitigate that, and restrict access to that data a lot quicker than if you have someone who tries to ignore it. Bad news never gets better with age,” Tallinger says.
In the end, just like with anything else in healthcare IT, some organizations are further along than others, so CISOs being able to create a culture of security “is an ongoing process,” Giannas says. “It’s not just about IT, and it’s not just about the information security departments. It’s about everyone playing a role across the organization, at all levels. All CISOs, even in mature environments, would say that they’re still continuing to grow in the area of establishing the right culture.”
