IREs Do Not Replace Good Disaster Recovery
Cyberthreats are evolving constantly. Now, malicious actors may target an organization’s backup systems, making recovery all the more difficult in healthcare. IREs are a separate, air-gapped environment for data and system recovery that may offer organizations a quicker turnaround to keep operations running.
But healthcare organizations should not rely solely on IREs for their cyber resilience.
“This environment is not a replacement for high availability. It is not a replacement for good disaster recovery. The first thing people see when they see this is, ‘Oh, we don’t need downtime computers anymore. Oh, why don’t we just fail over to this when we have a three-hour outage?’ No. This is not that, and should never be that,” said Jeffrey Thomas, senior vice president and CTO at Virginia-based Sentara Health. “This is really what we call a lifeboat. It helps us bridge the gap.”
WATCH: Learn about the risks and rewards of agentic artificial intelligence at HIMSS26.
Not just a single solution, IREs can help organizations reassess their cyber resilience through a more holistic, multidisciplinary lens. For example, a zero-trust framework is a foundational architectural component of an IRE.
“If you’re not building in cloud with a zero-trust framework, you probably are just replicating the same issues you have in your physical data center,” Thomas said. “That is the basis of it — least privileged access, using the controls appropriate to segment, to microsegment and control the flow of data when it’s in that environment.”
How, then, can organizations ensure that the right people access the environment during the downtime event? Thomas said that his team decided to allow clinical care access through mobile devices on a secure operating system.
“Our clinicians sit in those hospitals; they do not sit in that data center. Our biggest issue is, great, I can activate an IRE, but if I can’t get a clinician to access that environment and I have no network in that environment, how do I do it?” Thomas said.
LISTEN: What should healthcare leaders know about Microsoft Dragon Copilot?
He added that, in a few months, his team will validate their process as part of regular ransomware testing. It’s crucial that organizations understand that an IRE is not activated by IT but by the incident command center, so there are business decisions involved alongside technical ones.
“We are constantly developing our IRE. It is not a single deployment and government. We go back and we do iterations as we have the capability of services into that,” Thomas said, adding that it’s helpful to work with regular partners that will collaborate closely on the process.
Click the banner below to find out how to improve identity and access management in healthcare.
