One lesson that Children’s National Hospital Vice President and CISO Nate Lesser has taken from another organization has been to run more training exercises than what most providers typically do. When he learned that Intermountain Health underwent at least 24 security exercises in a year, rather than just one or two major exercises, he changed his approach.
“We still try to do at least one major exercise across a lot of departments and units, but now, we run mini-exercises on a monthly basis, sometimes more frequently with individual units,” Lesser said, adding that his team typically works more with nursing leadership.
All three leaders stressed that an organization’s cyber response plan may need to include nontechnical aspects; for example, how much cash on hand does the provider have access to if payroll is affected? What is the process to move information collected on paper charts into the EHR? What does “back to normal” even look like?
Emerging technologies represent another risk factor that more organizations must account for, especially as artificial intelligence continues to make headways in healthcare, Couture added.
“Every single one of those solutions that you put in that lets you do more with less on a day-to-day basis just made your resilience scenario that much harder. Because, while you can still do things the old way, you’ve now reset your staffing to expect to be able to get a certain amount of throughput,” Couture said. “Now, if that technology goes away, you don’t have that staff to do it the old-fashioned way. So, that’s something you have to think about: How are you going to handle that as you’re implementing each one of these new solutions? It’s great for what it is today, but also think about what this means for your resilience plan.”
READ MORE: Build clinical care resilience for when your EHR goes down.
Find the Right Industry Partners to Protect Your Environment
For healthcare organizations to improve their clinical care resilience, they should agree on some basic conditions. First, there should be an understanding about why it’s important and who will own it; fostering a sense of ownership will help crystalize its necessity to the organization. Next, seek advice and partnerships from experienced industry players.
As CDW Healthcare Strategist Eli Tarlow notes, if medical knowledge can be enthusiastically shared, so should information to improve clinical care resilience.
“Eventually, this resiliency approach should become second nature for healthcare organizations,” Tarlow wrote last year. “As an industry, we’re expected to always play catch-up when it comes to technology. Let’s not wait three years to meet a previous standard. Let’s make sure it’s part of our governance processes now.”
Find an industry partner who can offer thorough assessments and recommendations, remediation, simulation and real-life scenarios that can test how ready your departments are for an unexpected event.
