A Tumultuous Healthcare Cybersecurity Landscape
Organizations must prioritize clinical care resiliency as cyberattacks grow with more intensity, and as health systems rely more on services that offer less direct security control but allow them to spin up capabilities to scale.
The previous wisdom in healthcare IT was to own and manage your infrastructure, but as many organizations have learned, their core competencies did not lie in maintaining servers and updating data centers. Their core competencies are in delivering high-quality patient care.
So, it made sense to rely on technology partners that could better handle the cloud, for instance, or deploy Software as a Service solutions that were also cost-effective. These companies were also more likely to have the team members necessary to support a new solution, compared with smaller health systems with limited IT departments.
And while many of these partners could make much bigger investments into securing their products and services, that didn’t mean healthcare organizations were off the hook in terms of protecting themselves. These systems have become so complex and connected that organizations must double down on their own security.
READ MORE: How are health systems managing security in the cloud?
Taking the First Steps Toward Clinical Care Resiliency
What happens when a critical application goes dark? Is it as simple as switching to paper and manual processes? How does that impact communication across departments?
In order for healthcare organizations to take the first steps in improving their clinical care resiliency, they need to agree on some basic conditions. First, there must be an understanding of why clinical care resiliency is important and who will own it, because fostering a sense of ownership will help solidify its necessity across the organization.
Also, seek out advice and partnerships from industry players who can share their experiences and knowledge with you. So much medical knowledge is shared, and that same spirit should inform improving clinical care resiliency.
Eventually, this resiliency approach should become second nature for healthcare organizations. As an industry, we’re expected to always play catch-up when it comes to technology. Let’s not do that with clinical care resiliency. Let’s not wait three years to meet a previous standard. Let’s make sure it's part of our governance processes now.
An Outline To Achieve Clinical Care Resiliency
So, you’re interested in building up your clinical care resiliency? What’s a useful approach?
EXPLORE: A successful cloud migration begins with an IT infrastructure assessment.
An industry partner can help with crafting your strategy. Generally, the partner can offer:
- Assessment and recommendations, meeting with different departments, such as the emergency department, med-surg, ancillary departments, outpatient clinics and finance, to get a sense of how each department deals with an IT outage. A partner can also look for a current baseline in resiliency by department, note gaps and commonalities, and offer recommendations
- Remediation, guiding organizations on how to deal with various durations of outages without technology, aligned with industry standards and securing materials needed for downtime
- Simulation, observing how an organization operates with current downtime procedures
- Real-life scenarios that test prolonged downtime procedures. Can you continue to admit patients for a month? Can you do payroll for a week? What happens when this application is no longer available to you?
While a cybersecurity event can be a motivator to move toward clinical care resiliency, there are a number of situations that can spur the need for downtime procedures, and healthcare organizations must be ready for that.
This article is part of HealthTech’s MonITor blog series.
