Rural Healthcare Organizations Can Excel in Security Recruitment

Nebraska’s Community Hospital Improves IT Team Growth

Beeby’s strategy is to make Community Hospital a place where technical employees can keep growing without leaving McCook. For example, the information systems director doubles as the CISO, and he has been with the organization for 18 years. A network analyst who is heavily involved in cybersecurity has been there for nine years, and Beeby herself has been at Community Hospital for 25 years.

“We send people out to vendor-specific training and general security and networking training,” Beeby says. “Sometimes they complete training through online platforms or vendor-provided tools, and we also send our people to different conferences.”

The team watches for email compromise, suspicious network and device activity and risks tied to remote access. The organization has deployed Palo Alto firewalls, and the hospital uses Arctic Wolf to monitor network traffic.

Artificial intelligence adds another wrinkle. Community Hospital has begun developing an AI governance process to evaluate new tools, educate staff on appropriate use and assess emerging features from vendors.

GET EXPERT HELP: Elevate care coordination today while paving the way for tomorrow's breakthroughs.

Although Community Hospital has a stable, long-tenured information systems team, the small size of the organization could create significant challenges if two or three of those professionals left the organization at once. If that happened, Beeby says, remaining staffers would work together to pick up the slack, while also temporarily increasing the use of third-party contractors.

Community Hospital has also used hybrid and remote work to make IS roles more sustainable, including alternating onsite and remote schedules and, in one case, keeping an employee on a full-time remote schedule after he moved out of state during a transition.

However, Beeby notes that salary expectations can present a problem when coastal professionals apply to work remotely for a rural midwestern organization.

“Definitely, pay is a factor,” Beeby says. “But we’ve been pretty fortunate in recruiting, and we promote people after they come here too. We may bring them in as a technical analyst and then grow them into more of a system administrator role, or maybe even networking, and help them expand their knowledge set.”

Community Hospital in McCook, Neb., has only nine IT staffers, but the hospital must defend against many of the same threats as larger health systems in major cities.

Lakewood Health System Uses Location as a Benefit

At Lakewood Health System in Staples, Minn., cybersecurity hiring competes with the same budget pressures as other critical investments. “If we need a cybersecurity expert, but we also need a new CT scanner, how do you balance that out?” says Vice President of IT Jim Roeder.

Staples has about 3,000 residents, but Lakewood Health System serves 30,000 patients in a 30-mile radius. In addition to its flagship critical access hospital, the system runs five rural health clinics, as well as long-term care, assisted living and cancer treatment centers. 

Roeder knows that the organization can’t compete with larger health systems in terms of pay. Instead, Lakewood Health System competes on lifestyle, attracting candidates who value flexibility, rural life and ready access to dozens of the state’s 10,000-plus lakes. 

“We try to entice a little bit with a hybrid working arrangement, so you work from home 40% of the time,” Roeder says. “In the middle of the day, if you have to go to your kid’s event at school, we’re good with that. But the players in bigger areas can do that too. A lot of times, it ends up being someone who wants to live in lake country and have a cabin and go fishing. We have to try and highlight those things that are going to draw people here.”

Why Rural Health IT Security Is ‘a Battle Every Day’

Ransomware remains Lakewood Health System’s top cybersecurity concern, Roeder says,

followed closely by phishing attacks that target employees. The organization also focuses on data loss prevention to keep protected health data and personally identifiable information safe.

To support that work, Lakewood Health System uses some of the latest technologies from vendors such as Palo Alto Networks and Microsoft. The organization worked with Microsoft and a third-party implementation partner to configure cybersecurity tools, build policies and move to a hybrid cloud environment.

The cybersecurity staffing model is lean. Roeder effectively serves as both CIO and CISO, while his IT manager shares security responsibilities, and a systems administrator manages much of the server and security tooling work. That makes automation important, although Roeder notes that a routine update once led to 1,500 false alerts in a single day, creating a risk that real problems could get lost in the noise.

Roeder co-leads the Health Sector Coordinating Council working group with Stoll, and he says that interviewing other healthcare IT leaders for the report was “eye-opening.”

“It made me realize how lucky I am with the staff I have,” he says. “It’s a battle every day for small rural hospitals.”