I'm Mary Ann Colby, executive editor at Information Security Media Group. Today I'm speaking with Mitch Parker, CISO of Indiana University Health, about some of the sudden top challenges that healthcare sector CISOs and their teams are dealing with in working with their organizations supporting COVID-19 response. So Mitch, you're based in Indiana. What are things like there right now in terms of COVID-19 cases overall, and has there been a surge in why healthcare organizations in the region are being asked to deal with?
Yes, there has been. Every morning at 10 o'clock, Governor Holcomb's Task Force puts out a data report, and they talk about the number of positive cases, which, as of this morning was 4,944, the total number of deaths, which is 139, and the total number of people tested, which right now is 26,191. Health systems across the state are continuing to stand up testing sites. We have a big testing site downtown for Eli Lilly that a number of organizations have also used, and every health system in the state has seen a surge, and it's been concentrated mainly in Marion County and the surrounding counties of Hamilton and Hendricks, and also up in Lake County, which is up by Chicago.
So, yes, we've seen a surge, and there's been number of cases to say what? So, Mitch, as we know across the country, many more workers are being asked to telecommute. What are some of the key security challenges for healthcare entities that are now being asked to suddenly support a much larger telecommuting workforce? We've had a lot of challenges of teleworking over the years.
What I always like to tell people is that we saw the first demand for telework when we implemented electronic medical records, and the medical staff had to do sharding after work. This is pretty much the same for any health system at Quillenet and EMR, and a lot of organizations have also had remote desktop or good virtual desktop support because, again, a lot of skilled specialists, such as in medical building coding, have had the work remotely for a number of years, and again, you can't get them to move across the country and you've got to move to them. So, we've had good experience with getting the applications delivered to whoever needs it. However, some organizations have had to face the sheer challenge of volume and the sheer necessity of rapidly transforming a workforce from one that sat in offices to one that worked remotely within a period of a couple of weeks.
So, it's a lot like the challenges that we've faced in education. However, you've got entire teams that use the work in their offices that are now working remotely, and there's a lot of challenges with that if you don't manage every aspect of the program. And one of the areas that got me very familiar with this was when I was a Defense Department analyst. I was a contractor about 12 years ago, and right when they were putting in their telework program, one of the items they always did is they had someone come out into a visual inspection area and also make sure the connectivity was sufficient.
We have to do the work that entities like DOD and GSA did over a period of months in the first of the two weeks. So, yes, there's been significant challenges there across the board no matter what industry you're in. And so, Mitch mentioned EHRs. What about expanded telehealth services?
What are some of the security challenges for health care systems and their teams in dealing with this, especially if it's being expanded more so than an organization has previously offered these sorts of services? I think it's not just a technological challenge. The guidance that was put out by the OCR, which was relaxing and forcing the telehealth guidelines, has been misinterpreted by many organizations. So, the guidance they put out recommended that organizations look for solutions that have a reasonable and appropriate degree of security, and our ones are suitable for entering into a business association agreement with after this is all said and done.
And a lot of organizations just haven't done that yet, and they put a lot of solutions in place that may not measure the organization's workflow. You don't think they're very criticalized to what solutions you're going to allow. And also, what your workflow is and how are you going to build for it, how are you going to record it, and more importantly, do you even have a network bandwidth for it? And that's been a challenge.
And also, how does it work with revenue cycle? How do you build for it? So, organizations have had to rapidly adjust. And in addition to that, because of these surgeon patients, a lot of organizations have moved previous in-person appointments to telehealth.
Again, a lot of people and organizations that are not used to working with telehealth or telemedicine are now having to do so and learn very rapidly. It's been a learning experience for almost every single organization that has had to do with this. And capacity also, my understanding is Microsoft teams alone went up 775% in the past month. Zoom, I saw a statistic yesterday that said they went from $10 million to $200 million.
And while I have not seen any statistics for companies like Amwell, I do believe that that number has also had a corresponding increase. So, we do see issues of scale. And we also do see issues of getting a workforce to adapt from in-person to telehealth very rapidly. And that's what we need to put our focus.
Now, Mitch, you mentioned some of the capacity challenges. What about for identity and access management? What kind of challenges are now being seen as you have more people telecommuting, you have more people perhaps offering telehealth services from offices that maybe they didn't normally work in? Again, you have people remoting into systems that maybe they never remoted into before.
I don't actually see the issue being with remote access to systems. I see it being more with the amount of staff members, organizations are bringing on board. Our healthcare workers are incredibly overworked right now. Every organizations are.
I have been taking a look on social media. I've been taking a look out there at what the agencies are doing. And right now, you are seeing a rapid amount of healthcare staff being brought on to organizations. And I'm going to give the example of New York City.
New York City has brought in tens of thousands of healthcare workers such as doctors and nurses from across the country to be able to take care of the patients that need it. And what you need to do in a situation like that is to make sure that these people working have the access they need to be able to take care of patients. And so, that is causing a lot of organizations to rethink how they provision users and how they can quickly get someone off the street, get them credentialed, get them access, get them trained, and get them on the floors. So, I'll give an example of that.
I stayed at Michigan. There was a hospital in the Detroit area that literally sent out a text message blessed across the country to healthcare professionals saying, please come to Detroit now. That was pretty much the summation of the message. So, when you take a look at that, and you take a look at professional processes in healthcare, which traditionally are not known for being fast, we now have to make them fast because, ultimately, our focus isn't on 100% of security right now.
Our focus is on how do we best get people in these health systems taking care of patients and able to do so efficiently. You made many good points here, Mitch, with the whole challenge of suddenly bringing in healthcare workers to kind of join the COVID-19 fight, the thousands of people who were being asked in your state, for instance, to they're retired, to please come back, the nurses, they're even allowing some medical school graduates to start early, and in terms of onboarding these people, but then also giving them access to electronic health record systems. There could be expectations of them being able to access information about a patient, but there was no training, there was no time perhaps to give sort of the overview of the policies, and maybe in some cases, there's not even time enough to give them access to electronic health records, maybe they're giving them paper charts. What sort of security issues do you see in having to deal with all this?
I think there's a lot you have to do to get us trained down to be done very, very quickly. You have to realize that you don't have time to have a lot of this training being done on site in a classroom. You've got to give someone a better link and say, here you go. Also, you've got to make sure you have good patient privacy monitoring capabilities as well, because you really have to make sure that you are able to see who is doing what in the system and bring up any red flags.
But again, when you've got something with a field hospital set up, it would be an example of the one that they have right now in the Javits Center in Manhattan. More than likely, and I've had a good conversation with a nurse about this, you're going to have a clipboard at the end of the bed with a paper chart on it just like we had back in the olden days before EMRs. So you're going to have a combination of approaches, but most importantly, if you're going to be using electronic systems in your hospital to take care of patients, you need to make sure that you adapt your training to be innovative quick based on the web so that when they're on their way to your facility, they can start taking the training, make the maximum use of them at a time. Make sure you have good patient privacy monitoring, you've got a team to staff it, or if not, there are some outside services that will do it for you.
And also make sure that if you've got like a surge hospital, make sure you've got your processes down to ensure that if you're using paper charts, that people even know how to use them are right and I'm going to bring up something else. When it comes to using paper charts, a lot of younger nurses don't know how to use them. Case in point, I worked with a nursing pharmacist at my last job, who she came from a hospital that lost her primary and secondary data centers during a hurricane. So what that meant is that no EMR had to go back to paper to charge and back to paper for a number of procedures.
And even then, they had to have the older nurses train the younger ones who had grown up their entire life with EMRs that never had to charge on paper. So either way you put it, you've got electronic systems, you have to make sure people are properly trained. You have paper charts, you have to make sure they're properly trained. Either way, you've got to have your processes down to understand which way you're going before you put people on the floor electronic or not.
But sooner or later, even though the data that's captured on these paper charts are going to have to be entered into systems for billing and other purposes, what sort of security issues do you foresee could occur during that process when you're gathering all this information all of a sudden on paper because it's just the quickest thing to do. And then now you're forced to have other people perhaps enter this data later on. I worked on the EMR GoLite at my last job. One of the policies that I co-wrote along the regulatory affairs and nurse informatics was actually a policy just on how do we re-key in data from paper charts and reconcile that data as a down time event, as a wrap up from a down time event.
So we actually spent several weeks working on this policy to make sure we got it right several weeks, numerous meetings, and this was just an adaption of a policy from the ambulatory EMR to the inpatient. So it's something organizations really need to think about because you have to think about where this paper charts are going to go, how they're going to be physically secured, making sure you have reasonable appropriate protections for those charts. Make sure you have designated staff available to re-key that data into the EMR, and also potentially pulling data from other sources. So it's not a staffing plan to say the events over, let's all go home.
The events winding down, let's bring in different resources to address the need of making sure the patient's charts are as accurate as possible. We have everything in the EMR and that the workflow works so that we can accurately record and build for these services. So if a lot of work to do that, there are some great nurse informatics out there that really know how to do this, and we just have to make sure that we know that we identify these people and that we just don't think because the event's over, that it's done. It's a wind down, and when I had originally done this at OS job, we had forecasted that the wind down from the event might actually be longer than the event itself, just due to the number of resources, it takes to reconcile all the patient chart data from paper charts back to an electronic system.
So Mitch, what about medical devices and various supplies that are in shortage? How is that impacting systems and their teams? I will tell you that the biggest challenge with medical devices is you are literally talking about bringing every device possible that is functional and operational into service. They're talking about bringing devices up that may not have been turned on in years, and so you have to take a look at it as what can you do to bring these devices online safely?
What other methods of defense do you have? Because again, when you're talking about buying parts off of eBay, you're talking about getting used devices or you're talking about equipment that's been literally cobbled together or being used for a different purpose, you have to think and assume that you need other levels of protection. You really don't have time to think about, hi, I'm going to put security patches on here. No, they're pulling that out because they're looking at the minimum time that we fit the equipment or reuse it for patient care.
So you have to think about all your other layers of the fence on your network or in your system, or even are you even going to connect this at all? Are you just going to have someone manually love this? Because that might be the safest way to do so. In addition to organizations and regions kind of pulling old equipment in some cases out of storage, things that might have been in stockpiles that are now suddenly being used.
We also hear about states like Washington State donating ventilators to New York because it's such a hot spot right now. What sorts of security challenges are there when there are medical devices that are, you know, they have been functional most recently, but now all of a sudden they're being shipped to a whole new organization. Are there problems in terms of either resetting passwords or resetting access? What sort of challenges do CISO's face when all of a sudden there's a big shipment of fairly recent product that are now suddenly at the doorstep for us to use in our heart?
I think the biggest challenge isn't with security. I think the biggest challenge is making sure that the team members that are utilizing these vents know how to use them. So I really think, and again, it's based on my experience working with a number of nurses and care providers and health systems that it can be jarring just to switch someone to devices made from a different vendor, let alone to for a security challenge. And I think that a lot of the time you're going to have these devices up and running in a way to get the most quickly operational.
And if it means literally having someone taking notes on paper, that means it's probably going to happen. Because right now I can tell you everyone that makes ventilators in the United States, they don't have any. They're probably told next year at minimum. And if they're putting them in, they're not thinking about integrating them with the EMR.
They're thinking about what's the most efficient path for me to turn this on, get it operational, and have it start helping patients. So I really don't see much of a security challenge as much as I do a user workflow and familiarity with interface challenge. Because in many cases, you're going to take the vent. You've got to make sure that the care provider knows how to use it.
And again, based off of my experience, oftentimes care providers, they spend a lot of time understanding how the devices work, how the interfaces work, and you switch it up on them, especially the situation like this, data searching becomes more important and paramount to address the security issues. Thanks, Mitch. I've been speaking to Mitch Parker. I'm Mary Ann Kolbasak-McGhee of Information Security Media Group.
Thanks for listening.