Artificial intelligence is transforming health care — but it’s also giving cybercriminals potential new tools for disruption. In this conversation, Larry Pierce, director of cybersecurity and information security officer for Atlantic Health, unpacks how the growth of AI is reshaping cyber risk in health care, and why physical security is now inseparable from cybersecurity for America's hospitals and health systems.
View Transcript
00:00:00:08 - 00:00:17:06
Tom Haederle
Welcome to Advancing Health. Today, we learn from the experts how physical security is a necessary component of cyber security, and why they have added the misuse of AI by bad actors to the list of cyber threats facing health care providers.
00:00:17:09 - 00:00:47:01
John Riggi
Hello everybody. My name is John Riggi. I'm national advisor for Cybersecurity and Risk at the American Hospital Association. So pleased to be joined by my good friend today, Larry Pierce, who is the director of cybersecurity, information security officer for Atlantic Health. And folks, believe it or not, Larry has been at the same organization, Atlantic Health, for almost 40 years in various forms of information technology and cybersecurity,
00:00:47:02 - 00:01:10:13
John Riggi
really as the field evolved. So, Larry, so good to have you here today, especially as cyber threats of all types are increasing dramatically. Third party risk is a major issue that we're facing. In fact, quite frankly, it is the most prominent source of all cyber risk that we face in health care. AI is everywhere and on everything.
00:01:10:14 - 00:01:36:20
John Riggi
So we'll talk a little bit about that as well. Unfortunately, the risks that we as hospitals and health systems face and our patients face are not just the virtual threats. Unfortunately, there's been a dramatic rise in physical threats and attacks and violence against hospitals and health systems. And there is a nexus, a connection between the physical threats and the cyber threats.
00:01:36:22 - 00:01:48:10
John Riggi
From your perspective, Larry, having dealing with a very busy organization, a busy emergency department - how do you feel that the physical threats and the cyber threats intersect?
00:01:48:12 - 00:02:07:12
Larry Pierce
I think in many cases, you know, with the exception of when you're dealing with nation state threat actors who, you know, like the state thousands and thousands and thousands of miles away from you, there are a lot of things to your point that we need to be concerned about. It seems like there's an uptick in physical violence within in health care organizations.
00:02:07:15 - 00:02:33:03
Larry Pierce
You know, when you talk about physical security, we're looking at things that, you know, the intersection with cybersecurity would be an unsecured laptop, right? that may not be encrypted for one reason or another. That's really security 101 is ensuring that your mobile devices that are within the organization are always encrypted. So in the event that they walk out of the org or they're stolen, that they really turn into a brick.
00:02:33:06 - 00:02:56:27
Larry Pierce
But there are some vendor supplied systems that we have out there that may not employ the same technology. So data centers and server environments within the main hospital, we don't have a lot of data centers that are in the hospital anymore, but your server rooms and network closets, there could be a lot of damage caused in those areas if somebody happened to go in there with nefarious purpose
00:02:57:00 - 00:03:16:20
Larry Pierce
they weren't meant to be in there. That could cause us a lot of hardship. We rely on the security cameras that we have throughout the hospital system right now in physical security monitoring those. In the event that something happened, we can always go back to those and look and see what's happening. So operational technology is something we take very seriously here.
00:03:16:20 - 00:03:35:15
Larry Pierce
It's something that we work closely with our partners in emergency management, physical security and even law enforcement at the local, county, state and federal level. So up to including the FBI, Homeland Security, prosecutor's offices, local law enforcement.
00:03:35:18 - 00:04:03:18
John Riggi
You know, when I think about this, the intersection of physical threats and cyber security, you know, we always talk about ransomware attacks as being a threat to patient safety and really a threat to life crime. And I would venture and proffer that a ransomware attack in itself could be viewed as a violent crime. We tell the federal government all the time, if you do something that puts people in physical harm, risk of physical harm, then that's a violent crime.
00:04:03:23 - 00:04:22:20
John Riggi
So that's one of the one of the things we're pushing the government to understand as well. And they do. They do, quite frankly, as you know, with the FBI. So let's, let's talk back about here on the health care landscape and a little bit about what everybody else is talking about, AI. right? So talking about cyber, we've talked about physical threats, AI, everything.
00:04:22:27 - 00:04:41:10
John Riggi
So is AI is evolving and widespread implementation we have in health care happening quickly, really quickly. This has a lot of risks and rewards as we know. What do you see from your perspective, the emerging risks of this widespread and perhaps overly optimistic adoption of AI in health care?
00:04:41:12 - 00:05:00:19
Larry Pierce
AI is obviously not going to become it has to become a game changer for health care and many other industries. Contrary to what some people that you know aren't in the technology field that I speak with on a regular basis outside of work or even inside of work, and they ask me, you know, AI thing that's going on right now, is it here to stay?
00:05:00:19 - 00:05:25:14
Larry Pierce
Is it just a fad that's going to kind of come and go? My answer it's been very, very consistent with that. AI is here to stay. Depending on how you use it, whether we're leveraging it internally for protective technologies or whether we're using it to better patient outcomes. Those are some of the things that we are doing internally.
00:05:25:16 - 00:05:50:12
Larry Pierce
But I think in using AI in an ethical manner, we need to ensure that we are taking a very cautious approach with that. I don't think has demonstrated quite yet that it can take the place of a human to make a medical diagnosis, for example. We're not that far along. I'm not saying we may not get there at some point, but I don't think I was ever
00:05:50:12 - 00:06:11:21
Larry Pierce
billed - and I would I would argue this point, you know, unless I'm convinced otherwise years from now - not necessarily made to take the place of a human in every case. Is it going to limit some jobs? Absolutely. But, you know, in the health care space, we are seeing more and more platforms that are coming in. And I'm not just talking about security technologies.
00:06:11:22 - 00:06:38:03
Larry Pierce
These are third party systems that we're employing that are either incumbent systems that we've had here for a while that are starting to adopt more AI technology, and companies that are AI centric and completely involved with AI, and we're bringing them on board as well. So for us, again, very cautious approach, and we have a very rigid onboarding process for these AI technologies.
00:06:38:03 - 00:06:59:05
Larry Pierce
So it all starts with the governance process. And is there a need for it? Do we have the dollars? Because health care is getting squeezed quite a bit right now. From a monetary perspective, we're not getting the same reimbursements that we had once before. We're spending a lot more money than we ever had to before. These fancy AI technologies and everything else, they come with a price tag.
00:06:59:07 - 00:07:23:21
Larry Pierce
So in adopting these, we need to make sure that we're doing it ethically, responsibly. So we have a an AI committee that partners with - and it's not just the most important thing - it just fits in with everything else very nicely. So we do a full architecture and design. We do an assessment. We do a complete comprehensive cybersecurity review.
00:07:23:23 - 00:07:42:21
Larry Pierce
It all comes down to risk. And I'm not the final say when it comes to that. There are, you know, executive leaders within the org that will either accept risk or not accept the risk. But they are certainly informed when that comes along. We also have our team members or employees that are using AI right now.
00:07:42:23 - 00:08:14:20
Larry Pierce
Beyond just the medical side of the house, AI is being used to craft more business friendly emails. It's being used to develop algorithms associated with a better presentation. So we don't want, you know, an AI platform such as OpenAI, ChatGPT, Gemini. It should be able to have the ability to ingest spreadsheets that are our proprietary information, may contain, you know, many, many elements of PHI, PII.
00:08:14:22 - 00:08:36:03
Larry Pierce
We don't want to put that into their learning module because they all give you the caveat if you look at their privacy statements and policies, they could use this information almost indefinitely to train their models. Well, if their information is to be compromised and we've got over 500 records in there that were put in to come up with something, it's going to cause a breach situation for us that we don't want.
00:08:36:05 - 00:08:58:27
Larry Pierce
We've employed, you know, our content filtering, our DLP technologies are all trained at this point to significantly restrict what people can do with AI to prevent them from getting themselves in trouble. More importantly, from landing Atlantic Health in the news because of something that was an unintended consequence.
00:08:59:00 - 00:09:29:07
John Riggi
So again, AI is here to stay. It's an almost everything we use. It's not necessarily new technology coming into the organization. There are a lot of existing programs, of course, like Microsoft and Google that add AI features. So that governance council that you spoke about is extremely important, not only to assess new AI technology coming into the organization, but to identify instances where it is now been added to existing software and technology within organizations.
00:09:29:10 - 00:09:53:28
John Riggi
Just saw another report this week that corrupted data, PDFs and emails which are already in networks, are then consumed by AI, legitimately looking for responses or answers to questions, queries submitted to it, but it unwittingly sucks in malicious data and perhaps malware that's already within, present and within the environment and produces it as part of its response.
00:09:54:00 - 00:09:58:06
John Riggi
So really, lots of complications and dealing with AI as we go forward.
00:09:58:10 - 00:10:17:17
Larry Pierce
Threat actors are leveraging AI right now, which is something that we continue to try keeping up with. There's a lot of security technologies that are evolving that are coming up with protections for that, which is great. But one of the things I'll bring up, and it's pretty common, I think a lot of people have heard of it: What are, you know, what is your biggest concern with AI?
00:10:17:20 - 00:10:42:18
Larry Pierce
More sophisticated and realistic phishing emails that are coming in. The telltale signs of a phishing email coming in and there's a lot of email securities out there and other cyber technologies that do a very good job at looking at, you know, what we equate to millions or tens of millions of emails every month to come in, and we have to block the most malicious emails that come in are all the malicious emails that come into the organization.
00:10:42:20 - 00:11:04:25
Larry Pierce
They're using these emails to come up with verbiage that we would normally point to as this is a yellow flag or a red flag. It's not there anymore. Look at the deepfakes that are coming out right now that AI is doing. They are very, very realistic. The other phishings that AI is being used for. It started out as general phishing emails.
00:11:04:25 - 00:11:37:29
Larry Pierce
that went to an audience of a thousand or more people. And just like, if 1 or 2 people click on it, it was worthwhile for the threat actor. Then it evolved to spear phishing. Very targeted going to one person. Now you've got smishing, you've got phishing, you've got quishing. We're seeing all of that internally here. And there's a lot of technologies that really aren't from an educational perspective or detective perspective, able to really latch on to these and be able to prevent them from getting to the people that may get hooked on.
00:11:38:02 - 00:11:59:27
John Riggi
All great points about the ubiquitous use of AI in hospitals and health systems. I totally agree it's only going to accelerate. And again, lots of good will come from it. But we also have to think of AI representing a type of third party risk. We know in health care, third party risk is the major source of cyber risk that we are exposed to.
00:12:00:00 - 00:12:21:29
John Riggi
The data holds that change health care are increasing reliance on outside third party technology, service providers and supply chain. So AI again, is a major third party risk included in all the other third party risks. So as a growing concern, how does Atlantic Health approach third party risk management?
00:12:22:01 - 00:12:44:03
Larry Pierce
So third party risk is, you know, it's near and dear to me because if I look at our application portfolio and understand that we have 750 or so applications that are currently in use at Atlantic, whenever we're going to onboard a new technology or review an incumbent vendor that's been here for a while, we have that same rigid process in place.
00:12:44:03 - 00:13:01:25
Larry Pierce
So it starts with governance and is there truly a need for it? Financially, do we have the money for that? Is it budgeted? Is there going to be a return on investment or not? I mean, why do we need the product is what it comes down to. Then we need to go to the nuts and bolts of what does the assessment look like for this?
00:13:01:25 - 00:13:25:23
Larry Pierce
We do a full architecture and design for everything. A full security review. As I believe I mentioned before, we have an RFI process that we send to the third party. It's about 150 questions that they have to answer in there that allows our teams to be able to determine whether this is something that meets our minimum baseline security controls.
00:13:25:25 - 00:13:45:12
Larry Pierce
So as we look at a lot of these products that we're evaluating now, let me rewind 10 or 15 years ago. We had a lot of on prem data centers, so whether it was within one of your own facilities or it was a co-location. Everything was basically on prem to a certain extent. So we had control physical control of all the security associated with that.
00:13:45:14 - 00:14:15:01
Larry Pierce
That was on us. As we evolve and migrate to third parties, which is, you know, that is the trend, it's moving in that direction. It has been moving there. A lot of companies are already 80, 90% of the way there at this point. We are, I would say, shedding some of that responsibility. But with that comes the fact that we are now relying on the security posture of that third party that we are entrusting with what may be our crown jewels.
00:14:15:03 - 00:14:25:18
Larry Pierce
And for us in the health care world, that is our PHI, the protected health information of our patients, which is central to what we do as a business.
00:14:25:21 - 00:14:47:06
John Riggi
This mass migration to the cloud has been very good economically and for business processes, but it's created a different type of risk. We've talked a lot about AI and cyber threats and physical threats, operational technology. What do you see in the next year? Couple of years? The trends in cybersecurity and health care and potential threats?
00:14:47:08 - 00:15:07:25
Larry Pierce
I think a lot of the same threats that you see today, they're going to remain. You know, the phishing emails, the other ishings that we talked about. I think they're going to continue to evolve. They're going to be more sophisticated, more believable. The nefarious threat actors that we all deal with, unfortunately, too often are going to build their capabilities on these.
00:15:07:25 - 00:15:33:16
Larry Pierce
They're going to be tougher for technology companies. And that's what it's always been. And, you know, we are trying to stay one step ahead of our adversaries. And it just seems like unfortunately, it's the other way around. They're staying one step ahead of us in many cases. There needs to be a level of vigilance within your organization. You need to continue to be mindful and ensure that your third parties and your own people continue to watch the shop.
00:15:33:18 - 00:15:53:24
Larry Pierce
When I started my career, PCs weren't even part of the landscape here at Atlantic. So you look at how far we've evolved. I think we'll be having an entirely different conversation five years from now. We'll be talking about things that I won't even say were top of mind, things that weren't even in our minds today that they're going to change.
00:15:53:27 - 00:16:23:21
Larry Pierce
I'm hoping that security technologies will continue to evolve, that they're going to get better, more comprehensive. And I'm hoping that there is, you know, work done by the federal government and other areas of the world to make it more difficult for these threat actors to do what they do to, you know, there are greater consequences for them. Most of these people right now, we can't go after them, unfortunately, when they cause us millions and millions of dollars of heartache because of something.
00:16:23:29 - 00:16:41:04
Larry Pierce
So I'm hoping that you get better with legislation and some of the strong work that you're doing, you know, with your counterparts. We're going to become more and more reliant on technology. And I'm just hoping we have the right technical safeguards in place to prevent some of the attacks.
00:16:41:06 - 00:17:01:17
John Riggi
Thank you, Larry. Very well said. And thank you for your service in helping defend health care networks, your patients in the communities that you serve. I also want to thank all our viewers for what you do every day to defend networks, care for patients and serve your communities. This has been John Rigi from the American Hospital Association, national advisor for Cybersecurity and Risk.
00:17:01:17 - 00:17:09:19
John Riggi
If you'd like to learn more about cybersecurity and risk, please visit our website at aha.org/cybersecurity.
00:17:09:21 - 00:17:18:02
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.



