Advancing Health Podcast

00:00:01:05 - 00:00:23:09
Tom Haederle
Welcome to Advancing Health. In the face of today's multiple challenges, every hospital needs support and buy in for its mission of great care. Storytelling - sharing the right kinds of stories with the right audience at the right time - is a great way to build and maintain that support. This is particularly important for rural hospitals and health systems, most of which have razor-thin operating margins.

00:00:23:12 - 00:00:40:10
Tom Haederle
In this month's Leadership Dialogue, hosted by the American Hospital Association's 2025 Board Chair Tina Freese Decker, we hear more about the importance of advocacy and of all team members participating in telling the hospital story.

00:00:40:13 - 00:01:07:25
Tina Freese Decker
Thank you so much for joining us today. I'm Tina Freese Decker, president CEO for Corewell Health, and I'm also the board chair for the American Hospital Association. Last month we talked about trust and how our hospitals and our health systems can strengthen that trust with our communities and the people that we serve. Our rural hospitals are uniquely positioned to do this, as they are often the largest employers in their towns and communities, and frequently the only local source of care.

00:01:07:27 - 00:01:28:07
Tina Freese Decker
Rural health care is about being a family. We take care of each other in our communities as best as possible, and we're here to provide that care close to home, no matter what headwinds that we all face. I recently had the opportunity to attend the American Hospital Association's Rural Conference and you could really feel that sense of family and community in the room.

00:01:28:09 - 00:01:59:15
Tina Freese Decker
We work in hospitals in red states and blue states all across the country, but we are all focused on the same thing: helping our neighbors in our communities to be healthier. There are some big challenges that are facing real health care, but together with a unified voice, we can get what we need. As I have traveled around our country meeting with the American Hospital Association's regional policy boards and visiting the rural hospitals and my health system and others, the number one concern that I have heard from our hospitals, our communities, is access.

00:01:59:18 - 00:02:22:28
Tina Freese Decker
And that is why it is so integral to the American Hospital Association strategy and it is why it is so important that we come together as a field and that we're united as a field, because these challenges that we are facing are real. So today, I am pleased to have a distinguished leader in rural health care with us to talk about how we can all work together to advocate for the needs of our hospitals.

00:02:23:01 - 00:02:45:09
Tina Freese Decker
I'd like to welcome Lori Wightman. She is the CEO of Bothwell Regional Health Center, a 108 bed acute care hospital in Sedalia, Missouri. Laura has served in this role since 2019, but even prior to Bothwell, she worked in real health care as the president of Mercy Hospital Ada in Ada, Oklahoma. So, Lori, welcome. Glad you were able to join us today.

00:02:45:15 - 00:02:46:17
Lori Wightman, R.N.
Thank you, Tina.

00:02:46:19 - 00:03:03:20
Tina Freese Decker
And I wanted to start out with just telling us a little bit about yourself. I know you started your health care career as a nurse and then you made the shift to administration. Can you tell us about yourself and how you see that family aspect in the hospital and the community in our rural areas?

00:03:03:22 - 00:03:30:01
Lori Wightman, R.N.
Sure. Well, my father was a hospital administrator and my mother was a nurse, so I did both. And so it was a natural progression. And I think the foundation that nursing lays gives you all kinds of transferable skills that have been very helpful as I went into hospital administration. My career and dating advice has always been, you can't go wrong with a nurse.

00:03:30:03 - 00:03:57:14
Lori Wightman, R.N.
And there's certainly served me well. And you talk about that family atmosphere. That is why I continue to choose rural health care. I've done the CEO position in a suburban hospital, and I sat at our senior leadership team meeting and thinking I was the only one on our senior leadership team that even lived in the area that we served.

00:03:57:17 - 00:04:23:24
Lori Wightman, R.N.
Everyone else lived in a different suburb, and I just thought that was strange and disconnected. And, so I returned again then to rural health care because it is like a family. And it's ironic because we just finished revisiting our mission, vision and values. And our new mission statement talks about together we work to provide compassionate and safe care to family, friends, and neighbors.

00:04:23:27 - 00:04:37:07
Lori Wightman, R.N.
Invariably, when I met new employee orientation, a significant number of people were born at the hospital. That's why I love rural. It's like that "Cheers" phenomenon where everyone knows your name.

00:04:37:09 - 00:05:01:02
Tina Freese Decker
Very true. I used to lead a couple of rural hospitals as well. And like you said, even just walking into a rural hospital it feels like family where everyone there knows your name and of course, protect things from a confidentiality and a privacy perspective, but that feeling that we're all in this together. So I love that your mission statement is about together, that you can make an impact on people's health.

00:05:01:05 - 00:05:13:28
Tina Freese Decker
I described a little bit about what it's like to walk into a rural hospital. Can you share a little bit about what is like to be a rural hospital, what it means in today's environment and why it's such a great place to work?

00:05:14:01 - 00:05:47:06
Lori Wightman, R.N.
Well, in many ways, rural hospitals are uniquely the same as our suburban or urban counterparts. Forty six million people depend on a rural hospital for their care. So we struggle with the same labor shortages, the cost of labor supplies and drugs is rising faster than our reimbursement. We have all of those same struggles. Unique is that family atmosphere, I think.

00:05:47:06 - 00:06:13:26
Lori Wightman, R.N.
And we have multiple generations working at the hospital. Now, you can't say anything bad about anyone because invariably they're somehow related. Or they were best friends in high school, or they used to be married to each other. So I mean, it's unique in that way. We have the same types of struggles that  our counterparts do.

00:06:13:28 - 00:06:18:03
Tina Freese Decker
What pressures are you feeling the most acutely right now?

00:06:18:06 - 00:06:47:09
Lori Wightman, R.N.
Well, you take all of those common challenges that I talked about, and you turn up the volume a little bit. Because for us, 78% of our patients and our volume is governmental payers, so 78% of our business, we're getting reimbursed below cost. You can't make that up in volume. So we rely on all of the governmental programs, you know, disproportionate share all of those things.

00:06:47:09 - 00:06:54:22
Lori Wightman, R.N.
And, 340B is doing exactly for us what it was designed to do, save rural hospitals.

00:06:54:25 - 00:07:11:22
Tina Freese Decker
Those areas are critical that they remain. And so that we can continue to provide that sustainable, high quality care in our communities and all of our communities. 78% being governmental. It's a huge portion of what we do and what we rely on for access and caring for people.

00:07:11:29 - 00:07:23:15
Lori Wightman, R.N.
Right. We are the typical rural hospital. We have razor-thin margins and aging plant of 18 years.

00:07:23:18 - 00:07:31:10
Tina Freese Decker
So those are challenges that you're trying to navigate right now with all of the other things that happen. And how is your staffing levels going? Are those going okay?

00:07:31:13 - 00:07:55:12
Lori Wightman, R.N.
Have the same labor shortage issues. We still have 22 traveling nurses here, but we have started being very aggressive in a grow your own program. And so as soon as the next month we're going to cut that number in half and then, within six months, we're hoping to have all of contract staff out.

00:07:55:15 - 00:08:02:04
Tina Freese Decker
Is that something that you're most proud of, or is there something else that you want to share that you're most proud of from a rural hospital perspective?

00:08:02:06 - 00:08:29:24
Lori Wightman, R.N.
I think what I'm most proud of is you get to personally view the impact of your decisions on people. I'm very proud of our all the talented people that we have here, from clinicians to community health workers. All of our physicians get to use all of the things they learned in medical school and residency, because there isn't a lot of subspecialists, so they are working at the top of their license.

00:08:29:26 - 00:08:50:21
Lori Wightman, R.N.
Just several months ago, one of our critical care physicians diagnosed a case of botulism. Now as an old infection control nurse I get very excited about that because I never thought in my career I would see botulism. But it was diagnosed and treated here and the person's doing well.

00:08:50:23 - 00:09:25:27
Tina Freese Decker
Oh, that's wonderful to hear. When you talk about all the different people that are part of health care in rural settings, or also another settings, it's quite amazing to see how many different areas we need to come together to take care of our community. When you think about an even larger scale, from rural hospitals to urban and teaching hospitals and others, how do you think about the whole ecosystem of our field and how we, you know, do we need all of us or and is there a way to form that greater fabric and social connection, or is there something else that we should be doing?

00:09:25:29 - 00:09:50:21
Lori Wightman, R.N.
We are all very interconnected and I believe we are all needed. And I especially feel that as an independent hospital, not part of a health system, this is my first independent hospital. I rely on my hospital association more than I ever did when I was working for a health system, because it all comes down to relationships.

00:09:50:21 - 00:10:18:13
Lori Wightman, R.N.
And so how do you develop, how do you get yourself in situations where you are meeting and now working with your partners around the state or the region? Because it comes down to relationships, you really need to know who your neighbors are in terms of other hospitals, who you're referring your patients to and develop that working relationship because it is all interconnected.

00:10:18:13 - 00:10:25:06
Lori Wightman, R.N.
And we rely on our partners that we refer to, and they rely on us, too.

00:10:25:08 - 00:10:43:23
Tina Freese Decker
One of the things I heard you say about the Rural Health Conference that the American Hospital Association just put on, and the value of the American Hospital Association is that we're not alone. And those values of relationships are really critical. So I appreciate that. The American Hospital Association also talks a lot about how do we tell the hospital story.

00:10:43:25 - 00:10:55:15
Tina Freese Decker
So how do you engage in advocacy to make sure we're telling that hospital story so that our legislative leaders and others know the value that we're bringing to the community?

00:10:55:17 - 00:11:22:11
Lori Wightman, R.N.
Well, we are surrounded by stories. And so the first thing is to always be picking up on what is the story that is surrounding us, and how can we capture that? Because the most effective way is to bring that patient or nurse or physician to the legislator to testify, because they are the most effective way of communicating a message.

00:11:22:18 - 00:11:49:07
Lori Wightman, R.N.
You know, the suits can go and talk about data, but nothing is more effective than what I call a real person telling their story and how a decision or a potential decision is going to impact them and how it feels. The other thing we do is every October, it's become tradition. We have Advocacy Day with our board, at our board meeting.

00:11:49:09 - 00:12:21:12
Lori Wightman, R.N.
We invite our state elected officials  - so people representing us at the state capitol - to come to our board meetings. On election years their challengers also come and I invite the hospital association and they all answer two questions: What do you hope to accomplish in the next legislative session, and what do you think might get in the way? That sets the scene for my board to understand that part of their role in governance is advocacy.

00:12:21:14 - 00:12:29:19
Lori Wightman, R.N.
And so I've had two of my board members...almost every legislative session I go and testify on on some bill.

00:12:29:21 - 00:12:50:01
Tina Freese Decker
That is really a good idea. Thank you so much for sharing that. Do you have any other final suggestions for us as AHA members, as other hospitals, whether it's rural or urban, that we should think about or do as we think about advocacy and access or also field unity?

00:12:50:03 - 00:13:22:11
Lori Wightman, R.N.
You know, having been on the board of two different state hospital associations, I get it. You know, sometimes members can be at odds with each other on a given issue. And my advice to AHA would be to play the role of convener, facilitating conversations between members to better understand each other's position. And if a middle ground can't be reached, then that might be an issue that AHA remains neutral on.

00:13:22:14 - 00:13:34:07
Lori Wightman, R.N.
But there are so many issues where we can agree on and that is very much the role and what all of us depend on AHA to play in advocating.

00:13:34:09 - 00:14:02:15
Tina Freese Decker
There's a lot that binds us together. Like you said, we're all caring for our neighbors and our communities, and that's the most critical piece of it. And we have to keep that front and center with every decision that we make and every action that we do. Well, Lori, thank you so much for being with us today on this AHA podcast, for sharing your expertise in rural health care and for talking about some new ideas that all of us can take forward to ensure that we're telling the hospital story in the best way possible.

00:14:02:18 - 00:14:21:09
Tina Freese Decker
So while I know that we have our work ahead of us, I know that I continue to be energized every time I speak with committed and passionate hospital leaders like Lori. Again, appreciate your work that you do every single day for the neighbors and for the people in your community that you serve. We'll be back next month for another Leadership Dialogue conversation.

00:14:21:13 - 00:14:23:01
Tina Freese Decker
Have a great day.

00:14:23:03 - 00:14:31:13
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.

00:00:01:03 - 00:00:26:14
Tom Haederle
Welcome to Advancing Health. Hospitals and health systems never stop working to advance patient safety and quality. It has been and always will be our field's top priority. In today's conversation, two former American Hospital Association board chairs discuss the importance of bringing a culture of safety reporting to an organization, and how technology can't replace the human factor in a successful patient safety strategy.

00:00:26:16 - 00:00:41:04
Tom Haederle
Dr. Mindy Estes is the former CEO of Saint Luke's Health System in Kansas City and her guest, Nancy Howell Agee, is CEO emeritus of Carilion Clinic in Roanoke, Virginia.

00:00:41:06 - 00:01:06:23
Mindy Estes, M.D.
I'm Dr. Mindy Estes, and today we have the privilege of speaking with Nancy Howell Agee, CEO of Carilion Clinic. Nancy's remarkable journey began as a nurse when her commitment to patient care laid the foundation for an extraordinary leadership career. So let's just jump right in. You've had a remarkable career from nurse to CEO and long service in the field for AHA and other organizations

00:01:06:23 - 00:01:24:22
Mindy Estes, M.D.
and so, I think it really gives you a unique perspective on health care quality, safety, equity, workforce, all facets that go into a quality organization. So thinking back, what have been the most important actions you've taken as a leader to drive quality and patient safety?

00:01:24:25 - 00:02:09:21
Nancy Howell Agee
Well, you know, I'm glad you mentioned that I began my career as a nurse. And I treasure the fact that I am a nurse still. And, as one-on-one patient encounters are what have always driven me - the notion that you're caring for one person after another, and how you do that the very best of all. As I became a leader in health care about the time that I was moving as a chief operating officer and then the CEO, I was a representative from the American Hospital Association to the Joint Commission, and I was on the Joint Commission Board.

00:02:09:24 - 00:02:34:07
Nancy Howell Agee
And at that time, you know, we were beginning to talk about zero harm. And so I was hearing from the AHA in one ear: patient safety, quality; and in the other ear from the Joint Commission, patient safety and quality. So in stereo, what's really important. And I pondered that quite a lot as a leader to look at our own organization,

00:02:34:07 - 00:03:00:07
Nancy Howell Agee
what could we do differently? Not just check the box, not just meet the regulations, but really understand fundamentally what it meant to improve health care, improve patient safety, and improve quality. It seemed to me that it needed to start with the board. And so sort of a bottom up, top down conversation of education about our highest priority and what that meant.

00:03:00:07 - 00:03:31:07
Nancy Howell Agee
And when we talk about statistics, it's really important to measure quality, of course. But a statistic represents a patient. And so we began to frame how we think about quality with the patient in mind. Not the patients, but a patient. And it seemed to make a difference. At that time we reorganized the board and the board committees. And while we had a quality committee, it wasn't perhaps as robust as the finance committee.

00:03:31:07 - 00:04:00:15
Nancy Howell Agee
And it seemed like the committee that got the most airtime at board meetings was the finance committee. And educating the board about what it meant to be an integral, high integrity, zero harm organization. So we renamed the Quality Committee for the board CAPS: Clinical Advancement and Patient Safety. And now the two most important board committees are CAPS and finance.

00:04:00:17 - 00:04:27:09
Nancy Howell Agee
And our board chair sits on both. In hindsight, it was really important that our board chair began to [see] patient safety and quality is the single most important thing. I'll tell you something else we've done, Mindy. We celebrate what we call the great catch. And so the more event reporting that we do, we think that's fantastic. And so we, you know, any little thing, any big thing. Was funny,

00:04:27:09 - 00:04:51:07
Nancy Howell Agee
I was waiting on the elevator, a gurney went by and it went a little too fast around the curve. And there was a resident standing there and he said, hey, I think we need to put that in the event report. And it was, you know, just kind of an everyday encounter, but it was a great focus. The other thing we did was create a new set of values.

00:04:51:09 - 00:05:25:17
Nancy Howell Agee
Our mission is to improve the health of the communities we serve. We focused on our values and our values include courage, compassion, curiosity, commitment. And by focusing on those values,  we use those to talk and to educate regularly for new employees, as well as every year the required education for all staff include focus on our values and what that means to patient safety and quality.

00:05:25:19 - 00:06:02:13
Nancy Howell Agee
And the last thing I'd mention is that we organized everything under one umbrella. So everything from risk management to honor reporting to all the sort of things we do for preparation, for Joint Commission, for surveys from our state, patient safety, patient advocacy and our human factors team and our sim lab are all under one umbrella. And creating that real focus that's both education metrics and celebrate the good work that we do.

00:06:02:15 - 00:06:37:27
Mindy Estes, M.D.
It's remarkable. There are a couple of things that have, that have struck me. One is your point about so much time spent in board meetings on finance. And one of the things that, we did at Saint Luke's was to reorder our board agenda and have a quality close, if you will, just like we have the financial close where we are presenting the quality metrics not only on a monthly basis, but year to date basis, so that we have time on the front end of the board meeting to talk about quality as opposed to whatever time we had left.

00:06:38:00 - 00:07:06:15
Mindy Estes, M.D.
The other thing I would mention is, as you know, I'm currently on the Joint Commission Board, and we talk about innovation and quality and patient safety. And the conversations when you were on the board beginning to talk about Do No Harm. You know, today Joint Commission is innovating and innovating rapidly. So I think it really is, organizations in the Joint Commission, in this instance, marching together from a foundation that's been created over a number of years.

00:07:06:18 - 00:07:31:02
Mindy Estes, M.D.
You helped develop Carilion's innovative care model. Undoubtedly - and I've heard you speak on how that evolved - and I know you have a lot of insights for other leaders. So if you were advising a new system leader and there certainly as we've seen, movement in health care, there are a lot of new system leaders in our field. What would you tell them to do first, to set the tone for an effective culture in the organization?

00:07:31:02 - 00:07:34:04
Mindy Estes, M.D.
I think you've already touched on that, but I know there's more.

00:07:34:06 - 00:08:19:07
Nancy Howell Agee
I think creating an environment of this is our highest priority means you're using every single meeting, every memo, your social media, we have an internal social activity. We focus on that with every single communication that we have. And I think that that's critically important. But I'm glad you mentioned technology because both existing technology and new technologies, again, we focus on why we're doing this for patient safety and how it improves quality and by having that as our key priority, I think it begins to permeate the organization.

00:08:19:15 - 00:08:45:00
Nancy Howell Agee
Technology is important. If you ask me, what doesn't work as well as you thought it would when you first started? You know, I'll say introducing an electronic health record. I remember when we did that and we did it big bang approach. And I remember these words probably came out of my mouth as much as anybody. We're going to eliminate medication errors by having this technology.

00:08:45:04 - 00:09:15:24
Nancy Howell Agee
And of course that's ridiculous in hindsight. There's nothing that can completely alter the human nature of our business, thank goodness. But because we are humans, mistakes can happen. And so doing everything you can to have a safe environment, to create a culture that's a permissive culture that encompasses patients taking quality and everything that you do, I think that makes all the difference.

00:09:15:27 - 00:09:43:27
Nancy Howell Agee
You know, Mindy, you and I go back a long time. We used to think about things like central line infections and catheter infections and I don't know. It wasn't that we were cavalier about those things. I think we were just as concerned about patient safety and quality. We didn't recognize the whole milieu that it took to care for every single patient, every time, in the way that a patient should be cared for.

00:09:43:29 - 00:10:02:28
Nancy Howell Agee
And when I look back and I think about some of the things that we perhaps took for granted or didn't realize that we could change, and now I look where we are as an industry. Our whole field has improved patient safety culture, and I think there's even more that we can do.

00:10:03:00 - 00:10:26:20
Mindy Estes, M.D.
You know, to your point of change. And, you know, I think organizations like ours, we test, we pilot, we retest, and, you know, we want consensus. And if we don't like the first pilot, we do another one. And I think Covid taught us very quickly that, you know, we can innovate and we can innovate quickly. And we can learn from that innovation

00:10:26:20 - 00:10:39:12
Mindy Estes, M.D.
and if we fail, we need to fail quickly. And you touched on the electronic record and my next question, it was just going to be, what did you learn from something that wasn't as effective as you might have hoped?

00:10:39:15 - 00:11:03:10
Nancy Howell Agee
Well, I'll just echo first of all that you're right. During Covid, we learned, and I hope we continue to learn that lesson - and that is innovate, innovate quickly. You know, I think we can be accused of being way too slow and thinking through things, which is important. We have a saying here. Take risks without being reckless. After all, you are talking about a patient's life.

00:11:03:12 - 00:11:44:00
Nancy Howell Agee
The notion that we can innovate, that we can recognize and do something about that and take ownership at multiple levels. So I think one of the real lessons that began before Covid, but what really came home during Covid was a necessity for focusing on the resilience of our staff and all the things that we can do, because, you know, as a CEO, you and I are not really important to that patient interaction, that precious moment between a caregiver and a patient.

00:11:44:03 - 00:11:54:07
Nancy Howell Agee
And so all the things that we can do to support our staff so that they can give the kind of high quality, safe care that we would expect.

00:11:54:09 - 00:12:17:21
Mindy Estes, M.D.
You know, resilience continues to be important. And I think in this day and age is something that we used to take for granted as well, that the mission and the privilege to do what we do would fuel internal resilience. And I think part of this whole patient safety, quality and quality of our workforce and our workforces experience as well -

00:12:17:27 - 00:12:57:04
Mindy Estes, M.D.
that resilience and how we take care of that has become increasingly important. And Nancy, I want to thank you as always for your time, for your sharing your insights and experiences and your journey from being a nurse to an award winning CEO and your successful transformation of Carilion Clinic. It really provides powerful lessons for all health care leaders at all levels, and your commitment to quality and safety innovation, combined with your dedication to mentoring future leaders, especially women in health care, truly exemplifies exceptional leadership.

00:12:57:04 - 00:13:25:04
Mindy Estes, M.D.
And, you know, we've seen through your examples, how health care organizations can navigate while maintaining an unwavering focus on quality and safety, Because at the end of the day, that is what we do to provide the highest quality patient care and safety to our patients, first and foremost. And I really think it's important for our listeners to realize that underlying all of the success you've had is the heart of a nurse.

00:13:25:06 - 00:13:27:11
Nancy Howell Agee
Thank you Mindy.

00:13:27:13 - 00:13:35:23
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.

00:00:01:04 - 00:00:36:12
Tom Haederle
Welcome to Advancing Health and part two of the conversation on cybersecurity attacks against rural hospitals, and what can be done to protect against them. In this conversation between John Riggi, the American Hospital Association's national advisor for Cybersecurity and Risk, and Justin Spelhaug, corporate vice president of tech for Social Impact, Microsoft Philanthropies, we learn more about the role tech leaders can play in helping rural health care providers cope with cyber attacks and preserve their ability to care for the nearly 60 million Americans who depend on them.

00:00:36:14 - 00:00:45:02
Justin Spelhaug
So the impact is clearly disruptive on these hospitals, clearly disruptive. Now, John, what can these hospitals do to protect themselves?

00:00:45:04 - 00:01:04:21
John Riggi
So there's many things that they can do. There's many things they need to do. But again, it generally comes down to a resource issue. So we generally say start with the basics. Look at your tools and policies. We know that there are certain cybersecurity practices, basic practices that can help mitigate the risk of the majority of cyberattack.

00:01:04:27 - 00:01:33:13
John Riggi
So example: multi-factor authentication, unified identity management, cybersecurity training for staff. We know that most of the attacks still start with those phishing emails, a psychological technique versus technological. Another step: join the Microsoft cybersecurity program. You all have been very generous in offering free cybersecurityassessments, curated learning pass product discounts to all rural hospitals in the U.S.

00:01:33:16 - 00:01:53:03
John Riggi
And I mean, these are the type of things that we need to do together to help shore up the defenses of rural hospitals. Now, Justin, can you tell us more about the Microsoft cybersecurity program for rural hospitals in the role you see technology leaders having in addressing these challenges?

00:01:53:05 - 00:02:17:22
Justin Spelhaug
Yeah, for sure, John. And of course, the technology leaders in these hospitals are on the frontline of driving change, and they're managing everything end to end with really limited resources. And so we wanted to pull together a program that would provide them more capacity, more capability to respond to the threats that you've just highlighted. And really, there are three big buckets. New offers that help make our technology more affordable.

00:02:17:24 - 00:02:41:18
Justin Spelhaug
That's bucket one. Bucket two is capacity building services to help organizations respond. And then bucket three is new innovation to help rural hospitals have more impact, particularly with AI. So let me click into those just really specifically for just a moment. In bucket one, in terms of new affordable offers, we're providing those hospitals that typically have the least resources.

00:02:41:18 - 00:03:28:10
Justin Spelhaug
And so that's independent critical access hospitals and rural emergency hospitals, those that are not in a health system, they can access Microsoft nonprofit pricing, which can provide up to a 75% discount for things like Microsoft 365 off of commercial pricing. So that goes a big way in helping some organizations really get access to affordable technology. Now, all other rural hospitals in the U.S. that are using Office 365 or M365 can get access to one year free of our most advanced security suite, Microsoft 365, E5 security and EMS E3 for one year to ensure that they can take action on their infrastructure immediately.

00:03:28:13 - 00:03:55:22
Justin Spelhaug
We've also for everybody, we've extended one year of Windows 10 Extended Security update at no cost. So that's on the technology side. On the capacity building side, we're providing every rural hospital in America, over 2000 hospitals, free security assessments, through a pre-vetted Microsoft security partner to help them evaluate their risks and identify strategies to mitigate those risks.

00:03:55:24 - 00:04:19:08
Justin Spelhaug
We've also, in this bucket, put together curated learning pathways for both technical staff and non-technical staff. And then the third area is AI innovation. Now, John, you were highlighting how stretched the finances of rural hospitals are, and CHQPR reports - and you said, John, that 30% of all rural hospitals are at risk of closure - that's a real statistic.

00:04:19:10 - 00:04:46:20
Justin Spelhaug
And that means that funding is limited and funding is limited for security expertise and the services that they need. So to help tackle this challenge, we've launched a Microsoft Rural Health AI lab, which we affectionately call RAIL, that is developing tools to help improve both financial and health outcomes. The first tool we built, which is in testing now with a number of hospitals, is an AI tool to support managing denied insurance claims.

00:04:46:27 - 00:05:08:15
Justin Spelhaug
We know that's a massively manual process for many hospitals. We know that if we can manage that more effectively, we can improve hospital revenue, which improves all outcomes. We've also been working to deploy nuance to improve patient and physician nurse experience through AI. And we continue to look at how we can use AI to support hospitals for a number of other scenarios.

00:05:08:18 - 00:05:40:22
Justin Spelhaug
Since we launched it, nearly 500 hospitals have registered for the program. That's about 24% of all the hospitals in the country. And that's in about the last four months. Over 335 hospitals are participating in a cybersecurity assessment, and many are getting access to the offers as well. And this is, John, part of a broader commitment to rural communities. We've been investing for years, actually, in rural communities, both tackling the broadband divide in America, as well as investing in innovation in rural communities through our Tech Spark initiatives.

00:05:40:22 - 00:05:46:26
Justin Spelhaug
So this is just the next step that we're taking for this acute challenge that we're dealing with at the moment.

00:05:46:28 - 00:05:54:12
John Riggi
Since launching the cybersecurity program for rural hospitals. Let me ask you, Justin, what has Microsoft learned?

00:05:54:15 - 00:06:15:25
Justin Spelhaug
Yeah. You know, John, we've learned a lot. And, you know, as I mentioned before, we've engaged just about 500 hospitals. And our learnings really break into two categories. So if you're watching this and you are a cybersecurity professional, pay attention to this next section because I want to tell you what we're learning from the hospitals that we're engaging with directly.

00:06:15:27 - 00:06:42:06
Justin Spelhaug
Four key technical learnings that we're having. Number one, privileged account management is the top liability that we're seeing in many rural hospitals. Only 25% of rural hospitals adequately separate end user and privileged accounts, i.e. those accounts that have broader access to systems and data. Getting that segmentation is critical in terms of protecting your footprint. That's probably learning

00:06:42:09 - 00:07:11:20
Justin Spelhaug
number one. Learning number two is mitigating known vulnerabilities, running basic vulnerability scanning, doing timely patching, establishing processes to remediate those issues. Only 49% of hospitals that we're working with right now receive passing scores on being able to mitigate vulnerabilities quickly. That's because they're stretched. They're doing everything. They've got a limited amount of resource. That's really the truth. But it's a challenge nevertheless.

00:07:11:22 - 00:07:45:22
Justin Spelhaug
Number three, less than 65% of rural hospitals have implemented some of those basic cybersecurity best practices that you were highlighting, John. So email security, about 63% of hospitals. NFA, probably the number one thing we need to implement right now to protect against some of these threat vectors, about 64% of hospitals. Network segmentation, about 62% of hospitals. So A, it's good that we've got 60 something percent implementing these technologies, but we have 35-40% of hospitals that remain exposed and uncovered.

00:07:45:22 - 00:08:24:02
Justin Spelhaug
So that's what our program is trying to get at and get across. And then number four, while most rural hospitals scored well across the category of asset management, one subcategory, which is super critical, endpoint management is a substantial risk for rural hospitals. Less than 35% of assessed hospitals met the expert informed passing score for endpoint management. And if you remember what I said about ransomware, the ransomware is coming through those devices that do not yet have endpoint management comprehensively, you know, securing them.

00:08:24:02 - 00:08:46:26
Justin Spelhaug
So that's a real challenge as well. So there's a lot of work to do, a lot of work to do across the community. Now, the second category is that this challenge is enormous. And we're talking about over 2000 hospitals here in the United States. And it is going to take strong public private partnership with, I think, a real shared spirit both of collaboration

00:08:46:26 - 00:09:07:07
Justin Spelhaug
but John, like you have, urgency. Because this is a life and safety issue as you mentioned. This is people's lives at stake and livelihoods of communities at stake. And this relates to technology. Certainly we need to get the technology out there, but it also relates to funding, developing long term cyber skills, job pathways in these communities, broadband access,

00:09:07:08 - 00:09:25:22
Justin Spelhaug
there's a lot of different things that we need to get done. And, you know, Microsoft is all in. I know AHA is all in. And we're going to need more partnerships to tackle the size of this challenge. Another question here for you, John. You know, how can we collectively address the near-term risks of cyberattacks for rural hospitals?

00:09:25:22 - 00:09:29:07
Justin Spelhaug
Some of those issues that I just talked about from your vantage point.

00:09:29:10 - 00:10:07:10
John Riggi
First, I absolutely agree with all of those basic cybersecurity hygiene controls, procedures, policies that you've discussed. In fact, if hospitals are in fact looking for kind of a clear and concise list of these practices, starting with that multifactor authentication, unified identity management privilege accounts, you can go to, HHS' website - Health and Human Services website - where they have a list of ten essential cybersecurity practices and ten enhanced cybersecurity practices.

00:10:07:10 - 00:10:27:01
John Riggi
These are voluntary at the moment. They may become minimum mandatory at some point, but that's a good place to get that concise list, which includes all those recommendations that you made. And then ultimately, hospitals have to have the resources, not just a list to help implement these measures effectively.

00:10:27:03 - 00:10:56:13
Justin Spelhaug
Yeah they do, John. You know, we've also learned to remediate many of the risks that we're seeing to bring partner services in. If a hospital wanted to fund that, let's say they didn't have the staff, maybe between $30,000 or $40,000 per hospital to get those immediate issues addressed. You multiply that by 2000 hospitals. That's $60-$80 million, which in the grand scheme of things, and we're talking about rural America and rural communities, is a big number

00:10:56:13 - 00:11:16:03
Justin Spelhaug
but it's not that big of a number. And we need to be mobilizing all of the resources we can to tackle that. Now, of course, there's more systemic challenges, such as the skills in the community and ongoing challenges to maintain the environments and to upgrade the software and the hardware over time. That's going to require systemic, capacity building, systemic sources of funding.

00:11:16:03 - 00:11:37:05
Justin Spelhaug
But that has certainly been a learning we've had as well. So, John, as we kind of conclude the discussion, how are you thinking really about insuring rural hospital resilience long into the future? Sure, we're facing these challenges right now, but how do we create resilience over time?

00:11:37:07 - 00:12:23:28
John Riggi
Again, great question, Justin, because that's really what this is about. It's about the long game. If we just address the near-term tactical threat that will not secure our future against these threats, nor will it secure our rural communities in the future. So really, what we do need is this sustained support from both public and private sectors to kind of help bolster these resources and really this continuing partnership in innovation across the rural areas, these public private partnerships, and we need to continue to invest in innovative solutions, workforce development, collaborative efforts to address these both systemic challenges, these international challenges, the strategic threat and then ultimately which translates down to the patient care and safety

00:12:24:00 - 00:12:32:07
John Riggi
risk. Again, what good is needed this continued whole-of-nation approach, and we're proud to have Microsoft as a partner in that effort.

00:12:32:10 - 00:13:12:15
Justin Spelhaug
Now we're proud to partner with you, John. AHA has been just such a staunch supporter, first of the rural hospital community and really advocating for that community broadly, getting partners like Microsoft to the table, helping us formulate effective strategies that provide as much capability to as many hospitals as we possibly can. And, we remain super committed to this effort and look forward to working both with you, other public and private sector partners that want to come together, that are of like mind, that want to collaborate, that are feeling the urgency like we're feeling and seeing the urgency and support these essential hospitals and these essential communities all across America.

00:13:12:18 - 00:13:25:18
John Riggi
Thank you, Justin, and thank you Microsoft. It's been a great pleasure discussing this important topic with you today, and look forward to our continued partnership to help defend America's hospitals against these cyberthreats.

00:13:25:20 - 00:13:34:02
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.

00:00:01:04 - 00:00:45:24
Tom Haederle
Health care tops the list of critical infrastructure targeted by cybercriminals. These threat to life crimes hit every hospital hard, but rural providers even harder due to fewer resources and generally smaller IT staff. The average recovery cost from a ransomware attack is $11 million, a vast sum that leaves many rural hospitals one cyberattack away from closure. In today's podcast, we hear from John Riggi, the American Hospital Association's national advisor for Cybersecurity and Risk, and Justin Spelhaug, corporate vice president of tech for Social Impact, Microsoft Philanthropies, about the steps rural providers can take to reduce the risk and impact of a ransomware attack.

00:00:45:27 - 00:01:13:18
Justin Spelhaug
I'm Justin Spelhaug the corporate vice president of tech for Social Impact here at Microsoft Philanthropies, and I'm joined by my co-host John Riggi, the national advisor for Cybersecurity and Risk at the American Hospital Association. And we're here today to discuss critical issues of cybersecurity in rural hospitals, and how our partnership is coming together to tackle the challenges that so many rural hospitals are facing across America.

00:01:13:19 - 00:01:17:09
Justin Spelhaug
So thank you for joining us. And John, thank you for joining us. Good to see you here today.

00:01:17:12 - 00:01:20:24
John Riggi
Good to see you too, Justin. It's always great to partner with you.

00:01:20:26 - 00:01:30:09
Justin Spelhaug
Well, John, you know, as the expert in hospital cybersecurity, can you tell us why rural hospitals are particularly vulnerable to cyber attacks?

00:01:30:11 - 00:01:58:19
John Riggi
Justin, great question. There's really a number of factors about that. First, the impact of the physical distance on patient care and mortality when a hospital is shut down by a ransomware attack. For example, rural hospitals provide critical health services to about 60 million Americans, or nearly 20% of the US population. Rural residents already must travel more than twice as far as urban residents to reach the nearest hospital.

00:01:58:22 - 00:02:30:22
John Riggi
So when you have this increased travel distances, they are directly associated with higher mortality rates for time sensitive conditions like heart attack, stroke or trauma. And then you're diverting these patients during a ransomware attack, again just magnifying that risk. Then there are the resource challenges, financial constraints and skill shortages. Low operating margins due to patient volumes, high fixed costs relative to urban hospitals. And rural hospitals are more likely to have older technology and smaller IT support staff.

00:02:30:27 - 00:02:59:06
John Riggi
This impacts the resources to implement key cybersecurity measures, creating really, unfortunately, an ideal opportunity for exploitation for cyber criminals. The average cost of addressing cyber attacks - now this is the cost after you've been attacked - the cost to recover is almost $11 million. I mean, just an enormous, staggering amount for the average rural hospital. Thirty percent of all rural hospitals are already at risk of closing,

00:02:59:08 - 00:03:22:09
John Riggi
so they can be only one cyber attack away from closure. And then, of course, as I indicated, there's a skill shortage. Very difficult to get your best cyber security professionals to work in rural areas. The salaries are generally not as competitive as urban areas or even other industries, so you compile that...it's extremely challenging to get good experienced

00:03:22:10 - 00:03:53:22
John Riggi
IT staff to work in rural America. And then we have geopolitical factors making rural hospitals kind of unique targets. So over the past 12 months, cyber attacks against hospitals have increased about 130%, making them the top critical infrastructure that's targeted by cybercriminals. And make no mistake, they know when they target a hospital, lives are threatened. In fact there's now even evidence that nation-states are collaborating with criminal groups.

00:03:53:24 - 00:04:04:21
John Riggi
Justin, I know Microsoft keeps a very close eye on the evolving threat landscape. Can you talk to us a bit about the trends you're watching that might affect health care organizations?

00:04:04:24 - 00:04:27:13
Justin Spelhaug
I can and John, thanks. I mean, your feedback that hospitals are only, you know, one cyberattack away from closing, especially the rural hospitals that are very stretched, is just really eye opening. And when we look at the challenge facing hospitals, but frankly, many different kinds of organizations, one of the reports that we produced is a Microsoft Digital Defense report.

00:04:27:18 - 00:04:51:13
Justin Spelhaug
Now, we use about 78 trillion security signals a day from Windows and Cloud endpoint devices to inform this report. We've got security engineers and intelligence analysts tracking about 1500 unique threat groups all around the world. And the trends I'll talk about here are relevant for every industry. But as you said, John, it's impacting health care and it's impacting rural health care in particular.

00:04:51:17 - 00:05:32:03
Justin Spelhaug
So let's talk about a couple of the trends. The first one is that we're continuing to see a massive escalating intensity on password based attacks. When we look at our Microsoft entry data, we see organizations being barraged by about 600 million identity attacks per day, and 99% of those are password based. Now, advances such as zero trust architecture, conditional access policy, MFA have helped defend against this. But we're seeing hackers work around MFA, targeting infrastructure and applications and bypassing authentication altogether.

00:05:32:03 - 00:05:59:15
Justin Spelhaug
And that's why advanced monitoring and threat detection capabilities inside of an environment are so critical. So that's the first theme. The second theme that we see is nearly a 3X increase in year-over-year human operated ransomware attacks. They're attacking health care. They're attacking rural hospitals. They're attacking nonprofit. They're attacking schools, they're attacking sensitive government infrastructure. Now, on the good news

00:05:59:15 - 00:06:27:25
Justin Spelhaug
if there is any good news anywhere in this story, is we see a significant decline year-over-year in attacks reaching the encryption stage and locking up resources. And that's because of the deployment of automated attack disruption tool. It is also endpoint protection deployment 92%, 92% of all successful ransomware attacks involve the attacker going through unmanaged device on the network.

00:06:27:27 - 00:06:50:08
Justin Spelhaug
And it's also about increased training and awareness across the employee base in every organization. But we need to keep making progress because as you know, John, you said the average recovery was about an $11 million investment when they break through. It's devastating, for a rural hospital in particular it's devastating. We're also seeing a third theme and that's the ingenuity of fraud

00:06:50:08 - 00:07:20:26
Justin Spelhaug
tactics are quickly evolving. We saw growing sophistication of investment scams, tech support scams are particularly impacting hospitals and more. At the same time, we're seeing impersonation getting more sophisticated, in fact, and detection more difficult because of the access to deepfake technologies that cybercriminals are using. And globally, the World Economic Forum reports that scammers stole over 1 trillion in U.S. dollars from the global economy in 2023.

00:07:20:26 - 00:07:54:11
Justin Spelhaug
So the massive, massive impact. Then finally, John, something that you mentioned, nation-states. We're seeing actually blurred lines between nation-state threat actors and cybercriminals. They're partnering together to advance each other's objectives and in particular monitoring and see Iran, who appears to be the most active nation-state actor targeting health care organizations specifically. Perhaps the most acute impacts and the biggest headlines have been in the health sector, certainly over the last 12 months.

00:07:54:13 - 00:08:13:15
Justin Spelhaug
And when you talk about a small rural organization or a rural hospital, John, as you just did with less resources as you just talked about to protect themselves and respond. We know why, you know, hackers are targeting these organizations and why it is such a huge challenge for us here in the United States. So big challenges all around.

00:08:13:17 - 00:08:25:04
Justin Spelhaug
Now, John, those are the challenges. Can you talk a little bit about the impacts you're seeing these cyber attacks actually have on hospitals and maybe even more importantly, the communities that they serve?

00:08:25:06 - 00:08:56:17
John Riggi
As you know, the AHA has been a very loud voice signaling what the impact is of these ransomware attacks on hospitals. Unfortunately, this isn't just about the protection and privacy of data. It's very important, but most importantly is the disruption to patient care. These attacks have caused significant disruption and delay to health care delivery when hospitals are attacked directly or through some third party attack that results in a disruptive effect.

00:08:56:24 - 00:09:31:09
John Riggi
And we all know that when there is disruption and delay to health care delivery, patient safety is placed at risk. Lives are threatened. The bottom line: these attacks are not just data theft crimes. These are threat to life crimes. And again, they're not only going after hospitals, but after our mission critical third party providers. For instance, the Change Healthcare attack: the largest, most consequential cyberattack against health care in history, compromised the health care records of 100 million patients, 100 million Americans, costing the sector $100 million a day.

00:09:31:12 - 00:09:57:23
John Riggi
And then ultimately disrupting health care delivery. But it's not just the big organizations that are attacked. And of course, when a rural hospital is attacked, there's an outsized impact to the community they serve. Because these attacks, as we have seen, are not just attacks on the hospital as an organization. It's an attack against the patients inside the hospital and against the entire community

00:09:57:23 - 00:10:26:11
John Riggi
that depends on the availability of that hospital. A couple of years ago, we had an attack on Sky Lakes Medical Center in southern Oregon. Their 90 bed hospital serve about 120,000 people across 10,000 square miles. Their next nearest hospital, 72 miles away. And when this attack occurred and encrypted their systems forcing them to shut down many of their services, it was very, very significant disruption.

00:10:26:11 - 00:10:54:01
John Riggi
And that disruption lasted about 28 days. They had to use 60,000 sheets of paper for clinical documentation. Fortunately, they did not have to pay the ransom. They had the capability to recover and restore independently. But again, significant impact to patient care delivery. And even after it hired extra staff, it took some six months to input all the paper records into the system.

00:10:54:03 - 00:11:23:00
John Riggi
So the organization spent about $10 million, a huge expense that was not covered by insurance to overcome this attack. And we have to thank Skylights Medical Center for coming forward to share best practices and lessons learned so we can all help prepare for the impact of these attacks. Unfortunately, I have many examples of how these attacks affect the patients in these rural hospitals, but also threaten the safety of the entire community.

00:11:23:03 - 00:11:45:10
John Riggi
A couple years back, I got a call from a hospital in the Pacific Northwest, and they were talking about an attack that they were experiencing, but there were two other hospitals that were also under attack. And so their natural diversion points no longer existed. And they said, John, we are very, very concerned because our next nearest emergency department is 125 miles away.

00:11:45:16 - 00:12:02:21
John Riggi
Said John, we've got a medevac parked in the parking lot, but we already are in the state. It actually snows in the winter quite a bit, and we're expecting a storm to come in. If that happens, our medevac can't fly. And if we get a stroke, heart attack or trauma patient, that patient's going to have to go ground transport if it's even safe.

00:12:02:23 - 00:12:21:20
John Riggi
And unfortunately, we don't think that patient would make it under those conditions. That's how deadly serious these attacks are. And that's why we always say and tell the federal government that these attacks - make no mistake - the bad guys know what they're doing in the hospital. They're threatening lives. These are threat to life crimes.

00:12:21:22 - 00:12:39:29
Tom Haederle
Thanks for listening to part one of this podcast. Please join us on Wednesday for part two as we continue this important conversation on cybersecurity for rural hospitals. Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcast.