Advancing Health Podcast

00:00:01:03 - 00:00:26:14
Tom Haederle
Welcome to Advancing Health. Hospitals and health systems never stop working to advance patient safety and quality. It has been and always will be our field's top priority. In today's conversation, two former American Hospital Association board chairs discuss the importance of bringing a culture of safety reporting to an organization, and how technology can't replace the human factor in a successful patient safety strategy.

00:00:26:16 - 00:00:41:04
Tom Haederle
Dr. Mindy Estes is the former CEO of Saint Luke's Health System in Kansas City and her guest, Nancy Howell Agee, is CEO emeritus of Carilion Clinic in Roanoke, Virginia.

00:00:41:06 - 00:01:06:23
Mindy Estes, M.D.
I'm Dr. Mindy Estes, and today we have the privilege of speaking with Nancy Howell Agee, CEO of Carilion Clinic. Nancy's remarkable journey began as a nurse when her commitment to patient care laid the foundation for an extraordinary leadership career. So let's just jump right in. You've had a remarkable career from nurse to CEO and long service in the field for AHA and other organizations

00:01:06:23 - 00:01:24:22
Mindy Estes, M.D.
and so, I think it really gives you a unique perspective on health care quality, safety, equity, workforce, all facets that go into a quality organization. So thinking back, what have been the most important actions you've taken as a leader to drive quality and patient safety?

00:01:24:25 - 00:02:09:21
Nancy Howell Agee
Well, you know, I'm glad you mentioned that I began my career as a nurse. And I treasure the fact that I am a nurse still. And, as one-on-one patient encounters are what have always driven me - the notion that you're caring for one person after another, and how you do that the very best of all. As I became a leader in health care about the time that I was moving as a chief operating officer and then the CEO, I was a representative from the American Hospital Association to the Joint Commission, and I was on the Joint Commission Board.

00:02:09:24 - 00:02:34:07
Nancy Howell Agee
And at that time, you know, we were beginning to talk about zero harm. And so I was hearing from the AHA in one ear: patient safety, quality; and in the other ear from the Joint Commission, patient safety and quality. So in stereo, what's really important. And I pondered that quite a lot as a leader to look at our own organization,

00:02:34:07 - 00:03:00:07
Nancy Howell Agee
what could we do differently? Not just check the box, not just meet the regulations, but really understand fundamentally what it meant to improve health care, improve patient safety, and improve quality. It seemed to me that it needed to start with the board. And so sort of a bottom up, top down conversation of education about our highest priority and what that meant.

00:03:00:07 - 00:03:31:07
Nancy Howell Agee
And when we talk about statistics, it's really important to measure quality, of course. But a statistic represents a patient. And so we began to frame how we think about quality with the patient in mind. Not the patients, but a patient. And it seemed to make a difference. At that time we reorganized the board and the board committees. And while we had a quality committee, it wasn't perhaps as robust as the finance committee.

00:03:31:07 - 00:04:00:15
Nancy Howell Agee
And it seemed like the committee that got the most airtime at board meetings was the finance committee. And educating the board about what it meant to be an integral, high integrity, zero harm organization. So we renamed the Quality Committee for the board CAPS: Clinical Advancement and Patient Safety. And now the two most important board committees are CAPS and finance.

00:04:00:17 - 00:04:27:09
Nancy Howell Agee
And our board chair sits on both. In hindsight, it was really important that our board chair began to [see] patient safety and quality is the single most important thing. I'll tell you something else we've done, Mindy. We celebrate what we call the great catch. And so the more event reporting that we do, we think that's fantastic. And so we, you know, any little thing, any big thing. Was funny,

00:04:27:09 - 00:04:51:07
Nancy Howell Agee
I was waiting on the elevator, a gurney went by and it went a little too fast around the curve. And there was a resident standing there and he said, hey, I think we need to put that in the event report. And it was, you know, just kind of an everyday encounter, but it was a great focus. The other thing we did was create a new set of values.

00:04:51:09 - 00:05:25:17
Nancy Howell Agee
Our mission is to improve the health of the communities we serve. We focused on our values and our values include courage, compassion, curiosity, commitment. And by focusing on those values,  we use those to talk and to educate regularly for new employees, as well as every year the required education for all staff include focus on our values and what that means to patient safety and quality.

00:05:25:19 - 00:06:02:13
Nancy Howell Agee
And the last thing I'd mention is that we organized everything under one umbrella. So everything from risk management to honor reporting to all the sort of things we do for preparation, for Joint Commission, for surveys from our state, patient safety, patient advocacy and our human factors team and our sim lab are all under one umbrella. And creating that real focus that's both education metrics and celebrate the good work that we do.

00:06:02:15 - 00:06:37:27
Mindy Estes, M.D.
It's remarkable. There are a couple of things that have, that have struck me. One is your point about so much time spent in board meetings on finance. And one of the things that, we did at Saint Luke's was to reorder our board agenda and have a quality close, if you will, just like we have the financial close where we are presenting the quality metrics not only on a monthly basis, but year to date basis, so that we have time on the front end of the board meeting to talk about quality as opposed to whatever time we had left.

00:06:38:00 - 00:07:06:15
Mindy Estes, M.D.
The other thing I would mention is, as you know, I'm currently on the Joint Commission Board, and we talk about innovation and quality and patient safety. And the conversations when you were on the board beginning to talk about Do No Harm. You know, today Joint Commission is innovating and innovating rapidly. So I think it really is, organizations in the Joint Commission, in this instance, marching together from a foundation that's been created over a number of years.

00:07:06:18 - 00:07:31:02
Mindy Estes, M.D.
You helped develop Carilion's innovative care model. Undoubtedly - and I've heard you speak on how that evolved - and I know you have a lot of insights for other leaders. So if you were advising a new system leader and there certainly as we've seen, movement in health care, there are a lot of new system leaders in our field. What would you tell them to do first, to set the tone for an effective culture in the organization?

00:07:31:02 - 00:07:34:04
Mindy Estes, M.D.
I think you've already touched on that, but I know there's more.

00:07:34:06 - 00:08:19:07
Nancy Howell Agee
I think creating an environment of this is our highest priority means you're using every single meeting, every memo, your social media, we have an internal social activity. We focus on that with every single communication that we have. And I think that that's critically important. But I'm glad you mentioned technology because both existing technology and new technologies, again, we focus on why we're doing this for patient safety and how it improves quality and by having that as our key priority, I think it begins to permeate the organization.

00:08:19:15 - 00:08:45:00
Nancy Howell Agee
Technology is important. If you ask me, what doesn't work as well as you thought it would when you first started? You know, I'll say introducing an electronic health record. I remember when we did that and we did it big bang approach. And I remember these words probably came out of my mouth as much as anybody. We're going to eliminate medication errors by having this technology.

00:08:45:04 - 00:09:15:24
Nancy Howell Agee
And of course that's ridiculous in hindsight. There's nothing that can completely alter the human nature of our business, thank goodness. But because we are humans, mistakes can happen. And so doing everything you can to have a safe environment, to create a culture that's a permissive culture that encompasses patients taking quality and everything that you do, I think that makes all the difference.

00:09:15:27 - 00:09:43:27
Nancy Howell Agee
You know, Mindy, you and I go back a long time. We used to think about things like central line infections and catheter infections and I don't know. It wasn't that we were cavalier about those things. I think we were just as concerned about patient safety and quality. We didn't recognize the whole milieu that it took to care for every single patient, every time, in the way that a patient should be cared for.

00:09:43:29 - 00:10:02:28
Nancy Howell Agee
And when I look back and I think about some of the things that we perhaps took for granted or didn't realize that we could change, and now I look where we are as an industry. Our whole field has improved patient safety culture, and I think there's even more that we can do.

00:10:03:00 - 00:10:26:20
Mindy Estes, M.D.
You know, to your point of change. And, you know, I think organizations like ours, we test, we pilot, we retest, and, you know, we want consensus. And if we don't like the first pilot, we do another one. And I think Covid taught us very quickly that, you know, we can innovate and we can innovate quickly. And we can learn from that innovation

00:10:26:20 - 00:10:39:12
Mindy Estes, M.D.
and if we fail, we need to fail quickly. And you touched on the electronic record and my next question, it was just going to be, what did you learn from something that wasn't as effective as you might have hoped?

00:10:39:15 - 00:11:03:10
Nancy Howell Agee
Well, I'll just echo first of all that you're right. During Covid, we learned, and I hope we continue to learn that lesson - and that is innovate, innovate quickly. You know, I think we can be accused of being way too slow and thinking through things, which is important. We have a saying here. Take risks without being reckless. After all, you are talking about a patient's life.

00:11:03:12 - 00:11:44:00
Nancy Howell Agee
The notion that we can innovate, that we can recognize and do something about that and take ownership at multiple levels. So I think one of the real lessons that began before Covid, but what really came home during Covid was a necessity for focusing on the resilience of our staff and all the things that we can do, because, you know, as a CEO, you and I are not really important to that patient interaction, that precious moment between a caregiver and a patient.

00:11:44:03 - 00:11:54:07
Nancy Howell Agee
And so all the things that we can do to support our staff so that they can give the kind of high quality, safe care that we would expect.

00:11:54:09 - 00:12:17:21
Mindy Estes, M.D.
You know, resilience continues to be important. And I think in this day and age is something that we used to take for granted as well, that the mission and the privilege to do what we do would fuel internal resilience. And I think part of this whole patient safety, quality and quality of our workforce and our workforces experience as well -

00:12:17:27 - 00:12:57:04
Mindy Estes, M.D.
that resilience and how we take care of that has become increasingly important. And Nancy, I want to thank you as always for your time, for your sharing your insights and experiences and your journey from being a nurse to an award winning CEO and your successful transformation of Carilion Clinic. It really provides powerful lessons for all health care leaders at all levels, and your commitment to quality and safety innovation, combined with your dedication to mentoring future leaders, especially women in health care, truly exemplifies exceptional leadership.

00:12:57:04 - 00:13:25:04
Mindy Estes, M.D.
And, you know, we've seen through your examples, how health care organizations can navigate while maintaining an unwavering focus on quality and safety, Because at the end of the day, that is what we do to provide the highest quality patient care and safety to our patients, first and foremost. And I really think it's important for our listeners to realize that underlying all of the success you've had is the heart of a nurse.

00:13:25:06 - 00:13:27:11
Nancy Howell Agee
Thank you Mindy.

00:13:27:13 - 00:13:35:23
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.

00:00:01:04 - 00:00:36:12
Tom Haederle
Welcome to Advancing Health and part two of the conversation on cybersecurity attacks against rural hospitals, and what can be done to protect against them. In this conversation between John Riggi, the American Hospital Association's national advisor for Cybersecurity and Risk, and Justin Spelhaug, corporate vice president of tech for Social Impact, Microsoft Philanthropies, we learn more about the role tech leaders can play in helping rural health care providers cope with cyber attacks and preserve their ability to care for the nearly 60 million Americans who depend on them.

00:00:36:14 - 00:00:45:02
Justin Spelhaug
So the impact is clearly disruptive on these hospitals, clearly disruptive. Now, John, what can these hospitals do to protect themselves?

00:00:45:04 - 00:01:04:21
John Riggi
So there's many things that they can do. There's many things they need to do. But again, it generally comes down to a resource issue. So we generally say start with the basics. Look at your tools and policies. We know that there are certain cybersecurity practices, basic practices that can help mitigate the risk of the majority of cyberattack.

00:01:04:27 - 00:01:33:13
John Riggi
So example: multi-factor authentication, unified identity management, cybersecurity training for staff. We know that most of the attacks still start with those phishing emails, a psychological technique versus technological. Another step: join the Microsoft cybersecurity program. You all have been very generous in offering free cybersecurityassessments, curated learning pass product discounts to all rural hospitals in the U.S.

00:01:33:16 - 00:01:53:03
John Riggi
And I mean, these are the type of things that we need to do together to help shore up the defenses of rural hospitals. Now, Justin, can you tell us more about the Microsoft cybersecurity program for rural hospitals in the role you see technology leaders having in addressing these challenges?

00:01:53:05 - 00:02:17:22
Justin Spelhaug
Yeah, for sure, John. And of course, the technology leaders in these hospitals are on the frontline of driving change, and they're managing everything end to end with really limited resources. And so we wanted to pull together a program that would provide them more capacity, more capability to respond to the threats that you've just highlighted. And really, there are three big buckets. New offers that help make our technology more affordable.

00:02:17:24 - 00:02:41:18
Justin Spelhaug
That's bucket one. Bucket two is capacity building services to help organizations respond. And then bucket three is new innovation to help rural hospitals have more impact, particularly with AI. So let me click into those just really specifically for just a moment. In bucket one, in terms of new affordable offers, we're providing those hospitals that typically have the least resources.

00:02:41:18 - 00:03:28:10
Justin Spelhaug
And so that's independent critical access hospitals and rural emergency hospitals, those that are not in a health system, they can access Microsoft nonprofit pricing, which can provide up to a 75% discount for things like Microsoft 365 off of commercial pricing. So that goes a big way in helping some organizations really get access to affordable technology. Now, all other rural hospitals in the U.S. that are using Office 365 or M365 can get access to one year free of our most advanced security suite, Microsoft 365, E5 security and EMS E3 for one year to ensure that they can take action on their infrastructure immediately.

00:03:28:13 - 00:03:55:22
Justin Spelhaug
We've also for everybody, we've extended one year of Windows 10 Extended Security update at no cost. So that's on the technology side. On the capacity building side, we're providing every rural hospital in America, over 2000 hospitals, free security assessments, through a pre-vetted Microsoft security partner to help them evaluate their risks and identify strategies to mitigate those risks.

00:03:55:24 - 00:04:19:08
Justin Spelhaug
We've also, in this bucket, put together curated learning pathways for both technical staff and non-technical staff. And then the third area is AI innovation. Now, John, you were highlighting how stretched the finances of rural hospitals are, and CHQPR reports - and you said, John, that 30% of all rural hospitals are at risk of closure - that's a real statistic.

00:04:19:10 - 00:04:46:20
Justin Spelhaug
And that means that funding is limited and funding is limited for security expertise and the services that they need. So to help tackle this challenge, we've launched a Microsoft Rural Health AI lab, which we affectionately call RAIL, that is developing tools to help improve both financial and health outcomes. The first tool we built, which is in testing now with a number of hospitals, is an AI tool to support managing denied insurance claims.

00:04:46:27 - 00:05:08:15
Justin Spelhaug
We know that's a massively manual process for many hospitals. We know that if we can manage that more effectively, we can improve hospital revenue, which improves all outcomes. We've also been working to deploy nuance to improve patient and physician nurse experience through AI. And we continue to look at how we can use AI to support hospitals for a number of other scenarios.

00:05:08:18 - 00:05:40:22
Justin Spelhaug
Since we launched it, nearly 500 hospitals have registered for the program. That's about 24% of all the hospitals in the country. And that's in about the last four months. Over 335 hospitals are participating in a cybersecurity assessment, and many are getting access to the offers as well. And this is, John, part of a broader commitment to rural communities. We've been investing for years, actually, in rural communities, both tackling the broadband divide in America, as well as investing in innovation in rural communities through our Tech Spark initiatives.

00:05:40:22 - 00:05:46:26
Justin Spelhaug
So this is just the next step that we're taking for this acute challenge that we're dealing with at the moment.

00:05:46:28 - 00:05:54:12
John Riggi
Since launching the cybersecurity program for rural hospitals. Let me ask you, Justin, what has Microsoft learned?

00:05:54:15 - 00:06:15:25
Justin Spelhaug
Yeah. You know, John, we've learned a lot. And, you know, as I mentioned before, we've engaged just about 500 hospitals. And our learnings really break into two categories. So if you're watching this and you are a cybersecurity professional, pay attention to this next section because I want to tell you what we're learning from the hospitals that we're engaging with directly.

00:06:15:27 - 00:06:42:06
Justin Spelhaug
Four key technical learnings that we're having. Number one, privileged account management is the top liability that we're seeing in many rural hospitals. Only 25% of rural hospitals adequately separate end user and privileged accounts, i.e. those accounts that have broader access to systems and data. Getting that segmentation is critical in terms of protecting your footprint. That's probably learning

00:06:42:09 - 00:07:11:20
Justin Spelhaug
number one. Learning number two is mitigating known vulnerabilities, running basic vulnerability scanning, doing timely patching, establishing processes to remediate those issues. Only 49% of hospitals that we're working with right now receive passing scores on being able to mitigate vulnerabilities quickly. That's because they're stretched. They're doing everything. They've got a limited amount of resource. That's really the truth. But it's a challenge nevertheless.

00:07:11:22 - 00:07:45:22
Justin Spelhaug
Number three, less than 65% of rural hospitals have implemented some of those basic cybersecurity best practices that you were highlighting, John. So email security, about 63% of hospitals. NFA, probably the number one thing we need to implement right now to protect against some of these threat vectors, about 64% of hospitals. Network segmentation, about 62% of hospitals. So A, it's good that we've got 60 something percent implementing these technologies, but we have 35-40% of hospitals that remain exposed and uncovered.

00:07:45:22 - 00:08:24:02
Justin Spelhaug
So that's what our program is trying to get at and get across. And then number four, while most rural hospitals scored well across the category of asset management, one subcategory, which is super critical, endpoint management is a substantial risk for rural hospitals. Less than 35% of assessed hospitals met the expert informed passing score for endpoint management. And if you remember what I said about ransomware, the ransomware is coming through those devices that do not yet have endpoint management comprehensively, you know, securing them.

00:08:24:02 - 00:08:46:26
Justin Spelhaug
So that's a real challenge as well. So there's a lot of work to do, a lot of work to do across the community. Now, the second category is that this challenge is enormous. And we're talking about over 2000 hospitals here in the United States. And it is going to take strong public private partnership with, I think, a real shared spirit both of collaboration

00:08:46:26 - 00:09:07:07
Justin Spelhaug
but John, like you have, urgency. Because this is a life and safety issue as you mentioned. This is people's lives at stake and livelihoods of communities at stake. And this relates to technology. Certainly we need to get the technology out there, but it also relates to funding, developing long term cyber skills, job pathways in these communities, broadband access,

00:09:07:08 - 00:09:25:22
Justin Spelhaug
there's a lot of different things that we need to get done. And, you know, Microsoft is all in. I know AHA is all in. And we're going to need more partnerships to tackle the size of this challenge. Another question here for you, John. You know, how can we collectively address the near-term risks of cyberattacks for rural hospitals?

00:09:25:22 - 00:09:29:07
Justin Spelhaug
Some of those issues that I just talked about from your vantage point.

00:09:29:10 - 00:10:07:10
John Riggi
First, I absolutely agree with all of those basic cybersecurity hygiene controls, procedures, policies that you've discussed. In fact, if hospitals are in fact looking for kind of a clear and concise list of these practices, starting with that multifactor authentication, unified identity management privilege accounts, you can go to, HHS' website - Health and Human Services website - where they have a list of ten essential cybersecurity practices and ten enhanced cybersecurity practices.

00:10:07:10 - 00:10:27:01
John Riggi
These are voluntary at the moment. They may become minimum mandatory at some point, but that's a good place to get that concise list, which includes all those recommendations that you made. And then ultimately, hospitals have to have the resources, not just a list to help implement these measures effectively.

00:10:27:03 - 00:10:56:13
Justin Spelhaug
Yeah they do, John. You know, we've also learned to remediate many of the risks that we're seeing to bring partner services in. If a hospital wanted to fund that, let's say they didn't have the staff, maybe between $30,000 or $40,000 per hospital to get those immediate issues addressed. You multiply that by 2000 hospitals. That's $60-$80 million, which in the grand scheme of things, and we're talking about rural America and rural communities, is a big number

00:10:56:13 - 00:11:16:03
Justin Spelhaug
but it's not that big of a number. And we need to be mobilizing all of the resources we can to tackle that. Now, of course, there's more systemic challenges, such as the skills in the community and ongoing challenges to maintain the environments and to upgrade the software and the hardware over time. That's going to require systemic, capacity building, systemic sources of funding.

00:11:16:03 - 00:11:37:05
Justin Spelhaug
But that has certainly been a learning we've had as well. So, John, as we kind of conclude the discussion, how are you thinking really about insuring rural hospital resilience long into the future? Sure, we're facing these challenges right now, but how do we create resilience over time?

00:11:37:07 - 00:12:23:28
John Riggi
Again, great question, Justin, because that's really what this is about. It's about the long game. If we just address the near-term tactical threat that will not secure our future against these threats, nor will it secure our rural communities in the future. So really, what we do need is this sustained support from both public and private sectors to kind of help bolster these resources and really this continuing partnership in innovation across the rural areas, these public private partnerships, and we need to continue to invest in innovative solutions, workforce development, collaborative efforts to address these both systemic challenges, these international challenges, the strategic threat and then ultimately which translates down to the patient care and safety

00:12:24:00 - 00:12:32:07
John Riggi
risk. Again, what good is needed this continued whole-of-nation approach, and we're proud to have Microsoft as a partner in that effort.

00:12:32:10 - 00:13:12:15
Justin Spelhaug
Now we're proud to partner with you, John. AHA has been just such a staunch supporter, first of the rural hospital community and really advocating for that community broadly, getting partners like Microsoft to the table, helping us formulate effective strategies that provide as much capability to as many hospitals as we possibly can. And, we remain super committed to this effort and look forward to working both with you, other public and private sector partners that want to come together, that are of like mind, that want to collaborate, that are feeling the urgency like we're feeling and seeing the urgency and support these essential hospitals and these essential communities all across America.

00:13:12:18 - 00:13:25:18
John Riggi
Thank you, Justin, and thank you Microsoft. It's been a great pleasure discussing this important topic with you today, and look forward to our continued partnership to help defend America's hospitals against these cyberthreats.

00:13:25:20 - 00:13:34:02
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.

00:00:01:04 - 00:00:45:24
Tom Haederle
Health care tops the list of critical infrastructure targeted by cybercriminals. These threat to life crimes hit every hospital hard, but rural providers even harder due to fewer resources and generally smaller IT staff. The average recovery cost from a ransomware attack is $11 million, a vast sum that leaves many rural hospitals one cyberattack away from closure. In today's podcast, we hear from John Riggi, the American Hospital Association's national advisor for Cybersecurity and Risk, and Justin Spelhaug, corporate vice president of tech for Social Impact, Microsoft Philanthropies, about the steps rural providers can take to reduce the risk and impact of a ransomware attack.

00:00:45:27 - 00:01:13:18
Justin Spelhaug
I'm Justin Spelhaug the corporate vice president of tech for Social Impact here at Microsoft Philanthropies, and I'm joined by my co-host John Riggi, the national advisor for Cybersecurity and Risk at the American Hospital Association. And we're here today to discuss critical issues of cybersecurity in rural hospitals, and how our partnership is coming together to tackle the challenges that so many rural hospitals are facing across America.

00:01:13:19 - 00:01:17:09
Justin Spelhaug
So thank you for joining us. And John, thank you for joining us. Good to see you here today.

00:01:17:12 - 00:01:20:24
John Riggi
Good to see you too, Justin. It's always great to partner with you.

00:01:20:26 - 00:01:30:09
Justin Spelhaug
Well, John, you know, as the expert in hospital cybersecurity, can you tell us why rural hospitals are particularly vulnerable to cyber attacks?

00:01:30:11 - 00:01:58:19
John Riggi
Justin, great question. There's really a number of factors about that. First, the impact of the physical distance on patient care and mortality when a hospital is shut down by a ransomware attack. For example, rural hospitals provide critical health services to about 60 million Americans, or nearly 20% of the US population. Rural residents already must travel more than twice as far as urban residents to reach the nearest hospital.

00:01:58:22 - 00:02:30:22
John Riggi
So when you have this increased travel distances, they are directly associated with higher mortality rates for time sensitive conditions like heart attack, stroke or trauma. And then you're diverting these patients during a ransomware attack, again just magnifying that risk. Then there are the resource challenges, financial constraints and skill shortages. Low operating margins due to patient volumes, high fixed costs relative to urban hospitals. And rural hospitals are more likely to have older technology and smaller IT support staff.

00:02:30:27 - 00:02:59:06
John Riggi
This impacts the resources to implement key cybersecurity measures, creating really, unfortunately, an ideal opportunity for exploitation for cyber criminals. The average cost of addressing cyber attacks - now this is the cost after you've been attacked - the cost to recover is almost $11 million. I mean, just an enormous, staggering amount for the average rural hospital. Thirty percent of all rural hospitals are already at risk of closing,

00:02:59:08 - 00:03:22:09
John Riggi
so they can be only one cyber attack away from closure. And then, of course, as I indicated, there's a skill shortage. Very difficult to get your best cyber security professionals to work in rural areas. The salaries are generally not as competitive as urban areas or even other industries, so you compile that...it's extremely challenging to get good experienced

00:03:22:10 - 00:03:53:22
John Riggi
IT staff to work in rural America. And then we have geopolitical factors making rural hospitals kind of unique targets. So over the past 12 months, cyber attacks against hospitals have increased about 130%, making them the top critical infrastructure that's targeted by cybercriminals. And make no mistake, they know when they target a hospital, lives are threatened. In fact there's now even evidence that nation-states are collaborating with criminal groups.

00:03:53:24 - 00:04:04:21
John Riggi
Justin, I know Microsoft keeps a very close eye on the evolving threat landscape. Can you talk to us a bit about the trends you're watching that might affect health care organizations?

00:04:04:24 - 00:04:27:13
Justin Spelhaug
I can and John, thanks. I mean, your feedback that hospitals are only, you know, one cyberattack away from closing, especially the rural hospitals that are very stretched, is just really eye opening. And when we look at the challenge facing hospitals, but frankly, many different kinds of organizations, one of the reports that we produced is a Microsoft Digital Defense report.

00:04:27:18 - 00:04:51:13
Justin Spelhaug
Now, we use about 78 trillion security signals a day from Windows and Cloud endpoint devices to inform this report. We've got security engineers and intelligence analysts tracking about 1500 unique threat groups all around the world. And the trends I'll talk about here are relevant for every industry. But as you said, John, it's impacting health care and it's impacting rural health care in particular.

00:04:51:17 - 00:05:32:03
Justin Spelhaug
So let's talk about a couple of the trends. The first one is that we're continuing to see a massive escalating intensity on password based attacks. When we look at our Microsoft entry data, we see organizations being barraged by about 600 million identity attacks per day, and 99% of those are password based. Now, advances such as zero trust architecture, conditional access policy, MFA have helped defend against this. But we're seeing hackers work around MFA, targeting infrastructure and applications and bypassing authentication altogether.

00:05:32:03 - 00:05:59:15
Justin Spelhaug
And that's why advanced monitoring and threat detection capabilities inside of an environment are so critical. So that's the first theme. The second theme that we see is nearly a 3X increase in year-over-year human operated ransomware attacks. They're attacking health care. They're attacking rural hospitals. They're attacking nonprofit. They're attacking schools, they're attacking sensitive government infrastructure. Now, on the good news

00:05:59:15 - 00:06:27:25
Justin Spelhaug
if there is any good news anywhere in this story, is we see a significant decline year-over-year in attacks reaching the encryption stage and locking up resources. And that's because of the deployment of automated attack disruption tool. It is also endpoint protection deployment 92%, 92% of all successful ransomware attacks involve the attacker going through unmanaged device on the network.

00:06:27:27 - 00:06:50:08
Justin Spelhaug
And it's also about increased training and awareness across the employee base in every organization. But we need to keep making progress because as you know, John, you said the average recovery was about an $11 million investment when they break through. It's devastating, for a rural hospital in particular it's devastating. We're also seeing a third theme and that's the ingenuity of fraud

00:06:50:08 - 00:07:20:26
Justin Spelhaug
tactics are quickly evolving. We saw growing sophistication of investment scams, tech support scams are particularly impacting hospitals and more. At the same time, we're seeing impersonation getting more sophisticated, in fact, and detection more difficult because of the access to deepfake technologies that cybercriminals are using. And globally, the World Economic Forum reports that scammers stole over 1 trillion in U.S. dollars from the global economy in 2023.

00:07:20:26 - 00:07:54:11
Justin Spelhaug
So the massive, massive impact. Then finally, John, something that you mentioned, nation-states. We're seeing actually blurred lines between nation-state threat actors and cybercriminals. They're partnering together to advance each other's objectives and in particular monitoring and see Iran, who appears to be the most active nation-state actor targeting health care organizations specifically. Perhaps the most acute impacts and the biggest headlines have been in the health sector, certainly over the last 12 months.

00:07:54:13 - 00:08:13:15
Justin Spelhaug
And when you talk about a small rural organization or a rural hospital, John, as you just did with less resources as you just talked about to protect themselves and respond. We know why, you know, hackers are targeting these organizations and why it is such a huge challenge for us here in the United States. So big challenges all around.

00:08:13:17 - 00:08:25:04
Justin Spelhaug
Now, John, those are the challenges. Can you talk a little bit about the impacts you're seeing these cyber attacks actually have on hospitals and maybe even more importantly, the communities that they serve?

00:08:25:06 - 00:08:56:17
John Riggi
As you know, the AHA has been a very loud voice signaling what the impact is of these ransomware attacks on hospitals. Unfortunately, this isn't just about the protection and privacy of data. It's very important, but most importantly is the disruption to patient care. These attacks have caused significant disruption and delay to health care delivery when hospitals are attacked directly or through some third party attack that results in a disruptive effect.

00:08:56:24 - 00:09:31:09
John Riggi
And we all know that when there is disruption and delay to health care delivery, patient safety is placed at risk. Lives are threatened. The bottom line: these attacks are not just data theft crimes. These are threat to life crimes. And again, they're not only going after hospitals, but after our mission critical third party providers. For instance, the Change Healthcare attack: the largest, most consequential cyberattack against health care in history, compromised the health care records of 100 million patients, 100 million Americans, costing the sector $100 million a day.

00:09:31:12 - 00:09:57:23
John Riggi
And then ultimately disrupting health care delivery. But it's not just the big organizations that are attacked. And of course, when a rural hospital is attacked, there's an outsized impact to the community they serve. Because these attacks, as we have seen, are not just attacks on the hospital as an organization. It's an attack against the patients inside the hospital and against the entire community

00:09:57:23 - 00:10:26:11
John Riggi
that depends on the availability of that hospital. A couple of years ago, we had an attack on Sky Lakes Medical Center in southern Oregon. Their 90 bed hospital serve about 120,000 people across 10,000 square miles. Their next nearest hospital, 72 miles away. And when this attack occurred and encrypted their systems forcing them to shut down many of their services, it was very, very significant disruption.

00:10:26:11 - 00:10:54:01
John Riggi
And that disruption lasted about 28 days. They had to use 60,000 sheets of paper for clinical documentation. Fortunately, they did not have to pay the ransom. They had the capability to recover and restore independently. But again, significant impact to patient care delivery. And even after it hired extra staff, it took some six months to input all the paper records into the system.

00:10:54:03 - 00:11:23:00
John Riggi
So the organization spent about $10 million, a huge expense that was not covered by insurance to overcome this attack. And we have to thank Skylights Medical Center for coming forward to share best practices and lessons learned so we can all help prepare for the impact of these attacks. Unfortunately, I have many examples of how these attacks affect the patients in these rural hospitals, but also threaten the safety of the entire community.

00:11:23:03 - 00:11:45:10
John Riggi
A couple years back, I got a call from a hospital in the Pacific Northwest, and they were talking about an attack that they were experiencing, but there were two other hospitals that were also under attack. And so their natural diversion points no longer existed. And they said, John, we are very, very concerned because our next nearest emergency department is 125 miles away.

00:11:45:16 - 00:12:02:21
John Riggi
Said John, we've got a medevac parked in the parking lot, but we already are in the state. It actually snows in the winter quite a bit, and we're expecting a storm to come in. If that happens, our medevac can't fly. And if we get a stroke, heart attack or trauma patient, that patient's going to have to go ground transport if it's even safe.

00:12:02:23 - 00:12:21:20
John Riggi
And unfortunately, we don't think that patient would make it under those conditions. That's how deadly serious these attacks are. And that's why we always say and tell the federal government that these attacks - make no mistake - the bad guys know what they're doing in the hospital. They're threatening lives. These are threat to life crimes.

00:12:21:22 - 00:12:39:29
Tom Haederle
Thanks for listening to part one of this podcast. Please join us on Wednesday for part two as we continue this important conversation on cybersecurity for rural hospitals. Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcast.

00:00:01:05 - 00:00:29:17
Tom Haederle
Welcome to advancing Health. Every hospital, every day and everywhere is striving to improve its quality of patient care. As the winner of the American Hospital Association's prestigious 2024 quest for quality prize, WellSpan health serving 12 counties in Pennsylvania, is among the best at advancing health for those who depend on it. In today's podcast, we learn more about how the efficiencies WellSpan adopted during the pandemic are still in place and still paying dividends today.

00:00:29:20 - 00:00:43:05
Tom Haederle
Your host is Doctor Mindy Estes, former president and CEO of Saint Luke's Health System and former chair of the Board of trustees.

00:00:43:07 - 00:01:19:27
Mindy Estes, M.D.
I'm Dr. Mindy Estes, and today we have the privilege of speaking with Dr. Roxanna Gapstur, the president chief executive officer of WellSpan health, a position she has held since January 2019. Doctor gaster brings over 25 years of extensive health care leadership experience, having worked across various settings including practices, academic institutions and integrated health systems. Her background in strategic planning, business development and operational leadership, both at ambulatory and hospital settings, has been instrumental in her success at, well, speed.

00:01:20:00 - 00:01:36:03
Mindy Estes, M.D.
So let's just dive right in. To begin, can you provide our listeners with an overview of WellSpan health and its mission? Understanding the foundation of the health system gives context to the strategic discussions we'll be talking about today.

00:01:36:06 - 00:02:04:24
Roxanna Gapstur, Ph.D., R.N.
Yes, absolutely. WellSpan health is an integrated care delivery system in central Pennsylvania. We serve 12 counties and about a million and a half people have nine hospitals, 23,000 team members and about 2500 providers in our system. We are the largest provider of behavioral health in our region, and we also have a clinically integrated network which provides a basis for our value based care strategy.

00:02:04:26 - 00:02:07:27
Mindy Estes, M.D.
So your geographic footprint is quite large.

00:02:07:29 - 00:02:16:00
Roxanna Gapstur, Ph.D., R.N.
It's about 12 counties now in the center of the state. Yeah. We've been growing and serving more patients each and every year.

00:02:16:05 - 00:02:44:12
Mindy Estes, M.D.
Were you in WellSpan in 2019? And soon after a small event happened, the world was confronted with the Covid 19 pandemic. And despite these challenges, WellSpan was noted for maintaining high quality care and extensive community support. Could you share 3 or 4 critical factors that enabled your leadership team to be successful during this period, and what you've taken from it since?

00:02:44:14 - 00:03:11:23
Roxanna Gapstur, Ph.D., R.N.
Yeah, absolutely. One of our values here at WellSpan is working as one. And I think this was a moment for us to really live that value. And throughout the pandemic, we were able to rapidly adapt to changes. We practiced agility, and we practiced one of our other values to find a better way. We have a significant focus in a pretty big community health team that works across central Pennsylvania.

00:03:11:25 - 00:03:40:22
Roxanna Gapstur, Ph.D., R.N.
And little did we know that the pandemic was going to highlight some of the challenges. And that team really helped us respond quickly to some of those challenges. We focused significantly on the well-being of our team. Again, I think we all found at the beginning of the pandemic, perhaps this wouldn't last a long time. But as the pandemic went on, we needed to make sure that our team was taking care of and being one of the largest providers of behavioral health services.

00:03:40:22 - 00:04:03:24
Roxanna Gapstur, Ph.D., R.N.
We had pretty significant internal resources that we were able to bring to that issue. And then finally, we really empowered our teams to think differently. And at one point during the pandemic, even had developed our own N95 mask. So I think those were were some of the pieces that were most important because we unleashed the innovation within our own teams.

00:04:03:27 - 00:04:21:26
Roxanna Gapstur, Ph.D., R.N.
We were able to move pretty quickly on things like the outdoor testing, things like out-of-pocket costs. We were one of the first in the nation to say that we would provide things without charge. Really proud of the team for embracing agility and making sure that the well-being of our teams were front and center.

00:04:21:28 - 00:04:49:18
Mindy Estes, M.D.
You know, I want to pick up on something that you said, most of us in health care study things, and we study things for a long time, and then we pilot things, and sometimes we're pilot things. And I think the Covid crisis, if you think about making lemonade out of lemons, really told us that we could be agile, that we could make decisions quickly and in TAC one way or the other if we needed to.

00:04:49:21 - 00:04:55:13
Mindy Estes, M.D.
And the question I have for you, have you been able to maintain that agility?

00:04:55:15 - 00:05:23:13
Roxanna Gapstur, Ph.D., R.N.
We have actually, so was one of the things that we said to ourselves during our after action reviews that what were some of the silver linings of Covid, and how might we continue to capitalize on those? And one of those was being agile and making decisions quickly. I think because we are locally governed and one of the only health systems in our area that is locally governed, it helps us make decisions quickly because our headquarters are here and our family, friends and neighbors are here.

00:05:23:13 - 00:05:40:27
Roxanna Gapstur, Ph.D., R.N.
And so that is something we've been able to maintain. One of the things that I did with my team during Covid was we split into two teams. We had one team really focused on our long term strategy and another team that just focused on operations and taking care of patients each and every day. We've used that as well.

00:05:40:28 - 00:05:49:02
Roxanna Gapstur, Ph.D., R.N.
Since the pandemic ended, it was a great way for us to still make progress on some things, even though, you know, we had a lot on our plates.

00:05:49:05 - 00:06:06:24
Mindy Estes, M.D.
Well, you make an important point. The work of health care and the future of health care and what what we as organizations were going to do once the immediacy of the pandemic was over, it was tempting to put that on the back shelf and get back to it. But, you know, once you let it go, it's very difficult to restart.

00:06:06:25 - 00:06:28:21
Mindy Estes, M.D.
One of the things I was impressed by that I think goes into this long term thought, is that you had low nursing staff turnover during the pandemic. What strategies did you implement to have such a successful retention of nursing staff during, admittedly, an incredibly stressful and unknown time?

00:06:28:24 - 00:06:51:04
Roxanna Gapstur, Ph.D., R.N.
Yeah, that's a great question. I think one of the biggest areas was just the focus on the well-being of the team. We had a lot of peer to peer support going on, as well as our psychologists and psychiatrists across the system, working with our frontline care teams every single day. So we had real time coaching and support on all of our units.

00:06:51:07 - 00:07:12:26
Roxanna Gapstur, Ph.D., R.N.
We also did a lot of state interviews and a lot of work on understanding what people needed now because as you know, you know, things evolve during Covid and lots of changes happened over those 2 or 3 years. I would say a benefit to us is that generally, our region tends to lag a little bit on things that occur.

00:07:12:26 - 00:07:31:27
Roxanna Gapstur, Ph.D., R.N.
So we saw surges in new Jersey and New York prior to central Pennsylvania getting those same surges. And so we were working to try and learn from our colleagues and maybe what was coming. Our way, and how we could do a better job with our teams and with our nurses. So those were some of the things we did.

00:07:31:29 - 00:07:40:13
Roxanna Gapstur, Ph.D., R.N.
I think later when you ask about innovation, if you do, I can talk a little bit about some of the innovations we've done in nursing that I think also made a difference.

00:07:40:15 - 00:07:46:00
Mindy Estes, M.D.
Well, how about we just speak a little bit about innovation right now, particularly in nursing?

00:07:46:02 - 00:08:11:23
Roxanna Gapstur, Ph.D., R.N.
Well, certainly virtual nursing is something that we have rolled out across our system, which has made a really big difference in the satisfaction of our nurses, both in the time they spend and documentation. But the amount of time they're able to spend with their patients. So that's one area. We've also have tiered huddles in our system. So each day, seven days a week actually we start with tiered huddles around seven in the morning.

00:08:11:23 - 00:08:33:23
Roxanna Gapstur, Ph.D., R.N.
And those go until nine. At 9:00 is my huddle. So every day I know by 9:00 exactly what's happening in the system, and we're able to solve problems at the right level. So we have sort of tiers one through six. A lot of things are still at tier three and below or tier four and below, but those things that can't be are elevated to the senior leaders.

00:08:33:23 - 00:08:50:24
Roxanna Gapstur, Ph.D., R.N.
And we put a team on it right then and there. So I would say compared to when I first arrived at WellSpan, that we solve our problems more in real time. We're more situationally aware and we're able to prevent problems from happening because we have that focus.

00:08:50:26 - 00:09:21:03
Mindy Estes, M.D.
Well in solving problems where they're best solved. You know, is helpful for everyone. And you go away from that huddle knowing what you need to do and how you need to go forward. I think a lot of people perceive central Pennsylvania yet as a relatively homogeneous area, but WellSpan serves a diverse community. Can you discuss how you engage these diverse groups and provide resources while respecting their cultures and their autonomy?

00:09:21:05 - 00:09:53:15
Roxanna Gapstur, Ph.D., R.N.
Yeah, absolutely. I think a lot of Not-for-profit health systems feel very connected to their community and have different strategies. And certainly in my other roles in other states, even, I felt that connection. WellSpan has maybe a deeper connection than any I've ever experienced. And we have different ways of showing that. So each of our counties and our regions has a healthy county coalition, and WellSpan actually leads most of those coalitions.

00:09:53:18 - 00:10:23:18
Roxanna Gapstur, Ph.D., R.N.
But we don't try to do the work of the experts in our nonprofit organizations. Rather, we might be a convener, we might be a partner, we might be a funder. In some instances, we're working together alongside and with and the population across central Pennsylvania, as you mentioned, are more diverse. And I realized when I first arrived here, certainly the plan community is one of our largest stakeholders, and we serve a significant number of people from that population.

00:10:23:24 - 00:10:52:27
Roxanna Gapstur, Ph.D., R.N.
We have special cultural liaison individuals who work with our planning community. It's really important to have those relationships, and we've done that for more than 20 years. We also have special bundle payment programs and other types of programs that fit culturally for that particular action. And I will say during Covid that Covid was difficult for that population because of the amount of family interaction they prefer to have in their health care experiences.

00:10:52:29 - 00:11:24:06
Mindy Estes, M.D.
I want to skip to the notion of gun violence in workplace violence, workplace safety, community safety. You know, gun violence is a growing concern for all of us. And you've really taken an active role in addressing this issue in New York, Pennsylvania. And I really and I know our listeners would be interested in having you elaborate on when your efforts to reduce gun violence, the partners involved, the progress made thus far.

00:11:24:12 - 00:11:34:19
Mindy Estes, M.D.
And my sense is that this is one of these issues, that the minute you take your foot off the gas, it comes back. So talk a little bit about what you've been doing.

00:11:34:22 - 00:12:01:00
Roxanna Gapstur, Ph.D., R.N.
Well, I, I can't say enough about what the teams have done in this region on gun violence. It's an issue across all of our communities, but I would say probably more acute in New York County. And that's where we've done a significant amount of the work over the past three years. Probably the biggest piece of this has been understanding both our role and then what the role of others might be in helping prevent gun violence.

00:12:01:02 - 00:12:28:26
Roxanna Gapstur, Ph.D., R.N.
I did feel when I first came to WellSpan that there was more we could be doing as a health system in prevention, but also that we can't do it all. And so we needed the right partners. I will say that that strong partners right now have been our local police departments, certainly our judges. We have a really robust treatment court here that works very hard to prevent incarceration and to get people to the right kinds of treatment.

00:12:28:28 - 00:12:52:01
Roxanna Gapstur, Ph.D., R.N.
And we also have, in the last two years, a credible messenger program. This program first started on a grant and was a business partnership agreement between one of our local nonprofits and our WellSpan York Hospital, which is a level one trauma center. And the credible messengers are highly engaged individuals who support victims and families who enter York Hospital because of gun violence.

00:12:52:04 - 00:13:20:01
Roxanna Gapstur, Ph.D., R.N.
They work to solve some of the deeper causes of violence in the community. And so they're they're very connected outside of the hospital setting. And so far in the last three years, we've seen a 43% reduction in gunshot wound patients at our hospital and a 71% reduction in homicides in our community, which is just gives you goose bumps to think about because it's such a problem for some of the younger individuals in our community.

00:13:20:02 - 00:13:30:12
Roxanna Gapstur, Ph.D., R.N.
So I would say the credible messenger program in these partnerships with local non-profits have been the most impactful in addressing really root causes of gun violence.

00:13:30:14 - 00:13:33:16
Mindy Estes, M.D.
Question or the credible messengers? Volunteers.

00:13:33:18 - 00:13:56:02
Roxanna Gapstur, Ph.D., R.N.
Not the credible messengers, are paid on the grants that we received with the not for profit. But it has been so impactful that we've continued that payment, you know, after the grant. And so all of us in New York County are very invested in that program, both emotionally and financially, because we've seen such great results with it.

00:13:56:04 - 00:14:16:27
Mindy Estes, M.D.
Well, the success rate has it's really been extraordinary in the numbers of live saved in families saved, you know, has to be a positive for the entire community. I want to look ahead. And when we look ahead, what do you see as your biggest goal for WellSpan health and what challenges do you anticipate in achieving it?

00:14:16:29 - 00:14:39:27
Roxanna Gapstur, Ph.D., R.N.
Boy, that's a great question. I would say innovation is probably one of our biggest priorities. We really believe that the health care system, as great a job as we do in many things, needs some transformation and needs to meet the needs of the future. So we've worked really hard to think about people, process, and technology differently than we did in the past.

00:14:39:27 - 00:15:09:22
Roxanna Gapstur, Ph.D., R.N.
And we've spent the last two years setting up for our next strategic plan, which is WellSpan 2030. An innovation and transformation will continue to be a big part of learning how we can use people, process and technology differently together. And, you know, I think all of us were a little taken by surprise a couple of years ago with the, generative AI changes, the Pandora's box that can kind of open as we think about how we might have safer care, more efficient care, etc..

00:15:09:27 - 00:15:38:05
Roxanna Gapstur, Ph.D., R.N.
And I would probably call out to that we've been heavily involved in. One is using artificial intelligence to improve the speed and accuracy of our radiology exams. WellSpan has deployed over 14 different applications for the last five years in radiology. I think we're leading the pack, and in terms of how we've deployed and how engaged our radiologists are with artificial intelligence.

00:15:38:07 - 00:16:06:11
Roxanna Gapstur, Ph.D., R.N.
And as you know, Mindy, artificial intelligence requires a lot of work and effort and process in order to make it the most useful for care teams. Our teams have done that work, and we've seen 81% faster traditional review of our exams with our radiologists using using AI. And our physicians who read scans are 98% engaged with the applications.

00:16:06:13 - 00:16:30:25
Mindy Estes, M.D.
That's very exciting. And I think you've you've enabled your radiologists to be part of the process because, you know, I think ultimately will help us make smarter decisions, faster decisions, but does not replace the physician. I think once we understand how to use that, and we're still learning and the technology is evolving, you know, we'll see more and more of it.

00:16:30:27 - 00:16:46:29
Mindy Estes, M.D.
We are just about out of time, believe it or not. And I want to thank you for sharing your insights. Your leadership at WellSpan health clearly demonstrates how engagement can drive meaningful change and sustainable change.

00:16:47:02 - 00:16:55:11
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify or wherever you get your podcasts.