Thomas Morning

Healthcare CIO’s Brief: Healthcare IT Security—Where We Stand Now 1. The Current State: Mounting Threats and Supply Chain Risk In the first half of 2025 alone, breaches impacted more than 29 million patient records via some of the largest data compromises reported to HHS’s OCR portal. Much of this stems from hacking and IT incidents; back in 2010, only 4% of breaches were due to hacking—today, that figure has surged to 81%. Ransomware remains a constant threat: 77% of healthcare organizations were targeted in the past year, with 53% of those attacks succeeding. And the ways attackers strike keep expanding—supply‑chain attacks compromised data of over 78 million individuals in the first half of 2025. 2. The Price Tag: Still the Most Costly Sector #Healthcare retains the unenviable title of the costliest industry for data breaches. IBM’s 2025 report places the average cost per breach at $7.42 million, down from $9.77 million last year, but still the highest across all sectors. A breakdown of costs reveals detection and escalation ($1.47M), lost business ($1.38M), and post-breach response ($1.2M) as the main expense drivers. Notably, healthcare breaches take the longest to identify and contain—279 days on average, nearly five weeks more than the global average. #cio #ciso

11

https://lnkd.in/ejY_bXAJ Deloitte's outlook reveals a significant focus among healthcare executives, with 70% prioritizing investments in digital platforms and 60% in core EMR/ERP modernization. This emphasis underscores our commitment to enhancing foundational technologies and highlights the importance of evaluating business ROI and transformation impact, extending beyond mere modernization efforts. #CIO #DigitalTransformation #EMR #HealthITROI

13

AI is transforming cybersecurity—both as a shield and a sword. While it enhances threat detection and response, it also enables more sophisticated attacks. Check out the article to read about the three major AI-driven shifts and how organizations can stay ahead. #AI #Cybersecurity #ThreatIntelligence #centricconsulting

4

Cybersecurity budgets are tight, but the threats keep growing. Executives face a critical challenge: how to cut meaningful cyber risk without overspending. Here is a quick video outlining a practical, cost-effective framework based on real-world threat data. It focuses on doing the basics right, prioritizing broadly adequate controls, and making smarter investments. Watch the 45-second breakdown and read the full blog here: http://www.davidchou.live #CyberRisk #Leadership #SecurityStrategy #CISO #EnterpriseSecurity

6

Keeping it real with yourself about log monitoring and change management maturity can save you audit time, real money, and long-term reputation damage. I’ve sat on both sides of the table—designing security programs and walking organizations through audits after the fact. What consistently creates pain isn’t a lack of intent, it’s pretending manual or partial log review satisfies regulatory expectations. Across HIPAA, SOC 2, PCI DSS, and NIST CSF, these controls are not optional—and hoping tooling will magically “count” without real correlation and visibility is a costly gamble. If this post makes you uncomfortable, that’s usually a signal worth listening to. Read the white paper or take a look at what we’ve built with ICIT Sentinel. Even an honest gap assessment today can prevent a very expensive conversation tomorrow.

4

I’m looking forward to ADAPT and spending time with Rita Heimes. This will be a “real talk” session. No cyber mumbo-jumbo - just the facts about how the most highly disruptive attacks happen, and how to focus ourselves to stop them. Solutions exist, including joint publications with the Federal government. The Health Sector Coordinating Council - Cybersecurity co-led and wrote these solutions. The highlights: 1. Implement the Health Industry Cybersdcurity Practices (HICP) and HPH cybersecurity Performance Goals 2. Read the Hospital Resilency Landscape Analysis 3. Start rethinking TPRM in the lens of Systemic Risk; download the SMART Toolkit from the HSCC CWG website https://lnkd.in/gDnEZKBC

67

1 Comment

In value-based care, cybersecurity isn’t just about protection—it’s about enablement. When care happens across homes, hospitals, apps, and third-party platforms, security must follow the patient, not just guard the perimeter. That means: • Zero Trust as the default • Identity-first access • Vendor risk = patient risk • Resilience > prevention As a healthcare IT and security leader, I believe cybersecurity is now core to care delivery. It’s how we earn trust and deliver continuity in a connected, value-driven healthcare system. Is your security model keeping up? #HealthcareIT #Cybersecurity #DigitalHealth #ValueBasedCare #CIO #CISO #ZeroTrust

23

3 Comments

Appreciate the chance to share insights in this piece on how the CIO role continues to evolve across healthcare. The work goes far beyond technology. Today’s CIOs are shaping business strategy, driving operational efficiency, and building connected systems that support both clinicians and patients. Every initiative, every platform decision, and every workflow improvement comes back to one question: does it make care safer and operations smarter? #HealthcareLeadership #HealthIT #DigitalTransformation #HospitalOperations #CIO

95

As cyber threats continue to evolve faster than traditional controls can respond, static access policies create blind spots that expose the business to unnecessary risk. As an industry, we are generating lots of data, but few operationalize the signals in a continious manner taking meaningful actions to reduce exposure. Adaptive trust policies represent a strategic shift enabling organizations to move from a reactive, one-size-fits-all approach to a proactive, context-aware security model that continuously aligns access decisions with real-time risk signals. By dynamically adjusting user and system access based on behavioral analytics, device posture, location, and threat intelligence, adaptive trust helps executive leaders: ✔️ Reduce the attack surface without compromising agility ✔️ Automate risk-based decision-making at scale ✔️ Enable dynamic least privilege across hybrid environments ✔️ Strengthen operational resilience and business continuity For CISOs, CIOs, and business leaders driving digital transformation, adaptive trust isn’t just a security enhancement, it’s a business enabler that ensures the right access, at the right time, under the right conditions. This is how modern enterprises stay ahead of risk, by making trust adaptive and actionable. #ExecutiveLeadership #CyberStrategy #AdaptiveTrust #DigitalRisk #ZeroTrust #OperationalResilience #CISO #CIO #BusinessContinuity #BoardLevelSecurity

23

1 Comment

🔐 HIPAA Compliance in Healthcare: A Constant Balancing Act In today’s healthcare environment, HIPAA compliance is more than a checkbox—it’s a continuous, evolving challenge. From sprawling hospital systems to outpatient clinics, the complexity of managing protected health information (PHI) securely is growing. As technology advances and cyber threats become more sophisticated, so do the risks. Here are just a few of the challenges healthcare organizations face: 🧩 Complex IT Ecosystems: EHRs, patient portals, mobile apps, and third-party integrations all need to be secured and monitored. 👥 Human Factor: Staff training, insider threats, and simple mistakes remain some of the biggest vulnerabilities. 🔄 Constant Change: Regulatory updates, new technologies, and shifting workflows require ongoing risk assessments and policy updates. 🛡️ Incident Response: Breaches can happen despite best efforts—having a tested response plan is critical. 💰 Resource Allocation: Balancing patient care priorities with investments in cybersecurity and compliance isn’t easy. HIPAA compliance isn’t just an IT issue—it’s a cultural commitment to patient trust and data stewardship. #HIPAA #HealthcareCompliance #Cybersecurity #HealthIT #PatientPrivacy #RiskManagement #HealthcareLeadership

10

2025 raised the stakes for RCM leaders. Cyber incidents proved that cash flow depends on resilience, prior auth now has hard clocks, and price transparency moved from compliance checklist to growth lever. The playbook that’s working: What top teams are doing Building redundancy (dual clearinghouses, ERA/EFT failover, tabletop drills) Moving prior auth upstream to order capture with structured clinical snippets Treating denials like a product (weekly root-cause sprints, physician feedback loops) Making transparency usable (accurate estimates, clear bills) Applying AI surgically where exceptions live (remits, PA completeness, worklist triage) I unpack the shifts, the stubborn realities, and a 90-day action plan here 👇 https://lnkd.in/gtXeerUE If you lead RCM, revenue integrity, or health system ops, this will help you turn policy headwinds into operational tailwinds. #RCM #RevenueCycle #HealthcareFinance #HealthIT #PriorAuthorization #PriceTransparency #HospitalOperations #AIinHealthcare

6

Many organizations benefit from the value and the skillsets without the need to hire. Recruiting for some takes a long time whether for location, salary requirements, or culture. This is a great option and definitely fills a gap that pending legislation may require.

3

What to Look for in Your Next EMR Selecting a new EMR? Here are must-have capabilities for a smoother transition and long-term success: · End-to-end clinical workflows · Interoperability · Advanced reporting and analytics · Scalable, cloud-ready architecture · User-friendly design · Reliable vendor support Don’t just replace your system, upgrade your future. #EMR #HealthcareIT #CPSItransition #RCM #HealthTech

25

6 Comments

Insight worth sharing from our Propulsion partners!     HIPAA compliance isn’t just for hospitals—it matters for every IT provider, MSP, and business handling healthcare data. This practical guide explains what HIPAA means, who it applies to, and how to protect patient information through smart, scalable safeguards.     💡 A must-read for organizations aiming to strengthen data privacy and compliance.     👉 Read the full guide here: 

1