WEBVTT

1
00:00:00.040 --> 00:00:02.560
<v Speaker 1>Welcome back to the deep dive. Today, we're diving into

2
00:00:02.600 --> 00:00:07.320
<v Speaker 1>a topic that is well, really personal and actually surprisingly complex,

3
00:00:08.039 --> 00:00:12.679
<v Speaker 1>healthcare information security and privacy. You might think data security

4
00:00:12.720 --> 00:00:15.199
<v Speaker 1>is pretty much the same everywhere, but honestly, in healthcare

5
00:00:15.240 --> 00:00:18.120
<v Speaker 1>it's like a whole different universe. Okay, let's unpack this.

6
00:00:18.440 --> 00:00:22.120
<v Speaker 2>That's exactly right our source material here, it's pretty detailed.

7
00:00:22.120 --> 00:00:25.239
<v Speaker 2>It really shows these you need nuances. These things elevate

8
00:00:25.359 --> 00:00:29.600
<v Speaker 2>protecting health information way beyond your typical data worries. So

9
00:00:29.679 --> 00:00:31.559
<v Speaker 2>our mission today is really to give you a shortcut

10
00:00:31.559 --> 00:00:35.399
<v Speaker 2>to understanding why why this field needs some specialized focus.

11
00:00:35.439 --> 00:00:38.759
<v Speaker 2>We're talking patient safety, trust, and I mean the real

12
00:00:38.799 --> 00:00:40.600
<v Speaker 2>impact on actual human well being.

13
00:00:40.880 --> 00:00:44.399
<v Speaker 1>Right, So you'll discover why health data is basically irreplaceable,

14
00:00:44.679 --> 00:00:47.520
<v Speaker 1>and also this huge network of people and companies handling it,

15
00:00:47.600 --> 00:00:51.039
<v Speaker 1>many you probably don't even think about. Plus the global rules,

16
00:00:51.039 --> 00:00:53.840
<v Speaker 1>how technology fits in. It's this mix of high tech

17
00:00:53.880 --> 00:00:56.840
<v Speaker 1>and deeply human stuff. By the end, you should really

18
00:00:56.840 --> 00:00:59.640
<v Speaker 1>get the why behind all the strict rules and why

19
00:00:59.719 --> 00:01:02.640
<v Speaker 1>guard your health info is just so critical. Okay, let's

20
00:01:02.640 --> 00:01:06.719
<v Speaker 1>start right in the beginning. Why is health information PHI

21
00:01:06.920 --> 00:01:09.319
<v Speaker 1>or PII as it's often called. Why is it so

22
00:01:09.400 --> 00:01:12.560
<v Speaker 1>fundamentally different from other sensitive stuff like say, your credit

23
00:01:12.560 --> 00:01:13.120
<v Speaker 1>card number.

24
00:01:13.239 --> 00:01:16.760
<v Speaker 2>Yeah, that's a great place to start. So PII personally

25
00:01:16.840 --> 00:01:21.120
<v Speaker 2>identifiable information. That's broad term, anything identifying you, But PHI

26
00:01:21.319 --> 00:01:24.760
<v Speaker 2>protected health information. Is this particularly sensitive.

27
00:01:24.359 --> 00:01:25.400
<v Speaker 3>Type of PII.

28
00:01:25.799 --> 00:01:28.799
<v Speaker 2>What makes it so different and frankly almost impossible to

29
00:01:28.799 --> 00:01:30.719
<v Speaker 2>fix if it gets out, is that it's irreversible.

30
00:01:30.840 --> 00:01:32.359
<v Speaker 3>You can cancel a stolen.

31
00:01:32.079 --> 00:01:34.879
<v Speaker 2>Credit card, get a new number, even a social Security number,

32
00:01:34.920 --> 00:01:38.599
<v Speaker 2>you take steps. But your medical history, a mental health diagnosis,

33
00:01:38.640 --> 00:01:42.480
<v Speaker 2>a sensitive disease. Once that's disclosed without permission, you can't

34
00:01:42.519 --> 00:01:45.719
<v Speaker 2>just erase it. You can't undisclose it. It's out there permanently.

35
00:01:46.079 --> 00:01:48.599
<v Speaker 1>That really is a stark difference. It's not just about

36
00:01:48.599 --> 00:01:54.239
<v Speaker 1>money being stolen, but medical identity theft. That sounds particularly nasty.

37
00:01:54.560 --> 00:01:56.680
<v Speaker 1>Can you give us a clearer picture? How does that

38
00:01:56.799 --> 00:01:59.799
<v Speaker 1>actually happen and what are the real lasting effects on

39
00:01:59.840 --> 00:02:01.239
<v Speaker 1>some one's actual medical care?

40
00:02:01.359 --> 00:02:01.519
<v Speaker 2>Oh?

41
00:02:01.560 --> 00:02:04.159
<v Speaker 3>Absolutely, And the source really drives this home.

42
00:02:04.519 --> 00:02:08.680
<v Speaker 2>Unauthorized disclosure it can lead to really critical patient safety problems,

43
00:02:08.800 --> 00:02:13.680
<v Speaker 2>especially through medical identity theft. Just imagine someone uses your name,

44
00:02:13.759 --> 00:02:16.120
<v Speaker 2>your information to get treatment fraudulently.

45
00:02:16.479 --> 00:02:18.400
<v Speaker 3>Maybe they go to an er give your ID.

46
00:02:18.840 --> 00:02:21.400
<v Speaker 2>Suddenly there's a wrong blood type record in your file,

47
00:02:21.680 --> 00:02:24.159
<v Speaker 2>or an allergy you don't have, or maybe they get

48
00:02:24.159 --> 00:02:26.919
<v Speaker 2>a diagnosis that now becomes part of your permanent record.

49
00:02:27.199 --> 00:02:30.479
<v Speaker 2>This isn't just like a billing mistake. It directly impacts

50
00:02:30.520 --> 00:02:33.960
<v Speaker 2>your future healthcare. It could lead to dangerous treatments later on,

51
00:02:34.039 --> 00:02:35.759
<v Speaker 2>and as the source points out, it can even use

52
00:02:35.840 --> 00:02:39.360
<v Speaker 2>up resources, making them unavailable for people who actually need them.

53
00:02:39.560 --> 00:02:42.439
<v Speaker 2>The consequences are serious, both clinically and personally.

54
00:02:42.520 --> 00:02:45.800
<v Speaker 1>Wow. So yet definitely not just about financial loss. It

55
00:02:45.879 --> 00:02:48.520
<v Speaker 1>hits your physical health, your long term medical story. The

56
00:02:48.560 --> 00:02:50.120
<v Speaker 1>stakes feel incredibly.

57
00:02:49.759 --> 00:02:52.639
<v Speaker 2>High, precisely profoundly human stakes.

58
00:02:52.759 --> 00:02:54.719
<v Speaker 1>Okay, so your health data isn't just locked in a

59
00:02:54.719 --> 00:02:58.199
<v Speaker 1>filing cabinet in your doctor's office anymore. Modern healthcare it's

60
00:02:58.240 --> 00:03:03.039
<v Speaker 1>this huge, interconnected, honestly kind of confusing web. Who are

61
00:03:03.080 --> 00:03:05.719
<v Speaker 1>all these different players passing your information around? What are

62
00:03:05.719 --> 00:03:06.719
<v Speaker 1>they actually doing with it?

63
00:03:06.879 --> 00:03:08.280
<v Speaker 3>Yeah, it's definitely a web.

64
00:03:08.639 --> 00:03:11.639
<v Speaker 2>If you think about the bigger picture, your data flows

65
00:03:11.680 --> 00:03:14.840
<v Speaker 2>through this incredibly complex network. You've got the obvious ones

66
00:03:14.879 --> 00:03:19.719
<v Speaker 2>direct providers, doctors, nurses, techs, people giving care. Then there

67
00:03:19.759 --> 00:03:24.280
<v Speaker 2>are the payers, insurance companies medicare, medicaid handling the money side,

68
00:03:24.319 --> 00:03:27.360
<v Speaker 2>and these things called healthcare clearing houses. They sort of

69
00:03:27.400 --> 00:03:30.280
<v Speaker 2>translate billing infos so different systems can talk to each other.

70
00:03:30.680 --> 00:03:33.560
<v Speaker 2>But a really significant group, and one people often don't

71
00:03:33.560 --> 00:03:35.479
<v Speaker 2>realize the extent of is third parties.

72
00:03:35.599 --> 00:03:38.719
<v Speaker 1>Third parties. That sounds so broad for our listeners. We

73
00:03:38.759 --> 00:03:41.919
<v Speaker 1>know this isn't just like the company that delivers office

74
00:03:41.960 --> 00:03:45.479
<v Speaker 1>supplies in healthcare. These most b entities deeply involved with

75
00:03:45.520 --> 00:03:48.360
<v Speaker 1>the actual patient data. Right. Can you use some concrete

76
00:03:48.439 --> 00:03:51.599
<v Speaker 1>examples and then maybe explain why managing them is such

77
00:03:51.599 --> 00:03:53.479
<v Speaker 1>a massive piece of the protection puzzle.

78
00:03:53.680 --> 00:03:55.719
<v Speaker 3>You're absolutely right. They're not peripheral at all.

79
00:03:55.759 --> 00:03:59.280
<v Speaker 2>A third party is basically any outside business providing services

80
00:03:59.400 --> 00:04:02.919
<v Speaker 2>or products that interact with PHI, usually under contract. Think

81
00:04:03.000 --> 00:04:08.439
<v Speaker 2>medical billing companies processing claims, sure, but also massive data centers,

82
00:04:08.520 --> 00:04:13.000
<v Speaker 2>cloud providers like AWS or Azure storing huge amounts of

83
00:04:13.039 --> 00:04:13.919
<v Speaker 2>your health records.

84
00:04:14.560 --> 00:04:16.000
<v Speaker 3>And it goes further outsourced.

85
00:04:16.040 --> 00:04:19.800
<v Speaker 2>It support needing system access, lawyers handling patient related cases,

86
00:04:19.839 --> 00:04:24.480
<v Speaker 2>even specialized medical transcription services. The reality is healthcare organizations

87
00:04:24.480 --> 00:04:28.079
<v Speaker 2>today just can't function alone. They rely heavily on these

88
00:04:28.120 --> 00:04:31.480
<v Speaker 2>third parties for essential tasks. That directly involve your data.

89
00:04:31.639 --> 00:04:34.199
<v Speaker 1>So these aren't just vendors, they're almost like extensions of

90
00:04:34.240 --> 00:04:38.120
<v Speaker 1>the hospital or clinic itself handling sensitive stuff, which raises

91
00:04:38.160 --> 00:04:40.920
<v Speaker 1>a huge question. How do organizations even keep track of

92
00:04:40.920 --> 00:04:44.920
<v Speaker 1>all this, vetting them, monitoring them constantly, especially if liability

93
00:04:44.920 --> 00:04:47.920
<v Speaker 1>goes down the chain to subcontractors. Sounds like a potential nightmare.

94
00:04:48.040 --> 00:04:51.120
<v Speaker 2>It is a huge challenge, and the source really emphasizes

95
00:04:51.160 --> 00:04:55.000
<v Speaker 2>this point. These third parties often handle very sensitive phi

96
00:04:55.120 --> 00:04:59.399
<v Speaker 2>directly for the healthcare organization, and under US law, specifically

97
00:04:59.439 --> 00:05:03.519
<v Speaker 2>the hypi omnibus rule, these business associates and importantly even

98
00:05:03.519 --> 00:05:07.319
<v Speaker 2>their subcontractors are directly liable for breaches. It doesn't even

99
00:05:07.319 --> 00:05:10.199
<v Speaker 2>matter if a formal contract, a business associate Agreement or

100
00:05:10.240 --> 00:05:13.560
<v Speaker 2>BAA is signed. The liability comes with the function with

101
00:05:13.639 --> 00:05:16.839
<v Speaker 2>handling the data. So understanding who these partners are, vetting

102
00:05:16.920 --> 00:05:20.600
<v Speaker 2>them thoroughly and continuously monitoring them it's absolutely critical. It's

103
00:05:20.600 --> 00:05:22.920
<v Speaker 2>a chain of trust and every link needs to be strong.

104
00:05:23.319 --> 00:05:26.639
<v Speaker 1>Okay, let's shift slightly. We often hear privacy and security

105
00:05:26.720 --> 00:05:29.439
<v Speaker 1>used almost interchangeable. People swap them all the time, but

106
00:05:29.519 --> 00:05:33.439
<v Speaker 1>our deep dive shows their distinct ideas. Yet also deeply connected.

107
00:05:33.839 --> 00:05:36.399
<v Speaker 1>What's really interesting, maybe a bit tricky to grasp, is

108
00:05:36.399 --> 00:05:39.279
<v Speaker 1>how they almost merge in the digital health world. Can

109
00:05:39.319 --> 00:05:41.680
<v Speaker 1>you elaborate on that kind of intertwining.

110
00:05:41.879 --> 00:05:44.240
<v Speaker 2>Yeah, they definitely get intertwined. Think of it this way.

111
00:05:44.800 --> 00:05:47.279
<v Speaker 2>Privacy is about the what and the why. It's your

112
00:05:47.319 --> 00:05:50.680
<v Speaker 2>fundamental right to control your personal information. Who gets to

113
00:05:50.720 --> 00:05:52.399
<v Speaker 2>see it, why they get to see it, what they

114
00:05:52.480 --> 00:05:55.680
<v Speaker 2>use it for. Security is about the how. How does

115
00:05:55.720 --> 00:06:00.519
<v Speaker 2>the organization actually protect that private information, what safeguards, technologies,

116
00:06:00.639 --> 00:06:04.839
<v Speaker 2>policies are in place. In today's digital healthcare world, you

117
00:06:04.920 --> 00:06:08.759
<v Speaker 2>really can't have effective privacy without strong security, and security

118
00:06:08.759 --> 00:06:11.959
<v Speaker 2>measures are often designed specifically to enforce privacy rules. They

119
00:06:11.959 --> 00:06:16.600
<v Speaker 2>become almost one single competence. Security controls aren't just walls.

120
00:06:16.680 --> 00:06:19.439
<v Speaker 2>They're actually the tools that enable much better privacy than

121
00:06:19.480 --> 00:06:21.120
<v Speaker 2>we ever had with paper records.

122
00:06:21.439 --> 00:06:24.360
<v Speaker 1>That's a really helpful way to put it, security enabling privacy.

123
00:06:24.519 --> 00:06:26.920
<v Speaker 1>Can you give us a specific example, how does a

124
00:06:26.959 --> 00:06:30.680
<v Speaker 1>security measure translate directly into protecting patient privacy in a

125
00:06:30.680 --> 00:06:33.199
<v Speaker 1>way that just wasn't feasible before everything went digital.

126
00:06:33.399 --> 00:06:37.680
<v Speaker 2>Sure, take something called role based access control or RBAC

127
00:06:38.240 --> 00:06:42.480
<v Speaker 2>inside an electronic health record system and EHR. This isn't

128
00:06:42.519 --> 00:06:45.879
<v Speaker 2>just about locking everything down. It's a very specific security control.

129
00:06:46.240 --> 00:06:49.279
<v Speaker 2>It ensures that only clinicians or staff with a proven

130
00:06:49.519 --> 00:06:53.360
<v Speaker 2>legitimate need to know can access certain parts of your

131
00:06:53.360 --> 00:06:57.240
<v Speaker 2>record for a specific reason at a specific time. So

132
00:06:57.279 --> 00:06:59.800
<v Speaker 2>maybe your heart doctor can see your cardiac history and me,

133
00:07:00.480 --> 00:07:02.920
<v Speaker 2>but they can't just browse your mental health notes unless

134
00:07:02.959 --> 00:07:05.800
<v Speaker 2>it's directly relevant, like in an emergency. That kind of

135
00:07:05.800 --> 00:07:09.560
<v Speaker 2>fine grain control over who sees what, enforced automatically by

136
00:07:09.600 --> 00:07:12.560
<v Speaker 2>the system, almost impossible to do consistently with paper charts

137
00:07:12.600 --> 00:07:16.040
<v Speaker 2>sitting in a folder. So that security technology directly upholding

138
00:07:16.040 --> 00:07:16.959
<v Speaker 2>your privacy rights.

139
00:07:17.199 --> 00:07:19.199
<v Speaker 1>Yeah, that really shows how they work together. But that

140
00:07:19.240 --> 00:07:22.120
<v Speaker 1>synergy just makes another question even more interesting and sometimes

141
00:07:22.480 --> 00:07:25.000
<v Speaker 1>pretty debated. When we talk about your medical records, who

142
00:07:25.000 --> 00:07:26.319
<v Speaker 1>actually owns that information?

143
00:07:26.600 --> 00:07:29.639
<v Speaker 2>Ah ownership. This is where things get really different depending

144
00:07:29.680 --> 00:07:33.560
<v Speaker 2>on where you live. It's fascinating actually. In the US,

145
00:07:33.720 --> 00:07:38.000
<v Speaker 2>generally speaking, while you as the patient have rights to

146
00:07:38.120 --> 00:07:41.920
<v Speaker 2>access your info, rights to request changes, the healthcare organization

147
00:07:42.120 --> 00:07:45.680
<v Speaker 2>technically owns the record itself, the physical or digital file

148
00:07:45.720 --> 00:07:48.480
<v Speaker 2>they created. The thinking there is often tied to the

149
00:07:48.519 --> 00:07:51.560
<v Speaker 2>investment made in creating and maintaining that record. But hop

150
00:07:51.600 --> 00:07:55.319
<v Speaker 2>over to the EU under GDPR it's completely different. You

151
00:07:55.600 --> 00:07:59.199
<v Speaker 2>the individual are clearly the data owner, full stop. You

152
00:07:59.279 --> 00:08:02.240
<v Speaker 2>have strong rights like the right to be forgotten, meaning

153
00:08:02.240 --> 00:08:04.959
<v Speaker 2>you can demand your data be erased in certain circumstances.

154
00:08:05.000 --> 00:08:07.800
<v Speaker 2>It's very citizen centric. Then look at the UK's National

155
00:08:07.839 --> 00:08:11.040
<v Speaker 2>Health Service, the NHS. Because it's publicly funded, they view

156
00:08:11.079 --> 00:08:13.959
<v Speaker 2>health data more like government property, ultimately overseen by the

157
00:08:14.000 --> 00:08:17.639
<v Speaker 2>Secretary of State for Health. These different viewpoints drastically change

158
00:08:17.639 --> 00:08:20.439
<v Speaker 2>how your privacy is managed, how much control you really have,

159
00:08:20.759 --> 00:08:22.319
<v Speaker 2>and what you can do with your own health story.

160
00:08:22.399 --> 00:08:26.000
<v Speaker 1>Okay, so we've got incredibly personal data, this huge web

161
00:08:26.000 --> 00:08:29.240
<v Speaker 1>of handlers, different ideas about ownership. It makes sense that

162
00:08:29.279 --> 00:08:32.120
<v Speaker 1>there be this well maze of regulations trying to manage

163
00:08:32.159 --> 00:08:35.120
<v Speaker 1>it all. What are the big laws and principles globally

164
00:08:35.159 --> 00:08:37.320
<v Speaker 1>that try to guide this and how do they differ

165
00:08:37.320 --> 00:08:38.240
<v Speaker 1>in their basic approach.

166
00:08:38.440 --> 00:08:41.519
<v Speaker 2>Yeah, maze is a good word. The regulatory landscape is

167
00:08:41.559 --> 00:08:45.879
<v Speaker 2>incredibly dense. You've got international standards, national laws, sometimes even

168
00:08:45.960 --> 00:08:49.399
<v Speaker 2>state or local rules layered on top. Key examples people

169
00:08:49.480 --> 00:08:53.679
<v Speaker 2>might know are HYPA, the Health Insurance Portability and Accountability

170
00:08:53.679 --> 00:08:57.159
<v Speaker 2>Act in the US. Then there's GDPR, the General Data

171
00:08:57.200 --> 00:09:02.240
<v Speaker 2>Protection Regulation across the EU has PIPEDA, the Personal Information

172
00:09:02.320 --> 00:09:06.879
<v Speaker 2>Protection and Electronic Documents Act. Now generally, all these laws

173
00:09:06.919 --> 00:09:11.200
<v Speaker 2>require healthcare organizations to have robust information protection programs, but

174
00:09:11.320 --> 00:09:15.600
<v Speaker 2>how they approach it their philosophical basis can be quite different. IPF,

175
00:09:15.600 --> 00:09:17.960
<v Speaker 2>for example, puts a lot of focus on the responsibilities

176
00:09:17.960 --> 00:09:21.039
<v Speaker 2>of the healthcare organization what they must do to safeguard

177
00:09:21.080 --> 00:09:24.240
<v Speaker 2>the data they hold. GENEPR, on the other hand, starts

178
00:09:24.279 --> 00:09:27.480
<v Speaker 2>from the individual's fundamental right to data privacy. It puts

179
00:09:27.480 --> 00:09:30.240
<v Speaker 2>a heavy burden on anyone collecting data to justify it

180
00:09:30.279 --> 00:09:31.799
<v Speaker 2>and get clear consent right.

181
00:09:32.000 --> 00:09:34.399
<v Speaker 1>But even with those different starting points, are there common

182
00:09:34.399 --> 00:09:38.000
<v Speaker 1>threads basic ideas about protecting data that show up across

183
00:09:38.039 --> 00:09:38.879
<v Speaker 1>these different laws.

184
00:09:39.000 --> 00:09:42.759
<v Speaker 2>Oh, yes, definitely. There are core principles you see almost everywhere,

185
00:09:42.879 --> 00:09:45.360
<v Speaker 2>things like consent. You generally have to agree for your

186
00:09:45.440 --> 00:09:46.759
<v Speaker 2>data to be collected and used.

187
00:09:47.200 --> 00:09:47.960
<v Speaker 3>Limited collection.

188
00:09:48.080 --> 00:09:51.000
<v Speaker 2>Organizations should only gather the data they actually need for

189
00:09:51.000 --> 00:09:54.279
<v Speaker 2>a specific reason, purpose specification, They need to tell you

190
00:09:54.320 --> 00:09:57.559
<v Speaker 2>why they're collecting it, and disclosure limitation rules about who

191
00:09:57.600 --> 00:10:00.919
<v Speaker 2>they can share your data with. These ideas are pretty universal,

192
00:10:01.679 --> 00:10:04.120
<v Speaker 2>but how they're applied and enforced.

193
00:10:04.440 --> 00:10:07.120
<v Speaker 3>That varies a lot. Take breach notifications.

194
00:10:07.120 --> 00:10:09.480
<v Speaker 2>For instance, in the US, if a breach hits more

195
00:10:09.480 --> 00:10:12.639
<v Speaker 2>than five hundred people, the organization has to notify HHS,

196
00:10:12.799 --> 00:10:16.679
<v Speaker 2>potentially the media and you pretty quickly. Smaller breaches get

197
00:10:16.720 --> 00:10:20.360
<v Speaker 2>reported annually under GDPR, though a personal data breach usually

198
00:10:20.360 --> 00:10:22.840
<v Speaker 2>has to be reported to the data protection authority much faster,

199
00:10:22.960 --> 00:10:25.919
<v Speaker 2>often within seventy two hours, and individuals need to be

200
00:10:25.960 --> 00:10:26.879
<v Speaker 2>told if there's a high.

201
00:10:26.799 --> 00:10:27.279
<v Speaker 3>Risk to them.

202
00:10:27.320 --> 00:10:29.200
<v Speaker 2>It's a different timelines, different thresholds.

203
00:10:29.200 --> 00:10:32.159
<v Speaker 1>It's clear that keeping this data safe is a huge

204
00:10:32.519 --> 00:10:36.360
<v Speaker 1>complex job, and technology just keeps changing the game, doesn't it.

205
00:10:36.759 --> 00:10:39.480
<v Speaker 1>From the early days of electronic health records to today's

206
00:10:39.480 --> 00:10:43.639
<v Speaker 1>really advanced medical devices. How has this digital transformation impacted

207
00:10:43.639 --> 00:10:46.320
<v Speaker 1>privacy and security, both the good and the bad.

208
00:10:46.559 --> 00:10:48.600
<v Speaker 2>It really is a double edged sword. As a source

209
00:10:48.600 --> 00:10:52.759
<v Speaker 2>material points out, health information technology HIT has definitely brought

210
00:10:52.879 --> 00:10:56.840
<v Speaker 2>huge benefits. It's made sharing information securely much easier, which

211
00:10:56.840 --> 00:11:00.879
<v Speaker 2>can lead to better, more coordinated care, faster diagnosed. That's

212
00:11:00.919 --> 00:11:03.639
<v Speaker 2>the upside, But at the same time, it creates massive

213
00:11:03.679 --> 00:11:06.840
<v Speaker 2>new risks. EHRs make it easier to organize data. Yes,

214
00:11:07.440 --> 00:11:11.200
<v Speaker 2>theoretically sending a digital record is more secure than faxing paper. However,

215
00:11:11.240 --> 00:11:13.879
<v Speaker 2>the sheer amount of data now stored digitally means large

216
00:11:13.919 --> 00:11:15.679
<v Speaker 2>scale breaches are much more likely.

217
00:11:16.240 --> 00:11:18.000
<v Speaker 3>Think about it, Losing five.

218
00:11:17.879 --> 00:11:21.480
<v Speaker 2>Hundred paper records is physically hard, but five hundred digital

219
00:11:21.480 --> 00:11:24.279
<v Speaker 2>records that's the IPAI threshold for major breaches.

220
00:11:24.679 --> 00:11:25.480
<v Speaker 3>And as the source.

221
00:11:25.399 --> 00:11:27.720
<v Speaker 2>Vividly puts it, what used to fill a whole room

222
00:11:27.759 --> 00:11:30.519
<v Speaker 2>with paper charts can now fit on a tiny USB drive.

223
00:11:30.759 --> 00:11:33.000
<v Speaker 2>It can be copied and moved in minutes, sometimes without

224
00:11:33.000 --> 00:11:34.200
<v Speaker 2>anyone noticing immediately.

225
00:11:34.559 --> 00:11:37.120
<v Speaker 3>The scale of potential loss is just vastly.

226
00:11:36.720 --> 00:11:40.039
<v Speaker 1>Different that USB drive image. It really drives home the

227
00:11:40.080 --> 00:11:42.960
<v Speaker 1>scale and medical devices they must have their own completely

228
00:11:43.039 --> 00:11:46.799
<v Speaker 1>unique problems. You mentioned basemakers earlier. That's not just data loss,

229
00:11:46.840 --> 00:11:50.360
<v Speaker 1>that's potentially life or death. Really raises the stakes. What's

230
00:11:50.440 --> 00:11:52.799
<v Speaker 1>the core conflict when you try to apply regular it

231
00:11:53.159 --> 00:11:56.240
<v Speaker 1>security thinking to a critical medical device.

232
00:11:56.559 --> 00:12:01.320
<v Speaker 2>Absolutely, medical device security is a huge, huge concern precisely

233
00:12:01.399 --> 00:12:05.120
<v Speaker 2>because of that direct patient's safety link. We're talking pacemakers,

234
00:12:05.159 --> 00:12:09.279
<v Speaker 2>insulin pumps, infusion pumps, robotic surgical tools, remote monitors. These

235
00:12:09.279 --> 00:12:12.120
<v Speaker 2>an't just computers on desks. The fundamental conflict is this

236
00:12:12.519 --> 00:12:16.240
<v Speaker 2>standard it practice says patch vulnerabilities quickly, but if you

237
00:12:16.279 --> 00:12:19.159
<v Speaker 2>try to apply that blindly to a medical device, a

238
00:12:19.279 --> 00:12:22.200
<v Speaker 2>patch could cause the device to malfunction during a critical

239
00:12:22.240 --> 00:12:26.240
<v Speaker 2>procedure or stop working entirely. Imagine trying to update the

240
00:12:26.279 --> 00:12:29.120
<v Speaker 2>software on a device that's literally inside a patient, or

241
00:12:29.159 --> 00:12:31.919
<v Speaker 2>one controlling a life saving medication drip in real time.

242
00:12:32.120 --> 00:12:35.039
<v Speaker 2>It's just not feasible or safe in the same way. Plus,

243
00:12:35.080 --> 00:12:37.840
<v Speaker 2>many medical devices run on older operating systems that vendors

244
00:12:37.919 --> 00:12:40.399
<v Speaker 2>might not even support anymore, and replace in the whole

245
00:12:40.440 --> 00:12:44.120
<v Speaker 2>device is often incredibly expensive. So protection needs different strategies,

246
00:12:44.120 --> 00:12:47.279
<v Speaker 2>like network segmentation, isolating these devices on their own protected

247
00:12:47.320 --> 00:12:49.360
<v Speaker 2>network segments rather than just trying to patch them like

248
00:12:49.399 --> 00:12:50.080
<v Speaker 2>a normal PC.

249
00:12:50.600 --> 00:12:51.639
<v Speaker 3>And then you add.

250
00:12:51.480 --> 00:12:54.679
<v Speaker 2>Cloud computing risks, mobile devices, especially bring your own device

251
00:12:54.720 --> 00:12:57.919
<v Speaker 2>policies in hospitals. Each adds more layers of complexity and

252
00:12:57.960 --> 00:12:58.600
<v Speaker 2>potential risk.

253
00:12:58.879 --> 00:13:03.159
<v Speaker 1>Okay, so given all this, the irreversible data, the huge network,

254
00:13:03.200 --> 00:13:07.279
<v Speaker 1>the global rules, the tech challenges, it's crystal clear that

255
00:13:07.320 --> 00:13:10.600
<v Speaker 1>protecting health information isn't a one and done thing. It

256
00:13:10.639 --> 00:13:12.559
<v Speaker 1>can't just be a checklist you complete ones.

257
00:13:12.840 --> 00:13:15.639
<v Speaker 2>It has to be continuous, absolutely, which brings up the

258
00:13:15.679 --> 00:13:20.279
<v Speaker 2>really important question, how do organizations actually manage these risks

259
00:13:20.320 --> 00:13:23.480
<v Speaker 2>on an ongoing basis? Because the threats are always changing,

260
00:13:23.799 --> 00:13:26.559
<v Speaker 2>risk management and healthcare has to be systematic, and it

261
00:13:26.600 --> 00:13:28.960
<v Speaker 2>has to be continuous. It's a process, not a project

262
00:13:28.960 --> 00:13:31.480
<v Speaker 2>with an end date. The source material is very clear

263
00:13:31.519 --> 00:13:33.840
<v Speaker 2>on this. Data breaches are often a matter of when,

264
00:13:34.200 --> 00:13:38.279
<v Speaker 2>not if. That makes having a really solid, incistant response

265
00:13:38.320 --> 00:13:41.600
<v Speaker 2>plan absolutely critical. It's a key security control on itself.

266
00:13:41.840 --> 00:13:44.080
<v Speaker 2>It's not just about building walls. It's about knowing exactly

267
00:13:44.159 --> 00:13:47.039
<v Speaker 2>what to do when someone inevitably gets over, under, or

268
00:13:47.080 --> 00:13:50.360
<v Speaker 2>through one. A good response can dramatically limit the damage

269
00:13:50.360 --> 00:13:51.120
<v Speaker 2>and recovery time.

270
00:13:51.240 --> 00:13:55.279
<v Speaker 1>Right, So constant vigilance, planning for the worst, reacting fast,

271
00:13:55.639 --> 00:13:58.759
<v Speaker 1>and always learning. What does that cycle look like? In practice?

272
00:13:58.759 --> 00:14:00.600
<v Speaker 1>For these organizations.

273
00:14:00.440 --> 00:14:04.600
<v Speaker 2>Exactly that cycle. It means constantly monitoring their systems and

274
00:14:04.639 --> 00:14:09.600
<v Speaker 2>networks for suspicious activity, identifying potential vulnerabilities before they get exploited,

275
00:14:09.960 --> 00:14:12.879
<v Speaker 2>assessing threats, figuring out how likely something bad is to

276
00:14:12.879 --> 00:14:14.759
<v Speaker 2>happen and what the impact would be if it did.

277
00:14:15.000 --> 00:14:18.240
<v Speaker 2>They use different methods for this quantitative qualitative, and then

278
00:14:18.279 --> 00:14:21.039
<v Speaker 2>making informed choices about how to handle that risk. Do

279
00:14:21.080 --> 00:14:24.399
<v Speaker 2>they try to avoid it, mitigate it with controls, accept

280
00:14:24.440 --> 00:14:26.639
<v Speaker 2>it because the cost of fixing it outweighs the risk,

281
00:14:26.879 --> 00:14:30.279
<v Speaker 2>or transfer some of it, maybe through cyber insurance. The

282
00:14:30.399 --> 00:14:32.960
<v Speaker 2>end goal is always to minimize the harm, get back

283
00:14:33.000 --> 00:14:36.039
<v Speaker 2>to normal operations as fast as possible after any incident,

284
00:14:36.320 --> 00:14:39.159
<v Speaker 2>and this is key learned from every event, whether it

285
00:14:39.200 --> 00:14:40.720
<v Speaker 2>was a close call or a major breach.

286
00:14:40.840 --> 00:14:41.519
<v Speaker 3>Figure out what.

287
00:14:41.440 --> 00:14:44.840
<v Speaker 2>Went wrong and how to strengthen defenses. Frameworks like NIST

288
00:14:45.039 --> 00:14:48.320
<v Speaker 2>Hymns High Trust provide structured ways to do this, offering

289
00:14:48.360 --> 00:14:51.200
<v Speaker 2>standards and controls to help protect your data effectively.

290
00:14:51.519 --> 00:14:55.519
<v Speaker 1>Wow, what an incredibly insightful deep dive into this really

291
00:14:55.559 --> 00:14:59.759
<v Speaker 1>complex world of healthcare information, security and privacy. We've covered

292
00:14:59.759 --> 00:15:02.200
<v Speaker 1>so much, from why your medical history is unique and

293
00:15:02.240 --> 00:15:06.399
<v Speaker 1>irreversible to that huge global web of rules and handlers,

294
00:15:06.759 --> 00:15:09.720
<v Speaker 1>including those crucial third parties. And the challenge is the

295
00:15:09.759 --> 00:15:13.759
<v Speaker 1>real paradoxes of using technology like EHRs and medical devices safely.

296
00:15:14.039 --> 00:15:16.639
<v Speaker 2>Yeah, we've really seen how privacy and security just have

297
00:15:16.720 --> 00:15:19.679
<v Speaker 2>to work hand in hand. They're constantly needing integration and

298
00:15:19.759 --> 00:15:22.960
<v Speaker 2>updates to protect you the patient and understanding that whole

299
00:15:23.039 --> 00:15:25.679
<v Speaker 2>ecosystem right, including that chain of trust with all the

300
00:15:25.720 --> 00:15:28.799
<v Speaker 2>third parties involved is just fundamental to keeping health data

301
00:15:28.840 --> 00:15:29.440
<v Speaker 2>safe today.

302
00:15:29.679 --> 00:15:31.639
<v Speaker 1>So what's the bottom line here for you, our listener,

303
00:15:31.840 --> 00:15:35.440
<v Speaker 1>Whether you're a learner, a patient, or just an informed citizen,

304
00:15:36.240 --> 00:15:38.480
<v Speaker 1>it means that every time you interact with the healthcare

305
00:15:38.480 --> 00:15:42.639
<v Speaker 1>system digitally or in person, there's this huge ongoing effort

306
00:15:42.679 --> 00:15:45.799
<v Speaker 1>happening behind the scenes, and effort to make sure your

307
00:15:45.840 --> 00:15:49.679
<v Speaker 1>most personal information is handled carefully, trying to balance amazing

308
00:15:49.720 --> 00:15:53.919
<v Speaker 1>tech advancements with basic ethics and tough regulations. This isn't

309
00:15:53.960 --> 00:15:57.399
<v Speaker 1>just box ticking, It's about maintaining the fundamental trust between

310
00:15:57.440 --> 00:16:00.679
<v Speaker 1>you and the people caring for your health. So here's

311
00:16:00.679 --> 00:16:03.360
<v Speaker 1>something to think about. Next time you download a new

312
00:16:03.360 --> 00:16:05.879
<v Speaker 1>health app, or agree to share data for research, or

313
00:16:05.919 --> 00:16:08.080
<v Speaker 1>even just log in to you your own medical records,

314
00:16:08.519 --> 00:16:12.200
<v Speaker 1>ask yourself, how clearly do they explain the purpose specification,

315
00:16:12.559 --> 00:16:14.840
<v Speaker 1>why exactly do they need this data? And in a

316
00:16:14.879 --> 00:16:18.080
<v Speaker 1>world where data can be copied and spread globally almost instantly,

317
00:16:18.360 --> 00:16:20.360
<v Speaker 1>how much choice do you really feel you have over

318
00:16:20.399 --> 00:16:23.639
<v Speaker 1>something as deeply personal as your health story, especially when

319
00:16:23.759 --> 00:16:26.559
<v Speaker 1>once it's out there, it might never truly be forgotten.