Healthcare security, IT should be separate to be effective

Separate security from IT

Stepping into the world of healthcare security was a culture shock, Dunkle said.

When he joined Geisinger Health in 2015 as CISO, he was surprised by how many vendors the organization worked with that had a direct connection to the health system's network -- something he hadn't seen before in his security experiences in retail, finance or manufacturing.

"Nowhere have I ever worked ... would it be acceptable to do that," he said.

He found IT and security to be "synonymous" in healthcare. In his experience, other industries have learned to separate the two for better performance and increased efficiency. As a security professional, Dunkle said he has reported to CIOs, but IT and security are tasked with different missions and should operate separately to be effective.

The healthcare IT team is "service-oriented," attending to the technology needs of healthcare systems and clinicians so they can do their jobs more effectively, a job Dunkle said IT does well. While service does have its place, security teams tend to focus on risk management, he said.

"Service doesn't always win over security," Dunkle said. "Sometimes there's a point where you have to say, 'I wouldn't say no, but slow down.'"

Separating security from IT is a growing pain other industries have gone through, and, in doing so, have experienced the do's and don'ts that the healthcare industry can take advantage of, Dunkle said.

Policies and procedures

Alexander found a lack of policies and procedures in healthcare security compared with his previous experiences in other industries.

The U.S. government had "policies, plans and procedures for everything." In healthcare, that wasn't the case, he said.

A phrase Alexander heard frequently in healthcare IT is that the team functions as a "catcher's mitt," supporting the hospital, moving quickly and doing whatever leadership asks. Alexander said a governance process, not just for security but for IT teams across a healthcare organization, is necessary to ensure security.

"There were not a lot of standards at both organizations I worked at to put policies and procedures, governance in place," he said. "Once I instituted policies, plans and procedures in security ... then other IT departments looked at it and ... started adopting some of those tactics and procedures we had."