David Finn understands that good AI and data governance will be a key element in success going forward for the healthcare industry.
Nov 12 26
6 min read
Mark Hagland
When it comes to advising the healthcare industry on the current highly fraught moment in healthcare IT security, there’s no one better than David Finn, principal at Cyberhealth Integrity, a Dallas-based consulting firm.
As artificial intelligence becomes a permanent and major element in the healthcare cybersecurity landscape, analysis is warranted. I spoke with Finn, a cybersecurity and risk governance leader with four decades in healthcare IT governance and management issues. He elaborated on the challenges — and opportunities — in this make-or-break era in U.S. healthcare.
The interview included discussion on the tangle of issues involved with AI development and implementation and cybersecurity optimization.
This is clearly a fraught moment for cybersecurity leaders in healthcare. How do you see the landscape around cybersecurity and AI right now?
We have to start by looking at the entire environment, because understanding the scale and pace of change in healthcare is essential to understanding where we are in terms of security. And the threat landscape has changed categorically and fundamentally. And that’s driven by four forces specific to cybersecurity, and they amplify each other.
The first driver we’re looking at is artificial intelligence. AI hasn’t really created new attack categories, but it’s made existing attacks faster, more targeted, and more difficult to detect. A spearfishing campaign that once required a threat actor to spend two weeks researching your organization’s leadership structure, your email conventions and your operational calendar, now takes about 45 seconds to develop. If you’re the cybercriminal organization, you have to analyze the organization’s public website, grant or funding announcements, look at LinkedIn profiles for the executive team and press releases, and with that information, that criminal organization can generate messages perfectly suited to mimic the real organization’s messages. But the AI-assisted malware that they’re using in real time now is designed to evade detection tools, including the ones you probably just implemented in the past few weeks. The AI is designed to evade those detection tools.
If AI can evade protective actions, what can be done about that issue?
We can manage our fear of missing out by moving deliberatively; we have to have strong AI governance and controlled deployment. There’s so much shadow AI going on in healthcare that it’s horrifying. The doctors and nurses and everyone else have it on their cellphones. They use their own AI to ask questions. We’ve got to figure out how to do that AI governance and control and manage those deployments.
Healthcare has never done IT governance well. When I started rolling out Epic in one health system in 2002, I had to build an entire governance structure that included data governance. One day, one of the senior executives asked me, “Why are you doing data governance?” Because no one wanted to do it, and it was really hard, I told her. And later, she took it over as general counsel. We had a good plan for data governance. But at least when they were rolling out the EHR, they controlled who had access to the data through the EHR. So we have to manage the data governance; it is the center of everything, and yet, we pretend it’s not a big deal.
What’s more, assuming you’ve got good data governance and control of the tools, you’ve got to use mature tools. The AI firms don’t have the maturity and experience to manage this; how is a hospital going to do it?
Physicians, including specialists like radiologists, cardiologists and oncologists, are getting deeply involved in the development of the tools, especially in the development work around large language models. Does that involvement encourage you?
Yes, it does. To give you a sense of the significance of all of that, Texas Children’s, where I was and accidentally became CIO, didn’t have an EHR yet in 2002. I put the team together to do the selection process; it included 1,400 people from across the (integrated delivery system). I had doctors coming to me saying, “You’ll never get this done.” But we did a survey of 1,400 people and found only one department that was not impacted; and that was groundskeeping. Even the valet parkers were implicated, because of how they were alerted by the patient management system. My favorite part of the story is this: The first problem was reported by groundskeeping, whose team members were finding face sheets blowing in the wind out of the garbage bins.
And when you bring AI into healthcare, you’re not just adding a new tool, you’re introducing new components, like model development and training processes and new APIs. So instead of introducing a single application, you must secure the data that trains the model, the model itself, the prompts that feed the model, and the APIs that call it.
And any hospital that tells you they’re not using AI, they just don’t know what they have. And the AI is running, because the EHR application is using the AI. And this is why the governance becomes so critical, because only the governance can build security into the culture. So you also have to draw in your vendors.
If the healthcare industry simply continues running to catch up to the new threats and new threat actors, how can healthcare leaders make progress in this area?
That’s where it comes down to development. The fact that we’re 20 years on from data governance and no one’s doing it means we’re losing the battle there. I’m not sure how we do it; but within our healthcare organizations, the governance structures and the people responsible for making these decisions are going to have to realize that simply going fast is not the entire answer. And so we’ve got to be putting in AI to solve problems, not simply because the hospital down the street has it. And if you’re doing something because everyone else is and not trying to solve a problem, you’re going to go nowhere fast.
In fact, that’s why the payout on the investment in AI is not there right now. And if you’re feeding the AI your bad data that you haven’t been managing for 20 years — well, you know the old saying, garbage in, garbage out. So on a scale of one to five in terms of confidence, I’m at about a two. Until we start looking at things in terms of governance — well, this is a leadership problem, not a technical issue, and the discussions and decisions belong in the boardroom, not in the IT department. And the clinical and financial leaders don’t understand the technical issues, but at the same time, the IT people don’t understand how the data is being used. And the reality is also that once systems are deployed, the algorithms drift; they behave differently over time. So you have to do the continuous monitoring, auditing and documentation. The governance can’t stop after deployment; you can’t look away.
Mark Hagland is a contributor to Health Data Management and is a Fellow of the American College of Health Data Management.
More for you
Loading data for hdm_tax_topic #care-team-experience…
