Who'd want to be a CISO?

Challenging job, but increasingly well paid

Hong Kong Crisis Easing

Capacity improvement measures beginning to have an impact

Security and the Board Need to Speak the Same Language

How Security Leaders speak to thier C-Suite and Board can make all the difference

Australian Cybersecurity Outlook

Aussie healthcare scrambles to catch up

The Changing Face of the Security Leader

The role is changing, but what does the future hold?

Just keeping its head above water

New Zealand Healthcare steams forward with minimal security

Cyberespionage, and the Need for Norms

Harvard Political Review (external link)

The Growth of Medical Tourism 3

This is a multi-part story over 3 days. Take me to the beginning.

Trends in Medical and Dental Tourism

Patients Beyond Borders, a publisher of guidebooks for "medical tourists" estimates that more than 20 million people will travel to another country for medical treatment this year, up 25% from 16 million last year. Meanwhile, a 2016 report by Visa estimated that the medical tourism industry was worth $50bn a year, and continuing to grow.

In fact according to Deloitte medical tourism has been growing at 10% per annum or greater for the past 15 years. BCC Research predicts that double digit growth is expected to continue for at least another five years with destinations like Mexico, Thailand, Malaysia, Taiwan and Costa Rica leading the popularity charts.

But it's not just a migration of US medical consumers to these locations. Its a global trend of Americans and Europeans looking to cut costs and avoid wait times on one side, and the super wealthy in developing nations like China and India in search of specialist treatments not available in their own countries going the other way.

Despite its free National Health System, many UK residents are avoiding long wait lists for consults and procedures and traveling overseas for medical and dental treatment for less than half of private treatment at home. This includes cosmetic surgery and other treatments not covered under the NHS.

Medigo, a German-based medical travel company says that queries from UK residents jumped 53% last year. Official figures from the UK's Office of National Statistics also show that a rising number of people are going abroad for treatment.

The trend is similar in the US where the number of American health tourists goes up every year. About 422,000 traveled outside of the country for medical and dental procedures in 2017 according to the US National Travel and Tourism Office. That is up from 295,383 in 2000.

As the number of uninsured Americans continues to climb, it seems more than likely that high deductibles and reductions in insurance coverage are pushing more Americans to search elsewhere for affordable medical and dental care. With more attacks underway against the US Patient Protection and Affordable Care Act and companies increasingly shifting healthcare costs to employees, medical tourism looks to become a key facet of most people's healthcare and dental care.

Read the entire story:

The Growth of Medical Tourism 2

This is a multi-part story that launched yesterday.

My employer-sponsored-health-plan provides me and my family with an annual physical with our primary care physician. This normally involves a 40 to 60-minute appointment where a nurse measures my height and weight, checks my vision, draws some blood and has me pee in a cup before my doctor gives me a physical examination. Thanks to Obamacare this little interaction is annual and free, meaning no co-pay, no-deductible or other disincentive to see someone. It also provides the opportunity to discuss with my primary care provider anything that concerns me but didn’t warrant me shelling out money to book a regular appointment with the him or her. Finally, it also allows me to unlock and renew my prescriptions for the medications I am supposed to be on for another 12 months - even though I have been on the exact same stuff for more years than I can remember.

Sure, my free annual physical is valuable but just how valuable is it someone like me? I am at early risk of coronary heart disease, to a stroke, cancer or some ailment that will one day take me surprise and whisk me off to an early death, or worse, a lingering and expensive demise that medically bankrupts my family when my employer sponsored health insurance runs out? Welcome to US healthcare!

Would my 40 minute interaction with my doctor once a year actually discover such a risk?
Highly unlikely I suspect.

Would my health insurance pay for me to undergo a battery of tests to find out?
Also highly unlikely!

The current US Payer-Provider preventative care system is nowhere near as good as politicians would have us believe, and nowhere near as good as physicians would advise or recommend.

I guess my concerns are shared by many people over 40 and that may be why many of us receive flyers in the mail advertising advanced cholesterol or cancer screening – the “Plus Version” of an annual physical if you like. One where you are made to run on a treadmill while connected to an ECG and put through a battery of other tests not covered by your “free annual physical". “Prevention is better and cheaper than cure” as the saying goes and I’m sure all of us would agree.

So my wife and I looked into the costs of a comprehensive health check at home and abroad, including travel. We also looked into the costs of a dental checkup cleaning and treatments since we didn’t elect dental insurance this year. We both look after our teeth and the costs of dental insurance just didn’t make economic sense. What we found surprised us.

We could fly all the way to Bangkok, Thailand, stay in a 5 star hotel, enjoy a highly comprehensive health check - including in my case a full workup, get our teeth cleaned and fixed (and take a short vacation) all for significantly less than what it would cost us in the US..... And do it all at top-notch hospitals and dental clinics.

Our Medical Health Check

We selected Bumrungrad International Hospital in the heart of Bangkok for our health check and City Dental Clinic just down the road from the hospital for our teeth cleaning and maintenance. Not only is Bumrungrad reportedly one of the top ten JCI accredited hospitals in the world, it has one of the best hospital workflows I have ever seen. They have the health check workflow down to an art. It truly was a pleasure to witness and observe.

From the pleasant greeting upon entry to the five-star service throughout including lunch catered by the nearby JW Marriott, everyone spoke excellent English as well as half a dozen other languages to cater to guests from Europe, Australasia, the Americas, the Middle East and Asia, including a number of local Thai and Burmese.

No "nickel and diming" either and no unexpected costs. You select exactly what you want in advance from a menu of different health check options when you book your appointment, so you know what you need to pay when you show up on the day. If you need to add extras after your health check, like a consult with a specialist, the hospital will do its best to schedule you in that evening or the following day - even over the weekend. And the costs of an additional specialist consult? About $22 in my wife’s case.

What makes it all the more convenient, is that you can charge it to your healthcare savings card and pay for your medical treatments with pre-tax US earnings.

Need a procedure like a biopsy? $100 to $200 often on the same day and certainly while you are in town. Now if only US healthcare could be as efficient! For that reason, it’s probably best to schedule your health check on day 2 or day 3 of your stay so you have time for any additional follow up.

The only thing to look out for is that the hospital pharmacy is quite a bit more expensive than pharmacies outside. That's generally the case everywhere, but you don't have to purchase your meds from the Bumrungrad hospital pharmacy if you don't want to. You can just ask your doctor to write them down and have the billing clerk remove them from your bill when its time to pay for any extras if they were added. No need for official prescriptions in Thailand either. Pharmacies abound on every street and every mall in Bangkok so you have your choice of drug suppliers. Most Pharmacists speak excellent English and are very well trained and qualified. Don't have what you are looking for? The Pharmacist will be able to recommend a different drug and dosage and discuss side effects or other concerns with you.

The other thing to beware of is that some doctors will only schedule office hours in Bumrungrad on a couple of days per week so if you want to see a certain named specialist, then its best to plan a little extra time. Of course you could always opt for someone else in the same specialty area as we did and still get excellent advice. Many doctors we found will schedule office hours from 5pm onwards or weekends only, which was a little unusual from our experience in the US. In actuality, this worked out well for us as we were busy during the normal business day anyway.

Our Dental Checkup

Our dental checkups were equally as pleasant at the City Dental Clinic across the street from the hospital. A young but very well qualified dentist checked my teeth and then sonically cleaned them all for about $20. My wife needed a couple of fillings for a chipped tooth and some depleted enamel. Her clean and procedure came to a whopping $195 – way less than US dental insurance payments let alone the so called insurance-subsidized co-pays for treatment at our local dentist.

Why would anyone NOT take a trip to Thailand or other parts of the world for elective procedures and proactive health checks? Beats me - that’s all I can say! In fact, we are already planning our checkups and dental cleanings for next year.

Concerns about quality medical and dental staff? Bumrungrad International Hospital achieved Joint Commission status years ago and continues to be one of the best hospitals in the world. It serves over 400,000 medical tourists annually who by all acocunts save between 50% and 75% on medical expenses they would have incurred for similar services in the US. The hospital's repeat international clientele is probably testament to its reputation and the quality of service patients receive.

Everyone we met was top notch – as good as you would find at home – just with lower hospital billing and insurance overheads, and significantly lower malpractice premiums to pay, thanks to the absence of ambulance-chasing lawyers in Thailand.

Why the US is falling so far behind the developing world should be obvious to all of us who work in the industry, but no one seems interested in fixing a broken system, removing overheads and getting healthcare costs down. With so many vested parties needing to be involved that may never happen here. And so, medical tourism is likely to continue to grow, and consumers will continue to vote with their feet.

Continue on to the final chapter of this story

The Growth of Medical Tourism 1

Despite the United States having arguably some of the best healthcare in the world, it also has the singularly most expensive. We have all heard the story of the hundred-dollar Aspirin. Many of us have witnessed or been fleeced by the ridiculous markups some US hospitals attempt to profit from - sometimes in excess of 1,000% or 1,500%. The US spends twice as much on healthcare as most comparable nations, yet has highly unequal access to healthcare services, and quite frankly, terrible patient outcomes if you happen to be poor, or live in the wrong part of the country.

As the costs of US health services continues to spiral, consumers are facing ever-increasing healthcare charges. This includes massive annual deductibles which effectively render insurance useless for most until the end of the year when deductibles have been met, and increasingly high co-pays that cause many to forgo their prescription medications and doctor visits in order to pay rent or put a meal on the table for their family.

Just ask anyone who works in the profession how the advent of high-deductibles and other rising out of pocket costs is affecting their businesses. Designed to contain employer and employee healthcare costs, high deductibles have led to much higher out of pocket costs for consumers and quite seriously changed user consumption patterns. Many medical practices are empty at the beginning of the calendar year when a fresh deductible kicks in, for all but the most serious of emergencies. What's more, it stays that way for months till patients have met their deductible and are no longer dis-incentivized to visit their medical providers.

Most of us who have tried to purchase medications in the US that are not included in our medical insurance formulary list have experienced first-hand unregulated US pharmaceutical prices that gouge consumers for $200 or more for the exact same medication that sells outside of the US for $20. It’s no wonder that so many Americans stock up on their prescriptions when on vacation abroad, regardless of whether they have health insurance at home or not.

Yes - Your over-the-counter drug price in other countries is often cheaper than your insurance co-pay at home!

But what other aspects of their healthcare are Americans looking abroad for?

In this multi-part blog, I explore the rise of medical tourism and how it is often better and cheaper to get on a plane and fly across the world for treatment in a modern top-notch accredited hospital rather than subject yourself to the co-pays, high-deductibles, obscured billing practices, and unexpected / underhanded out-of-network surprise charges not covered by your US health plan.

Read Part 2 of this story


Jason Hawley & Richard Staynings co-present at HIMSS19 today in Orlando.  Photo: Ty Greenhalgh.
Don’t Let Your IT and OT Systems Become Antiques.

The problem of out of date legacy hardware, operating systems and applications across the healthcare industry is endemic. This is especially so at small hospitals and clinics where tiny IT and security staffs and highly constrained budgets, prevent the upgrading of end-of-life and often vulnerable technologies. Aggressive sun-setting of Windows versions by Microsoft and near constant patching requirements compound the pressure on small IT staffs to support and secure their health IT infrastructure. This situation introduces risk into the healthcare delivery environment as IT systems continue to operate with unpatched CVEs and unsupported hardware and software.

Poor coordination between HIT vendors and Microsoft causes healthcare applications to break if patched or remain vulnerable if unpatched. Lack of support for current Windows operating systems means that new workstations and servers need to be downgraded in order to run EMR or other HIT applications.

"Windows 10 comes with .NET version 3.5 built in, however our EMR only supports .NET version 3.2, so when we upgraded our desktop OS from Windows 7 to Windows 10, we had to uninstall .NET and reinstall an old out-of-date version" claimed Jason Hawley, CIO of Yuma District Hospital and Clinics, a critical access system in rural Colorado. "We can no longer run automatic updates from Microsoft as patches break our EMR. HIT software developers are constantly behind the Microsoft development curve," he added.

Going to to the CFO and asking for money to replace and upgrade, just because systems are end-of-life doesn't work according to Hawley. "The money simply isn't available to upgrade or replace",  he states. "We don't have the man-power and we can't justify the re-licensing costs."

Jason is not alone in his experience. Many security and technology leaders in similar-sized facilities make the same complaint, where IT hardware is used till it breaks and software is run well beyond its vendor support.

So how can CIOs and CISOs of small or critical access facilities get away from having to support dangerous legacy hardware and software?

"The obvious solution is to move what you can to the cloud as soon as possible, but this presents challenges in itself," claims Richard Staynings with the HIMSS Cybersecurity Committee. Regulated data needs to be highly secured - especially if its being moved off-site. Consequently, many CEOs are reluctant to take the leap of faith needed to support this change.

However most cloud service providers probably do a better job of securing their customers' PII and PHI data than any critical access hospital is able to do anyway. Especially given small IT and security staffs, low levels of security expertise and limited budgets for upgrading. In fact for most critical access facilities migrating to the cloud is a major security improvement over the current state.

"Cloud providers have an added incentive to double-down on security as their reputation is highly dependent upon the security of their services," claims Staynings. "Educating the CEO and board to that fact is however a different issue and an often lengthy process that should probably be started sooner rather than later," he adds.

Moving the IT budget from a 'CapEx' model of asset purchase and depreciation over a long period of time to an 'OpEx' model of annualized services, will likely take some persuasion and the support of the CFO. However once approved will enable small providers to finally retire out-of-date and end-of-life assets.

"Cloud migration is not as straight forward as simply moving a VM from a data center hypervisor to a cloud one," claims Staynings. "There's a lot of planning and optimization that needs to take place to make sure that you don't get unexpected usage bills for running AV and other scans 24 by 7 on each of your systems. For that reason, if you've not done this before you should probably seek help"

In the mean time CIOs and CISOs have a duty to report the risks of legacy no-longer-supported hardware and software in the organization's Risk Register. This should include OT devices like hospital building management systems and medical devices which have even longer life-spans than IT systems like servers and workstations. Most of these OT devices have little to no built-in security and require compensating security controls such as network segmentation to protect themselves and the rest of the network from attack. But first you need to find these devices, which isn't easy. Fortunately there are some new tools from the likes of CyberMDX, ZingBox, ClearData and others entering the market to help you with your medical device asset inventory and initial threat assessment.

CEOs and their boards need to make well-informed risk management decisions to accept, transfer or remediate those risks. 'Ignoring' or 'avoiding' a risk should not be an option, which unfortunately is an all-too-common process being used today in small under-funded healthcare delivery facilities.

Jason Hawley is CIO, CSO and Biomed Director at Yuma Hospital and Clinics - a critical access system in rural Colorado. Richard Staynings is a Global Healthcare Security Strategist. Both currently serve as members of the HIMSS Cybersecurity Committee. Slides from their HIMSS presentation can be viewed or downloaded here.

Converging Paths

Patient safety has always been a major concern for healthcare providers but never before has it been so inextricably linked with cybersecurity. This is a subject I have blogged about, lectured to students of healthcare and cybersecurity, and spoken about to audiences of senior healthcare leaders at conferences and summits all over the world.

It's a convergence that we all need to become familiar with as enterprise risks change across the industry and the threats to the business evolve as we increasingly digitize.

Today, I had the pleasure of sharing this message with the HIMSS Cybersecurity Community. A community of healthcare leaders, technologists and security professionals that do their best to make sure that your non-public information remains confidential, integral and available, and that the IT systems employed to diagnose, treat, and monitor you as a patient, do not become compromised by nefarious nation states or cyber criminal actors. The HIMSS Security Community does a great job of sharing information across thousands of providers globally, to help leaders protect their patients and their patient data.

We all know that the global healthcare industry has problems and needs all the help in can get at a time of aging populations, static budgets and increased cyber risk. What compounds these concerns is a long history of under funding for the day-to-day security of hospitals and clinics, and  the longer term maintenance and replacement of end of life IT systems.

This is a subject that I will be addressing in more detail with Jason Hawley, CIO and CISO at Yuma District Hospital at the HIMSS Annual Conference this year in Orlando on Monday February 11th. If you are planning to attend HIMSS19, please come along to the Security Forum and join us as we dig deeper into this subject.

For those able to attend my webinar today, many thanks and it was great to address many of your questions. For those unable to attend I have posted a link to the WebEx recording and to my presentation slides below.

Webinar Recording