Put yourself in my shoes… a Code Stroke patient arrives in our busy ER. Time is of the essence. We need to rapidly diagnose and treat the patient to prevent long term paralysis or even death. But nothing happens until we can access their health records, review the relevant data, order a CT scan, consult our colleagues, and initiate treatment. And none of that can happen at all because our hospital has put in a new enhanced password policy. As well they should. Keeping protected health information (PHI) private and secure is of utmost concern in healthcare…but more on that later.

COVID-19 forced a spike in policy-makers’ interest and willingness to invest in public health; a spike that is unfortunately retreating to the old business as usual. (President Biden, in his State of the Union speech, warned “we remain vigilant” while calling for an end to the emergency, but quickly switched the subject from the urgency of public health to prosecuting fraud.) Luckily, along with increased attention came a raft of intelligent suggestions for changing how public health institutions carry out their mission, starting with the Centers for Disease Control (CDC).

Digitalization has created immeasurable opportunities for businesses over the past two decades. But the growth of hybrid work and expansion of Internet of Things (IoT) has outpaced traditional 'castle and moat' cybersecurity, introducing unprecedented vulnerabilities, especially in the healthcare industry. Although all organizations have important data to secure, healthcare holds some of the public's most sensitive personal health information (PHI) – not to mention insurance and financial data, as well.