Shawn Cordner (00:13.048)
Hey everyone, welcome to the Amplitude of Tech Podcast. I’m Shawn Cordner, Chief Marketing Officer of Amplix. This is a special edition of the podcast. It’s because it’s Emmy season and the Pit, one of the best shows out there, if you ask me, is up for a whole bunch of awards tonight. By the time you’re seeing this, we will have known what they got. Why do I care about the pit? Why should you care about the pit? Well, this season there is a cybersecurity element to the story arc.

And I brought David Jost, who is VP of cybersecurity here at Amplix, onto the podcast to talk about how realistic their cybersecurity storyline was. Did they do the right things? And what can you learn from it? Hope you enjoyed this episode as much as I do.

Shawn Cordner (01:00.238)
All right, David Jose, welcome to the Amplitude of Tech Podcast. This is an Inside Amplix edition.

David Jost (01:06.072)
Thank you, Shawn. Glad to be here.

Shawn Cordner (01:08.12)
Glad to have you. So maybe start off with who you are and what you do here at Amplix.

David Jost (01:12.75)
I am the vice president of cybersecurity and I also work with our clients across our client engagement opportunities.

Shawn Cordner (01:19.874)
Awesome. so cybersecurity is something that is starting to make its way into culture, n not just our culture as people that work in enterprise technology, but in society in general. I think a lot of headlines that are driving up some fear about cybersecurity and AI related attacks, and so people are hearing about that. more recently, a very famous TV show, The Pit.

had cybersecurity as part of its storyline for this past season. And I wanted to get together with you. I think we’re coming into award season and that TV show is most likely gonna get some awards and I think it’s gonna be back in the news. And I thought what a great opportunity for us to talk about how they incorporated a cybersecurity storyline into this season and let’s fact check them a little bit. So what do you think? You up for that?

David Jost (02:16.618)
Absolutely, Shawn. And I will tell you that as we’re recording this today, the MEs are actually occurring tonight, twenty five nominations for this show. So I cannot begin to predict on that, but I can tell you where this aligns with healthcare and with reality. And that’s what we’re looking forward to.

Shawn Cordner (02:32.628)
I did not know the Emmys were tonight. I’m glad you told me. I’ll have to let my girlfriend know so we can get a bottle of wine and enjoy that. I’ll be pulling for the pit. pretty good show. May you wanna start off with little bit about the show itself?

David Jost (02:46.566)
Sure. Yeah. I mean, I think, you know, the the main piece that I want to just share here is that on the pit there has been the during the previous season, there was a buildup to some things that were happening, but that ultimately ended up manifesting into a cybersecurity breach, into a ransomware type of situation. There’s some more detail to that, but we want to talk a little bit about that.

Shawn Cordner (03:12.632)
So the Pit, for anyone that doesn’t watch The Pit, I don’t know why you’d be listening to this episode if you didn’t, but if you don’t watch the Pit, what it’s about basically is a group of ER doctors and nurses. It’s in a teaching hospital in Pittsburgh and it’s a little bit like ER. In fact, one of the guys that is in the pit is an ER alum and so th the stories basically it the whole season is one day.

So each episode is basically an hour of their shift and it just moves you through a day, and that day is a chaotic day in the ER. And this season it was extra chaotic because of the cybersecurity breach. So somewhere around episode seven, I think, is when we get introduced into the cybersecurity storyline. basically somebody walks in that is an executive or an administrator in the hospital and they haven’t seen that person. Most people don’t know who that person is. He’s big and important.

And they’re curious why he’s there. And he summarily makes an announcement that other hospitals in the region have been shut down due to a cybersecurity breach and they’ve been sending all of the patients to the pit to to their hospital because it’s the only one in the region that is open. he then goes on to say that by the way, we’re under attack as well. We’re defending it, but our IT people think that we might not be able to defend it, and so we’re taking the hospital offline.

So let’s start off there. How realistic is that scenario?

David Jost (04:41.068)
Yeah, and I was just gonna d just if I could backtrack for a second too. I mean, so first off there’s the pit and it’s it’s Pittsburgh Trauma Medical Center. So it’s an you know, ER or in in reality E D, you know, situation. And they are taking this off proactively. So what I think is very important, and I wanna talk about that, like how realistic it is, but the interesting story is what happens next. You know, I think really that there are capable, very capable clinicians. This is happening over the course of

less than twelve hours, but it’s happening over a whole season. And they lose the digital connective tissue around the patient areas. So that makes, you know, cyber really tangible, right? Where does this play into it? Records, labs, communications, coordination, you know, not just IT, if you will. So I think in terms of watching this, what I liked most of all about this and what I would say how realistic it is, is that we never needed to see the hacker. Although typically, you know, always the stereotype is they’re wearing the hooded sweatshirt, they’re in a basement somewhere.

in this case, there was no need to see that because what we are doing throughout this whole session is we’re experiencing the incident through the consequences. So they’re not asking really what are, you know, what is the malware variant or where is, you know, what’s going on. They’re asking where’s my result. So you mentioned the episode seven, Shawn. And I think as the, you know, from my standpoint, I’m a little jaded. I see cybersecurity everywhere, or a little aware, however you want to look at that. And as I was watching this, I started to see things and I was going, hmm.

You know, where is my lab result? What’s going on? Well, this is down. That’s not working, right? Little things that might seem normal, but there starts to be some questions about can I trust this information? So I think the the biggest thing about like shutting down the piece in terms of is that the best option to be able to shut down a system, right? And I’m gonna answer with a very definitive potentially. All right. I mean, I think the thing that you really need to be thinking about is you have to be able to look at the threat.

The shared connectivity, the credentials, the ability to contain it, right? So that is an option. So really you need to consider, and if you’re in a healthcare organization or anywhere shutting down systems, it’s not, it’s not just a a risk decision. in healthcare, especially, it affects patient care. So it’s a lot it literally is life or death, right? So containment isn’t simply a technical decision when disconnecting. It affects patient care. So when you’re looking at this, I think the reality of it is

David Jost (07:03.956)
You really shouldn’t have just two options. You know, that’s the piece. However, shouldn’t you know, you can should over yourselves, right? You want to look at this and say that may or may not be. In this case, there’s a lot of things we could talk about, but ideally that’s where segmentation and having a lot of drills and running through different scenarios as well. But I think very realistic, Shawn, in terms of this situation and how this came down for those who have watched it.

Shawn Cordner (07:28.856)
No, we don’t know exactly what the attack was, right? Is it did we hear if it was ransomware or if it was you know still

David Jost (07:37.07)
There is a there is a piece actually where so in watching this and I’m if you haven’t figured out already, I am a you know, a a major fan, I watch, I’ve also rewatched it and looked at it. There is a place where the it’s actually the CEO who comes in the big wig. And that’s everyone right away is saying what’s going on here. Now granted he’s gulp he’s dressed for a barbecue because this is also happening on Fourth of July weekend, which is a very important point we could talk about. But that’s where these kinds of things are more prone to happen.

So he came in with Al Hashimi and the the who’s the attending and they talked about it. They said, We’ve identified there’s been a cybersecurity attack and there is a ransom being asked. And you see everyone in the in the ED, you know, starting to raise their eyebrows. What? Ransomware. This sounds interesting, exciting. This is spy stuff, right? What’s going on? So that is what that’s as much as they tell us. But what they tell us leading up to that is that this is a code black, which could be any number of things.

You know, from just like a crisis, an emergency. It’s used for anything that interrupts the systems.

Shawn Cordner (08:39.703)
Yeah. What what systems? I mean, do you think that they’re targeting the the software that they use for managing patients and scheduling, or did they go after the network? I mean, do we have any idea?

David Jost (08:51.886)
So, you know, what what is happening is in terms of a ransomware attack, they are trying to get what is most valuable. That’s the PHI, the personal health information, the data. in the process of that, some of the other ancillary things are shutting down systems and it’s not limited to just one software system or anything. So from this standpoint, what’s unique about the situation with the pit itself versus Westgate, I think is the name of the other facility, is that they haven’t actually been attacked.

What has happened is they have shut down the system. So they’ve had to go old school, paper charts, fax machines, people unfamiliar with analog workflows, right? So there’s interruption in service. There’s there’s challenges to response time. There’s challenges to reliability. All of those things make it more likely that someone’s going to need to react very immediately to ransomware attacks and they’re gonna need to take it seriously and it’s gonna need to be addressed. Again, it’s life or dealt.

Life or death, excuse me, but on the other side of it, it’s about ransomware. So it’s whatever can get the attention to get the money.

Shawn Cordner (09:59.01)
And you mentioned it being on July fourth and said that’s a common thing. Is that because it adds to the chaos and gives the the attackers more leverage?

David Jost (10:08.756)
yes, and the other part of that is typically and it’s played out well in this, there’s a lack of consistency in terms of perhaps the staffing. There’s some things that happen irregularly. There is a massive demand oftentimes. So wherever that’s occurring, you know, Fourth of July without giving away storylines, obviously you know fireworks play a big role in in some of the kinds of injuries, but all kinds of things.

And there also is less ability to reach the people that you need to to be able to help you, to answer questions, to do whatever you need. So that is why that happens oftentimes on fourth of July, holiday weekends, Friday at five thirty on a regular weekend.

Shawn Cordner (10:51.714)
Yeah. another thing was the CEO when he came in and he announced that the other hospitals were under attack. I I have two questions about that part of it. The first was he said that their IT people had turned away over a thousand different attacks or defended against a thousand different attacks. And that kind of evoked to me that old school nineties.

you know, vision of a hacker like you said with the hoodie on. And for me, it reminded me of the movie Swordfish. If anyone’s seen the movie Swordfish, you know what I’m talking about. They’re, you know, the guy’s just typing away like he’s in some offensive mission trying to hack into another network. I don’t imagine that it actually works like that. So what what do you mean by turning away what what does it mean to defend against attacks like that? And then the second part of that is

Do you typically see clusters like this? Because it it seems like what the strategy would have been on the side of the attackers was to go after these regional hospitals that are connected because it would, you know, create a lack of supply of health care and again increase the leverage that they would have.

David Jost (12:06.828)
Yeah. So let me let me address that. I mean, first of all, there’s the the notion of turned away attacks. I think sometimes it’s just letting people know we’re resilient, we’ve been doing this, we’re on it, right? the reality is you are always under fire. There are always things that are happening. And so sometimes we don’t use the B word breach, right? We don’t look at where that’s at. We talk about incidents. There are incidents of all sorts happening all the time and they’re being detected and they’re

you know, they’re they’re escalating, right? So there are a lot of different ways that people come at this. I think in terms of the second part of your question in in looking at the kind of the some of the things that happen in terms of is this happening on multiple health centers at the same time. Yeah, absolutely. What I’m gonna tell you is that the the bad characters, the whether it’s nation states, hackers, combination, et cetera, right, they what they really play off of is human psychology.

And all of the things that that increase the likelihood are things like making something urgent, having it happen right away, hitting people at a place where they are less likely to be paying attention maybe to the small stuff or to the details. And that’s why it’s so important to have done drills in real life, not having your first real downtime exercise be the actual incident. But when you look at these things that are happening, there are things that I would say are fairly common. You will see that things that are happening in terms of attacks or other things that are irregular.

Things that are happening, and we just did a tabletop exercise for a client where we were discussing that they’re happening very, very fast. So there’s a time that’s even more of a current thing, right? Because of the speed of AI, because of the speed of everything that’s happening. But it’s also because at some point, when someone’s coming at you, for anyone who’s who has kids or who’s had teenagers or whatever, can I go? Can I do this? Can I do that? Get the other, get the brother, get the sibly to ask it, right? At some point, what happens? You have a bit of fatigue.

And you just give it’s it’s just too much, it’s too much, right? And that’s what you’re kind of looking at happening from that standpoint. But the other piece is locally, to your point, if you’re looking at Westgate and then there’s the pit, which is one of the locations, and some of the others that potentially might be attacked as well, it makes sense, right? Because that that increases the extreme nature of that urgency, right? You’re s anywhere in the Pittsburgh area, there aren’t a lot of options. So this does happen in reality.

David Jost (14:31.512)
But I would say the general rule is there is no rule. It oftentimes doesn’t sometimes it’s a singular location. But particularly in healthcare, I think you’re probably spot on.

Shawn Cordner (14:41.346)
Now, if if you’re in a particular vertical like healthcare and you start to see more and more healthcare attacks in the news, can you assume that the sector is getting targeted more and is there something that you should do if you feel like your industry is being attacked? And you know, current day real life example of that would be we know that a lot of infrastructure organizations you know not

government departments

David Jost (15:13.526)
Water, electricity, et cetera, et cetera. Right.

Shawn Cordner (15:15.566)
Yeah. Infrastructure are being attacked now because of the Iran war. you know, what what’s the practical takeaway about something like that?

David Jost (15:25.358)
So here’s here’s the good news, which is not really good news, that’s a little bit of a backhanded good news thing, right? Is that you don’t need to see signs that healthcare is being attacked. You don’t need to see signs that infrastructure is being attacked. In fact, I you know, it would be a very, very short game if we spent some time talking about the sectors that are not under attack. Right. So this has made T V news on arguably the most popular T V show. It’s a storyline. So things have escalated at a very rapid case.

rapid, you know, pace. But when you look at some of the things where they’re typically are the the industries that are most likely attacked, they really tend to be, you know, healthcare is always at the top. You’re looking at financial, you’re looking at education, major attacks in the educational, higher education system. There are places where things may not be life or death, but they feel like it, right? You’re in finals week. That’s where that, you know, that one finally came together. Things that are happening, there are all kinds of scenarios like that. But they’re

They’re really the the the same things come into play that you should be doing. Should be operating from a standpoint of cyber resilience. You should be looking at having very solid plans, governance around everything you’re doing, but not just having the plans on a binder on the top of a shelf, but actually going through and testing these. And I shared this with you, so you’ve heard this before, Shawn, but you know, again, you know more about me than

probably anyone does right now. I’m a TV fiend, right? So I grew up on it and I I love it. I will make another analogy. The reason that people need to do the testing, the incident testing, oftentimes this is referred to as simulations or tabletop exercise. All you need to know is from the television show The Office, go to his let’s I’m just randomly gonna grab, but it is actually season five, episode fourteen and fifteen, called the fire drill. And on

And at that point, there is a fire response plan at Dunder Mifflin. But until they’ve and then Dwight actually starts to light things up because no one’s paying attention to the general stuff that’s there and he feels like they’re not prepared. You do not know until you’ve gone through that real life real life simulation and it wouldn’t emulate the way or you know, I would not replicate the way that he did that. But I would I would say you’re not gonna know that you know, Stanley’s gonna suffer a heart attack, that Jim and Andy are gonna try and push a

David Jost (17:47.182)
copier, you know, to barricade through. Angela’s going to throw bandit up in the roof and say save bandit. You don’t know what’s going to happen. It’s the same thing. You can have a plan for how to be able to continue things. But when you shut it down, one thing I did not see here that any is that anyone seemed to really have an idea within the clinicians within other places of what the procedure and what they should be doing. And that typically

In the hospitals, healthcare systems we work with, all of the great organizations out there, they are typically at different levels of having tested it and tested it and then they retest it to make sure that everyone’s you you’ve got new employees coming in, you have time changing, threats are changing, et cetera. It’s very different to do a tabletop exercise in two thousand twenty six than it was in two thousand twenty.

Shawn Cordner (18:35.81)
Yeah, so let’s get into that. first time I recommend that you not wait to announce this to your staff until the CEO is able to leave a barbecue and drive there in person. maybe a text message would have been a little bit more efficient to give people a heads up. But so he gets there and he announces it and basically as they’re talking, the systems go down. They had no opportunity to take any kind of backup. it seems like the

Only fortuitous thing that they had going for them was they have a staff member that has a photographic memory. And so you gotta make sure you get one of those. That’s part of the cyber resilience plan. so that, you know, that was the only reason that they could or the only way that they could keep straight all of the different patients that they had and what was going on. So it what’s the reality of you know, the healthcare space? What kind of redundancies and systems do they have in place that would allow them to go manual were they to shut down?

David Jost (19:11.394)
That happens every day. That’s it. Right.

Shawn Cordner (19:35.488)
And then what kind of procedures do you see, you know, from going analog how how could they go about doing that?

David Jost (19:44.216)
So, I mean, you know, certainly it’s not that unbelievable because there are could be any number of reasons why you may have to go old school on it, right? I think the thing is is that the distinction is less about what happened at that point. Could you do it? It’s however you’re going to do this. It’s less about it’s you know, the distinction is between having a downtown procedure and having downtime capability. Like are you actually able to do that? So if you’re saying, Well, we’ve got records, we’ve got forms, we’ve got whatever.

You need to be thinking about all of the contingencies, right? Are the forms updated? Are they still relevant? Are they still compliant? If you’re looking at this, do people know how to operate a fax machine? Actually there are some very hilarious scenes where people have no idea what that sound is. And for those of us of a certain age, we certainly know that sound of a fax machine or a fax coming in. So that’s a that’s a very important thing. I think that

You know, in terms of looking at redundancies, that’s gonna vary, but it’s always part of that resilience is having a business continuity plan. What are you looking to do and what is that going to be? And you probably have different layers of that, right? So if you’re gonna do this and all of a sudden you thought that you had 17 fax machines, but no one’s really touched them for a while and somebody was using them to you know to hold their coffee that spilled and they don’t work. Who knows what’s happening?

So I think it’s important to have contingencies, implications of what happens then, who’s responsible for what. And I think that the the scary part about it is that, you know, you are you you do again, I’m I’ve said this before, but you don’t want your first real downtime exercise to be the actual incident. And to me, that is the biggest thing that stood out in this particular scene. And I think maybe it’s a good thing because it’s pretty real, it’s scarier that way. It cat it captures people’s attention.

The reality is it probably makes for quicker you know, homage on a particular short season, right? But that’s that’s my thought on that.

Shawn Cordner (21:47.116)
I gotta laugh about the fax machine thing because if there’s any place where fax machines are alive and well, it’s in the healthcare space, right?

David Jost (21:56.3)
Right. And so so when you look at this as well, that’s always the thing, you know, someone’s asking you to fax something and your the response you always have in your brain, you know, you choose not to say it because these are professionals and they’re taking care of you is, sure, let me just go back to nineteen eighty nine and and you know, access my my fax machine. But the reality is if it was a set of different tools, but the some of the things that Dr. Al Hashimi was walking through. So we’re gonna have this system check for this, put a plus for that, put a zero for that.

And again, first time anyone’s seen this. And the bigger thing, Shawn, is not so much about do you have redundancies, it’s that you have to understand that when the re the like recovery is not what happens when the power goes back on. Everything that you have done during this time, whether it’s eight hours, twelve hours, three days, is now also in a in two different universes. It’s in your digital and it’s in your analog. How are you going to bring that all together? Where are you at right now?

Where’s the accuracy check on on all of those pieces? So there’s there’s a lot to unpack here. You know, we don’t have time to hit it all, but that’s those are some important points.

Shawn Cordner (23:05.794)
Now, they were back up and running. If if you go by the show’s timeline, each episode is you know, an hour long. That’s an hour of their day. So basically they were down for maybe four or five hours ish. Now we know that they weren’t they were under attack, but they weren’t actually breached. but that does seem like a short period of time to go from we’re in so much danger here that we need to proactively shut our systems down to everything’s fine and we’re back online here. So two two parts to that question is

What does remediation look like and how long does this usually take? And then the second one is in their particular case where they were simply proactively shutting down so that they could avoid risk, what could have happened in that time period that they felt more secure and comfortable going back online?

David Jost (23:53.528)
Sure. Yeah, that was on a on a different network, I guess. It wasn’t on the show we were watching, right? They went into it. but I would tell you that if I’m sort of calculating, I would say worst case or b largest case scenario is the whole thing’s happening during one night, right? So it’s happening from this point to that point. When they first did it, they said in it’s essentially the in an abundance of caution kind of thing. We’re gonna shut this down. Which is interesting to the point you mentioned before too, because the other part that it kind of went with

Okay, and an abundance of caution. How about waiting 30 seconds to you know till Whitaker can take the picture with focus? You’re right, yeah, in b in focus. But nope, it’s done. That was it. Here’s the last thing you notice. Again, it’s drama. that being said, I would tell you if I were trying to surmise what might have happened, is they were they were talking about Westgate and talking about how they had been able to turn away several attacks. There may there some information was gained, some level of grabbing.

Shawn Cordner (24:30.178)
Sure, right.

David Jost (24:52.546)
the reins a bit or just some greater confidence in the fact that there was not an immediate threat that was greater than the the cost or the and just n in all kinds of senses, not just dollars, right? Right of being down any longer. So somewhere, somehow, in the same group that decided to talk about this separately, and that’s often where that happens.

and you were mentioning like maybe, you know, you would have people know about this sooner. I think you you have these processes you go through where you’re notifying, where you’re doing all of that. I’m gonna leave that aside. The biggest thing is that it’s like the reason it’s not a big deal if you say it’s gonna happen and here’s where we’re at, is that everyone’s saying, I’ve trained for this. You know, right? Here is the moment, right? So we’re ready, or at least some of the people do. So I think that the the recovery is much, much bigger than the moment the screens come back.

The recovery is much, much bigger than the moment that systems start to come up. And there is not a single answer to how long remediation could take. And I so I would I would just say that’s a big depends. and that is one of the factors that you are doing, that you are really calculating, like your recovery time, and you’re trying to look at this from your organization and improve upon it as you are communicating to the board during the whole process of looking at the business impact analysis, the business continuity plan.

Shawn Cordner (26:16.11)
So, you know, the the software that we’re talking about here is primarily operational, right? So they were able to disrupt operations. What we didn’t hear about was any kind of medical devices that may have come offline. So you you have a whole you know hospital filled with imaging systems and lab machines and IOMT devices, which is Internet of Medical Things. So there’s all of this equipment that is actually providing care to the patients.

And that would be an even bigger risk probably, although not having access to files could be a huge risk because you don’t know, you know, drug interactions, for example, or allergies or medical history, right? So so there there’s a lot of inherent risk to both, I guess, but what about those devices, those internet connected devices?

David Jost (27:05.142)
Yeah, I mean I think you’re you have to look at the at the whole of it, right? You’re looking at the fact that you you know, one, you’ve lost you you know, you’ve lost connectivity to anything related to digital. So that is going to have some impact on devices. Though there was some reference to things where they had certain places where they had like a CT, you know, you know, a scanning where they had this available. It was certainly not in the same level of abundance. There was a lot of hand wringing, like I don’t know what we do. We just do the best that we can, right?

There are there are hanging questions in terms of liabilities, in terms of risk, in terms of everything that’s out there. And I think it’s a lot like when you look at it and you’re saying, like, okay, what’s the risk? What’s the level of not having these here? It’s a lot like when we and we talked a bit about this. Some of the things that you just described could very likely be some of the risks when you’re talking about AI without governance or looking at things without guardrails. And from a governance perspective, it’s always like, Okay, you know, I think Dr. Al Hashimi says there’s a ninety eight percent

accuracy to which you you know you look at that and you say is that is that good is that not good I don’t know it’s just thrown out like from that standpoint from a governance perspective ninety eight percent alone tells me little to nothing so two percent wrong about what and with what consequences to your point if it’s something where it’s a a you know medication you know counter effects type of thing that’s happening right that could be serious

If it’s something where someone could get a wrong diagnosis, that could be very serious. If it’s something where it’s going to take a little longer to be able to verify it or there’s something else in place, that’s not as as critical. But when you look at that, are the errors going to be detectable? You know, is the is this going to be the the situation there? So I think that you need to be thinking about this, that accuracy is a performance metric. It isn’t by itself a safety case. So it tells you how accurate it’s going to be, but each instance of where it’s

accurate or not accurate is gonna have an effect on safety to different degrees if that makes if you know, that’s coming through clear.

Shawn Cordner (29:11.138)
Yeah. ninety eight percent accuracy tells you that you need a human in the loop. And and what you’re talking about specifically is Dr. Alashimi, who is coming in to take over running the ER for the the main character who’s well I won’t give away too many spoilers. but regardless, she is trying to introduce in the beginning of the the season a an AI note taker and there was a lot of resistance to that.

surprisingly, even some of the younger staff were pushing back on that a little bit. And then eventually it ends up getting embraced. I I wasn’t clear how that was still up and running, if the entire IT stack was down, but they seemed to have access to it and they were using it for you know, charting patients.

David Jost (29:56.536)
They they had what had been done prior. They did not have the ability to do it. So there’s actually a place where w I can’t capture the name, so I fail once in a while in my trivia contest, but where she is rolling her eyes because they’re saying she says, Does is this going to affect are we gonna be able to use the AI the AI tool for charting? He said, Not until we get, you know, everything back up and running. It’s like, okay, we’re gonna use you know we’re gonna go old school, we’re gonna do this, right? So

I think any references that they made to AI are from things that they had previously on the chart. Got it. And and that’s scary because now you can’t really go back and you you know, leverage the same means to be able to to verify and see where that’s at. But so the over so really I think like an over dependence on digital systems without an analog fallback, it it is definitely a vulnerability. but it’s more an operational vulnerability as much as a or as much as a technical one. Yeah.

Shawn Cordner (30:52.406)
Because you can start to rely on that and then when you don’t have access to it anymore, do you still have the skill set or just even you know, as you’re performing your functions, if the doctor’s not actually taking notes as they’re going along to update the charts either, but they’re relying on this AI thing, you know, what if the app crashes and they don’t have access to any of the spoken notes or the you know, AI generated notes, it would be you know quite a problem for

all the patients, right? So how do you strike that right balance between enabling these people with technology and also ensuring that there’s a little bit more redundancy in the system?

David Jost (31:35.116)
Yeah. And I I I d I actually interestingly was gonna come back to redundancy that whole notion of it, right? So you’re in like in a situation like this, the crisis, part of your plan, your fallback doesn’t need to reproduce the normal operations. Right. It needs to preserve the critical mission safely. So there’s a different there’s a different benchmark, I think, that you’re looking at that. Obviously over the longer term, the consequences are critical. And then at that point you need to determine whether you can continue to operate here or it needs to be done somewhere else or whatever’s happening.

But the first line is to say how do we immediately, like from a resilience standpoint, it’s more about preserving the mission under degraded conditions. And so you’re kind of in a triage sort of situation there determining what you need to do. So I I I don’t know that that you’re going to be looking at many ways. I mean, you’re gonna look at ways that are sort of short-term solutions. We can fall back on this. We’ve tested the the analog situations, but the digital

Backups, the redundancies are going to be other digital. Now, I’m what is the answer? I don’t pref preport to be an expert. Perhaps it’s not there at that facility. Maybe it’s somewhere else and other things. There’s a million ways to look at that at this for people in different types of roles on that. But I think you have to accept that this is not going to be business as usual. And it clearly isn’t. You’re looking at things where

I I won’t say corners are cut because, you know, like I would not say it there because that’s not the kind of language you want to be using in this situation. But you need to look at things in terms of what is most critical to preserving the mission safely and doing what we need to do.

Shawn Cordner (33:11.374)
So given all that as a context, do they get any kind of special dispensation for HIPAA regulatory compliance? Because they were playing pretty fast and loose with patient information in that situation. But to your point, this is an emergency triage situation, not triage in a medical sense, but triage in a we got to figure this shit out quickly, sort of sense, right? So they’re definitely breaking some of the HIPAA regulations there. I mean, how do you ensure that your backup

plan is compliant or is it that important to ensure that you’re compliant in that situation? I mean, what are your thoughts?

David Jost (33:49.318)
My thoughts are just my thoughts. I will just share that, right? Because we’re dealing with HIPAA rule and law on this. But I think that there are like the you know, HIPAA from a HIPAA security standpoint, it’s not a certification, it’s not a piece on that. It’s looking at where are you at in terms of managing and secure you know, securely doing what you need to do to be able to manage the risk and everything that’s there. There was actually some mention during the place to make sure that we are continuing to pay attention to HIPAA and do the best that we can. And I I would not be

genuine if I were telling you that I could speak to exactly what the legal implications are and where that might be. a lot of times the you know when you’re looking at what’s happening right now, you have to do the best you can to be able to again do complete the mission safely and you’re already in a situation where you’re gonna be held to how effectively you have been managing your HIPAA security. Have you been complying with the HIPAA security rule?

Have you been doing the regular security risk assessments, et cetera, right? Because there is, you know, it whether it’s here or Westgate, there is a breach or there is an incident and there’s some level of oversight that might that might come up at that point. But again, I would be speaking out out of turn to be talking specifics.

Shawn Cordner (35:05.506)
So it sounds like the best approach is to proactively be thinking about layers of defense and recovery here, right? So how do you put yourself in a a well-defended situation so that this doesn’t happen in the first place? Assuming that it probably will happen in some capacity, do you have your data backed up? Are you able to restore it? do you have analog processes and procedures in place? Does everybody know it?

And are you able to recover quickly and have you proven that you can recover once you’ve done these things? Yeah. this seems like it’s, you know, and then have you done the tabletop exercises? Yeah. Have your employees practice it, right?

David Jost (35:51.482)
So rather than going through the checklist of all of the things, I’m going to think about this more from the standpoint if if I’m a chief information security officer or I’m a CIO and saying, hey, what’s what’s one thing that I should do on, you know, today’s Monday. So tomorrow, you know, after I’ve watched the pit and I’ve seen this, what’s one thing I should do? Big what are the lessons learned here? I would say, I would keep it simple. Ask this question. If our most critical digital systems disappeared right now.

How long could we continue delivering safe care? And that’s a very non-like how what’s going on with this system, that system, whatever. Just what is the general question you’re looking at? So then don’t answer it in a conference room. Do not try to answer that in a conference room by pontificating and thinking about it. Test one critical workflow end to end without the technology and then another and look at these things to start to go through this. And of course, there’s a more of a plan to that, but don’t tell me you have a downtime plan.

Show me what the that the organization can actually operate it. You know, that this could actually take place if it happened right now. And I and again, maybe that is the lesson of it happening so fast is just to make it like there is no time to quickly like grab everything, to grab your family pictures like in an emergency. This is right now. It’s done, you know. So I thought that part maybe does does play well for the for the reality of this.

Shawn Cordner (37:15.438)
Yeah, the whole point of the of training is to make your response second nature, to build muscle memory, right? So you don’t have to think in a time of crisis, you can actually just respond the way that you’ve been trained to respond. So what would you say to, you know, technology leader that says, Wow, that sounds really expensive and time consuming and we’re an ER here, David. How can we carve out time to do those kind of exercises?

David Jost (37:40.558)
So it’s so this is really like and we talk about accountability, right? You’re looking at this, there are multiple areas where accountability lies, not just with this person. It sits with IT, clinical leadership, the board, it’s really all of them for different things that you’re kind of looking at. But I think like my perspective, and this is somewhat simplified, is that y you know, you’re looking at saying, okay, this is seems very expensive. So that’s the ROI. What’s what’s it gonna take? What are we gonna get for this?

And I always talk in terms of COI, which is the cost of inaction, and what happens if you don’t. So that’s that is that brings it back to like my answer to that person that you said would somewhat tongue in cheek would be, you know what? Let me let’s let’s do a tabletop exercise and talk after that. So let’s let’s go ahead and look at that and let’s let’s design one very, very well. I would tell you a tabletop exercise, again, that’s the simulation, the real time, the

The episode of The Office we talked about. If every tabletop goes perfectly, if you’re doing your tabletops and they’re going perfectly, then the scenario that you have set up probably isn’t difficult enough. So you need to keep challenging yourself. So even as you’re doing this, and there is no regular timeline. I mean, there are things you need to look at. It’s good to do them during at least once a year, maybe some people say every six months, but there are a lot of other variables like when have things changed, what’s happening in the threat landscape.

Do we have new people coming in? How often? Who do we need to, you know, revive on this? There’s no bad answer to that from adding it more frequently, right? But I think you need to look at this and really put it to the test. And you need to embrace the notion that everyone understands this is not a this is not a pass failed test. This is this is insight that we are gaining. This is, you know, learnings that we are gaining that can help us to be better and better at this for a very important mission.

Shawn Cordner (39:32.558)
All right, I’m gonna do the lightning round here. I’ve got four final questions. first question is let’s give letter grades. what would you grade their preparedness?

David Jost (39:47.31)
okay, we’re we’re in a non-grade inflation world here. All right. So I’m just gonna tell you, I would say their preparedness across the board was probably a C minus. You know, I I won’t go to a D. I would say their preparedness at a it sounds like their preparedness at a executive level was better than it was across the board, right? They knew who to to go to.

I’m not sure why Dr. Robbie wasn’t called in earlier. That’s one of my personal things. It’s like they should have had the people there because that would have been helpful to say not only we’re facing this threat, we’re doing this, we’re doing whatever, but Dr. Robbie had what that Dr. Al Hashimi didn’t have history, understanding of the environment. He’s a leg he’s got the legacy of the pit. So he knows what they can or can’t do inherently to some extent. That would have been valuable information to have before like calling the

The shots on it, right? So I think on that part I would say like a C minus and then yeah, I’m a little bit of a softy there. I would say a C minus and a little bit of a softy there.

Shawn Cordner (40:53.026)
Fair fair enough. I d I don’t know if that’s being a softy, that’s a that’s a pretty rough grade. But so how would you grade their response?

David Jost (41:05.046)
I would say that their response across the board was like a B plus given the situation they were in. Like you can’t go back in time, right? There’s a whole bunch of like, could you have told me sooner? Could we have looked at this sooner, et cetera? But I think the way that they did it and they were able to keep things cool. You know, I mean the the most salient point from the office example I used, right? Not a hospital, is Michael Scott screaming, What he just stay calm, people.

Right, you know, there was a level of everyone’s going, Okay, this is great and they got right into it, you know, so serious. Would you

Shawn Cordner (41:39.926)
Did drop them a grade if they didn’t have the employee with photographic memory?

David Jost (41:44.492)
Yeah, I guess actually maybe I’m I’m somewhat inflating it, but again, we already determined, Shawn, that everyone needs to have one of those staff.

Shawn Cordner (41:51.266)
Right. Right. That’s the big takeaway from this podcast is go get yourself one of those. okay. So we graded them. just overall, how would you say like how realistic would you say this whole thing has been, from the attack itself to the response?

David Jost (42:08.034)
I I think very realistic. I mean that the the way that this happened, even down to the part where I’m giving a critique on they should have done this, they should have done that, but not that’s that’s life, right? Things happen and there’s a bunch of things you should have that that all of us should have done in our home or something we should have done and and I live in an area where there are hurricanes. There’s things that I should have done this, but you know, you can maybe still do it if you know it’s coming and you rush off to the grocery store and buy a bunch, but it would have been better to do it ahead of time. So I think this is very realistic.

I you know, in an overall s standpoint, as much as a you know, a one hour or less drama can be in a condensed period. Overall, the pit is is is you know repeatedly cited as the most accurate, most authentic medical environment drama by medical professionals. So I would say that that part alone helps to add to the fact that the things that would matter are the thing many of the things that came up.

Shawn Cordner (43:06.518)
You know, I’ve heard that. I’ve heard the ER is also very accurate. surprisingly, I’ve heard that Scrubs is one of the most accurate ones as well. On the other s end of the spectrum, you’ve got Doogie Hauser, which I think was probably not that realistic. But so my last question for you is we’ve got twenty four, sorry, twenty five Emmy nominations for the pit tonight. What’s the overunder for tonight?

David Jost (43:32.142)
So I don’t know what they all are offhand, so it’s the most nominated. I would I will play it safe and say that they will w they will receive at least fifteen Emmys.

Shawn Cordner (43:42.956)
At least fifteen Emmys. All right. Yeah. I’m gonna hold you to it then, David. Okay.

David Jost (43:46.19)
Okay, we’ll see. Save a little bit of the wine, you know, for a toast.

Shawn Cordner (43:51.448)
There will be no wine left over. all right. David Jose, thanks for your time and expertise.

David Jost (43:56.216)
Thank you.