Rebecca and Speaker B explain why healthcare cybersecurity needs planning ahead, not last-minute fixes. They warn against rushing technical standards like TLS 1.2 rollouts, which can break systems and harm patients. Keep your EPHI data-flow diagrams current and prepare for quantum-safe encryption before deadlines force your hand.
I think that, you know, one of the themes of this discussion so far is like, this is just sound cybersecurity practice. There's some additional documentation involved for sure, but there's also tools out there that can help, you know, reduce some of that manual stuff. I think I've just seen in other compliance areas way too many times, you know, organizations saying, "Hey, we're gonna wait on this. Hey, we're gonna wait on this. We don't think it's gonna happen so soon." Or they're saying, "It's 6 months. We don't think it's gonna happen then." And then you're scrambling, and that doesn't really make sense. I will say the one caveat to that is if there's anything— and I, it sounds like there's not— but if there's anything in the HIPAA law that is just not really plausible or will cause like significant issues, then I think, you know, that's something that the plan can be to kind of push back on that. I'm thinking specifically, I think PCI tried to enforce TLS 1.2 you know, years before that was really possible for a lot of organizations. We actually tried it at one organization that I had, and it immediately started breaking things. I was 2 months into my cybersecurity career. It was very stressful. So, you know, I think that's the one caveat. But for the most part, like, you know, having a data flow diagram for your, your EPHI is, is just good practice, you know. You know, preparing for quantum encryption is just good practice. Those kinds of things. I think it's important just to start planning for those.
No doubt. And I just wanted to echo something when we're talking about healthcare here, it's— we don't— it puts patients at risk when you are at the scramble phase. And it seems like if we're talking about patient safety and care, we would want to do everything beforehand to make sure that we're not all hands on deck at the 11th hour when we have patient lives on the line. Kind of thing. So if you're going through and, you know, doing all these implementations without the proper planning and you're, and you're breaking things, like you said, Rebecca, I mean, that it's not good when you break things in a hospital.
