Advancing Health Podcast

00:00:00:18 - 00:00:31:20
Tom Haederle
Many Americans believe that the world's most elite law enforcement agency, our own Federal Bureau of Investigation, has a purely domestic charter and operates only within the borders of the United States. That's not completely accurate. While it's true the FBI cannot issue subpoenas, conduct investigations, or make arrests overseas without consent from the host country, it does have an international operations division of nearly 100 offices around the world that monitors and works to mitigate the kinds of crimes and threats that don't respect borders.

00:00:31:23 - 00:00:46:00
Tom Haederle
And in this age of rampant cybercrime, their presence is more important than ever.

00:00:46:02 - 00:01:26:02
Tom Haederle
Welcome to Advancing Health, a podcast from the American Hospital Association. I'm Tom Haederle with AHA communications. The rise in devastating cyber attacks directed against hospitals by state-sponsored bad actors remind us that America's interests can be assaulted from anywhere and must be defended everywhere. In this podcast hosted by John Riggi, AHA’s National Advisor for Cybersecurity and Risk, we hear from an Oliver Rich, assistant director for the FBI's International Operations Division about the unique ways the Bureau operates in host countries and the essential role that diplomacy and cooperation play in working together to block or deflect criminal activity.

00:01:26:05 - 00:01:52:03
John Riggi
A.D. Rich, Oliver, if I may. You've had a very interesting and highly distinguished career in the FBI, and many young men and women still dream of becoming an FBI agent. Could you tell us your path to the FBI? What drew you to the FBI in a career in law enforcement? And how did you prepare yourself for the highly competitive process for selection to the most elite law enforcement agency in the world?

00:01:52:05 - 00:02:09:18
Oliver E. Rich, Jr.
Again, thank you very much for the opportunity. Good to be with you. And thank you for the question. You know that it's never lost on me, that you know the incredible opportunity that I have working for the FBI. I can say that, you know, I've met some people in my career that have thought about being an FBI agent their entire life.

00:02:09:18 - 00:02:35:10
Oliver E. Rich, Jr.
Right? And that's always been their dream. That's not particularly my story. When I was a kid, my father was in the Air Force and he was an Air Force mechanic. And he used to talk about all the planes and the aircraft and the jets and things like that when I was a kid. And so as a kid, I grew up wanting to be a pilot, and that's pretty much was my dream until I went off and joined the Navy and became a pilot in the Navy.

00:02:35:12 - 00:02:52:06
Oliver E. Rich, Jr.
When I left the Navy, my wife was in the military as well. And when, you know, we had kids and, you know, life was changing and those kinds of things. I did happen to meet a guy one time when I was stationed in Memphis, Tennessee. He was an FBI pilot, and he started talking with me about the FBI.

00:02:52:06 - 00:03:08:12
Oliver E. Rich, Jr.
Took me over to the FBI building. Showed me around. And, you know, we talked about it, and I was like, man, that'd be an interesting career. As I was  getting out of the Navy. I ended up going to the airlines. And then 9/11 happened, and I didn't forget about my experience and my exposure to the FBI.

00:03:08:13 - 00:03:28:20
Oliver E. Rich, Jr.
But also, you know, being an airline pilot. Great job. I mean, it really is a great job. You know, you can have a lot of fun, go all over the world and stuff like that. A really, really enjoyable job. I just thought that there was more service to be done and I reflected on my conversations with not only that FBI agent, but another FBI agent that I met when I was in the Navy.

00:03:28:20 - 00:03:49:01
Oliver E. Rich, Jr.
And so they talked with me about, you know, the amount of service or the kind of service that I could have as an agent. And it really just piqued my interest. And particularly after 9/11, you know, I talked to my wife and I said, I think, I think I want to do this. So I reached out to an agent that I knew from the military, and, he helped to recruit me and get me into the FBI.

00:03:49:01 - 00:04:14:00
Oliver E. Rich, Jr.
And so it's been a it's been a great career. I think, you know, that a lot of the things that in my past and in my, in my career before coming into the FBI kind of fit well with, with the FBI, the military background, it's not just about military folks. I was really proud of our class that we had so many different people with backgrounds from a range of industries, including banking and finance and accounting and teachers.

00:04:14:00 - 00:04:37:11
Oliver E. Rich, Jr.
And so it wasn't just, you know, military guys that was there. But I think what we were looking for is a kind of person that really wanted to serve. And, you know, we were I came in 2004. So there's a lot of us that looked at what happened on 9/11 and wanted to make a difference and wanted to serve, and felt like we could in a way that would allow us to be part of a team and allow us to be a part of something bigger and support the nation.

00:04:37:11 - 00:04:55:00
Oliver E. Rich, Jr.
And I think that was the backbone of really most of us and why we did that. I'll tell you when I took the test, when I took the test for the FBI, you know, I thought I failed it. It was a lot of math on that test. And I was like, there's no way I passed that test. I'm just going to go back and take my airline job.

00:04:55:02 - 00:05:07:24
Oliver E. Rich, Jr.
But it really made me want it more. I am that kind of person that if you tell me I can't do something, then I'm like, I would double-down and I want to do a lot more. So when I thought I didn't pass a written test, I was like, oh my gosh, you know, I could not fail this test.

00:05:07:26 - 00:05:26:18
Oliver E. Rich, Jr.
But I got the letter. I found out later that they didn't care about the math. They're really just trying to work me up to, you know, for the really important part, which is what kind of person are you, what kind of character you have? Are you driven? Also just being that, you know, type A personality, a lot of us are where we want to get 100% on everything.

00:05:26:25 - 00:05:37:00
Oliver E. Rich, Jr.
You know, I think I was ready for the academy, I think I was ready for the career. And, you know, I was very, very pleased to be able to work with some of the some of the best people that I've, I've got a chance to meet in my lifetime.

00:05:37:02 - 00:06:01:12
John Riggi
Thanks for that background, Oliver. It's interesting how you talk about one meeting with someone who takes an interest in a young person to help mentor and guide them can change their entire lives. In the fact that you, being present in the Bureau has helped the Bureau become better as well. So these, you know, as I've learned, you know, I spent 28 years in the Bureau, you know, and been out for a retired eight years now.

00:06:01:15 - 00:06:26:19
John Riggi
And I think back of, all the folks that helped me and mentored me in my career and steered me in the right direction. And there is a personality type goes to the Bureau. Be the best - as soon as you attach elite to anything, that's what we want. But I realize now, at this stage in my life, that some of the most important things that I do involve mentoring young folks, helping them realize their fullest potential.

00:06:26:19 - 00:06:52:16
John Riggi
And thank goodness that person - thank goodness for the nation and the FBI - they took that time with you, Oliver. Let's talk current tense right now. Tell us about your current role. Extremely fascinating that most folks don't realize the FBI has an international mission. You're not just a domestic law enforcement agency and domestic, national security agency. The FBI absolutely is international in scope.

00:06:52:18 - 00:07:07:23
John Riggi
Talk to us about your global responsibilities as head of the FBI's International Criminal National Security Investigation and Operations that you oversee. And, maybe you can talk to us about what authorities the FBI does or does not have overseas as well.

00:07:07:25 - 00:07:30:24
Oliver E. Rich, Jr.
The kinds of issues and threats that we deal with as a nation today obviously do not respect borders, right? And so the FBI, many, many years ago saw this as something that we you know, saw the international, aspects to crime and to national security as something that we needed to be able to have a presence and be able to work from overseas standpoint.

00:07:30:24 - 00:07:51:21
Oliver E. Rich, Jr.
So as far back as in the 40s, I think our first office that the FBI established was in, Bogota in Colombia. And then we set up some additional sites in Mexico. And the program sort of expanded. But today, International Operations Division, we have about 65 legats and another 30 legal attache offices offices.

00:07:51:21 - 00:08:30:13
Oliver E. Rich, Jr.
where we have a senior FBI agent assigned along with the team, as well as we have some offices around 32. So we have about 98, you know, 90, 97, 98 offices around the world. The staff with about 350 people. And we cover about 180 countries, in international operations division. And our goal is to be a good partner with our foreign partners, with our international partners, to help mitigate threats of national security, to help mitigate threats of, from a criminal aspect, whether it's transnational organized crime or crimes against children.

00:08:30:16 - 00:09:03:24
Oliver E. Rich, Jr.
We have agents stationed all over the world to help mitigate and manage these threats and risks. For the most part, 99% of the time we don't have any authorities overseas to act except for the authority and the power of our foreign partners. So, so much of what we do is just based on relationships. It's based on the fact that we are talking with like minded countries, for the most part, to have an interest in mitigating the same types of threats that we have an interest in.

00:09:03:27 - 00:09:37:24
John Riggi
So, Oliver, fascinating what you're describing here, how many different countries that you cover. And I think one of the key points you mentioned is that everything that is a national security threat or internet organized crime, major crimes are international in scope these days. And certainly part of the reason for that is the internet. People are able to including the bad guys, communicate much more efficiently and develop global relationships, which unfortunately is turned into global criminal and national security threats.

00:09:37:26 - 00:09:55:11
John Riggi
As you indicated, the FBI has no unilateral authority. You just can't handle a agency or a foreign entity, a subpoena or a search warrant you've got to work at through cooperation. So that's really what I found amazing when I was dealing with the legats when I had the privilege to be overseas for a little bit as well.

00:09:55:13 - 00:10:25:17
John Riggi
Speaking about being overseas: recently I had the opportunity to provide a keynote presentation at a very large European cybersecurity conference with the head of your FBI Rome office, your legal attache, Chris Flowers, just did an amazing job. We discussed recent joint international cyber law enforcement disruptions. Could you briefly tell us about some of those, such as the Lockbit in the hive ransomware group disruptions and how you work with allied foreign law enforcement agencies?

00:10:25:19 - 00:10:29:04
John Riggi
Finally, does the private sector play a role in those disruptions?

00:10:29:06 - 00:10:47:13
Oliver E. Rich, Jr.
Yeah. Thanks again, for your question, and thank you for attending the event over there. I mean, I know there was a there was a lot of people are huge event. And, we were very fortunate to be able to, take part in, with, with our, our legal attache, Chris Flowers over there, who's representing the Bureau extremely well in Rome with all our partners.

00:10:47:15 - 00:11:06:05
Oliver E. Rich, Jr.
Look at, you know, cyber is one of those things like I said earlier, there is no borders here, right? And, so these are huge problems that we face within our cyber division. In the FBI in general, you know, part of our strategy is to one: identify and disrupt cyber networks wherever they are in the world.

00:11:06:05 - 00:11:31:28
Oliver E. Rich, Jr.
And so we have to work very closely with our international partners, and also with, with our domestic partners as well. To do this is I mean, these are, very challenging threat actors. They present numerous, numerous areas where we have difficulty in tracking and figuring out who they are. But we are working very hard to, number one, remove their anonymity of these actors.

00:11:32:01 - 00:11:54:03
Oliver E. Rich, Jr.
So, you know, remove that cloud that they have around them and who they are and identify them and publicly name them through indictments and things like that. And so we want to do that. We want to be able to get onto their networks. We want to be able to disrupt their networks, and then we want to be able to impose consequences where a lot of these folks are working in terms of, ransomware, you know, the money, the financing, how do we get that?

00:11:54:06 - 00:12:17:11
Oliver E. Rich, Jr.
Can we get into their wallets? And can we can we take that, take those funds back and make this a game that is not necessarily one that they're willing to take the chances enacting. And so, Lockbit and HIVE are two examples of that, where the FBI and other partners around the world have been really successful in taking down infrastructure, getting on infrastructure, identifying who the actors were and imposing consequences

00:12:17:11 - 00:12:56:12
Oliver E. Rich, Jr.
in terms of the financing. When you mentioned the private sector and how they might be engaged and how they might help. Number one, we really, really need to continue to need the private sector to come forward and to share information about when they're hit with ransomware attacks, to help identify the threat actors tactics, their procedures, and also sort of what they're looking for and in terms of where the ransoms are being paid. We need that information it helps us conduct our investigations, and it also helps us to do joint and sequence operations with our partners around the world, identifying crypto wallets and working through these chains to see where the

00:12:56:12 - 00:13:19:24
Oliver E. Rich, Jr.
money actually lands. We have some very, very smart people that work on that. And we, you know, our cyber division, along with, the other agencies we work with in that space, you know, they're working very hard to impose consequences on these threat actors in that area, but super, super excited about what we did with Lockbit and HIVE to take down Lockbit ransomware as a service and malware as a service.

00:13:19:29 - 00:13:39:22
Oliver E. Rich, Jr.
If you got briefings on this, you'd be surprised about how easy it is to deploy some of this ransomware as a as a service or malware as a service to, to deploy this material. And it is a problem that is going to continue to grow, which is why we have to work internationally with partners. All around the world to combat it.

00:13:39:25 - 00:14:07:27
John Riggi
Certainly, we understand from the hospital perspective the threat that ransomware groups pose to us and as a nation. Ransomware attacks on U.S hospitals and health systems continue to disrupt and delay healthcare delivery, posing a risk to patient safety. And, we've had hospitals from very large systems experiencing attacks currently to very small, remote rural hospitals that serve 500 square miles.

00:14:07:29 - 00:14:32:28
John Riggi
And suddenly they have to go on ambulance diversion. These are just truly life-threatening issues. And we're glad to see the FBI attempting to impose risk and consequences. Take the money out of the equation. Help them - the bad guys - understand that ultimately if you the attack a hospital, it's not an economic crime, it's a threat to life crime and that they face serious risk and consequences for that. Oliver from all of from Europe

00:14:32:29 - 00:14:45:03
John Riggi
global law enforcement intelligence perspective, what do you see as the emerging global threats, cyber and otherwise? What should we be watching for in health care and in general here in the US?

00:14:45:06 - 00:15:09:22
Oliver E. Rich, Jr.
So I look, I think that, you know, the problems that we've seen in the past are still with us. Right? And so if you think about transnational organized crime, those problems are still with us, and they're going to remain a problem for us for quite some time. Counterterrorism, you know, those problems still with us, but technology and sort of changing methods and tactics and these kinds of things make these challenges a lot more difficult.

00:15:09:27 - 00:15:31:03
Oliver E. Rich, Jr.
Let's talk about CT, for example, I'll go back to the medical system in a minute. But from a counterterrorism perspective, if you think about the ease with which people move around the world today and how that might create additional risk for terrorism to act, or the widespread use of drones and those kinds of things, and what a drone can be used for today.

00:15:31:10 - 00:15:53:04
Oliver E. Rich, Jr.
Years ago, you know, we didn't have to worry about drones so much. Now, what someone can do with a drone and how drones are used and automation and these kinds of things are present much more of a challenge. And so as technology continues to move and create the different ways for people to deploy criminal and national security threats, we still have to keep watching out for that, right?

00:15:53:06 - 00:16:30:28
Oliver E. Rich, Jr.
When it comes to fraud. And if you look at health care and these kinds of issues, so fraud, ransomware attacks, we just talked about how ransomware as a service was going to continue to be a problem. Malware, these kinds of cyber threats are going to continue to be a problem. Fraud itself and the ability for people to use computer generated images and messaging in order to commit fraud, whether it's healthcare fraud or, or just, you know, stealing money from people who have saved, spent their entire life saving up a nest egg.

00:16:30:28 - 00:16:53:05
Oliver E. Rich, Jr.
And now somebody comes along and uses AI generated technology to commit fraud. So these are all problems that I think are just going to require us to be a lot more vigilant, a lot more understanding of what these trade issues are. Gonna require a lot more outreach and engagement, which the FBI is doing, a whole lot more outreach and engagement to educate people.

00:16:53:05 - 00:17:09:08
Oliver E. Rich, Jr.
So we're trying to stop crime and events from happening in the first place before we ever get to the investigation piece. How do we help people identify threats on their own and so they become less vulnerable? And how do you identify risk for hospitals? And so you become less vulnerable.

00:17:09:13 - 00:17:37:28
John Riggi
And as you mentioned, technology is the great enabler. However, it is an enabler for criminals as well. And as technology continues to evolve, so will the attack vectors, whether it's national security threats, criminal threats, and of course cyber threats as well. AI of course, we're watching that very closely in health care, the use of artificial intelligence in health care holds tremendous hope and promise to the point where AI may be used to discover cures for cancer, so forth.

00:17:38:01 - 00:18:05:16
John Riggi
As you mentioned, we're also seeing our adversaries use AI to generate highly effective malware to target hospitals and health care. So it's a double-edged sword at the moment. And again, clearly the cooperation, as you mentioned, between private sector and the FBI, especially in cyber matters, is vitally important. The evidence and intelligence related to cyber crimes lies on private sector networks, which comprise about 85% of all the networks in the United States.

00:18:05:19 - 00:18:20:17
John Riggi
And contrary to popular belief, and correct me if I'm wrong, Oliver, I don't think so, that the FBI just can't see into private sector networks without a warrant or cooperation. And, so the government doesn't see all that they need private sector cooperation.

00:18:20:20 - 00:18:44:15
Oliver E. Rich, Jr.
No, you're absolutely right about that. We definitely need the private sector to cooperate with us. We need the public in general. And this has been the lifeblood of the FBI for many years. Is is having the public help law enforcement help us in our national security mission to protect the United States. I mean, it is a whole of society, whole government approach to defend ourselves against the threats that we face.

00:18:44:17 - 00:19:13:17
Oliver E. Rich, Jr.
I mean, a wise person said, hey, you know, it might have been a general or famous general, but it takes a network to defeat a network, right? And so we have to build stronger networks and stronger partnerships and stronger relationships to work against the adversaries that we have in all of these different spaces. I mean, the one thing about the FBI and, you know, just go back to the first question you asked and what's attractive about the FBI is we work in so many different areas. So many different responsibilities in our portfolio, but it creates a challenge for us.

00:19:13:17 - 00:19:35:17
Oliver E. Rich, Jr.
Right? And we absolutely need the public. We need private sector partners. We need our law enforcement partners domestically and international to work with us, to make us more effective at addressing all these different, different issues that we have to face every day. In order for us to be the most effective and most capable as we can as a nation and as a global community,

00:19:35:17 - 00:19:54:26
Oliver E. Rich, Jr.
we have to be able to work together. We have to be willing to share information with one another that will help us. Number one, identify areas where we're vulnerable. And number two, come up with ways of hardening or mitigating those risks to us, either as an industry, as a community and as a nation.

00:19:55:02 - 00:20:16:12
John Riggi
Thank you, Oliver. I think you summed it up quite nicely. It's not just dependent on the private sector or the public to defend ourselves against these threats. The government can't do it without our cooperation. Whole of government is great. Absolutely. But as you said, it's a whole of nation approach, private sector, working with the government to defeat our common adversaries here, cyber and otherwise.

00:20:16:15 - 00:20:40:05
John Riggi
Thank you for being here with us today. Appreciate everything you do and all the men and women of the FBI to defend the nation against all physical and virtual and counterterrorist and all types of international crime. And thanks to all our listeners for tuning in and thank you for all our frontline health care heroes, for everything you do every day to care for patients and serve your communities.

00:20:40:12 - 00:20:46:06
John Riggi
This has been John Riggi, your national advisor for cybersecurity and risk. Stay safe everyone.

00:20:46:08 - 00:20:54:19
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.

00:00:00:12 - 00:00:35:02
Tom Haederle
The federal public health emergency for Covid 19 officially ended 15 months ago, but any health care provider will tell you the official date means little because the pandemic's repercussions for hospital and health system workforces lingers on. It's felt every day, while the great migration out of the health care profession has slowed. It's not over. Nonetheless, caregivers are finding ways to cope and continuing to deliver great patient care.

00:00:35:04 - 00:01:01:16
Tom Haederle
Welcome to Advancing Health, the podcast from the American Hospital Association. I'm Tom Haederle with AHA Communications. Corewell Health, which provides care to a large section of Michigan, also faced a shrinking workforce during the pandemic, as so many providers did. In this podcast, we learn about its response, which can be summed up like this. Instead of saying we'll do more with less by making people work harder, we said, how do we do more with less?

00:01:01:16 - 00:01:06:02
Tom Haederle
By thinking outside the box and reinventing some of the things we did.

00:01:06:04 - 00:01:30:03
Elisa Arespacochaga
Thanks, Tom. I'm Elisa Arespacochaga, vice president of clinical affairs and workforce, and today I'm really excited to have a conversation with Dr. Darryl Elmouchi, Chief Operating Officer of Corewell Health, where he leads strategy, operations and clinical care delivery across 21 hospitals and is dealing with all sorts of challenges related to the workforce and really supporting the teams that, he gets to lead.

00:01:30:05 - 00:01:46:18
Elisa Arespacochaga
And I'm excited to have him share with this group some of the amazing work that they are doing and piloting and innovating to really support their workforce. So to get us started, Darryl, can you tell me a little bit about your background and sort of how you came to this role, from your clinical work?

00:01:46:20 - 00:02:07:20
Darryl Elmouchi, M.D.
Sure. So thanks so much for having me. I'm excited to be here. I am what's called a cardiac electrophysiologist. So a cardiologist who did very specialized procedures for heart rhythms, and never, ever intended to be standing here talking to someone like you. But over the course of many years. And you'll see a theme here when we talk about some of the work we've done.

00:02:07:23 - 00:02:29:10
Darryl Elmouchi, M.D.
I came to see, not only caring for patients being important, but for caring for people that care for patients to be important and really saw a need to make systems better. And so started down that path well over a decade ago and over the course of many years took on different jobs trying to do that. And over the last few years have been really leading all care delivery for Corewell Health.

00:02:29:12 - 00:02:36:03
Darryl Elmouchi, M.D.
if you recall, Corewell Health has actually two health systems emerged about two years ago, Spectrum Health and Beaumont Health, in Michigan.

00:02:36:06 - 00:03:03:27
Elisa Arespacochaga
You're covering not only the entire state, but really trying to make sure you're supporting, to two different teams and bringing those cultures together. So that's, definitely a challenge. And I know we've talked about this. You're facing the same workforce shortages and challenges with turnover and the overall impact on that care team. So not only are you trying to support them, but you're trying to support a team that maybe tired and worn out and needing some, extra supports.

00:03:03:27 - 00:03:17:05
Elisa Arespacochaga
And quite honestly, they're fewer than maybe they were before. So what are some of the biggest challenges you've been seeing? And some of the drivers of dissatisfaction that you really wanted to tackle as you started thinking about this work?

00:03:17:07 - 00:03:47:29
Darryl Elmouchi, M.D.
Yeah, you know, I think you kind of hit it very well. And I'd say a couple of things. Obviously, I think for everyone coming out of Covid, it was just a year or two plus that was incredibly challenging emotionally, physically in every possible way. For caregivers. And then coming out very specifically, we saw, like everyone else, this migration of folks that were no longer in the workforce, whether it was early retirements of nurses or people that came into the workforce and pretty quickly said, I can go do something else that's easier.

00:03:48:01 - 00:04:06:27
Darryl Elmouchi, M.D.
I don't have the calling that I used to have. And so we were trying to do the same amount of work or more with less people. And ultimately that just is a recipe for burnout, and it doesn't work. so we took a multi-pronged approach, and I want to preface this by saying we're on a journey. There's nothing that's perfect.

00:04:06:29 - 00:04:25:21
Darryl Elmouchi, M.D.
But, I really like to pride our teams and some of our leaders because instead of saying, how do we do more with less? By making people work harder, we said, how do we do more with less? By thinking outside the box and reinventing some of the things we did. And I'm really proud with some of the pilots that we've been now starting to scale.

00:04:25:21 - 00:04:27:29
Darryl Elmouchi, M.D.
And I'm happy to share a lot of them, if you'd like.

00:04:28:06 - 00:04:48:12
Elisa Arespacochaga
Absolutely. I know one of the areas you've really, sort of double clicked on is looking for ways to incorporate technology, which is not something that clinicians have, you know, had a real good track record with, let's just put it that way. But looking for ways to incorporate that technology that can reduce the burden, particularly that administrative burden.

00:04:48:12 - 00:05:03:28
Elisa Arespacochaga
That is not why you went into health care. You went into health care to help people. And, you know, typing up their complaint list is not doesn't feel like it's helping them. So what are some of the ways that you have been using technology to really augment the ability of the team?

00:05:04:00 - 00:05:25:08
Darryl Elmouchi, M.D.
Maybe I'll start with nursing because I think probably across the country, that's been the area that's probably been the most challenging in terms of workforce and how hard it is to both hire and continue keeping nurses, as well as attracting new nurses into the field. You know, we've done a lot of things, like many other working on pipelining, partnering with universities and so forth to try to increase the number of nurses in the state.

00:05:25:10 - 00:05:42:11
Darryl Elmouchi, M.D.
But in addition, we had a team that looked at what are our nurses doing, particularly in the hospitals on the floor. What are they doing minute by minute? And how much of that work is really not value at it's not what they went to nursing school for. It's not what we really intended to hire them to do, but they're doing.

00:05:42:11 - 00:05:54:18
Darryl Elmouchi, M.D.
And maybe I'll turn and ask you just a quick question. What percentage of what a nurse does every day in the hospital do you think is really kind of clinical, needing a nurse versus anything else?

00:05:54:20 - 00:06:06:05
Elisa Arespacochaga
Well, I only know the answer because I've heard you talk about this, but I was shocked because I would have thought it would have been in the 70 to 80% range before I heard your, what your study showed.

00:06:06:08 - 00:06:33:07
Darryl Elmouchi, M.D.
So we did very detailed pilots looking on different nursing floors to understand what nurses do. And as it turns out, direct patient care is about 44% of their time, meaning 56% is something other than direct patient care. And even within direct patient care, a large percentage of that is documentation. And that's not necessarily truly direct patient care. But you'd argue that a nurse probably has to document.

00:06:33:09 - 00:07:01:12
Darryl Elmouchi, M.D.
So there's a huge amount of other work. And the hard part about this is that as we learn and we dove into this, that other work isn't work that doesn't have to be done. It absolutely is. It just might not have to be done by a nurse. And so what I would share with you is this if you start thinking about what a nurse does, aside from going in and adjusting medications, giving medications, assessing patients, checking vitals, all the things that clearly are part of a nurse's toolbox.

00:07:01:15 - 00:07:21:20
Darryl Elmouchi, M.D.
There are so many other things that happen that are really challenging for nurses. So think about everything as simple as, you know, a patient wanting a glass of water. That's really important for that patient, for the nurse, probably someone else can do that is going to find supplies on the floor. So many other things that they're coordinating and trying to do that really aren't that helpful.

00:07:21:27 - 00:07:44:10
Darryl Elmouchi, M.D.
So what we ended up doing, and this is a really interesting way that it was piloted, we said, well, is there a way for patients to let us know what they want in a room that uses technology? And by use of that technology, can we use another workforce to do some of that work? And we started this pilot now about two years ago in one of our smaller rural hospitals, and we actually had an Alexa.

00:07:44:10 - 00:08:07:24
Darryl Elmouchi, M.D.
So an Amazon device and a created an interface in an app on Alexa where the patients could talk to that. And the first thing we learned was it totally didn't work. It just didn't work well. Patients, really, it couldn't understand them. The patients themselves really couldn't figure out how to use them very well. So we scrapped that. And we partnered with a local entrepreneur and actually created an app.

00:08:08:01 - 00:08:30:10
Darryl Elmouchi, M.D.
That app can go on a iPad or type a tablet device in a room. The app also we put on nurses workstations and their devices. They carry it around the hospital. And what we learned is that there was a ton of requests or there are a ton of requests, for these nurses. Through this app, we started adding more requests that someone else could do.

00:08:30:12 - 00:08:53:19
Darryl Elmouchi, M.D.
So the second thing we did was we temporarily hired a distinct workforce where we more or less, and for lack of a better term, gamified or Uberized, what they did relative to these other tasks. So if a patient needs a blanket, the patient clicks on the app. They need a blanket. Someone else in the hospital who's hired to do this brings them a blanket, and they could be coming from another unit.

00:08:53:24 - 00:09:15:25
Darryl Elmouchi, M.D.
And that person gets incentives to do more over the course of time. So almost like an Uber driver gets incentive to drive. We started working on this more and more, and we realized that actually the most clicked from the app came not from the patients, but from the nurses themselves when they were tasked with something, when they came by a room, they saw something was needed or asked, and they can actually ask someone else to do it for them.

00:09:15:27 - 00:09:27:23
Darryl Elmouchi, M.D.
And we have now scaled this across multiple, nursing units at large academic thousand plus bed hospitals and in smaller hospitals. And it has been incredibly effective.

00:09:27:26 - 00:09:49:18
Elisa Arespacochaga
I just love this idea. And I especially love that you went back to it. Even after the first version. Didn't quite, do what you needed. I just love the idea of being able to really look for ways to create that delegation chain in a way that doesn't feel like you've got to, you know, then train another workforce and pull them in.

00:09:49:20 - 00:10:14:00
Elisa Arespacochaga
This is work that can be done in a way that that really doesn't put another burden on the nursing team to figure out how to get it done. So can you tell me a little bit about what you're doing to bring some of those teams together, so that you can reduce some of the frictions? I know we often set workflows in health care, and then they are set in concrete and we never move them.

00:10:14:03 - 00:10:25:17
Elisa Arespacochaga
but to try to make the teams more efficient, especially when you're working with maybe people you haven't worked with before or you're trying to do different things with that smaller team.

00:10:25:19 - 00:10:49:10
Darryl Elmouchi, M.D.
Yeah, I love the question. And I say that, you know, if you think about kind of some of the universal challenges in modern health care delivery, one of them is everything's become so big that it becomes more impersonal. Humans are we're just tribal. We like to be around people that we get to know. We understand how they work, how we work, and large hospitals, large clinics, large systems.

00:10:49:15 - 00:11:10:04
Darryl Elmouchi, M.D.
That becomes increasingly challenging. So I'd point that is just one underlying problem that really takes away from the family feeling of things. Number two, as a health system, we had issues with our length of stay. We wanted to work on making our length of stay better. I firmly believe a shorter length of stay improves the patient experience, because they're not waiting for things in the hospital.

00:11:10:04 - 00:11:28:03
Darryl Elmouchi, M.D.
They can be home and not lying in a hospital bed, and it allows us to use our resources more effectively. And as we were looking at both of those problems, we had different teams kind of looking at them. We realized there's a very simple solution, which quite honestly, it's quite possible many of our members have done years ago or never went away from.

00:11:28:07 - 00:12:00:01
Darryl Elmouchi, M.D.
But we started realizing that particularly in our larger hospitals, we had people all over the hospital and very few areas where there were kind of similar people that were working together all the time. And very specifically, this has to do with the move to hospitalist and physicians. So we have large hospitalist program, and we had hospitalist that were in our largest hospitals, you know, over a thousand beds going to 6 or 7 nursing units in a given day around because they were caring for a patient here or a patient there and so forth.

00:12:00:03 - 00:12:32:29
Darryl Elmouchi, M.D.
And as we started working on length of stay and doing what we call care progression rounds, where you have a case manager assigned to a floor, a nursing unit manager assigned to a floor, you realize they'd have to call in the doctor who's running from somewhere different, and that just didn't seem to make sense. And when we started thinking of both of those problems together, we said, you know, the more we can try to cohort patients, doctors, nurses, care managers in the same area, the same unit, the same floor, the more they can work together, not only in this shift or for this week when they're working.

00:12:32:29 - 00:12:49:18
Darryl Elmouchi, M.D.
You know, doctors are often seven days on, seven days off in these areas, but over time, they can develop long term relationships that really help strengthen that bond and have people work together well. And it's been incredibly positive, both from a well-being standpoint and from a length of stay standpoint.

00:12:49:21 - 00:13:07:26
Elisa Arespacochaga
That's awesome. It's, reminds me of one of potentially the Hocus movies that I am a big fan of. But the Apollo 13 and where, you know, Tom Hanks starts talking about, wait, you want to change one of my team members when you know, we know the way, you know the sound of each other's voice, the tone of our voice, how we react and all of those things.

00:13:07:26 - 00:13:33:01
Elisa Arespacochaga
And it's so important to not underestimate the value of that teamwork and that connection among our clinicians, particularly when they are dealing with much more stressful times, patients who are sicker, all of those things that we're seeing now, I think it's really a great approach and, you know, always nice when it also helps reduce length of stay and make the patient experience better.

00:13:33:01 - 00:13:38:24
Elisa Arespacochaga
But I can't imagine it doesn't really make the team members feel really unified as a group.

00:13:38:26 - 00:13:55:24
Darryl Elmouchi, M.D.
Absolutely. And it's such a much more cohesive feeling. And, you know, and I'll be very honest and say that if we look at our particular larger hospitals, somewhere between 50 and 80% of the units were now able to do that. We call it Co-horting. We were 0%, you know, a few years ago. So we've made a lot of progress.

00:13:55:24 - 00:14:05:02
Darryl Elmouchi, M.D.
But there's probably a limit to what you can do just based on the nature of variability within health care. But even that 50 to 80% has made a huge difference.

00:14:05:04 - 00:14:23:15
Elisa Arespacochaga
As you starting to think about this, in especially going into the future and starting to change workflows in the work environment and thinking about the team a little bit differently. I don't know if you've guys coined the term, but I love the idea of someone being an in-box ologist, and I'd love for you to share a little bit about that.

00:14:23:17 - 00:14:41:01
Darryl Elmouchi, M.D.
Yeah, so this one could be one of my favorites. I'm a little biased, as you know, a former practicing physician. So when I started in clinical practice, you know, about 20 years ago, there were no EHRs, at least where I was. and so I was so used to you work, you go home, you work, you go home.

00:14:41:06 - 00:15:04:00
Darryl Elmouchi, M.D.
And when you're home, you could be on call, but you're not finishing notes at 2 a.m.. you're not jumping in the inbox because of alerts and so forth. And nowadays, anyone who works in electronic record, regardless of what it is, is inundated with inbox messages. and that essentially is like your email in basket. But for clinical issues, some of those are very important.

00:15:04:02 - 00:15:25:15
Darryl Elmouchi, M.D.
Some of those are more informational and less important. And it becomes truly overwhelming. And so we started looking and many of the modern EHR vendors, we have to have epic, can give you all sorts of data on what we call pajama time. So how much time clinicians are spending after hours generally when they're home in the in basket.

00:15:25:15 - 00:15:52:15
Darryl Elmouchi, M.D.
And you can look at how much time during say a clinic day they're spending doing things in the, in the in basket and in the E.R.. And it is mind numbingly frightening where we've come. So you talk about burnout amongst the physician and app workforce. It is completely understandable. And you even go a step further. And you say in the beginning of Covid, electronic messages to providers were common, but not commonplace everywhere, all the time they've skyrocketed.

00:15:52:15 - 00:16:11:22
Darryl Elmouchi, M.D.
If you look at data across the country, anywhere from 3 to 6 fold post-Covid. So and that's just new work. You're not getting necessarily paid for it. It's and you're not allocating time for it. So we started looking at what can we do to make life better. And we took it on two paths a technology path and just a rethinking the workflow path.

00:16:11:22 - 00:16:31:06
Darryl Elmouchi, M.D.
And I'll start with the letter first. And we said, you know, there's a lot of stuff that comes to us in basket that absolutely needs a clinical eye on it, but probably can be addressed without the top of license. And our workforce physician looking at each of these. And so we decided to create a pilot. We call this the inboxologist.

00:16:31:06 - 00:16:59:21
Darryl Elmouchi, M.D.
And I'm pretty confident, I don't know that we're the first person to think of this, but we're definitely, I think, the one to coined the term. We actually have a publication coming out, relatively soon on our data for this, for the inboxologist, which is what we call an app, a physician assistant or nurse practitioner specifically hired to manage the inbox of a number of clinicians started with just physicians, but they actually could be managing the inbox of other apps that are in the clinical workforce.

00:16:59:23 - 00:17:25:18
Darryl Elmouchi, M.D.
And the goal was to see, can we decrease the amount of burden on the physicians and apps that they're doing this work for? Can we decrease their pajama time? And our hope was and we this was kind of our underlying assumption that this would improve productivity enough without us asking for anything in return, that it would at least break even and pay for itself, because you have to find something sustainable in this world.

00:17:25:21 - 00:17:42:26
Darryl Elmouchi, M.D.
The second big issue we had with it was, would anyone want to do this? If we're going to advertise for this role, would anyone want to be in the in basket all day as part of their job? Well, we started probably a year and a half ago and I can tell you it has been amazing. So first of all, would anyone want to do this?

00:17:43:02 - 00:18:06:00
Darryl Elmouchi, M.D.
I think I recall us having somewhere like 2 or 3 dozen applicants for the first two open positions. it turns out that, there are a lot of apps that really like this work. They can do this from home. The hours are pretty flexible, and so it's a pretty nice lifestyle work and it's still important work. The second part of it was, can we scale this and make it work?

00:18:06:00 - 00:18:24:10
Darryl Elmouchi, M.D.
And we had a lot of learnings to do because we didn't know. Do you say that one app covers ten doctors, covers five doctors, and it turns out you really have to adjust this based on the panel size of the physician or app, the type of work they do. We really started in primary care thinking that's where the biggest burden was.

00:18:24:12 - 00:18:52:14
Darryl Elmouchi, M.D.
And I can tell you that the data has been absolutely spectacular. I'm going to actually share you our most recent data, which came out about a month ago. So the average physician who is enrolled in this meeting, they have an inbox ologist, spends an average of 77 minutes during daytime hours, less in their invested each day. So an hour and a quarter and 95 minutes less each night of pajama time when they have an inbox.

00:18:52:21 - 00:19:18:07
Darryl Elmouchi, M.D.
Just the work life balance of these providers went from on a scale of 0 to 5, five being the best one from a three to a 4.25, with this being the only intervention. And we've seen a 41% in basket reduction volume. So either it doesn't come to them because it's something the app can be address or when it gets to them, there's a narrative around it where it's very clear kind of where to look and what to do.

00:19:18:14 - 00:19:20:24
Darryl Elmouchi, M.D.
It has been spectacular.

00:19:20:26 - 00:19:23:28
Elisa Arespacochaga
You've given the most of a day back in a week.

00:19:24:03 - 00:19:46:20
Darryl Elmouchi, M.D.
Could you imagine? And I'll share. And so the big thing for, you know, my CFO colleagues, is when you look at this, we also had that idea like, what will happen? How will this work? And so we have now determined that just about everybody who goes through this has enough time on their day where they will see an extra patient in the clinic every day, every few days, what have you.

00:19:46:24 - 00:19:54:03
Darryl Elmouchi, M.D.
And when you add it all up and you also look at decreased turnover, it actually pays for itself and a little bit more.

00:19:54:05 - 00:20:14:03
Elisa Arespacochaga
I love talking to you because you give me so much hope for the work we do in healthcare. Darryl, I can't thank you enough for sharing these great highlights that you're working on, and I hope we can revisit sort of where core well, Health is taking this into the future. I'm super excited. for all the work you're doing and the ability of the rest of the field to, to try taking these on.

00:20:14:07 - 00:20:15:11
Elisa Arespacochaga
Thank you so much.

00:20:15:13 - 00:20:17:27
Darryl Elmouchi, M.D.
Thanks so much for having me. It was a pleasure.

00:20:18:00 - 00:20:26:10
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and write us five stars on Apple Podcasts, Spotify or wherever you get your podcasts.

00;00;00;21 - 00;00;28;18
Tom Haederle
America's very first hospital opened its doors in Philadelphia in 1752. And in that first model the hospital's board members or overseers were responsible for its finances, while doctors and medical staff were charged with issues of quality and safety. That set the pattern for the next 200 years. It wasn't until the advent of Medicare in the 1960s that hospital boards were assigned primary responsibility for quality and safety as a condition of participation in the program.

00;00;28;21 - 00;00;42;19
Tom Haederle
Today, those responsibilities have only grown in size and scope.

00;00;42;22 - 00;01;10;14
Tom Haederle
Welcome to Advancing Health, a podcast from the American Hospital Association. I'm Tom Haederle with AHA communications. In this Safety Speak series podcast hosted by Sue Ellen Wagner, vice president of Trustee Engagement and Strategy with AHA, she speaks with Jamie Orlikoff, National Advisor on Governance and Leadership to the American Hospital Association and one of the nation's leading experts on the role hospital boards can play in supporting quality and safety efforts within their organizations.

00;01;10;16 - 00;01;28;07
Tom Haederle
As Orlikoff notes, the basic question hasn't really changed much since that first hospital took in patients so long ago. Now, as then, the challenge remains: how can laypeople who are not nurses or clinicians get comfortable with their roles on the board and actually improve quality and safety?

00;01;28;09 - 00;01;52;19
Sue Ellen Wagner
Thanks, Tom. I'm very happy to be with Jamie Orlikoff today, who's going to be talking to us about laying the foundation for the board's role in quality and patient safety. Jamie Orlikoff is president of Orlikoff and Associates Incorporated, which is a consulting firm that specializes in health care governance and leadership strategy, quality, patient safety and organizational development.

00;01;52;19 - 00;02;00;26
Sue Ellen Wagner
And he's also the national advisor on Governance and Leadership for the American Hospital Association. Jamie, thank you for joining me.

00;02;00;29 - 00;02;03;03
Jamie Orlikoff
My pleasure. Well, I'm happy to be here.

00;02;03;05 - 00;02;10;08
Sue Ellen Wagner
Would you tell folks a little bit more about a lot of your accomplishments that you've had over the several years?

00;02;10;08 - 00;02;33;01
Jamie Orlikoff
Accomplishments I don't know if I'll emphasize, but I'll talk a little bit about my engagement in this topic. You know, the board's role in oversight and quality. I'm doing a little research and prep for this podcast came across a book that I and a colleague of mine wrote, Mary Totten is her name - back in 1991, which was called the Board's Role in Quality of Care, and it was the very first book written about this topic that we're going to discuss.

00;02;33;02 - 00;02;58;27
Jamie Orlikoff
And in looking over it, I didn't know whether to be horribly embarrassed or, you know, shocked at how naive much of the content was. But some of it is still right on track. The essential concept that the board bears the responsibility for quality, which we can chat about if you're interested. So I would just mention that and then that I've spent, you know, a good, good portion of my career addressing this challenging issue.

00;02;58;28 - 00;03;25;25
Jamie Orlikoff
You know, how can a board that is composed primarily of lay individuals, i.e. people who are not clinicians, they're not physicians, they're not nurses. How can they, first of all, get comfortable with their responsibility to oversee the issues of safety and quality and then to effectively improve, you know, act as a board to effectively improve the quality of care that's provided in their organizations and the safety profile within their organization?

00;03;25;25 - 00;03;38;22
Jamie Orlikoff
And so I've been approaching that from many different perspectives for 40 years. I don't know if you'd call that an accomplishment. Sometimes I feel like Don Quixote tilting at windmills, but that's all I'll say on that.

00;03;38;24 - 00;03;45;13
Sue Ellen Wagner
Well, and also, you get to practice what you preach. You've been on boards, you've chaired a couple of boards. You just want to mention that.

00;03;45;15 - 00;04;05;14
Jamie Orlikoff
Yeah. Well, right now I just stepped down as board chair of the Saint Charles Health System at the end of 2023. I'm still on the board, and I am chair of the board's Safety and Quality Committee. So I'm still very, very engaged in this particular issue and specifically in the interface of the board and the organization in terms of its oversight and quality.

00;04;05;14 - 00;04;19;14
Jamie Orlikoff
So I will tell you, being a consultant to boards and also being a board member, it's much easier to be a consultant than it is to actually be a board member. It's very challenging, very difficult. It really gives you a very good perspective on the issues and the challenges.

00;04;19;17 - 00;04;38;26
Sue Ellen Wagner
Good. Well, again, very happy that you're here with me today. So can you provide some background for the board's responsibility and role in quality and patient safety? And can you specifically speak to the CMS requirements of the governing body? I think this will be a really great foundation for some new board members.

00;04;38;28 - 00;05;10;27
Jamie Orlikoff
I think the question you're asking is a really important one. And that notion is who is responsible for quality? And in the last it's really well understood. The default perspective and the incorrect perspective is the board takes care of finance and the medical staff takes care of quality. And that's not true. It used to be true. And that's the problem: is for many, many years, going back to the founding of the nation's first hospital by Ben Franklin in 1752, the role of the board was primarily raising money, and then later on managing that money.

00;05;11;03 - 00;05;40;06
Jamie Orlikoff
The responsibility for quality, such as it was, rested with the medical staff, and they typically then just deferred that to the individual physician. That didn't change until the 1960s, as a result of a series of malpractice cases, the most famous one being from Illinois, the Darling vs.Charleston Memorial Hospital case, where the hospital was sued by the plaintiff, saying the hospital made some errors in failing to effectively oversee the physician and allowed the physician to injure

00;05;40;06 - 00;06;03;23
Jamie Orlikoff
you know, the patient who became a plaintiff. And that was upheld at the Supreme Court level, where the court basically said that modern day hospitals do more than simply furnish facilities for treatment and very specifically said when a patient avails himself of the services of a hospital, he expects, at a minimum, that the hospital will endeavor to protect him from injury and more importantly, the hospital will attempt to keep him well.

00;06;04;00 - 00;06;33;16
Jamie Orlikoff
And then here was the line that began to change everything: the public must be protected. From whence does this protection come? It comes from the Board of Trustees. Boom! That suddenly changed everything. Now, the case law was still kind of inconsistent with the state hospital licensing statutes. And remember, this is 1965. So Medicare legislation had just passed. But because of this case, it sent reverberations through the American health care system.

00;06;33;16 - 00;07;09;00
Jamie Orlikoff
And within three to four years by 1969, all hospital state licensing statutes had been changed to say that the board bears the ultimate responsibility for quality. That the board oversees the medical staff and the medical staff reports to the board. So they're not separate, co-equal authorities, but there is a hierarchical relationship. And then to your point, you know, Medicare legislation passed in 1965 and then became effective in 1966 or right around that time, the kind of worker bees of government, the non-elected people had to write the Medicare regulations.

00;07;09;02 - 00;07;24;24
Jamie Orlikoff
They said, you know, we're spending all this money. It's going to cost a lot of money. How do we oversee quality? How do we make sure there's good quality? Who is in charge of quality at the hospital? And they basically said, oh, look what just happened in Illinois. Look at the Darling case and look what state statutes are doing.

00;07;25;02 - 00;07;51;28
Jamie Orlikoff
So they put into the very, very first Medicare rules, conditions of participation, which is basically a contract between a hospital and the federal government. They said the board bears the ultimate responsibility for quality. So that didn't change legally until 1965. Since then, it has become more codified in the law. In case law, and the Medicare regulations have become much, much more specific.

00;07;52;01 - 00;08;14;23
Jamie Orlikoff
So now if you take a look at the conditions of participation, you go to their section 482.11 and 422.22. And they very specifically say, number one, there must be an effective governing body that's legally responsible for the conduct of the hospital. And then they immediately go in talking about it is the board who oversees the medical staff.

00;08;14;25 - 00;08;43;29
Jamie Orlikoff
The board ensures that the medical staff is accountable to the governing body for the quality of care provided to patients. So right now, the Medicare regs make it very, very clear that it is the board that bears the ultimate responsibility for quality and more specifically, when a hospital gets in trouble with the federal government, when the government issues a what's called a 23-day letter, you know, basically saying you're out of compliance with the conditions of participation, you have 23 days to fix it.

00;08;44;01 - 00;09;15;26
Jamie Orlikoff
And if you don't, if your remediation plan is not sufficient, you could lose your status to be eligible for Medicare reimbursement. Which is basically a death sentence for a hospital, because all of their commercial contracts specify that in order to be eligible for commercial reimbursement, they must be in good standing with the Medicare program. But whenever Medicare does this, and they do it more frequently than many hospital board members think, the number one citation when they say it was determined that you continue to be out of compliance

00;09;16;01 - 00;09;40;17
Jamie Orlikoff
is that a regulation that I quoted to you, 482.12, the governing body that the board failed to fulfill its obligation to effectively oversee quality of care or oversee the medical staff in the provision of the quality of care. So that's a little bit of the history. And that's also kind of an emphasis that, you know, from a legal and a regulatory perspective, it is the board.

00;09;40;18 - 00;10;00;12
Jamie Orlikoff
They bear the ultimate responsibility for quality. But yet many board members don't really understand that. Many medical staffs don't understand that. I'm amazed. Just within the last two years, the chief of the medical staff of a fairly, you know, decent-sized system told me the medical staff is responsible for quality. Wow. And I said, no, no, no, it's the board.

00;10;00;13 - 00;10;25;07
Jamie Orlikoff
He said, no, no, no, no, it's the medical staff. So that is a factual issue which should not be open for debate. Now the other issue which we'll talk about, you know, perhaps later in this podcast or another podcast, is once that's understood, how does the board then effectively oversee quality? But in order to do that, everyone in the organization needs to understand that the board is responsible for quality.

00;10;25;09 - 00;10;47;23
Jamie Orlikoff
What that means. And then you need to start to overcome some of the conceptual barriers to effectively being able to have governance oversight of quality. Don't you have to be a physician to understand quality? It's amazing how many board members kind of retreat to that defensive perspective. No one - you never hear anyone say, don't you have to be a certified financial professional to understand finance?

00;10;47;23 - 00;11;00;18
Jamie Orlikoff
You never hear anyone say that, but you will frequently hear board members say, no, no, you've got to be a doctor or a nurse to understand quality. So the first step is really understanding that the board is.

00;11;00;20 - 00;11;28;11
Chris DeRienzo, M.D.
Thank you for tuning in to this episode of Safety Speaks, the podcast series dedicated to patient safety, brought to you by the American Hospital Association. I'm Dr. Chris DeRienzo, the AHA’s chief physician executive and a champion of the Patient Safety Initiative. The AHA patient safety initiative is a collaborative, data driven effort that lifts up the voices of individual hospitals and health systems into the national patient safety conversation.

00;11;28;14 - 00;12;00;14
Chris DeRienzo, M.D.
We strive to catalyze and connect health care professionals like you across America in your efforts to innovate and improve, and to bolster public trust in hospitals and health systems by helping you share your successes. For more information and to join the 1,500 other hospitals already involved, visit aha.org/patient safety or click on the link in the podcast description. Stay tuned to hear more about the incredible work of members of the AHA’s Patient Safety Initiative.

00;12;00;16 - 00;12;07;10
Chris DeRienzo, M.D.
Remember, together, we can make health care safer for everyone.

00;12;07;12 - 00;12;31;14
Sue Ellen Wagner
So when you're a hospital CEO and you know you have your board chair, you have new board members coming on. They should be explaining all of this to the new board members so that they understand that they're accountable, that they're responsible, that they don't need to be a physician, correct? So there needs to be some great lines of communication that come through so that new board members understand what they do.

00;12;31;17 - 00;12;41;06
Sue Ellen Wagner
And it's probably not a bad idea for the CEO and board chair to remind the medical staff of the requirements too, that who's responsible and why.

00;12;41;08 - 00;13;03;04
Jamie Orlikoff
Great points, Sue Ellen.  And what you're really talking about is one of the characteristics of effective governance is a really good mandatory new board member orientation process where this issue is discussed, you know, in some detail. And the same thing is true for a new orientation process for elected medical staff. So everyone understands it. And I'll give you a point.

00;13;03;06 - 00;13;25;27
Jamie Orlikoff
I was facilitating a board self-evaluation session in the last six months, and one of the board members said, well, I'm really concerned because I think we're a micromanaging board. We spend all this time on medical staff credentialing, on approving the privileges of individual physicians. We shouldn't do that. That's management's job. Oh, man. So it's like, whoa, wait a minute now, how long have you been on the board?

00;13;25;27 - 00;13;45;19
Jamie Orlikoff
And this person had been on board three years. Wow. How can you be on a hospital board for that length of time and not understand one of the basic concepts that the medical staff does not report to management. It reports to the board. That management doesn't make decisions or even recommendations regarding medical staff credentialing. And that's a board decision.

00;13;45;19 - 00;14;08;23
Jamie Orlikoff
So that really emphasizes your point. You don't want board members to hopefully, you know, pick this up, you know, organically by going to meetings. You want to really emphasize this in the orientation process, because this is a responsibility of a board, which is unlike any other governance responsibility in non-health care organization. So there's really no equivalent to it.

00;14;08;26 - 00;14;12;05
Jamie Orlikoff
And so that's where it really needs to be emphasized as you smartly point out.

00;14;12;07 - 00;14;19;05
Sue Ellen Wagner
Great. Thank you so much. Any lasting comments Jamie on the history of quality and what boards should know.

00;14;19;08 - 00;14;54;02
Jamie Orlikoff
Yeah, I would say if you really want to go back, you know, because I'm kind of a nerd on this topic, you know, and you want to take a look at origins of the interest in quality and safety. It goes back to ancient Babylonian in 2000 B.C., or about 4000 years ago. And, there was an emperor named Hammurabi who's famous for codifying the first set of written laws after cuneiform writing, the first written form of language came about. And one of the laws that he passed was a law establishing avenues for patients to redress grievances for perceived acts of malpractice against physicians.

00;14;54;04 - 00;15;13;06
Jamie Orlikoff
And the law basically said, and this is a quote, if the physician has made an incision in the body of a free man and so has caused the man's death, or has opened a carbuncle in the man's eye, and so destroys the man's sight, they shall cut off the physicians for him, you know. So boom, there's a big problem there for several perspectives.

00;15;13;06 - 00;15;40;09
Jamie Orlikoff
Number one, you see the punitive aspect that has been in existence for so many years. If there's a problem with quality or safety, that means someone did something wrong and they should be punished. And it's taken us years to get past that thinking and move into the concept of systemness and a just culture where we now begin to recognize that the majority of issues which cause injury to patients, preventable injury,

00;15;40;09 - 00;16;10;11
Jamie Orlikoff
you know, that that cause less than optimal quality, are not individuals doing something wrong. There are problems in systems and systems which make it either impossible or very difficult for, you know, a provider to do the right thing. So that's one thing to take from that. And that's also a very important concept for boards to understand, because it helps them understand, oh, I get my job as a board to oversee a system and to look for levers which will improve a system.

00;16;10;14 - 00;16;36;17
Jamie Orlikoff
So that actually is very helpful for many board members to get more comfortable with their responsibility for quality and safety. Now, the other really important issue in this law which we still deal with is these two different terms, safety and quality. And what's the difference? Boards really need to kind of understand this difference because they're related but different. Safety basically is not injuring the patient or the or a staff member, "doing no harm."

00;16;36;21 - 00;17;06;06
Jamie Orlikoff
So safety equals the absence of injury. Quality, on the other hand, is doing all and only the care that we know will help the patient. So they're related but different. How? Just because you are not injuring patients does not mean you have good quality care. But if you are injuring patients, you cannot have quality care. So a good way of thinking about this is safety is like the floor, you got to have safety.

00;17;06;09 - 00;17;37;29
Jamie Orlikoff
Quality is the ceiling. So it's important for board members to understand the difference because frequently this responsibility is integrated. Look at the name of the board committee that I chair, the safety and quality committee. So the board is responsible for both. But it has to be very, very cautious to make sure it understands both the relationship between these two very important concepts, but also how they are different so that they can work very effectively to say, okay, do we have safe care?

00;17;37;29 - 00;18;04;12
Jamie Orlikoff
Because the answer is no. That's where the board's going to spend most of its attention until they get safe care. And then once they get that to a level where there is no or very, very low levels of, you know, preventable patient injury or preventable patient mortality, when they get to that point, then they can start to focus on making certain that they're providing all and only the care that, you know, science shows will benefit the patient.

00;18;04;18 - 00;18;24;01
Jamie Orlikoff
So that's a little bit of the more of the background and the nuance and the history. But it also points out that, you know, going back to Hammurabi, you know, this law is 4,000 years old, and that was before there were hospitals. So the concern, society's concern for quality, for safety has been evident in every civilization since that time.

00;18;24;09 - 00;18;32;10
Jamie Orlikoff
And board members are kind of the linchpin between the concern for society and the expression of it in their individual hospital.

00;18;32;12 - 00;18;42;16
Sue Ellen Wagner
Well, thank you so much, Jamie, for joining us. Really appreciate it. That great background. And hopefully folks will be able to use this as a good part of their orientation.

00;18;42;19 - 00;18;50;29
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and write us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.

00;00;00;14 - 00;00;26;05
Tom Haederle
Money worries. The job. A personal relationship. The daily news headlines. All of these things and many more can cause anxiety and stress. In fact, experts note that anxiety and stress are 100% common, in that everyone - from all walks of life - feel some level of these things practically every day. Managing stress is more important than ever. But these emotions can gain the upper hand for many people

00;00;26;09 - 00;00;38;27
Tom Haederle
and that's when it's time to reach out for help.

00;00;38;29 - 00;01;15;08
Tom Haederle
Welcome to Advancing Health, a podcast from the American Hospital Association. I'm Tom Haederle with AHA communications. In this month's Leadership Dialogue series podcast, Dr. Joanne Conroy, CEO and president of Dartmouth Health and the 2024 Board Chair of the American Hospital Association, invites an expert colleague from Dartmouth Health to discuss ways to manage stress. They talk about how to tell the difference between the normal, garden-variety anxieties of everyday life, and the kinds of stress and anxiety levels that affect roughly one-third of the US population and limit enjoyment of life.

00;01;15;10 - 00;01;43;24
Joanne M. Conroy, M.D.
Thank you for joining us today for another AHA Leadership Dialogue discussion. It's great to be with you. I'm Joanne Conroy, CEO and president of Dartmouth Health and currently the chair of the American Hospital Association Board of Trustees. I look forward to our conversation today, and I'm delighted to have my colleague, Dr. Robert Brady, join us. Robert leads our anxiety disorder service at Dartmouth-Hitchcock Medical Center.

00;01;43;27 - 00;02;01;11
Joanne M. Conroy, M.D.
He originally trained at the University of Arkansas, where he earned his doctorate in clinical psychology, later doing some post-doctoral work with the VA, and has now been at Dartmouth here for almost ten years. Robert, thank you for joining us.

00;02;01;13 - 00;02;01;28
Robert Brady
Good to be with you, Joanne.

00;02;01;28 - 00;02;38;09
Joanne M. Conroy, M.D.
Our health system along with many others across the country, is deeply committed to ensuring that our patients and our communities have access to the full range of behavioral health services. This is especially important given our current environment, when events from national news to personal challenges can really ratchet up an individual's anxiety. Coverage of wars, the recent assassination attempt of a candidate running for office, and various other headlines create anxiety for people across the country.

00;02;38;12 - 00;03;09;29
Joanne M. Conroy, M.D.
That on top of everyday stress that people are trying to manage makes it all more important for our communities, our patients, our families and our workforce to have the tools they need to identify and reduce stress and anxiety. We know anxiety is actually quite common, and it's an issue for many people in all walks of life. Robert is going to answer a lot of questions for us about anxiety and the incidents and how we actually manage it as an individual and a community.

00;03;10;01 - 00;03;22;00
Joanne M. Conroy, M.D.
But what I'd love to do is have Robert tell us a little bit about himself and how he actually got into this line of work, which for many people could be anxiety provoking in itself.

00;03;22;03 - 00;03;45;12
Robert Brady
Yeah, sure. Thanks, Joanne. And you know, as you mentioned earlier, I am a clinical psychologist by training. And here at Dartmouth Health, I lead a specialty team in our anxiety disorder service that's focused on the treatment and assessment of anxiety disorders, including generalized anxiety disorder, panic disorder, social anxiety disorder, and specific phobias, along with OCD and PTSD.

00;03;45;14 - 00;04;04;22
Robert Brady
Now my research goes a bit further than anxiety, so I'm really focused on applying implementation science methods to develop and evaluate brief psychosocial interventions that are delivered in nontraditional mental health settings so that we're trying to increase access to care overall. But in terms of how I got more focused on the anxiety disorders, it is a little personal.

00;04;04;22 - 00;04;28;16
Robert Brady
And I like sharing this because it normalizes anxiety. But, I remember being an extraordinarily socially anxious, socially fearful kid. And it wasn't until I learned through my own experience of kind of approaching the scary thing, seeing that nothing bad happened, that I really started kind of coming out of that shell and being less worried about embarrassing myself and really having a fuller life.

00;04;28;17 - 00;04;42;14
Robert Brady
So I'm a big believer in the value of exposure-based therapies. That's really what I specializes in, in my intervention. And ultimately I just found anxiety to be, and still do, to be a fascinating problem to people that a lot of people struggle with.

00;04;42;16 - 00;05;08;23
Joanne M. Conroy, M.D.
You know, that's interesting as something that a lot of people can relate to. You're not the only one that gets anxious, you know, before a social situation or before giving a talk or presentation that sometimes can be disabling. We used to do oral board exam practice sessions with our residents, and some of my brightest residents -they were so anxious they couldn't talk and breathe at the same time.

00;05;08;26 - 00;05;30;29
Joanne M. Conroy, M.D.
And, you know, actually the practice sessions really helped them actually overcome their anxiety. So it was really less about their knowledge and more about how to really manage their own anxiety in this situation. Well, how prevalent is anxiety, anyway, across the general public? How many people would self-identify as having a challenge with it?

00;05;31;01 - 00;05;50;05
Robert Brady
Sure. Well, I always like the question how common is anxiety? Because if we just mean anxiety, the answer is it's 100% common. And I always tell people, everybody is going to experience some level of anxiety on a daily or at the very least a weekly basis. And I would say anyone says they're never anxious is not telling the truth.

00;05;50;07 - 00;06;12;13
Robert Brady
But if what you mean, is what's the prevalence of people who will go on to have really problematic anxiety, the sort that's kind of been seeking care or getting in the way of their life, then we're looking at approximately 30 to 35% of the of the U.S. based population at least, meeting criteria for some anxiety disorder at some point

00;06;12;16 - 00;06;14;02
Robert Brady
over the course of life.

00;06;14;04 - 00;06;23;20
Joanne M. Conroy, M.D.
What are the criteria for deciding whether you have just garden variety or human anxiety and anxiety that probably needs to be addressed.

00;06;23;22 - 00;06;55;28
Robert Brady
So, you know, without getting in the weeds of all the individual criteria for each anxiety disorder, we would say there are two kind of main, defining features. Either the problem - the anxiety is interfering in the person's life, or it's substantially distressing personally to them. Either it's a problematic symptom or it's a painful symptom. But really, any time that the anxiety has gotten so big that it's limiting life or limiting enjoyment of life, I think it's worthy of being treated at that point.

00;06;56;00 - 00;07;10;25
Joanne M. Conroy, M.D.
You know, a lot of people would equate that to having a panic attack, but that's probably just one symptom that people experience and probably a kind of an extreme one. You don't want to get it to the point where you actually experience that.

00;07;10;27 - 00;07;48;12
Robert Brady
Right. And so panic attacks are very common to have over the course of life. And that's going to be different than panic disorder. When we have someone with a panic disorder, it means they're having recurrent panic attacks. And maybe most importantly they're changing their life in some meaningful way. That is, they're stopping doing the things that give them pleasure, or they're not going to places that are important for them to complete their activities of daily living. That is not the panic attack, but it's the anxious apprehension of panic and the change in life, all to prevent what is otherwise an unpleasant but actually harmless experience.

00;07;48;15 - 00;08;07;13
Joanne M. Conroy, M.D.
Now, the certain segments that you've seen a significant increase in anxiety. I think we all kind of are worried about young adults and teenagers, but there are probably other segments of the population that are experiencing rising anxiety that we need to be aware of.

00;08;07;16 - 00;08;26;07
Robert Brady
It's a good question. What are the prevalence differences by segment or age group? You know, I don't know. That's the kind of research we're looking back on in some ways. But I can say that two of the areas that we're, kind of particularly concerned about as you mentioned, are young adults. I'm not a young adult anymore,

00;08;26;10 - 00;08;45;21
Robert Brady
and I think it would be really tough to be one these days. We think about anxiety as a perception of threat somewhere in space and time, that's how I think about anxiety, that the danger is not there, but it might be in the future. I mean, kids right now, they're kind of drinking through a firehose of cues for anxiety.

00;08;45;29 - 00;09;14;20
Robert Brady
They have a constant flow of information and they can't predict anything. One day, you know, some part of themselves is acceptable and appreciated and the next day it's not. It's something that has changed. And they can't be that aspect of self anymore. So that would be a really hard place to be in. And certainly anyone who's a parent or knows other young folks is understandably concerned about the risk of increased anxiety in that population.

00;09;14;23 - 00;09;41;02
Robert Brady
The other end of that spectrum is our older adults. And so some folks, listening to this may be aware of or familiar with the term anxious depression and older adults. Anxious depression is a sort of milling about presence of just discomfort. We've got end of life issues that we're starting to think about. We're having fewer folks in our lives because a fact of life is as you get older, there's an increased likelihood of losing folks that are close to you.

00;09;41;05 - 00;09;58;09
Robert Brady
And so all those things compile, along with trying to maintain that quality of life they're used to while also going through the substantial change of retirement and changes in your living. So that results in a lot more of that anxious apprehension. And that's another population we're particularly focused on.

00;09;58;12 - 00;10;19;06
Joanne M. Conroy, M.D.
You know, a topic that a lot of people talk about is the role of social media. And I can tell you that there are times that I just don't want to open up my newsfeed because I don't think it's going to be good. But we know that a lot of our younger patients are very tied into social media.

00;10;19;09 - 00;10;48;11
Joanne M. Conroy, M.D.
And frankly, for some of our older patients, that is sometimes the only contact or stimulation they may have if they don't actually get out of their apartment or their home frequently enough to interact with others. So I know you probably have written many papers on the impact of social media, but, you know, how should we approach it? As, you know, aunts and uncles and parents with these younger kids who I think are significantly affected by it?

00;10;48;13 - 00;11;14;21
Robert Brady
So a simple question we might ask someone in our clinic is: is this behavior helpful to you? On balance, is this thing - whatever it is you're doing, maybe it's accessing social media - is it making life better? Or is it actually perhaps causing some problems? And sometimes we'll hold up the mirror, you know, kind of figuratively, to say, this is what I heard you describing about your use of social media, and you said, this is how it makes you feel, but I notice you're continuing it.

00;11;14;23 - 00;11;37;01
Robert Brady
Maybe this is functioning more as a habit or an effort to avoid something else. Maybe it's repeatedly trying to look for reassurance in the social media and not being able to learn to tolerate the uncertainty. So a there's a lot - it's a very complex subject. It's not it is not my content expertise, certainly. But it shows up, almost ubiquitously in our population.

00;11;37;04 - 00;11;55;21
Joanne M. Conroy, M.D.
Yeah. It feels like sometimes a national event can actually get amplified by the number of times it actually shows up on social media and all the social media venues, and it almost makes it feel more impending for people that they could be affected by that.

00;11;55;24 - 00;12;16;14
Robert Brady
Yeah. And so in some ways, it becomes a numbers game, right? It's so omnipresent, it's so constant that you kind of say, well, it has to be important if they're putting it on the website this many times, right? Failing to remember that the normal stuff of life doesn't make social media, right? The normal stuff of life doesn't make the news.

00;12;16;14 - 00;12;23;11
Robert Brady
It's the scary stuff. And the more you see it, the more you start to say, oh, it must be. This is something I have to be worried about.

00;12;23;13 - 00;12;48;19
Joanne M. Conroy, M.D.
Let's shift a little bit and talk about anxiety in health care workers. You know, we have a lot of uncertainty and violence in the world that gets amplified by social media. But health care workers are often on the front line, either treating victims who are affected by violence. But also we have more violence within the health care setting.

00;12;48;22 - 00;13;13;10
Joanne M. Conroy, M.D.
You know, people are angrier. And you know, we can use the example of the active shooter that we had here almost seven years ago that created a lot of anxiety within the organization. It felt like our safe little bubble of the upper valley had actually been popped, and people realize that we could be vulnerable.

00;13;13;12 - 00;13;40;05
Robert Brady
Right. And we oftentimes are the most anxious about the things that we can't predict. Right? If anxiety, as I said before, is the perception of threat somewhere over the horizon, ideally the salve, the balm for anxiety would be able to predict things and those unpredictable events and the idea that they might happen. That's what provokes that anxious, that anxious response. I mentioned at the top that I've been here for about ten years.

00;13;40;08 - 00;14;00;04
Robert Brady
And so I've been able to work with a lot of health care providers, both as colleagues of course, but also sometimes in my clinical work. And health care providers come across as superheroes sometimes, and I think sometimes we also think of ourselves as superheroes, forgetting that if anxiety is a normal human response, we're going to have it too.

00;14;00;07 - 00;14;20;29
Robert Brady
We try to kind of push that part away, instead of kind of welcoming or accepting it and acknowledging it. The pandemic also certainly heightened that sense of anxiety, because here is an unpredictable event, and we're being asked to do things where we don't feel like we have the same sense of control and that that starts to impact our resilience.

00;14;21;01 - 00;14;31;29
Robert Brady
We are not superheroes, but we have the training and ideally, we have the support necessary to remind us that we can deal with even the unpredictable parts of the work.

00;14;32;01 - 00;14;58;13
Joanne M. Conroy, M.D.
Was really fascinating after the active shooter here that people surfaced with experiences before they came here. We found out we had three people that used to live in Sandy Hook and our incident actually stirred up a lot of that kind of trauma that they were still kind of dealing with, being proximate to that event.

00;14;58;15 - 00;15;20;28
Joanne M. Conroy, M.D.
And it was fascinating that you would think that how proximate you were to the event had something to do with your anxiety level. But it had nothing to do with your anxiety level. It felt like it was almost a reflection of the other trauma you'd had in your life. You know, how common is that? I was struck by that.

00;15;21;01 - 00;15;52;08
Robert Brady
Sure. So we think about those as kind of trauma reminders. So, you know, oftentimes someone goes through a terrible event and they say, I don't want to think about that anymore. They try to put it in a box and put it in the back of their mind. but all it takes is a little reminder to cause that to come back, to be thinking about that more. A lot of the work that we do in the anxiety disorder service at Dartmouth Health is with PTSD specifically, trying to help people understand and process the things that happened before.

00;15;52;10 - 00;16;09;08
Robert Brady
And we think, you know, when you have something bad happen, if you say, I'm going to put that away, I'm not going to think about it anymore, you better hope that the way you were thinking about it when you locked it away, that that was an effective way of thinking about it. That was adaptive. Because if you don't think about it anymore, you put it aside to, I'm just not going to deal with that.

00;16;09;10 - 00;16;23;20
Robert Brady
Well, you're kind of stuck with whatever thoughts and beliefs you had about it at the time. So then when someone a similar event, happens, they didn't deal with the first one. And it makes understanding how this could happen again all the much more difficult.

00;16;23;23 - 00;16;55;05
Joanne M. Conroy, M.D.
What should we be doing as leaders of hospitals and health care systems to actually support our staff? You know, at some point in my career, I thought everybody would benefit from sitting with psychologists at least twice a year, almost check ins. And I think we've actually even talked about that. We do that with our residents and we have a psychologist that's hired to support the residents, but that's probably undoable for some of our health systems.

00;16;55;05 - 00;17;02;02
Joanne M. Conroy, M.D.
And we have 18,000 employees across the health system. But what else should we be doing to help support our staff?

00;17;02;05 - 00;17;25;19
Robert Brady
So I think this is a good point to note that most of our colleagues manage anxiety quite well. In fact, we actually did a study during Covid of health care workers in the resilience, and specifically with anxiety. And we found that the overwhelming majority of health care workers did not report anxiety that would be concerning, that would be in kind of the clinical range.

00;17;25;19 - 00;17;50;18
Robert Brady
Or if they had high anxiety, it went away within a year. But what that also showed is that almost a fifth of our colleagues do have, you know, problematic anxiety. What we want to be able to do is help to identify the folks that are most at risk, because we don't want them to suffer in silence. We want to be able to promote normality of anxiety and to be able to talk about it.

00;17;50;20 - 00;18;29;11
Robert Brady
And one of the other things we learned from that study was when the health care workers can't predict day to day what's going to happen, or when they're asked to do services and tasks outside of their usual sense of what I can control, control and predict, their anxiety was much higher. So as leaders, I think what folks in health care want to be able to do is both encourage people by reminding them you have the training and skill set to do amazing things, and you can cope even with uncertainty, while at the same time trying to give them the most predictable working environment that they can. Not unnecessarily inserting uncertainty, even if

00;18;29;11 - 00;18;54;05
Robert Brady
sometimes that's part of the job, trying to smooth out those rough edges of unpredictability. You know, we talk a lot about encouraging psychological safety, and then other times we will talk about brave spaces. I want to encourage people to create predictable spaces so that the person knows what to expect as much as possible from day to day.

00;18;54;08 - 00;19;15;10
Joanne M. Conroy, M.D.
That's probably the key to my success, because the same Joanne Conroy shows up every single day. I'm boring, but the same person shows up. I want to thank you for joining me today Robert, and I appreciate you sharing some of your valuable expertise and insight, and certainly some of your own personal insights in terms of managing anxiety.

00;19;15;10 - 00;19;36;29
Joanne M. Conroy, M.D.
And I encourage all of our viewers to reflect on some of the advice that Dr. Brady has shared, whether managing individual anxiety or helping somebody get the assistance they need. Until next time, I want to thank everybody, and I look forward to seeing you next month and our Leadership Dialogue. Have a wonderful day.

00;19;37;02 - 00;19;45;12
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and write us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.

00;00;00;19 - 00;00;22;29
Tom Haederle
Imagine getting an email or a phone call from a total stranger with this message: "I have your medical information and I know that you had surgery on this date." Pretty scary stuff. We've seen a sharp uptick this year in the brutal tactics of cybercriminals, who are now directly contacting and threatening patients during ransomware attacks, pushing the boundaries as never before.

00;00;23;01 - 00;00;48;26
Tom Haederle
As always, the bad guys demand payment and if a victim resists, they may threaten to publish sensitive photos online, take advantage of stolen patient records, or even send phony incident reports to the local police to trigger a harrowing visit from a SWAT team. Yes, that's happened too.

00;00;50;06 - 00;01;20;19
Tom Haederle
Welcome to Advancing Health, a podcast from the American Hospital Association. I'm Tom Haederle, with AHA communications, John Riggi, AHA’s national advisor for cybersecurity and risk talks over with two experts how this latest despicable tactic in the arsenal of cybercriminals should be managed starting with updating incident response plans. As John notes, if there were ever any question that the intent of these gangs was to harm patients, it is now clear that is their fundamental intent.

00;01;20;22 - 00;01;45;21
John Riggi
Hello everyone, and thanks for joining today. I'm John Riggi your national advisor for cybersecurity and risk at the American Hospital Association. Today we'll discuss a new cybersecurity trend. Cybersecurity criminals are contacting and threatening patients during ransomware attacks. And there is a need to update incident response plans to adjust for the uptick in this despicable criminal behavior.

00;01;45;24 - 00;02;31;11
John Riggi
Unfortunately, last year was the worst year on record for data theft attacks and ransomware attacks. Foreign-based bad guys, primarily Russian ransomware gangs, are continuing to evolve their despicable tactics to increase the likelihood of payment by victims, including calling victims directly based on information in their stolen health care records, demanding payments from them directly, and/or conducting swatting attacks, dispatching local police to fake armed incidents at those homes of patients, which is very, very dangerous for the patients and responding law enforcement, and also threatening to publish very sensitive photos of patients online.

00;02;31;13 - 00;02;56;11
John Riggi
So, as you can see, they are pushing the boundaries directly, threatening patients. If there was ever any question that the intent of these gangs was to harm patients, it is clear now that is their fundamental intent. Today I'm joined with Jake Milstein, chief marketing officer at Critical Insight, and Johnathen Inskeep who was the former CIO at Caribou Medical Center.

00;02;56;13 - 00;02;59;12
John Riggi
Jake and Johnathen, thanks for joining the podcast.

00;02;59;15 - 00;03;00;14
Jake Milstein
Thanks for having us, John.

00;03;00;14 - 00;03;01;21
Johnathen Inskeep
Yeah, thank you.

00;03;01;23 - 00;03;12;00
John Riggi
Jake and Johnathen. Let's jump right in. Can you help our listeners understand what cybercriminals are doing during ransomware attacks and how they affect patients?

00;03;12;00 - 00;03;38;09
Jake Milstein
I think you, you know, you hit on some of the attacks that just occurred, but I want to go back actually a couple of years here, and recognize that this has been a criminal tactic in sort of a spotty way. You know, you go back 3 or 4 years and there was an attack on a school district in Texas, and that attack on the school district in Texas, the school district, I don't know, they either didn't pay quickly or decided not to pay.

00;03;38;11 - 00;04;02;20
Jake Milstein
And the criminals started calling parents and emailing parents and saying, oh, I know your son's name. I know your daughter's name. And of course, the parents started calling the school district. We saw it in health care a couple of years ago, but it was kind of spotty. The big change here is at the end of 2023, we saw it several times.

00;04;02;20 - 00;04;27;10
Jake Milstein
We didn't just see it one time. We saw it at a health care organization in Oklahoma, and then we saw it at Fred Hutch Cancer Care Center, which you talked about, which is in Seattle. And in the Fred Hutch case, the criminals went so far as to threaten these swatting attacks. The swatting attacks are when the criminals would, you know, they threatened to call 911 and say, you know, this person has kidnaped me and I'm in the basement.

00;04;27;10 - 00;04;48;27
Jake Milstein
Send the SWAT team, right? So the SWAT team would come. And you know, how might it affect patients? I mean, wow, can you imagine getting an email as a patient? You know nothing about cybercrime. And all of a sudden, you know, somebody emails you and says, I have your medical information and I know that you had surgery on this date.

00;04;48;29 - 00;04;52;05
Jake Milstein
You know, I mean, that's pretty scary stuff, right, Jonathen?

00;04;52;07 - 00;05;11;17
Johnathen Inskeep
Oh, absolutely. I just try to put myself in the shoes of, like the patient. If you're receiving those phone calls, you start to wonder. It's like, is this really happening to me? And then you start like, how did you get my information? And, you know, they point back to the hospital and you immediately lose trust and value in the health care service provider that you were going to.

00;05;11;18 - 00;05;21;13
Johnathen Inskeep
It's just devastating. And then a lot of people, it's like, I don't really have any problems, but I don't want any problems that I've had shared with anybody. So it really just leaves you vulnerable.

00;05;21;15 - 00;05;42;15
John Riggi
Just think about it from the patient perspective. As you said, you're getting these calls. And of course, the first thing that patients are going to do is call the hospital. Now the CEO is getting calls. . . . word that these patients are being directly extorted. Imagine again the pressure on the hospitals. Nobody wants to pay ransom. And again, of course, we at the AHA strongly discourage the payment of ransom.

00;05;42;15 - 00;06;06;07
John Riggi
It will only encourage these groups to continue to conduct these attacks and fund them for perhaps other, more serious crimes as well. But you know what I was confused about, I should say, wondering about in this latest, highly publicized case when they were contacting patients directly for demanding a ransom payment from them, they were only asking $50 each.

00;06;06;10 - 00;06;08;13
John Riggi
I don't get that. That's a lot of work.

00;06;08;14 - 00;06;28;01
Jake Milstein
You know, it's super interesting. It's super interesting. And, you know, I've seen a debate and actually been part of a debate on this. So folks know what this is. And I might have the exact figures wrong here, but basically what the criminals said was pay us $3 and we'll let you know if we have your records. You can see your record for $3.

00;06;28;01 - 00;06;50;23
Jake Milstein
And if you want us not to expose your record publicly, then it's $50. And so some people have said that really this is just a pressure tactic that I personally think that that is more advanced than a pressure tactic. And I actually think that the bad guy - this is just a new revenue stream for that. It is the what is the triple extortion?

00;06;50;23 - 00;07;09;13
Jake Milstein
The quadruple extortion. I think you know, this is the you know, we're going to tier your payments. I actually think it's a revenue stream because, you know, you know, criminals are you know, they're good at math. We know this. You know, let's say you have what, 100,000 patients and everyone pays you $50,000. I mean, you know, it's real money.

0;07;09;15 - 00;07;33;00
John Riggi
Right? And, you know, as I'm thinking this through, ransomware as a service has proliferated dramatically the past couple of years. And people are assuming, wow, if they're demanding millions from the hospital victim, why would they go after patients for $50? Well, maybe this is a separate department within the ransomware as a service. Said, you guys can have the patient aspect of this.

00;07;33;03 - 00;07;54;12
John Riggi
There's others we know that are making money off stolen credentials. So we have the initial access brokers. This is truly a very efficient underground economy all around ransomware where there are multiple components making money off different aspects of the attack. So this is my theory only there's probably some groups said, hey, whatever you can collect from the patients you keep.

00;07;54;15 - 00;07;58;11
John Riggi
And that helps apply pressure to the victim organization as well.

00;07;58;16 - 00;08;32;17
Jake Milstein
Yeah. I mean, rewinding back to that Texas attack on the school district. There was no demand for money from the parents. That was strictly a hey, call the school district and, you know, get them to give us $5 million or whatever the ransom was. This new thing is different. Now, I will also say there's another case in, I believe, the Los Angeles area - plastic surgeon, bad guys got the pictures and both extorted the plastic surgery clinic and demanded $500 per patient from the patients.

00;08;32;19 - 00;08;47;01
Jake Milstein
Now, I will say that is an actual moneymaking scheme. And, John, if you're right, you know, what we're looking at here is these criminal enterprises, and they are enterprises are now developing a B2B wing and a B2C wing. Like this is ridiculous. But that's what we're starting to see here.

00;08;47;03 - 00;09;07;26
Johnathen Inskeep
Yeah. The other thing I would say, too, is when you have a victim called like that, what are they preying upon? The reaction of the victim, right? So as the victim...oh my gosh, they have my information. I'm going to pay the $3. Well, that's a great way for that victim to be victimized again, because you put in through their paywall your information to be able to pay that.

00;09;07;26 - 00;09;22;05
Johnathen Inskeep
Now they have your financial information to take advantage of your debit card, right? So a great way to snag the person once again, unfortunately, it's just a great way to prey upon a person, which is just unthinkable.

00;09;22;08 - 00;09;25;01
Jake Milstein
Are you saying the criminals don't accept cash, Johnathen?

00;09;25;04 - 00;09;29;10
Johnathen Inskeep
I've never got one to accept cash. I would try to get him to do monopoly money once, but he told me no.

00;09;29;12 - 00;09;30;05
Jake Milstein

00;09;30;08 - 00;09;58;00
John Riggi
Wire transfers? No, that's no good. Digital currency? I recently made a provocative comment on social media, in a sense. And I said that digital currency is the root of all cybercrime. And ultimately, if it wasn't for crypto digital currency, it would be much more difficult for bad guys to conceal, transfer, anonymize the proceeds of crime and certainly would take a massive reduction.

00;09;58;00 - 00;10;04;12
Jake Milstein
Yeah. I mean, I think that that is definitely true. I'm not sure I agree that it's the root of it.

00;10;04;12 - 00;10;05;07
John Riggi
They're meant to be thought-provoking.

00;10;05;07 - 00;10;25;20
Jake Milstein
I understand. You know what, I don't know if it's the root of it, but I do think that it brings up an interesting question for folks like it is. I understand deeply that the AHA tells people not to pay a ransom. I don't think people should pay a ransom. Some organizations make the business decision to pay the ransom.

00;10;25;23 - 00;10;47;14
Jake Milstein
And one of the things that folks need to do in building an incident response plan is to come up with, are we going to pay the ransom? Under what duress would we pay the ransom? Would we never pay the ransom? And I will say, if you come to the possibility that you might pay the ransom, think about how you're going to do that before you're in this situation.

00;10;47;17 - 00;11;02;23
Jake Milstein
If you're going to have to buy Bitcoin, how are you going to do that? If you're going to use a firm, how are you going to do that? Again, do not think anybody should pay the ransom. But this is all part of it. I will tell folks, I was in a fascinating tabletop with this guy, John Riggi, who's joining me on this podcast.

00;11;02;25 - 00;11;18;12
Jake Milstein
There was, hospital exec and the hospital exec said, I'm never going to pay the ransom. I'm never going to pay the ransom. John, I don't know if you remember this. And John got to, you know, all your systems are shut down. No, I'm not going to pay the ransom. You're on divert. I'm not going to pay the ransom. 00;11;18;16 - 00;11;26;08
Jake Milstein
And then John said, the criminals have started calling your patients. And this hospital exec said, okay, I'm paying the ransom.

00;11;26;10 - 00;11;46;04
John Riggi
Exactly right. There is a boundary. They know what the pressure limits are to extort these payments. These are equivalent of violent crime extortions. So you know my background, 30 years in the FBI - dealt with a lot of bad guys, including Russian organized crime bad guys, and terrorists as well. They know what the pressure points are, apply pressure to get whatever their objective is.

00;11;46;04 - 00;12;08;10
John Riggi
They claim these are financially motivated crimes, the bad guys, but really financially motivated, under threat of harm to patients, under threat of harm to patients again is why we always say these are threat to life crimes. There is a whole network now. Again, I said a whole industry around how do we creatively find ways to extort money out of the victims?

00;12;08;10 - 00;12;37;03
John Riggi
We extort the patients. We also have data leak sites that if the organization, the victim organization has not reported the attack publicly, the ransomware guys publicize it on their public web leak sites, notifying the government. So they have all types of issues there. Again, trying to maximize pressure on the victim to pay. Again, we discourage payment. We know that ultimately, even the FBI says this is a business decision.

00;12;37;06 - 00;13;01;11
John Riggi
And if patient safety is at risk, that is a consideration of whether to pay or not. Now, the best way is you talked about being prepared. Cyber insurance companies now actually generally come with their cyber policy methodology is to pay the ransom in digital currency. They actually have ransomware negotiators. There's a whole industry on the good side that's developed around ransomware.

00;13;01;14 - 00;13;22;12
John Riggi
So all these things have to be thought out. But ultimately we say, look, just don't get yourself into that position if at all possible. Offline secure backups that are immutable, that you can use to restore, know where your data is. But ultimately, if your data is encrypted, the bad guys can't use it. Even if they get to it, they can't use it.

00;13;22;14 - 00;13;48;28
John Riggi
Quite frankly, I think that there is not enough attention being focused on data mapping and encrypting the data. All these layers of technologies, millions and millions we spend are around protecting data, ultimately to protect patients. So let's start at the bullseye. Let's encrypt the data at rest and in transit. Even the government says if the bad guys get to your data and it's not readable, you don't even have to report it.

00;13;49;00 - 00;14;10;15
John Riggi
So again, let's start with some of the fundamentals and the basics. So speaking of vulnerabilities right? Which lead to these attacks for both of you. So are there common vulnerabilities in hospital systems that you see that cybercriminals, especially ransomware groups, are most frequently exploiting? Maybe Johnathen, you could take that.

00;14;10;18 - 00;14;31;04
Johnathen Inskeep
I think they take advantage of obviously the patient care aspect, right? But what they're finding is a lot of these real hospitals and stuff like that, maybe lack a little bit of direction and don't have the securities in place to be able to handle those type of attacks. And then what happens is that can either come in through a third party.

00;14;31;06 - 00;14;46;09
Johnathen Inskeep
There's a lot of risks that's there. There's a lot on the plate for the hospital, and it just puts them as a prime target, right? They've got all the medical record information there on the patient. They know they can hit a bunch of people all at once. And so it's actually kind of a scary scenario. You're just you were talking about targets.

00;14;46;09 - 00;15;00;25
Johnathen Inskeep
Hospitals are the prime target. And so to try and find a way to curb that, I agree with the encryption process. I also think that you should be following a security framework to help narrow that gap, to be able to identify risk. Yeah. Ultimately you're always going to be a target for the bad guys to hit.

00;15;00;28 - 00;15;23;21
Jake Milstein
And I think there's a basic unfairness here. There's a basic unfairness in that you can do everything that you should do to build up your defenses, and yet the bad guys only need to be able to get in one way. And when you look at that and you look at how they're getting in, it used to be the number one way bad guys got into hospitals was through email.

00;15;23;23 - 00;15;58;01
Jake Milstein
That's no longer the case. So when you look at the HHS data, you know, the number one way that they're getting in is through vulnerabilities and through third parties. What's a vulnerability? So a vulnerability is every time Chrome tells you to update or your iPhone tells you to update or whatever, because there's a vulnerability. If you look at all of the devices, if you look at all of the software a hospital is using, all of them, there are vulnerabilities that need to be patched, and those patches need to be treated as urgent incidents so that bad guys can't get in.

00;15;58;03 - 00;16;21;13
Johnathen Inskeep
And I would add to that, the other thing that's really makes it difficult is you to patch your home computer pretty easy-peasy, right? For some of these hospital systems, for them to be able to implement a patch, whether it's an EHR patch or even just a simple Microsoft patch, it takes a lot of coordination to make sure that that patch doesn't have a profound effect on other operating systems, right?

00;16;21;13 - 00;16;39;13
Johnathen Inskeep
So there's a lot of times that those patching processes take proper planning, like how do we have time to be able to have downtime for the network to be able to restart and implement the patch, do a little bit of testing. And so when they drop, unfortunately, we can't just immediately go run and patch it and come up all good, right?

00;16;39;20 - 00;16;44;11
Johnathen Inskeep
There's a little pre-planning that has to take place which leaves you exposed.

00;16;44;13 - 00;17;16;09
Jake Milstein
And you know we mentioned third party. So I want to break third party vulnerabilities into two buckets. Bucket number one is third party is holding patient data or employee data. And bad guys get it by getting into a third party system. And that's the data theft. The other is the third party has a door into the hospital network, and then the bad guy uses that door to get into the hospital network, and then is able to launch a ransomware attack on the hospital network.

00;17;16;09 - 00;17;22;02
Jake Milstein
Those are two different kinds of third party vulnerabilities, and both are getting bigger and bigger.

00;17;22;03 - 00;17;52;21
John Riggi
Yeah, I agree, and is actually even a couple more. So not only do they hold the data or they are the electronic pathway in because how does that all that data move through electronic transmission, but also that the third party themselves maybe become victim of a ransomware attack, which then disrupts hospital operations? You have some mission critical or as I often say, life critical third party that immediate patient care depends on - is then struck with ransomware.

00;17;52;21 - 00;18;14;21
John Riggi
And the bad guys are strategic and intentional. They know if we hit this particular third party, it will disrupt care in 100 health systems, placing massive pressure on that third party to pay tens of millions of dollars in ransom, tens of millions of dollars in ransom. So and then there's the other third party risk of their technology risk, third party technology that has vulnerabilities in it.

00;18;14;21 - 00;18;21;19
John Riggi
Right? We don't write our own operating system code very often I would assume. We don't build our own medical devices. We rely on third parties.

00;18;21;21 - 00;18;41;05
Johnathen Inskeep
Yeah, absolutely. I can't remember the last time I broke down the code to build something, right? So we have all these dependencies. And I think one of the biggest things centered around that is proper risk identification, right? If you take a third party on for operational purposes, how much do you know about either of that product? Where was that product made, manufactured?

00;18;41;05 - 00;19;01;02
Johnathen Inskeep
What's the risk of it coming into your environment and third parties you work with? Like what's the obligation? How strong is your business associate agreement with that third party vendor? Did you identify things that are related to risk in your environment that you're talking about in your business social agreement? Because I tell you, if you don't have it listed, they're not going to be held accountable for it.

00;19;01;05 - 00;19;23;02
John Riggi
Quite frankly. You know, we don't want to alarm folks too much here, but really it's third party risk management and fourth party. So, who are the subcontractors for those third parties? That should be part of the evaluation. Where are they based? Are they based in the United States or overseas? China's ofering a lot of good deals these days to get into our health care sector.

00;19;23;09 - 00;19;26;26
John Riggi
Unbelievably good deals, related to the Chinese government.

00;19;26;26 - 00;19;28;24
Jake Milstein
We saying that deals are too good?

00;19;28;27 - 00;19;53;23
John Riggi
They're too good to be true, right? As we always say. So take a close look at that. What type of technology are they using? Is that technology vulnerable? Third and fourth party risks? Some of it you can control, some of it you can't. But that's where we have to be ready with that incident response plan that not only takes into account if you are the direct victim, but what about if our mission critical third parties are attacked?

00;19;53;28 - 00;20;05;14
John Riggi
How does that disrupt our operations, disrupt and delay patient care, risking patient safety. And the IT department has no control. Right, Johnathen, your third party gets hit. What do you what can you do about that?

00;20;05;21 - 00;20;23;26
Johnathen Inskeep
No control because you have to function. I think one of the most interesting things was this like our EMR vendor that we had - American company, right? However, when we went to do updates at night with the HR vendor, they were people from India that we worked with. And what was interesting to us is we had a geo blocked on India.

00;20;23;29 - 00;20;41;28
Johnathen Inskeep
So they had to call me and say, hey, we can't connect to your system. Can you make an allowance on your firewall? And that wasn't a risk that we thought we would run into because we're working with the American company that's here in America, and they outsourced their technical deployment out to India. And it was just this astonishing.

0;20;41;28 - 00;20;47;26
Johnathen Inskeep
Like we didn't factor that in when we committed to the HR program. And it's things that hindsight we should have looked at.

00;20;47;27 - 00;20;53;03
John Riggi
Right. And of course, the time you discover that is in the midst of a crisis.

00;20;53;05 - 00;20;54;05
Johnathen Inskeep
Absolutely.

00;20;54;07 - 00;21;26;15
John Riggi
You know, I do a lot of media. Talk to a lot of reporters. I explained to them in these terms, hey, these are foreign bad guys being sheltered by hostile nation-states, attacking us, putting us at risk. They're very sympathetic. They understand and generally do want us want to help by promoting good, accurate information. So just as when we face the threat of terrorism, the media was very helpful to distribute alerts to really show what the impact of these threats are and help folks prevent attacks.

00;21;26;17 - 00;21;54;17
John Riggi
Thank you both, Johnathen and Jake, for sharing your thoughts and insights and joining this podcast with us today. For AHA members, for our listeners, if you would like to learn more about AHA's cybersecurity programs, please visit aha.org/cybersecurity. This is been John Riggi, your national advisor for Cybersecurity and Risk.

00;21;54;20 - 00;21;57;23
John Riggi
Stay safe.

00;21;57;25 - 00;22;06;07
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and write us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.