As ransomware attacks become more sophisticated, the traditional defensive perimeters of healthcare cybersecurity are no longer sufficient to guarantee patient safety.

For Healthfirst Inc., New York’s largest not-for-profit health insurer, protection has evolved from blocking attacks to ensuring rapid recovery through rigorous data classification and immutable backups, according to Latesh Nair (pictured), global product head for security and data at Healthfirst. That means mapping access to data, especially protected health information and personally identifiable information, before layering on the controls that make recovery possible.

“The first thing we do is identity and access management, which is who has access to what type of data sets, and that we call [the] access management layer. The next one would be more in terms of the data access layer, which is who has access to the sensitive data,” Nair said. “Then the third step would be all these things should tie to the compliance and the regulations — does it have the right retention policy? Does it have the right backup policies? Can you have the log management, can we do the audit process?”

Nair spoke with John Furrier for theCUBE + NYSE Wired: MedTech Unplugged: The Future of AI in Healthcare & Life Sciences interview series, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed resilient healthcare architectures amid rising ransomware attacks.

A roadmap for healthcare cybersecurity

Resilience starts with understanding critical applications and tagging sensitive data, Nair explained. Once data is classified, the focus shifts to ensuring it can be restored without corruption following a breach. As part of that effort, Healthfirst has turned to Rubrik Inc. to strengthen recovery metrics.

“We also make sure we have the right technology. Rubrik is the right technology that we are using today to support immutable backups,” Nair said. “The tool and the technology needs to be there to support that part of the [key performance indicators].”

This layered approach requires balancing rapid innovation, such as the use of artificial intelligence, paired with strict governance. To stay ahead of fast-moving threats without slowing the business, Healthfirst is now formalizing cyber resilience as a proactive discipline with its own team and roadmap.

“We are creating a team of cyber resiliency just to understand what … needs to be done,” Nair said. “More like a proactive versus reactive [approach], and then trying to build a whole roadmap around that.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of theCUBE + NYSE Wired: MedTech Unplugged: The Future of AI in Healthcare & Life Sciences interview series:

Photo: SiliconANGLE