Security Confidential S3 E2 Chenoa Moss

Manoj Tandon: Hello everybody and welcome to another episode of Dark Rhino Security Confidential. This week we are honored to have Chenoa Moss join us. Chenoa is a gifted IT professional. She’s been in the business for many, many years. She has worked at a plethora of healthcare companies as an expert in healthcare IT and compliance. Welcome to the show, Chenoa.

Chenoa Moss: Thank you. Thank you for having me, Manoj. I’m glad to be here.

Manoj Tandon: You know Chenoa, one thing when I was reading about you a little bit, I was surprised to learn that you have a degree in Industrial Systems Engineering, so it was all databases and process control type work.

Chenoa Moss: I was already a nerd, and that’s what gave my friend for what I knew, right? My idol growing up was my cousin Angela, and she was a paper science engineer. So I wanted to be an engineer, really. And you know, one thing I’ve noticed is that a lot of engineers move on. Engineering is a degree that you can turn from one thing to another, and I’ll leave it at that. If you have a degree in engineering, you can do whatever, pivot anywhere. My cousin Angela is actually a high-level HR professional. She does a lot of union negotiating and HR management leadership for large corporations. She’s worked all over the country.

Manoj Tandon: So, talk about a pivot coming to healthcare. Heck, this last year, 2020, is somewhat unexpected. It has been a year. I’m curious, what have you seen as an impact, other than the obvious where the emergency rooms have been overrun and we’ve had very unfortunate people get very, very sick? But in terms of the system itself and the process of healthcare?

Chenoa Moss: Healthcare as a whole has been so deeply impacted by this, and not all in a bad way, truly. If you look around and you think about what’s been going on since the beginning, I was away for what was supposed to be the HIMSS conference the first of March this year, and they canceled HIMSS. I came back home, and then immediately I started seeing the impacts of COVID because we were having daily meetings to talk about it. We were planning how we were going to manage it, how we could help flatten the curve. We were meeting with the state and helping to do planning. We were doing different analytics that we’ve never done before. Of course, I work in analytics. That’s my favorite thing in the world, doing data. So, there were things happening in healthcare across the nation that never happened before. We were looking at giant companies that have always been the snails, they’ve always been behind, doing amazing innovation just out of necessity. Necessity is the mother of invention. And as we realized we’re going to need more ventilators, we’re going to need a different way to do staffing, we’re going to need different ways to do payments, all of this innovation was happening through the payers, through CMS, the government, and so healthcare professionals had to follow suit.

Manoj Tandon: Can you give us some examples, like any innovations that you saw happen that just stick out to you?

Chenoa Moss: Well, the things in the news that I think everybody saw, I suppose. Battelle Industries worked with OhioHealth. A couple of doctors that worked both at OhioHealth and worked together, and lived together—they were married to each other—came up at dinner with an idea to recycle the N95 masks. So their employer hooked them up with Battelle, and they were able to do an original, first-time-ever method to cleanse and recycle these masks, and they’re doing it for the entire state and other facilities as well, as I understand, at Battelle.

Manoj Tandon: And that has a very material outcome for a lot of people, and that’s wonderful.

Chenoa Moss: Well, they were running out of masks, right? There weren’t any to be had, so we had to figure out a way to use them again.

Manoj Tandon: Now, you mentioned you do a lot of work in analytics. Is there anything on the analytics side that changed that is noteworthy? Anything with demographics or people, or things that you noticed that might not have been noticed?

Chenoa Moss: Well, there has been a focus much more, I think, on demographics, for sure. But we’re looking more at folks who have needs at home. We’re looking more at the holistic person. We don’t just need to know it’s a male or a female of such and such age and they have X, Y, and Z health risks. It’s more than just the risks. It’s what kind of support system do they have? Are they able to take care of themselves at home? Do they have proper heating and ventilation? When you have a respiratory issue, those things matter. And so it became more focused on the different needs of any kind of variety of patients, not just a condition. It’s managing at the patient level. It’s very patient-centric. It’s something we’ve been trying to do for years, and this brought it front and center.

Manoj Tandon: So that sounds like that’s a very good thing, to look at an individual very holistically. Do you think that change is going to be permanent?

Chenoa Moss: I do. I feel like we were already trying to get there, and this just accelerated it. This just accelerated the entire effort. So we are doing more patient-centric work and different ways of managing because some people just heal better at home. So we’re sending them home when we used to keep them in the hospital to make sure that we could take care of them. We’ll send them home and send a nurse to visit, or we’ll set them up with phone calls from nurses and hardware. We’ve got all these wearables now. We always talk about, “How can we use these wearables in what we do?” Well, here it is. We can monitor while people are at home healing, and we don’t have to drag them into the hospital and cause all that additional stress. A lot of people are very stressed to be away from their home.

Manoj Tandon: And you know what, anecdotally that makes a lot of sense. I mean, people are much more comfortable at home, right? Not in a hospital environment. And if you’re surrounded by people and things that you really like, I would have to imagine that there’s a psychosomatic component to this, where you might respond much better to whatever therapy is being offered. Again, not being a doctor, I can’t really know if that’s true or not, but intuitively it makes sense.

Chenoa Moss: And we’re doing it together, right? So this is the first time that I’ve seen coordinated efforts among folks who should be competitors, both providers and payers looking for solutions to make the patients better. At any possible turn that they can find a solution, they can work together, and they can save a life or improve a life or help someone to have a better quality of life. They’re doing it together. It’s a coordinated effort, and it didn’t use to be that. As I mentioned, the innovation has been fabulous. I’ve really appreciated what I’ve seen this year.

Manoj Tandon: That is fantastic to hear. And it’s fantastic at all levels, because the patient outcomes are going to be better. I gotta believe that at some point it’s greater efficiency, so somewhere cost gets impacted in this entire cycle. I don’t know where.

Chenoa Moss: Oh, it’s hugely impacted. You’re correct. One of the first things we had to do was figure out how to get paid. There were some executive orders from CMS, from the President, and from the ODH that helped us to find ways to facilitate keeping cash flow while patients weren’t able to come into offices, or were trying to avoid keeping them in or having surgeries. We’re trying to keep everyone safe at home, right? So the entire industry had to find a way to cope with that, and it started all the way at the top with CMS, and that ran downhill to all of us. There were new ways to diagnose, to write diagnoses, because it’s a new disease. And then you had to have a way to bill that, and you had to have a way to code that. And of course we have to have ways to track that down the road. We’re going to be analyzing this for years and decades to come because it’s a pandemic, and how long since we had one? 1918.

Manoj Tandon: Prior to COVID, many healthcare providers had telemedicine. Everyone was dabbling into it, and I think it’s become a big thing now. Do you see that having a permanent major change in how, at least, you’re working with your primary care doc? That we may not need to go in as much when we come out of this pandemic, and we may be doing much more presently?

Chenoa Moss: I’ve had an appointment with my provider two times this year. One was in person and the other was a televisit. And I can tell you from that experience with that provider and other experiences of what I’m seeing and talking to colleagues across the country, we are wishing that we would have a permanent solution with it. We’ve always wanted to use it more. It’s more of a time saver; it’s more cost-effective; you can have more people seen by the doctor, so it helps you care for more patients who need to be cared for. But the reality is it’s hard to get the patients to want to do it. The patients don’t want to do a video conference, or a teleconference, or a FaceTime with their doctor. They want to come in and see their doctor. And so the reality is it’s up to the patients whether or not this goes on forever.

Manoj Tandon: See, I had the polar opposite thought, because I needed a few things, and for me it was so easy. Got on the iPhone, scheduled an appointment. There was no waiting in a waiting room, no meeting other sick people, no filling out long forms. Everything was electronic and done. I mean, I would have it no other way. I think it was pretty darn cool.

Chenoa Moss: A lot of us feel that way. I appreciated it, and it’s not who you expect. Some folks might say, “Well, the older folks, the Medicare people, they probably aren’t interested in it.” No, they’re the ones that want to stay home and use their phone right now. They don’t want to come in; they don’t want to get out and risk themselves. You’re finding younger people are now saying, “Well, I don’t want to televisit; I want to see my doctor,” and we don’t know the reasons behind that, right? So it’s all a lot of research, a lot of digging, a lot of studies that still need to be conducted, but we’re going to keep offering it and we hope people keep using it.

Manoj Tandon: I hope it becomes a thing, personally. I think it’s a fantastic way to deliver service. Now, let’s switch to a slightly different topic here, and that is HIPAA compliance. It’s something you’re probably intimately familiar with. In this era where you’re talking about all these folks coordinating efforts with one another, has HIPAA been a detriment to that, or has it helped?

Chenoa Moss: I think that people have a skewed view of what HIPAA is. I think people look at it as the Privacy Rule mostly, but more recently, in the last couple years, the interoperability rules have come out. As of November they started to take effect, and some more in January, and there will be more in February. We’re having a lot of new laws out of HIPAA—they’re HIPAA regulations—that are actually facilitating this kind of care. So more data sharing, more openness between providers and payers. A lot of supplemental clinical information that a payer doesn’t get on the bill is going out. A lot of payers are sharing information back about how providers are performing, how they compare to benchmarks, how they compare to their peers, and helping them to do a better job of managing their patients. All because of this opportunity through interoperability to share information, to share test results, to share different diagnoses, and get a better idea of the risk that each patient is under. Everybody has a risk score, and you know, “What do they need? How bad off are they? How much better could they be?” And you can see improvements and declines in their health through these scores because you have the information available.

Manoj Tandon: HIPAA has helped with interoperability?

Chenoa Moss: They definitely are. There are standards that help the data transfer more effectively. Of course, bills have always been the X12 standards. So when you’re sending out a claim and you’re getting your remit back, they’re always in the X12 standard. But a lot of the file transmissions have been flat files. The more that they establish the interoperability standard, the more that folks are using C-CDA and CDA and transmissions that are more modern but also more secure. Everybody thinks about HITRUST when they think about security, but HIPAA does a pretty thorough job of specifying that data needs to be encrypted when it’s stored, and data needs to be encrypted when it’s moved. There are not a lot of rules, but a lot of good guidelines there. And so folks that are in healthcare today, they all follow HIPAA. HITRUST is another story altogether.

Manoj Tandon: Well, you know, we at Dark Rhino, about 20 percent of our customer base is healthcare-related. That’s pretty significant. It was not by design; it just actually happened that way. One-fifth of our entire customer base comes from healthcare. In that, they are all supporting operational functions in healthcare. There’s only one group of physicians; it’s probably our smallest customer, a wonderful group of radiologists where we help them with securing the transfer of patient information that they need to share. Radiologists, I guess by definition, need to share a lot of things, right? Whether it’s MRIs, X-rays, or what have you. But yeah, 20 percent, and a lot of them are younger companies. It seems like a lot of them want to pursue HITRUST. And from what we have seen, Chenoa, it’s an extraordinarily expensive exercise to go through a HITRUST qualification.

Chenoa Moss: It is, and it’s not necessary for everyone. This might just be my opinion, I don’t know, but I feel like I’ve talked to a lot of other folks who are in information security that share my views to some extent, if not completely. HIPAA is pretty strong regulation already for healthcare. We have what we need in place if we follow what we’re expected to do in the guidelines in HIPAA. And financially and otherwise, if you’ve got SOC compliance and Sarbanes-Oxley and all these things, if you’re following all of those rules, you’ve already got a pretty good start on HITRUST. HITRUST is just documentation, more or less, that proves that you’re doing what you’re supposed to be doing. In healthcare, you know how they say, “If you don’t write it down, it didn’t happen.” HITRUST is a lot more of that. The people that I would think should focus on HITRUST aren’t really healthcare facilities or even payers—it’s not the people sharing information per se, it’s the people transporting it. So if I was to start a new startup where our purpose in life is to sell our software to a payer or a provider to facilitate any of the operations that are surrounding the transport of patient information in their data, I’m going to be what they call a BA, or a Business Associate of those folks that I’m working for. Now I am obligated to meet the same set of requirements that they are, but also I’m doing it on their behalf, so there are more rules around that and what is necessary for a BA than I think there are for the actual people who need the services. Those are the people I feel like should be seeking HITRUST. If you’re writing software and you want people to buy your software, there’s a better chance that someone like me, a consultant, is going to recommend your software if you can get that HITRUST certification.

Manoj Tandon: But a HITRUST certification doesn’t necessarily imply that you are more secure.

Chenoa Moss: No, it’s implying that what you have documented, you have the proof of following, and it gives you a framework to follow to get there, right? And it’s not something you want to do alone. Don’t try to do HITRUST all by yourself. Actually, the first step of HITRUST is to have a third-party audit. So before you do anything, you’ve got to hire somebody right off the bat to tell you how you are performing against the standard as it stands, and give you a roadmap to get you from Point A to Point B, to resolve everything that’s missing—usually documentation or processes or procedures—and get yourself certified. There’s always a roadmap of stepping stones that you have to follow, and everybody’s situation is different.

Manoj Tandon: We’ve got at least two clients that are going through it right now, and it seems like it is a multi-year undertaking for them. And it’s had an impact on us as a security provider to them. We are being obligated to follow certain things as a fallout, and none of those are really out of the ordinary because for our SOC 2 requirements, we’re following those standards to a large degree anyways, and we have to meet SOC 2. It’s a check in the box that we have to have as a cybersecurity company, right? But still, it does have flow-down. It absolutely does. Some vendors now are actually using that as the basis to write a letter or report that certifies you in HITRUST. So that’s a great stepping stone to jump off with. Do you still have to go through a complete HITRUST audit?

Chenoa Moss: The audit is mandatory. There’s always going to be an audit. And not just one, right? You’re going to have to come back and do audits. I believe it’s annually. But yeah, the audit is step one. You have to do the audit so you know what’s needed. And maybe the first thing they tell you you need is, “Oh, you’ve got a SOC 2? Well, you can use that to address these three things,” and there are all these other things that you still have to take care of. A lot of them are physical controls. I’m always surprised to find that folks have a lot of good policies and procedures—they’ve got HIPAA written into everything that they do—but you walk down the hall and the door’s open to the wiring closet, or the front door. People can just walk in and go straight back to the office; they don’t have to sign in. All these things are part of HIPAA that folks don’t think about, but in HITRUST you’re forced to reinforce those efforts and make sure that you double down and secure everything, both physically and electronically.

Manoj Tandon: When we look at the breaches just in this past year, there’s been some significant health systems that have gotten breached. And I know some of them, and they are compliant with so many different standards. We don’t always see that there’s a strong correlation between, at least, cybersecurity and the level of credentials that you hold from a compliance perspective.

Chenoa Moss: Interesting. I’ve seen a lot of healthcare organizations where there’s a reason they don’t have their own IT. If they haven’t got IT, there’s a large segment of customers who don’t even think about those checkboxes, right? So they’re reading the law and trying to comply with the law the best they can. Some of it’s vague, some of it’s clear. The encryption levels are changing. New things are being developed. It wasn’t C-CDA or CDA before. It was all we had was HL7, and we’d do some ADT transfers and call it a day. But now, we’re adding more elements of data and we’re adding more attributes of people’s lives, more facets of their lives. The social determinants of health are out there, and that’s going to help us get a long way towards all the analysis we’re going to do after all this COVID stuff is over.

Manoj Tandon: But you know what? Surprisingly—well, not surprisingly—healthcare records that are stolen are worth a lot more than just an identity.

Chenoa Moss: Oh, absolutely. Yes, absolutely. And that’s been a big deal this year. I assume you’ve read, since you’ve got 20 percent of your clients in healthcare, that there’s been a lot of ransomware attacks. People are primed for it right now because a lot of the workforce is working remotely, like we are today, right? So if you’ve got suddenly a remote workforce, hopefully you’ve got everybody coming in over the VPN. You’ve sent them home with their computers that already have encrypted hard drives, and you’re connected full-time to the VPN or you’re not connected, and you’re secure and safe in that manner. But then also, too, when they’re doing these phishing attacks, they use the tools people are already familiar with. You just started using Teams at one place, and that place that uses Teams is realizing, “Oh, we get all these emails from Teams.” If I’m a hacker, I’m going to send you an email that looks like Teams, right? And it’s going to be an easy way in because you’re going to click on it and think, “Oh, I’ve got a message from so-and-so,” and I click that and it’s going to take me to it, but instead it makes you sign in and it stole your credentials.

Manoj Tandon: And we often talk about how one of the largest security assets an organization has, which is often underutilized, is its own employees and its own people. We feel like if those folks had a much larger awareness, without adding any more process and controls, you could become a lot safer.

Chenoa Moss: That’s true, and that’s why one of the things you’ll find in any HIPAA audit is it requires at least annual training for all of your employees to remind them of all the rules that they need to follow—minimum necessary and things of that nature—to protect the data for their patients. It’s an annual retrain. You need to keep checking in and getting that certificate every year.

Manoj Tandon: We think there’s a lot of room for improvement, at least on the cybersecurity side, from what we’ve seen in healthcare. It seems like there’s—and rightfully so—a lot of focus on patient care. But when it comes to cyber, it’s more of a, “Let’s do enough.” But if we’re not at the pinnacle, then that’s okay; we’ll accept the risk.

Chenoa Moss: That’s the first place the budget cuts go, isn’t it? “Let’s see what we can cut out.”

Manoj Tandon: Yeah, it is. Thanks for saying that. I didn’t want to go there, but you’re right. If it comes down to a new X-ray machine or putting in a better cybersecurity program, cybersecurity is going to lose.

Chenoa Moss: Up until now, I think that’s true. I believe that the recent ransomware attacks are putting a bigger spotlight on it. I feel like when I talk to colleagues both inside and outside of healthcare—former colleagues, folks I’ve worked with all across the country—it’s starting to be something they take notice of. They’re not just saying, “Oh, it’s just another virus.” It’s a big scare because it’s taking operations down. You’re hearing about whole health systems with a dozen hospitals or more unable to function, unable to use their software to take care of their patients. It’s risking people’s lives, and that’s not something we can tolerate.

Manoj Tandon: Yeah, we had that episode in Germany, right, where the hospital had to send patients to a different institution because they couldn’t access their systems. But is there also then, Chenoa, not a backup there—not of electronics, but back in the ’70s where there were files and folders color-coded?

Chenoa Moss: Backup procedures at every facility I’ve ever been in. There were backup procedures for if the system goes down. I’m not sure what was happening at the facility you mentioned, and I haven’t talked with those folks. It would be interesting to do so. But there are always backup procedures for when the system’s down. There are always planned outages to maintain the system, and everybody has to know what to do while the system’s down. Hospitals are 24-hour-a-day operations, so we need to know every step of the way how to take care of things and keep things moving to care for our patients. We can’t just sit back and say, “Well, when it comes back up we’ll figure it out,” or, “We’ll document it later.”

Manoj Tandon: So there’s still a place for paper manual trails, if you will, of information. That’s still possible and they exist; they haven’t been completely eliminated?

Chenoa Moss: Not completely. In fact, I’ve seen providers who still completely document on paper.

Manoj Tandon: I don’t know if there’s anything wrong with that. I mean, it’s kind of hard to steal the file folder, unless they’re driving around breaking into the place. You can’t really get at that data, right? And that’s the one thing about cybercrime that has become so prevalent—people have realized it’s easier to commit. You don’t have to leave the safety of whatever comfort you live in to commit it. It’s very lucrative, right? You can make a lot of money with a little bit of effort—not too much effort, unfortunately. And three, you’re not going to really get caught because a lot of this is being perpetrated by people overseas, and there is no jurisdiction for our law enforcement to go over there and do anything about it.

Chenoa Moss: And some of them aren’t doing it just electronically, either. These phone calls—these spam phone calls we get now—are very dangerous. I’ve seen reports of two-factor authentication where the second half of the authentication is a phone call to your cell phone. I’ve seen those as a hack mechanism as well. So watch out for that.

Manoj Tandon: There are some other problems with two-factor authentication, which I won’t talk about on the air. I don’t want to give anything away. But I will say this: when two-factor authentication is done correctly and it’s done properly, it brings a great deal of security to where even three-letter agencies can’t really bypass it simply. The key is if it’s done right, right? And the policy enforcements around it are done right.

Chenoa Moss: That’s just the way it is in the wrong process for everything.

Manoj Tandon: Yes, there is. And you know that better than anybody else, being so familiar with processes.

Chenoa Moss: Well, before I was in healthcare, I jumped to healthcare from pharmaceuticals. Talk about being regulated—the FDA does not lift a thumb for anyone. So I learned a lot of practical utilization of testing, tracking, and documenting from that experience. The FDA validation processes for pharmaceuticals and for food services are very meticulous, detailed processes, and they leave nothing to chance.

Manoj Tandon: And do they do a great job of enforcing?

Chenoa Moss: Very much so, yes. Or the FDA will come shut you down.

Manoj Tandon: Several years back, there was a company out of Cleveland that actually did get shut down. It was a pharmaceutical company—I can’t remember the name. They were publicly traded, and their stock was even doing quite well, but somehow it came out after the fact that the data was manufactured.

Chenoa Moss: There’s a whole book about that. Bottle of Lies, I believe is what it’s called. It’s about an entire industry of generic drugs that were trying to make a nickel off of everyone, essentially. Starting with the AIDS scare and manufacturing data to get past, so that they could sell their non-functioning medical supplies and drugs to unsuspecting countries. Whole countries. Read Bottle of Lies—it names every person by name. It’s very detailed.

Manoj Tandon: Wow, I’ll have to do that. In cybersecurity, one book I always refer people to is The Perfect Weapon. I think it’s a great book if you haven’t read it. It’s a good read; it’s an interesting read. It talks about how cyber is a perfect weapon, and I would tend to agree. I mean, you think about it in terms of the most asymmetrical weapon ever created. You can disable a nation like the United States, and you don’t need tanks, and bombs, and machine guns, and nuclear weapons to do it. I got to ask you, what do you think the future is for healthcare IT in 2021? What do you think are going to be the big things? Do you have any insights you might be able to share?

Chenoa Moss: I think that we’ve mostly learned that we can innovate so much more rapidly than we ever imagined. Some of those things that we used to say were a nine-month project or a two-year project, we’re going to start rolling those out more quickly. I think that leadership has taken notice, and they realize that they’ve been making cuts, maybe in the wrong places in some instances. And I think that different facilities are going to start leaning harder on IT. They’re going to start leaning harder on the data. They’re going to start looking for better solutions, creating better solutions internally. They aren’t just going to be “buy”—there’s going to be more “build.” We’re going to go back to more of a build mentality, I think. More AI, more software-driven analytics, more of everything that is all the stuff that you and I worry about keeping safe every day.

Manoj Tandon: That is actually a very positive note to end this discussion on. Chenoa, thank you for joining us today. Really appreciate it.

Chenoa Moss: My pleasure, thanks so much.