Name: Building Cyber Resilience in Rural Healthcare: Starting with What Matters Most
Uploaded: 2026-02-25T18:48:05.779Z
Duration: 32 min 8 s
Description: Building Cyber Resilience in Rural Healthcare: Starting with What Matters Most

Transcript for "Building Cyber Resilience in Rural Healthcare: Starting with What Matters Most": Welcome, everyone. My name is Lauren Anderson. I am an industry product marketer here at Rubrik, and I'm joined by my colleague, Brian. You wanna introduce yourself? Yeah. I'm Brian Knutson. I do technical marketing for Rubrik, helping Lauren out on on the vertical side of things, particularly for today's topic, which is health care. Yeah. Specifically, rural health care Yeah. Which, as we know, and as you very well know, has a lot of different, very specific challenges from urban health care systems. So, you know, you have fewer resources, you have more complex care needs with your communities and your populations that you care for, you have more training challenges, you have all these things that are compounding to really cause, I think, a really true crisis in rural healthcare right now. Yeah, yeah, so that's what we're gonna talk about today is to kind of go over what we've been seeing and, you know, lots of news reports and everything we're covering on to give you all a sense of one, you're not alone by any stretch of the imagination, but what we see across a lot of different customers in that space that have been running into these challenges and kind of where the land is right now. We find a lot of people in the rural healthcare space, you know, they got their heads down, they're doing their work, and sometimes don't look up to see that sometimes their stuff is not unique. Their situation is pretty common. Yeah, absolutely. And one of the things that we're really passionate about here at Rubrik, particularly with healthcare, is sharing knowledge and really helping the industry become more resilient because that's something of with our philosophy is if we can stop ransomware and stop the effects of ransomware and the impact it has on patient care, we can all collectively become better. So but when you you really look at the stats and where we are, you can see, like we mentioned, there's there's a crisis happening in health care today. So particularly with rural health care providers like yourselves, where you're operating forty four percent are operating at negative margins, never negative operating margins. You have these closures that are happening left and right. So I think I heard 200 closures in the past ten years and even more than that are at risk of closure. And then you think about the impacts of cyber attacks. So I think it's really critical to understand that the average downtime for health care after a cyber event, seventeen days. Yeah. Which is really scary. It is very scary. And you talk to folks like the American Hospital Association, and they'll say you need to prepare for thirty days of outage, which is even crazier when you think about it. Just reverting back to those manual processes and the effects that those can have when you have folks that maybe they've never seen a manual. Maybe they've never had to do any actual physically writing on pieces of paper and running those to the doctor. There's just so many things that can go wrong in that process. And when you see that, we actually see increases in mortality. We see these direct impacts to patient care. We see, I think, a 30% increase in medical errors. It has a true impact to continuity of care and making sure you can maintain your mission of providing true care to your patients. And when we look at, again, the impacts of that healthcare beyond just the impact to your patients, there's this this really huge financial impact. So you look at a system like Saint Margaret's, which was a health care system in Illinois that unfortunately, after a cyber attack, two years after they were forced to close because of the financial impact that they endured after the cyberattack. And that's not a limited story. There are at least a couple of others where that's been the case as well. You think of the impacts financial impact of cyber events, You have sort of that initial impact Yep. Which is, okay, the ransom payment investigation, you know, trying to set up clean rooms and whatever you have to do to recover. And then you have the long tail effects. Yes. So those can go on for years. So, you know, whether that's, you know, regulatory fines, like HIPAA violations that might impact know, might happen from data exfiltration, whether that's paying lawyers, whether that's, just the reputational impact that comes from patient attrition who don't wanna go to a facility that they've seen this happen to, that can go for years and years. It's really devastating, and that's ultimately what happened to St. Margaret's, and it's something we see across the industry all the time. Yeah. Pretty pretty dire consequences, unfortunately. And for me, it was one of those situations where it's like, they used to not hit health care, but it's become a prime target these days. Absolutely. Yeah. And just to unfortunately add to those additional financial pressures, as everyone is very well aware, recent legislation, We have the Medicare, Medicaid cuts that, again, have a disproportionate impact to rural health care. However, there is a bit of an opportunity with the Rural Health Transformation Program, which some of you might have heard about. We'll talk a little bit about it. But this is a grant program from the federal government. It's being distributed to all 50 states. So all 50 states have applied at this point, and every state is going to have a different process for how rural health care providers can help can access these funds. So, you know, this is really something where for your specific state, you're gonna have to go and kind of understand what's the best way for me to get these funds. And, specifically, I will say that the funds, one of the the core tenets of the program was cybersecurity. Yep. Because I think, the federal government, the industry as a whole recognizes the importance of cybersecurity for, again, maintaining that mission, continuity of care for our patients, and keeping our communities safe. Yeah, and when it comes to these different programs, the federal government has set a certain number of guidelines, and it goes everywhere from hiring more staff and retaining staff in these rural hospitals, which of course is a huge challenge, all the way to things like cybersecurity. So by no means is all of this money going to go to cybersecurity, but it is a big part of the program as a whole and in most of the states as well. So, there is money out there, is the good news. In some places, it will be competitive too, though. In some places, they may not go directly to the hospitals. It may go to government programs that help support those hospitals. It's all over the place, and part of what we've been spending a lot of time doing, Lauren and I and a bunch of others, trying to understand all these different states. What are they doing and and where we can help people like you? Yeah. Absolutely. Okay. So let's, you know, think about the process of recovery after a cyber event. So, unfortunately, from what we know, typically, the event where you're notified, hey. We've encrypted all of your data, happens at the most inopportune time. So you think on, you know, Friday night right before the weekend, they wanna cause as much damage as possible. And, unfortunately, a lot of times, you know, when you are at that point, you realize the gaps that you have in your recovery process and just the complexity that's involved in the kind of the breadth of impact to all of your systems. So in a cyber event, you have the potential for, like, everything to go down. Yeah. And I don't think you know, it's very different too when you think about the difference between, like, disaster recovery and cyber recovery. So in a cyber incident, you don't know what's been encrypted, what's been affected. Like, where is that clean point? When did it happen? And so that lack of understanding creates a trust problem, a trust challenge where you have to know exactly where to recover it from. Or unfortunately, you'll be reinfected, and you'll just prolong that outage. And so that can again, that prolonged outage is that direct impact to both your financial bottom line, to your patient's ability to get care, and even potentially to your patients' lives. So it's critical, critical that we're able to reduce that gap in this this time, this average time of seventeen days. We have to do as much as we can to reduce that. And we think when we talk about cyber resilience Mhmm. And what that means, then, you know, this is something Rupert talks about a lot. It means we know we're gonna get breached. Like, you know, we know that's gonna happen. Unfortunately, it's just a reality. You have to assume that the breach will happen, that you might already be infected. And if that's the case, then it's less about the prevention, and it's more about, okay, we know it's here. How can we mitigate that? How can we make sure that we can reduce this time and impact as little as possible and maintain our operations, critical operations to get to that point of recovery faster. So what is that cyber recovery time objective? How can we get there? Yeah. So, like we've just talked about, with the lack of, you know, the tools, the right processes in place, the ability to find clean and where it is, that means that you can be impacted for weeks and your patients are impacted for weeks. And it's really important that we reduce that as much as possible. And just going back to what I kinda talked about earlier, the financial impacts of a cyber event. So when you think about, like, there was a really great study by Deloitte that was done, I think maybe ten years ago, that looked at the kind of full holistic impacts, financial impacts of a cyber event. And so you kind of have think about it like an iceberg narrative. Right? Where you have the tip of the iceberg, and those are these those immediate impacts. So downtime outages, you have a direct loss of revenue from, you know, directing ambulances to other health systems. You have overtime staffing, and then you have the ransom and, you know, kinda everything that comes from that, the the question, do I pay it? Do I not? And, ultimately, that's something that, you know, every organization has to figure out for themselves. But then you have what's below on the bottom of that iceberg and those downstream impacts. And this is where we think about those long tail impacts, the things that cause Saint Margaret's to close after two years, two years after the cyber event. So, like, you know, do you have to notify your patients? Do you have legal settlements? You think about the impacts to your cyber insurance, so your insurance premiums and how those might increase. You know, the you might have impacts from grants. Like, that could be affected. So and then, ultimately, like, higher employee turnover. There's a huge impact to your staff, you know, during these events when they're having to work overtime. They have this loss of communication, this kind of burnout that happens, and that directly impacts the already strained systems that are trying to hire folks. So all of these just culminate together to have this impact that goes from, you know, maybe hundreds of thousands of dollars to millions, tens of millions, and even hundreds of millions of dollars for some systems. Yeah. So, let's let's talk about if you put those right systems into place and the the timeline that Lauren shared before, the way Rubrik has seen it is when you do these things and and do the proper preparations to prepare for this and be resilient, what that timeline can be. And in our purview, like as much of the stuff that you can do before the event even happens to prepare for the recovery of it, there's actually a lot you can do. Things like identifying where the sensitive data already is, doing things like being able to automate data loss prevention based on that sensitive data, and be able to have all the pieces and parts. Know, it's kinda like for Doctor planning. We all went out there and we said, Hey, we need to know exactly what systems we have. We need that full inventory. We need to know where we're going. We need to know what needs to be brought up, what order needs to be brought up. We did all that planning ahead of time. The same needs to happen for cyber resilience. It is very similar in a lot of ways, but has a lot of nuances, like the alerting aspect of things. You know, the systems go down, you notice, but if you can find that attacker before it happens, then you can be prepared. It's a bit like watching the weather forecast and knowing, hey, that storm's coming and it might hit us. And being able to shrink all these things down by having those types of rapid alerting, already having your isolated environment that you can bring things up, whether that's to do forensics testing and actually let the ransomware kind of run around in your environment so you can watch what it's doing, or if it's to have a known good environment where you can bring up clean systems, which of course requires you to know which point in time, of your backups are going to be clean, and I know from talking to many customers that they spend a lot of time trying to find the clean point. If they don't have something that tells them where it is already, they get in this cycle of, I'm going to restore it. I'm gonna scan it. I'm gonna determine, okay, this one's not clean, shut it down, and then repeat that process over and over again. So, by doing this preemptively, by searching for that ransomware, that malware in those backups as they're being taken, now all of a sudden, you don't have to do that in the heat of the moment when you've got somebody breathing down your neck trying to get that Epic system, for example, back up and running, and being able to do all these things kind of as quickly and automated as possible helps to shrink that down from, you know, potentially several weeks to hours or days, and it's a compound effect that if, you know, I take an extra day, it's not a one more day's worth of financial loss and stuff that happens on that iceberg, it ends up being probably more exponential because things like burnout, you know, are exponential. More they're working, the longer those hours are going to be over a week versus a day is a big difference, And that brings us to kind of the concept of a minimum viable hospital. I know with Doctor planning, that was one of those things that, you know, what needs to come up first? Okay, you need that system. Well, that system's dependent on this system. It's a lot of that same kind of work. It's pretty unique in a hospital situation, though, because you need to think about way more than just the tech stack, much more than just, you know, which servers are up, which applications, which databases are up, because a hospital is a living, breathing building, really. So even things like, do we have enough bandages? Do we have enough towels that are clean? How are we going to clean those towels so that we can reuse them? Those types of things are critical pieces, and obviously, Rubrik can't solve all those, but we like to push our customers to think about that. So like, what's the prioritization of things, and where are the resources to make that happen going to overlap? Are they going to need to use the same facilities people to bring that up at the same time as maybe you're trying to get the environmentals up within your data center? Yeah, and I think one thing that's really critical about the idea of the minimum viable hospital compared to maybe traditional Doctor recovery planning is I think when you're thinking of Doctor, it's about, okay, we wanna have everything recovered. And you might have 400 tier one applications. But in a situation in a cyber event, what we're trying to do is identify what are those core critical applications. So it's not 500. It's not 100. We're talking like 10 to 15 applications that are most critical to maintaining patient continuity of care. And that's where you really have to focus. It really has to be that level of cut. And that is a huge challenge, and it's something that has to be done in concert with a very cross functional team so that you can truly understand, okay, what is really critical? And that's gonna be different depending on every different hospital system. Know, maybe it's your EHR. But what we found at Rubrik, you know, having done this with with different systems, having gone through recovery processes, is that there are a couple of kind of core critical foundational points. And we understand that specifically with rural health care, you do have limited resources. You have limited financial resources, limited resources to implement. And so you really have to be very precise about where you invest your time, your energy, your your your resources. And for us, when we think about what is most critical, it's what's here at the bottom. So, you know, starting with identity. Yeah. If you wanna talk about that, Lauren. Yeah. Totally. Because really what it comes down to is you just gotta keep it's dependency mapping. It's just keep asking, what does the system require? What does the system depend on? And when it comes down to it, your Active Directory, your EntriteD, your Okta, whatever that might be for your identity system is that core thing. That is the thing that if I don't have that system up and running, I don't log into my EHR, and the challenges around identity are getting really bad at the same time as all of this is happening because they are attacking the identity directly. Of course, communications are huge, and if you're dependent on something like Teams or Slack or even just email and those systems go down, how do you communicate with people? This is kind of that basic, like you talked about earlier, Lauren, around how do we go about doing records management? How do we go about giving orders from one department to another? Those types of things need to be considered from a communications perspective because you may not be able to pick up the phone and call. Absolutely. And so, getting that up and going as soon as possible so that you can do communications because communication is where things break down as often as anywhere else. Right, and it's critical during a crisis. Absolutely. How it's working. Yeah, absolutely. So, when we look a little bit deeper into the identity side of things, that is one area where Rubrik is focused, and we're not gonna talk a ton about Rubrik. This is to more kind of introduce where we can fit in, but identity is one of those key places and getting that up and running faster. Most environments have some elements of Active Directory. Active Directory is complex. It is hard to manage. I've done it in the past, and getting it back up and running from nothing is even more complex, and if you have more than one domain in your forest, that's a lot of steps. In fact, the manual we printed out at one point, and it's like a huge chunk of paper to print out the whole thing, and so we looked at automating the whole process. We've been backing up and recovering AD for a long time, but automating that whole process from beginning to end to make sure that they're all coming up in the right order and the pieces get connected is a huge part of the puzzle and something that we have put together in order to help customers with that. On the other side of things with communications, we focus a lot on M365 because we see that use very, very heavily in a lot of hospitals. It is in a lot of corporations too, for that matter. A lot of them are dependent on that, and so being able to pull the data out of there should something happen, if M365 is down and you need access to that file, guess what? I just go log into Rubrik and I'm able to download it from there, and now I've got access to that file again, but being able to restore, for some reason, you have to go backwards in time for both identity and for the M365 to say, Hey, they created an account in here, and we need to eliminate it, and I don't know how many they might've created, so I need to go back in time three days, wherever that might be in order to avoid having that backdoor open. So, it's not just about restoring the data that's clean, the identities need to be restored clean as well, and to bring all that back together. So, to put that in the context of what else Rubrik can do, there's a lot of bits and pieces. We have focused on having some specific product features around EMRs, EHRs, so that you can maintain the policies around data protection on those, because a lot of you are going to be regulated around that. Having stuff for unstructured data so that things like PACS is obviously hugely critical data that needs to be prevented from getting locked out and not being recoverable. A lot of you are moving into the cloud. A lot of you are looking to do all of these new technologies, so we put a lot of focus on having all these bits and pieces that will support you through that based on and including things like anomaly detection, threat monitoring and detection, being able to find sensitive data across all of these different areas because you have sensitive data all over the place. You've got PHI all over the place, and while we may not help prevent them from getting access to that data, we can help you identify what sensitive data they do get access to. You saw a few on the last slide. We've got a whole bunch of healthcare customers that we've helped over the years. A lot of them super happy. A lot of them you probably recognize, and some of these are straight up reference customers for us. So, if you would want to talk to one of these, reach out to us. We can probably arrange a call with many of these, But more importantly, a lot of these are big names. These are the big hospitals, and you may look at this list and say, I don't see a lot of rural healthcare in here. That doesn't mean we don't have them. Rural healthcare tends to maybe not be as forthcoming when it comes to being on a slide like this, but what we show this for is to help you understand like the big organizations see value and find us as a partner for them in their cyber resilience, and it's something that we have focused on. I highlighted too on the last slide, you know, specifically that identity in the M365, one thing Rubrik wants to do to help support all of you in a rural healthcare setting, knowing that you've got the same level of sensitive data as all these big guys, but you probably don't have the budget that they do. And understanding the financial straits of healthcare in the rural setting as it is, we've got bundles that we've put together that can give you discounts to help support you through this, try to make the most of that rural health transformation program money that hopefully you can get access to in your state and be able to utilize it for that. So, lot of us trying to help out is a big thing, and I know Laura and I talk about this a lot. That's one of the reasons why we love supporting healthcare. I have a history with healthcare, and, you know, we're all patients at some point in our lives. We're patients, yes. Our loved ones are patients, so we all have a connection to it. So, it is something that we throw out there as a sales tactic, but it's one of those that hopefully will help you out in the end. So, the question really becomes what outcome do you want out of your environment? Knowing that your budgets are limited, your resources are limited from a people perspective as well, Do you want a cyber attack? Which, again, we all kind of look at it and say, well, it's not a matter of if, it's a matter of when. When it hits you and you're caught off guard, you haven't prepared, do you really wanna have to deal with all of these negatives that are gonna happen that could result in the hospital having to close its doors in a few years? And, you know, nobody goes into healthcare not wanting to help the patients, so, obviously, that's probably the biggest deal for the doctors and nurses and the staff that you would be supporting as an IT department, or do you want to be in a situation where you will be able to bounce back very quickly, to be able to say, Hey, maybe we find it before it explodes all over the place, but being able mostly to be able to say, Hey, once we get to that stage, let's go ahead and put the clean back and be able to find that clean as quickly as possible. It'd very surgical to say, well, it looks like it hit this system at this time or at this day, and it hit this system at this day. So as long as those two don't have high dependencies on data being the same between those two, you can, you know, restore one to yesterday and one to the day before, and be very surgical on that while still being able to do it as an automated kind of runbook type of an approach and have that capability of avoiding the reinfection. And ultimately, the whole goal is to get your environment back up to the point where you can take care of those patients. Absolutely. All right, great. So, well, we've talked a lot today. Yeah. You know, a good lot things that we've covered, but what can you do next? I think first, we talked about the Rural Health Transformation Program. So, again, every state is gonna be different. We encourage you to look at your state, especially your state HHS department. Typically, that's how they're centralizing the information here, but you can find lots of information online and figure out where is your state in the process. So some states are beginning to formulate their plans. Some are gonna be a few months out. But regardless, this is a five year plan, five year program. So we have this here, and this is gonna go on for the next five years. But again, just remember that cybersecurity is a core tenant, and it is in every application to some extent. So, hopefully, you should be able to use some of those funds to invest in your cyber resilience resources. Then second, we talked about a little bit about things like our minimum viable hospital and that preparation aspect. So we think about before state and really just going through the pain of imagining what could a ransomware event look like for a health care system like yourselves. We actually have a free exercise that we do. It's kind of a tabletop experience where we encourage everyone from your health system, so whether the CIO, even clinicians, nurses, this is a problem for everyone, and then you really need to understand how it might impact them. And so we have this exercise. We will do it free for you. Just reach out to us, and we can set up, I think it's a few hours with your teams. And we'll kind of walk through play by play, what does a ransomware experience look like? Like, what is that how is it who does it impact? And kinda it helps everyone kind of understand, oh, wow. This is a problem that we need to solve, and can even kickstart those conversations around, okay, what applications are most critical to patient care? So, it's a great way to get that started. Yeah, and based on real world scenarios. So, we took an actual hospital event and turned it into a story. You know, names and situations were redacted to protect the innocent type of thing, but it gives you that ability to just, you know, sometimes those connections within the org you don't ever think about, like, hey, guess what? The compliance team's gonna show up, and they're gonna have some really tough questions for you to deal with. Are you prepared to answer those? All happened with this in the context that gives you a lot of time to discuss as a team about how you would react and maybe figure out what those gaps are right there in the room. Yeah. Absolutely. And then the last thing, we talked a little bit about some of our capabilities. So specifically, again, those tier zero, what we see as kind of the most critical things to maintaining that baseline of care are identity recovery and communications, so primarily M365. So we have a lot of great resources on our website. We encourage you to take a look at them. Some different great demos that I think Brian himself put together. Some of them, not all of them. But definitely encourage you to check those out as well. And both Brian and I are also available on LinkedIn and other places if you wanna reach out as well. Definitely. So lots of resources out there. We kept it limited to try and help you focus because we know that is one of the big challenges. So kind of three different avenues you can go down to learn a bit more. We'd love to help out wherever we can. The zero hour is not associated with customers. It's not a pre sales activity. It is something that we will do for places that wanna do it, and you can look at our website. We've got a lot of those that are ongoing all the time, so I was in Denver at the 2025 to do one of those for the Denver HIMSS chapter, So a lot of lot of possibilities are out there. Yeah. Absolutely. I think, ultimately, we'll close with, hey. We're here to help. Yep. We understand that rural health care is really under a huge amount of pressure right now with limited resources, financial, cybersecurity, otherwise, and we're here as a resource. So please reach out, and we're happy to kind of share our learnings. We have lots of other great resources from you. And, yeah, just reach out if you need anything. Yeah. Thanks, everybody. Appreciate it.