From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Tom McKay

itbrew.com

Photo of a doctor and nurse looking at a patient chart

Hundreds of legacy IT systems responsible for monthslong outage at UK hospitals, report finds

Old cooling equipment, convoluted legacy systems, and poor planning led to a two-month IT outage at London hospitals, according to an investigation.

Toilet with a medical cross on the back with binary code in front of it on a dark background

Health Tech

Healthcare Brew covers pharmaceutical developments, health startups, the latest tech, and how it impacts hospitals and providers to keep administrators and providers informed.

Healthcare Brew delivers the latest news and trends in healthcare.

healthcare-brew.com

Healthcare Brew

HCB: Systems with Heart

About the Event

Speakers

Questions?

Healthcare’s Checkup: Building Systems with Heart

Digital Health Compliance Embed

IT Solutions Powering the Newest Era of Digital Health Compliance

Billy Hurley

Nasim Eftekhari thinks healthcare could use a few more data engineers—the kinds of professionals who know how to work with the predictive models supporting California’s City of Hope medical center, where she oversees applied AI and data science.

With the help of AI, City of Hope patients can be continuously monitored for surgery complications, like sepsis or infection. The analytical models pull from the facility’s electronic-medical records system, known as 

“These models are continuously monitoring patients, and if there is a risk, if there is something that needs to be done, there is a notification that pops up inside Epic, in a physician’s working environment, and they get to take action,” Eftekhari told IT Brew.

While some AI applications are already in effect at City of Hope, other “moonshot” ones are in the works, like using models to closely watch cells for early signs of cancer.

Whether moon-bound or Earth-bound AI, Eftekhari told IT Brew about the AI-specific skills that are in demand—and how to acquire them.

The responses below have been edited for length and clarity.

Do any IT-specific responsibilities emerge or change as healthcare environments add AI?

When we start developing a predictive model, we work with our IT partners to find where this data lives…For example, the data that is coming from devices in the ICU. It might be on a server somewhere. How do we reliably get access to that data? We do a lot of coordination in terms of data engineering interfaces. For a lot of our models, we need to read from Epic in real-time.

As healthcare environments become more AI-equipped, what IT-specific skills are most in-demand

I personally believe you have a lack of data engineers in healthcare. Having data engineers and machine-learning engineers to take care of that entire pipeline, going from data to information to insight back into physicians’ or care teams’ working environment—I think that is something that is not there, right now. We had to develop this whole pipeline in house ourselves.

Another thing that is very sorely needed is 

—in all industries, but especially for us…How do you make sure that these models are being retrained on a regular basis, making use of the most recent data or maybe tossing away data that is not very helpful anymore?

Where do you enhance your skills in these fields?

There’s a lot of good online resources that are available for free, or very little cost, on platforms. On Coursera, for example, you can get a specialization in data engineering. There are many machine learning engineering courses. A lot of these skill sets are in common with software engineering.

If you’re talking to younger people, these courses are now being offered in computer science and maybe computer engineering [programs]. There are data-science-specific masters or PhDs now emerging in universities.

What’s the most exciting possibility to you for using data and AI to support healthcare environments?

My professional dream is to contribute to extending world-class healthcare to less privileged individuals through technology…If AI could collect all of the data based on all of the historical data of the patients in the US and how they were treated here, and could recommend, for example, the treatment plan, I think that would be amazing.

An African-American doctor is helping a female patient in a yellow sweater read through a form.

As AI emerges, healthcare seeks data engineers 

While AI can quickly answer questions, a good old-fashioned human IT pro is still required to connect the right data to analytical models.

We all know that one show-off in college whose favorite prerequisite was, for some reason, organic chemistry II. Luckily, Cardinal Health’s Jerome Revish’s class of choice might be data-related, if he had to pick a course at “Digital U.”

Data, after all, powers many of the advanced gadgets he’s tasked with supporting, as senior VP of digital and commercial technologies at the Ohio-based healthcare services company.

The AI tool CORE, for example, relies on clinical and socioeconomic information to spot at-risk patients. Another 

-sounding device, VIPER, automatically matches cancer patients to clinical trials.

Cardinal-delivered classes like “A Beginner’s Guide to Data Analytics” exist alongside presentations in data literacy and data strategy—all offerings in the organization’s Digital U. Created in 2020, the collection of seven “colleges” includes emerging-tech topics that illustrate the changing healthcare environment, like cloud, information security, and analytics.

“In this evolving talent market, it’s important for us to continue to find ways to upskill and rescale. Because [of] the time that it takes, and also the cost that it takes, to go acquire new talent in a demanding market right now, you just can’t get talent fast enough to be able to keep up with competition,” said Revish.

, at least 6,000 employees have completed the company’s “Digital Fluency” program.

 report, professional-services firm Deloitte noted that many organizations today offer development opportunities like mentoring and rotational programs, “to create fresh talent instead of fighting over a limited supply.”

“IT shops have been chasing after the mythical ‘10x engineer,’ these 

 who can do all the things. Well, the problem is they spend so much time looking for the person, and then if they ever find them, they pay so much for the person, that here's the rub: The average emerging technology lifespan right now, per our research, is down to two and a half years,” Mike Bechtel, Deloitte’s chief futurist, told IT Brew.

The technology healthcare environment is certainly changing quickly, thanks to the arrival of data automation and cloud services. Chatbots increasingly 

. Electronic health records are frequently moved to the cloud.

New York-Presbyterian (NYP) Hospital uses AI-based technologies for a range of activities, from monitoring fetal heartbeat tracings to filtering phone traffic.

“[AI] has helped us see: What percentage of calls coming in are about scheduling? What percentage are about directions? What percentage are about our services? And it helps us structure our teams and business accordingly,” said Rick Evans, SVP and chief experience officer at NYP.

More than a century after clever medical professionals first thought to place medical schools next to hospitals, Peter Fleischut, chief information and transformation officer at NYP, sees the value of a new combination.

“Now, what we need to be able to do is put computer science experts and physicians together so that we can solve the next series of problems that we face in healthcare…That is going to be the new skill set that we’re going to need moving forward,” Fleischut told IT Brew.

Tech learning and medical learning: on one campus.

Do you work in IT or have information about your IT department you want to share? Email bill@morningbrew.com.

AI 101: How healthcare employees are upskilling as hospitals upgrade

A ‘Digital U’ offers employees a chance to learn about AI, cloud, and other technologies becoming increasingly important to today’s hospitals.

Eoin Higgins

French health IT firm Withings made a splash at CES ’23 in January with their U-Scan urine analyzer—but the product, which transfers personal medical information to the cloud, has raised questions about health data security.

U-Scan is a small, flat, circular device that sits in your toilet bowl. It analyzes your urine and sends that information to a medical cloud run by a third-party partner in Europe, 

It’s that transfer of information—sensitive health information that could reveal private information about the patient’s personal well-being—that puts the data into a digital space where it could, potentially, be hacked.

Julius Dewavrin, a product manager at Withings, told IT Brew at CES that the company takes security seriously—not just for U-Scan but for its other medical products, like its scales and blood pressure monitors, as well. In 14 years of operations, Dewarvin claimed, Withings has never been shut down by a hack, attributing this to the work of the company’s IT department.

“We are audited on a regular basis to check if all data is safe and secure,” Dewavrin said. The data is also encrypted, he added, and not tied to a user’s name or identity.

 While it’s possible that a hacker could penetrate Withings, Dewarvin believes that’s unlikely.

“Many global companies are attacked on a daily basis,” Dewavrin said. “The team is prepared for the better or worse attack.”

Questions surrounding health data come from a real uncertainty on the part of consumers and providers alike with respect to protections, according to Jon Moore, senior VP and chief risk officer at health IT security firm Clearwater.

“You’ve wandered into a bit of a gray area in terms of data privacy and regulation in the US,” Moore told IT Brew. “Most people in the US assume that their data is going to be secured, in particular data associated with their health.”

The central issue is that the Health Insurance Portability and Accountability Act (HIPAA) is supposed to protect your health data and provide privacy protections. According to Moore, however, there’s a fundamental lack of understanding over what the law actually applies to. He said the law is intended for “organizations that are involved in the transmission of electronic protected health information for purposes of, typically, transactions like billing, coding, that kind of thing.”

“If you’re a doctor in the US, but you don’t take insurance, so you’re not sending electronic payment information, you don’t fall under HIPAA,” Moore said. “HIPAA is a lot narrower than most people understand,” he said.

Withings, not being a healthcare provider, likely doesn’t fall under HIPAA, but Dewavrin told IT Brew that Withings abides by HIPAA regulations in the same way it abides by GDPR regulations in the EU.

One thing’s for sure, Moore said: We probably shouldn’t expect too many changes at the regulatory level when it comes to healthcare data.

“It’s really difficult for me to envision us completely flipping the US position on personal data on its head, and moving completely to more of a European model,” Moore told IT Brew. “That would probably be too much of a leap. The impact of businesses would be dramatic.”

Do you work in IT or have information about your IT department you want to share? Email eoin@morningbrew.com.

Withings urinalysis product is latest health app to send sensitive data online, raising leakage concerns

The laws governing the use of and security parameters around health data are less clear than you’d expect, one expert says.

 A combination of serious server vulnerabilities and configuration mishaps discovered earlier this year could have let attackers cause chaos of the low-speed variety in hospitals by hijacking 

. IT Brew talked with Asher Brass, head of cyber analysis for Israeli healthcare cybersecurity startup Cynerio, about how he discovered and resolved vulnerabilities (collectively called JekyllBot5) in server software for ST Engineering Aethon’s Tug robots with the 

assistance of federal cybersecurity officials

Tug robots are bulky, autonomous cargo carts that are used in hospitals for logistical tasks like delivering medication and lab samples or cleaning, giving staff like nurses and lab technicians more time for other duties. Aethon says robots operate in 150+

In December, Brass told IT Brew, he and the Cynerio Live research team discovered serious vulnerabilities in the Aethon Tug Homebase Server’s JavaScript and API implementation, including one WebSocket bug carrying a 9.8 CVSS score. The now-resolved bugs seemed so serious and easily exploitable that Brass moved to contact Aethon via the Cybersecurity and Infrastructure Security Agency (CISA) “as soon as possible.”

While doing routine work at a client hospital, Brass noticed “interesting [network] traffic” and began to investigate, discovering their Tug fleet management server incorrectly allowed access to any user.

“Basically, the brain of this whole operation can be talking to anywhere from a dozen to over 100 Tug robots that are operating at any given time in a hospital,” Brass said. Further investigation led to more ominous findings, including that any user connected to the network could access the API for managing users and up their privileges to administrator.

With this unapproved access, Brass told IT Brew, he could theoretically do anything from seize control of the Tug robots’ cameras to pilot them using what appeared to be a “hidden” joystick feature. Brass could also modify or delete users at will, including Aethon’s superuser account used for remote access, though it wasn’t clear if that could be overridden by the company, or if it had other backdoors into the software. Worse, Brass found a Google search result that linked to insecure Tug fleet management consoles at other hospitals.

“I clicked the link and I was in,” Brass said. “...Right over the internet, I can see photos from within the hospital, I can do the same API trick.”

“Even if the HTTP port was closed, and you couldn’t actually surf to that web page, there was an open port that the console used to talk to the robots, and you could connect to that port over a web socket and just send arbitrary commands to robots,” Brass said.

An attacker could “not only move them from place to place but get them to call elevators to your floor, get them to ride elevators, get them to open doors, close doors, open the drawers that contain medication or the lab samples that they’re transporting, delete active users,” he continued.

Some of the issues could have been mitigated by other network security measures, Brass said, but in every single hospital running a Tug server that he observed, “I was able to do the API manipulation as an authenticated user and the WebSocket manipulation as an authenticated user.”

Brass said he never attempted to exploit the bugs, but instead contacted CISA. A week later, 

, as well as firmware updates to every Tug bot. CISA 

“I’m pleased to say that they’ve successfully mitigated the vulnerabilities that we disclosed,” Brass told IT Brew.

In a statement attributed to CEO Peter Seiff, Aethon told IT Brew the bugs were never exploited, and fixes were prioritized.

“No vulnerability was actually exploited at this site or any other,” Sieff wrote. “It is important to note that our system does not interact with any sensitive data and the vulnerability identified would not have inadvertently exposed patient, staff or financial data. Nonetheless, after being informed by CISA, Aethon took immediate action.”

Brass told IT Brew that the “huge, huge number” of smart systems in hospitals means they should prioritize dedicated cybersecurity.

“These robots, they’re technically not clinical,” Brass said. “But we were just talking about how if you disrupt them, you’re disrupting all kinds of different clinical activities, right?…If you have a thermometer controlling a lab, and you suddenly start boiling the lab, all the samples are gonna go bad.”

“So all hospitals have a lot of IoT…that they have to manage, and it’s very, very hard to do so without a dedicated solution,” Brass added.