Michael Prakhye Creates a Security-First Culture at Adventist

Prakhye shares his journey to Adventist Healthcare and his efforts to protect patient data and confidentiality.

<By Noah Johnson>

Michael Prakhye started his career in general IT working for small doctor’s offices and government agencies like the National Institute of Standards and Technology and the Department of Defense. But as he grew in the field, he came to find his true passion—information security.

“The constant evolution of cyberthreats over the past twenty years requires a continuous learning mindset, which I found particularly interesting,” Prakhye says. “It intrigued me that it wasn’t just about technology but about understanding the motives and tactics of bad actors and developing comprehensive systems to safeguard against them.”

After serving as an IT specialist at NIST, he went on to do just that for more than twenty years, helping organizations ensure that patient data is secure and confidential. Currently, he serves as chief information security officer at Adventist Healthcare, a faith-based nonprofit organization that is one of the longest serving healthcare systems in the Washington D.C. area. Coming aboard in 2016 was an opportunity for him to make a difference in what he calls “one of the most critical, challenging and underfunded industries where patient safety is paramount, and the stakes are high.”

“Visiting a hospital happens at a time where people are most vulnerable and making sure their care continues is one of the most important jobs I can have,” he says. “Joining the organization was a great opportunity to create a clear cybersecurity vision, to develop a program from scratch, and to work with other senior leaders to foster a culture of security first.”

With the proliferation of cyber-attacks and data breaches on hospitals systems over the past four years, the organization’s security-first culture is more vital now than ever. Over that time period, there has been a 239% increase in large breaches reported to the Office for Civil Rights involving hacking and a 278% increase in ransomware. When those breaches happen, hackers have access to “some of the most valuable data there is,” Prakhye says.

<Advice on Understanding Your Audience to Build a Security First Culture>

“If your board and senior executive team buys into a security-first culture, and understands why cybersecurity should be top of mind, they will be open to supporting and investing in the organization. When they do, it’s important to always engage with them on what’s happening in the world, in the industry and to talk to them in a way they can understand. If you talk to a CFO, bring it down to the numbers, for example. Make it so they understand from their perspective rather than speaking in cybersecurity terms.”

“That data is much more valuable than your social security number,” he says. “You can create a new identity with that information. You can receive care and get medication while being someone else. It’s a bigger deal when patient care stops as a result of the attacks because someone who is receiving life-saving care is at risk of not being able to continue it.”

Prakhye and his team have shielded Adventist from those kinds of threats by implementing several cutting-edge advanced threat detection and prevention measures. They’ve also worked to increase cybersecurity awareness among their hospital colleagues.

“Our training programs include organization-wide simulation training and testing to equip them with the knowledge and skills to recognize and respond to potential security threats,” he says.

“We put a lot of focus on automation to significantly reduce the risk of human-related security incidents. While it may be impossible to eliminate the risk entirely, we have invested in proactive and holistic cybersecurity strategy that resulted in a reduction in preventable security incidents, enhanced the resilience against some cyberthreats, and strengthened the patient trust in our commitment to security,” he says.

While the ever-evolving nature of cyberthreats will always be a challenge for a healthcare executive like Prakhye, so will another reality about cybersecurity—it’s expensive. And for an organization like Adventist, which operates under the unique Maryland All-Payer Model, there’s only so many resources to go around. The model aims to control healthcare costs by setting uniform rates for hospital services regardless of whether a patient is covered by Medicare, Medicaid, or private insurance.

Adventist’s work toward controlling healthcare costs doesn’t go unnoticed. “Proofpoint is proud to support the mission of Adventist Healthcare by partnering with Michael and his team to protect people, defend data, and help foster Michael’s vision of a security-first culture,” says Ryan Kalember, chief strategy officer of Proofpoint.

And while Adventist works to ensure a decrease in cost of care, operating under financial constraints can be difficult, Prakhye says. But he navigates that by working cross-functionally with his colleagues.

“We’ve been lucky to have the support of the senior leadership, who has been instrumental in fostering a culture of security first, and that’s helped us make the most of our limited funds and to make great strides at protecting the organization,” he says. “We also have great vendors and partners that we collaborate with to that end.”

For information security professionals looking to better protect their patients, it might be helpful to visit healthcare-specific conferences, Prakhye says.

“Going to those, I’ve noticed that regardless of size, hospital systems all have similar challenges and opportunities while using similar solutions and tools. Talk with others to figure out any tips and other ways people approach the problems your system is facing.”

<Editor>
Navpreet Dhillon

<Design>
Anastasia Andronachi

<Web Development>
Jose Reinaldo Montoya

<Photo and Video Editor>
Cass Davis

<Photo>
Courtesy of Michael Prakhye/Adventist HealthCare

<Video Backgrounds>
ezstudiophoto/AdobeStock (Red Blur), swatch+soda/AdobeStock (Chrome Melt)

Adventist HealthCare

Michael Prakhye