Cybersecurity uncertainty in healthcare: A conversation with Carter Groome

In the latest episode of Health Stealth Radio, host Frank Cutittaa sits down with Carter Groome, CEO of First Health Advisory, for an illuminating discussion on the current state of healthcare cybersecurity amid political and economic uncertainty.

Groome, whose company serves nearly one-sixth of the nation’s hospitals, reveals a troubling trend: a significant uptick in cyberattacks targeting healthcare organizations. From business email compromise to brute force attacks and social engineering schemes, threat actors appear to be exploiting the current administrative transition period and its accompanying uncertainty around cybersecurity policy.

“We don’t know their stance on CISA. We don’t know what the FBI’s involvement will be going forward in cyber ops,” Groome explains, highlighting how this policy vacuum is creating anxiety across the healthcare sector.

The conversation also delves into broader economic concerns, with Groome noting the potential impact of projected $880 billion cuts to healthcare funding. For already financially vulnerable facilities operating on razor-thin margins, particularly rural hospitals and federally qualified health centers, these cuts could be devastating.

Despite these challenges, Groome sees positive developments in executive awareness. The cyber incidents of 2024, particularly the Change Healthcare attack, have elevated cybersecurity to a business imperative at the board level. Conversations with CFOs have evolved from complex discussions about brand equity to straightforward questions about operational resilience: “How long can you go without making money?”

The episode offers valuable insights on the intersection of cybersecurity and business continuity planning, the importance of enterprise-wide resilience strategies, and the potential of AI to both combat and exacerbate cybersecurity challenges.

For healthcare leaders navigating today’s volatile cybersecurity landscape, this candid conversation provides essential perspective on protecting both patient safety and organizational viability.