Building Resilient Health Infrastructure with ASPR
How is CIP for the Healthcare and Public Health Sector Defined?
This episode outlines why cybersecurity is such a critical concern for healthcare and public health (HPH) sector critical infrastructure owners and operators.
[Music]
MICHAEL ELTRINGHAM: You’re listening to “Building Resilient Health Infrastructure with ASPR,” a podcast from the HHS ASPR Critical Infrastructure Protection Division. If you have any questions about this episode, please email us at CIP@hhs.gov.
Hey everyone! Thanks for listening. I'm Michael Eltringham, a program analyst within the Critical Infrastructure Protection Division of HHS ASPR or the “CIP” division as we call it. I'm joined by our division director, Dr. Laura Wolf. How are you, Dr. Wolf?
LAURA WOLF: Great, how are you?
ME: I'm great. Today's question on our episode of the podcast: “What is healthcare and public health critical infrastructure?” So last time, if you listened to our last episode, we defined just general critical infrastructure. Today we're going to talk about our field of particular expertise which is the healthcare and public health sector critical infrastructure.
So to start, let's kind of take it to a - just talk about maybe a hypothetical story or an example of an individual who may need healthcare, and what are the different aspects of the healthcare - because there's I think a lot of folks hear the term “Healthcare and Public Health critical infrastructure and they think, “Oh well: hospitals are critical. That's pretty much it.” But I think it's a lot more than the average person might think. So can you talk about maybe an example of all the different ways one person might be impacted by healthcare and public health critical infrastructure?
LW: Absolutely it's broader than hospitals and this is one of my favorite questions to answer.
So if you picture a scenario of just going to the hospital for a simple procedure or a test: so you walk in a door, first of all, you're greeted by staff. You're told where to go. You probably fill out insurance forms for the procedure to be to be paid for. Your procedure is performed with equipment and supplies. And when it's over you may need a prescription and you leave the hospital and then go to a pharmacy for a prescription.
Just in that quick interaction you've been touched by all of healthcare and public health critical infrastructure
ME: Yeah and I think it's interesting to think about not just because you know people think of infrastructure and they immediately think of physical things –
LW: Yeah, the building.
ME: But it's not all physical and I think the concept that you like to use to describe it is something called, “The Four S’s.” The first thing I want to ask you: did you come up with this or did somebody else?
LW: No! I did not -
ME: Because I don't want us to get sued.
LW: No, it’s a common term, used for setting up disaster medical responses. I think it's a broad term.
ME: Yeah and it applies to us. So: stuff, staff, systems, and space. Let’s walk through each one.
LW: Sure.
ME: Stuff?
LW: So whenever we need supplies for healthcare – and the healthcare supply chain is complex and diverse and works in a just-in-time manner so there are a lot of risks to that supply chain, there are a lot of examples where we've had medical device or pharmaceutical shortages over the years. And so our partnership works to strengthen that system and understand it and have our community understand where some of the threats to that system might impact them. So stuff I think encompasses pharmaceuticals, medical devices, the equipment needed to set up office space for the healthcare sector.
ME: Staff. Now this one sounds self-explanatory, but I think even this one's broader than folks might realize because you think staff and you think “hospital staff,” which is true, they are critical.
But then aren't there other operators within healthcare and public health like maybe the truck driver who drives the supply truck of medical materials, that kind of thing as well?
LW: Absolutely. It's incredibly diverse, and you know healthcare and public health are growing fields for employment and so it's pretty vast. But if you think about it a lot of the infrastructure would not function without staff and we have staffing challenges in a variety of scenarios.
Every year when there's a seasonal influenza going around, you lose part of the staff at doctors’ offices and at hospitals and that's a challenge in and of itself especially when it's compounded by a supply shortage. So that's always a challenge.
Another example of needed staff if we look at one of the systems we worry about: cyber systems. Cyber expertise is often sought in healthcare institutions and we don't always have a cyber professional at those institutions. But that's really important for us as well. So thinking about the people that keep this industry going.
ME: The next one: systems.
LW: Systems, so again, this could mean anything, but a couple of the systems that we really focus on that I've already mentioned: our supply chain and cyber. They're interdependent with other sectors of critical infrastructure. We need communications to be working in order for you to order a product or for a doctor to send a pharmaceutical order to a pharmacy or for your health plan to be billed, your health records to be to be available.
So these systems are really crucial to our receiving the kind of care that we expect and our records to be available whenever we need them. And the maintenance of those systems is challenging and there are a lot of threats to those systems that we think about.
ME: The last S stands for space. And that's not the NASA space. It’s maybe a different way to describe something that people might more commonly look to as infrastructure facilities.
LW: Right, although we do think about space, whether or is a threat to us from space weather could cause long-term power outages and variances. So we do think about that space. But you're right: in the “Four S’s,” this space is the actual facilities and the structures that we are looking at. And one of the areas we're concerned about is resilience to extreme weather. As we're seeing, climate change is changing how we experience weather. There are longer term floods, there's erosion, there's extreme winds that are impacting our facilities. And so we work with partners to identify best practices for recovering from an experience like a major hurricane or even advising on when you're building a new structure how to make it most resilient to last over multiple decades that that facility is going to be around.
ME: One way we look at the health care and public health sector, and in future episodes we'll go a little deeper on, you know, our sector partnership and the partners that make up those, but could you touch on the various subsectors that we focus on within our sector?
LW: Absolutely. So we look from “cradle to grave,” literally, for the partners that we work with in infrastructure protection.
So the majority of the partners in our councils come to us from the direct patient care subsector. This includes anything with hands-on patients. So hospitals, ambulatory care centers, dialysis, long-term care centers, any of those institutions. Then we have medical materials which looks at pharmaceutical and med surge supplies. We have health plans and payers. Major insurance plans are our partners in that subsector. We have the pharmaceuticals, labs and blood sub-sector which comes to be very critical during responses to make sure that pharmacies are prepared for disasters, that labs can do testing they need to, and that blood is available during a response. Then we also have health IT, which encompasses all of our partners that either work to secure networks or provide some of the tools that our partners use to share health information across the sector.
And finally, as I said, “cradle to grave,” we also have a subsector of mass fatality managers, a lot of funeral director associations. Where this sub-sector played a critical role with us was in preparing for a potential Ebola event across the country. How would how would we deal with highly infectious diseases and potentially large numbers of fatalities.
So that's on the private sector side. On our government side, we have federal program offices like ours. Our partners at CDC and CMS all the three-letter agencies. FDA is another big partner. All the agencies that have to do with with critical infrastructure in the private sector and then our public health community that includes some federal partners but also our partners at the state level, at the county level, and even at the tribal and territorial level. We run the full spectrum of health care and then make sure that our government and public health partners are involved as well.
ME: So you touched on our where our partners come from, you know, the “who” of “who we work with,” but how do we work with them? You're going to have to tune in next time guys! Because that's our episode. We want to leave you wanting more, I'm going give you the little tease. So we'll cover that in our next episode talking about our health care public health sector partnership, how we work with our partners, the collaboration process, the communication process, in both steady state and emergency response, in ways to help save lives and protect Americans.
So that's our episode and thanks for listening everyone! As always, please email us if you have any questions on the HPH sector partnership or anything you heard on this episode. You can email us at CIP@HHS.gov that's CIP@hhs.gov and again any questions you might have or feedback on the podcast we'd love to hear it. Thanks again for another great episode Laura!
LW: Thank you Mike!
ME: Thanks everyone for listening!
[Music]