Scott Gee (Host): Hospital security leaders are being asked to prepare for an increasingly complex threat landscape. While cybersecurity remains essential, the larger operational question is resilience. How can hospitals continue protecting patients, staff, and visitors when key systems become unavailable?

Welcome to the AHA Bringing Value Series from the American Hospital Association. In this series, we speak with AHA business partners and learn how they support AHA hospital and health system members. I'm Scott Gee, Deputy National Advisor for Cyber Security and Risk here at the American Hospital Association. And today, I'm with Mike Lauer, Vice President for Emergency Preparedness, Employee Health and Safety, and Security at BJC Health System; and Jason Grellner, Vice President and Head of Healthcare at Evolve Technology.

Hospitals are increasingly being encouraged to prepare for prolonged technology outages and prioritize clinical continuity alongside cybersecurity resonance. Join us as we explore how security leaders can strengthen continuity plans and work across IT, operations, emergency management, and clinical teams to maintain safe and effective care during periods of disruption. Mike, Jason, welcome to the podcast.

Jason Grellner: Thanks, Scott.

Mike Lauer: Thanks for us.

Host: So, let's kick it off with the first question. How has the conversation around hospital security changed over the years, and are you seeing an increased focus on operational resilience?

Mike Lauer: Absolutely. There is an increased focus on operational resilience, and you'll hear me use that word resilience a lot today. The conversation has evolved from traditional security, loss prevention, to a much broader discussion about enterprise risk, workplace safety, care continuity, and organizational resilience—that word again.

We've also changed to strategic risk management. You know, 15 years ago, hospital security were primarily focused on access control and theft prevention, parking lot safety. But today, security leaders are expected to be strategic partners and strategic thinkers. And I think that's one of the most critical changes that's come to my role, is I am being asked to be a strategic thinker. And for some of us in law enforcement, that's a change. And we're so focused on operational activity that being a strategic thinker requires a different thought process for us.

Jason Grellner: I think you're dead on. And I think to show that, what we see is more and more positions like yours in organizations where we have an overall security leader for the healthcare system, where we were used to just seeing leaders at the hospital level, right? Where we were asked to be reporting to that local president or CEO of the local hospital and really weren't beholding to the overall healthcare system. Now, we see positions like yours, like I held at Mercy, like John does now, where you're seeing this vertical of healthcare safety, security, and then bringing in that emergency management portion underneath that lampshade, if you will. And again, being a critical thinker and being a part of the team, right? Making sure that we can continue to provide exceptional healthcare in the worst of conditions.

Mike Lauer: Exactly. My role as a system-level security leader has only been in existence since 2018 and then, over time, has evolved into the emergency management role as well. And for me, that was partly due to COVID and our COVID response. I was brought into emergency management at the beginning of COVID to help lead the, COVID response for BJC

Jason Grellner: And I think, again, I think, in the past before then, because the same thing happened at many other healthcare systems. Prior to that, you had emergency management leaders who were great at coming up with policy and process, but it really fell a lot of the times onto the shoulders of security to go out and implement those policies and processes anyway. So, having that leadership in one place really helps to make sure that the policy and processes are thought out, they're going to work properly, and that they can be implemented by those that are going to be on the front lines when something happens.

Host: Yeah, that's great, Jason. Bringing that operational mindset into the policy and procedure planning part is always going to be beneficial because policy folks can come up with things that nobody else can implement. So, having the guys actually doing the work involved early on is a great idea. So, what does the hospital environment look like when critical systems are unavailable, particularly in the security setting?

Jason Grellner: I can tell you that the simplest of systems can give you heartburn. You know, the infant protection system at your hospital when it needs to be updated or upgraded or taken down for any reason, the manpower that you have to bring to bear in a hospital to guard doorways and exit ways and staircases and elevators while that system is down can be monumental. It can cost you a lot of money overtime. And that's just for a simple, update to the system or maybe we're changing out a sensor or doing something.

Imagine, if you lose all communications. As Mike said, video management systems are much more robust than they ever have been. Access control, we're controlling more doorways across not only campuses, but entire healthcare systems than we've ever controlled before. Temperature monitoring, go back to COVID and vaccines and making sure that we were temperature monitoring on all of those vaccines where they were located. All of that relies on the ability to get the information that you need.

Mike, the catch word 10 years ago was single pane of glass. If I heard it once, I heard it a million times. Single pane of glass. Single pane of glass. That's great, unless that glass breaks. If it's all feeding to one single pane of glass and that glass breaks, what do we do now, Mike?

Host: Another name for it, a single pane of glass is a single point of failure, unfortunately.

Mike Lauer: Yeah, Scott, you asked what does a hospital environment look like when critical systems are unavailable? Everything slows down and care slows down immediately. And our caregivers are so used to technology today that when we lose technology, Oftentimes they're so reliant on it that a lot of our nurses today, if a system goes down, they've never documented on paper. And what we've learned through some downtimes that were self-created, we take systems down periodically to be able to upgrade, one of the things we learned is that a lot of our younger nurses were not taught handwriting in school, and our older nurses, everything's in handwriting. And so, they can't read it. So, it slows things down. We lose situational awareness when cameras are down. We increase our risk environment when our systems are down, whether it's visitor management or access control. But then, as to Jason's point, we become more reliant on people, because we have to staff those infant abduction areas with people to make sure we protect our babies.

Host: Yeah. And Mike, that's an excellent point. We see that with hospitals all the time. The clinicians in particular are concerned about what happens when they lose technology. And they're training for it, they're practicing. But what I always encourage people to do is think about those other systems, those operational technology systems, specifically, given our backgrounds, the security systems. You're not going to have cameras, you're not going to have control of door locks. Even when the clinicians bring in extra people to be runners or something along those lines just to make things happen that used to happen automatically with the technology, do those runners have access to all the doors they need to get through? Can you add them to the badge management system? So, there's hundreds and hundreds of things to think through when you lose technology, but a significant impact to security technology is something that quite often gets overlooked, to be honest.

Jason Grellner: And I would say the biggest thing there, Scott, is communication. And I lived through three outages of communication across our entire network. We serviced 42 hospitals, 600 clinics, 76 retail pharmacies. We were in seven different states. And we lost gross communications.

There are no more copper lines. You don't pick up the phone and dial the phone anymore. Everything is digital. The phone lines are digital. Sending imaging, right? Your images more than likely are not read locally. Those are being sent out, and somebody is reading those CT scans. They're reading those MRI scans. They're reading even down to the X-ray. We don't slap the X-ray panel up on the wall behind lights anymore. And so, thinking about just simply how do I get out of code stroke? How do I get out something overhead if my digital communication system is down? And what are the redundancies? You know, UHF, VHF, satellite now is available, cellular capabilities. And so, you've got to look at all of those, and can your safety and security system, does it have room to ride on the backbone of that? Or is your EMR taking up all the bandwidth, right? Because EMRs are just getting more and more robust and larger and larger, and eating up more and more bandwidth. And where is that going to ride in an emergency? To Mike's point, because if you ask some of our newest clinicians to paper chart, the first thing they're going to ask you is, "What is paper?"

Host: An excellent point.

Mike Lauer: And Jason, when critical systems go down, we're still a hospital. We still have to take care of people, and we still have to provide medications, and we still have to read imaging. And we need to make sure that we're resilient to be able to continue to provide care in a safe way.

Host: That's entirely correct, Mike. I couldn't agree more. So, which security functions are most vulnerable during an outage, and how do organizations reduce those single points of failure?

Mike Lauer: We had a tornado that went right past our front door within a mile of our facility that many of our team members were watching go by. And it impacted our community much more than our healthcare system. But there's a lot of impacts when systems go down. And, you know, access control's obviously one of the major ones. And then, video surveillance, like I said, you know, we've talked about this before. When we lose video surveillance and we lose access control surveillance, we lose our set of eyes that are in our security operation centers to all of our operations.

Jason Grellner: And again, I'm going to fall back to communications. When you lose the ability to communicate even just floor to floor in a hospital to move patients to where they need to be to get the care that they need and you start looking at, "Well, we have old VHF radios," Do the repeaters even work? Are they still where they used to be? Have they been updated? Because you went to digital five years ago. And now, you want to go back and use UHF or VHF. Is it even available to you? Do you have that satellite?

It used to be that if you had a satellite phone, you must be working for special ops somewhere overseas. And now, we've got people who go out camping and hiking and take satellite transmitters with them. So, they're much more available and readily available. We've got things like Starlink. Can you have a backup locally to something like a Starlink where you have the ability to at least get some bandwidth and get some communications up? And do you have the radios available, right? Everybody's used to just picking up the phone on their desk or at the nurse's station. How are you going to deploy communications devices in an outage? Where do they go? Where are they kept? How do you know that they're operational? Are the batteries up? How do you get all of that out if you're not prepared for that?

Host: A lot to think about, Jason. So finally, can you tell our listeners how they should be considering resilience when evaluating new technology?

Mike Lauer: So, every critical security system has to have a plan B. And if plan B is reliant upon the same functionality and technology as plan A and the same people, we're setting ourselves up for failure. We can't have a single point of failure that impacts our organization. So yeah, we have to have layered approaches.

Jason Grellner: Yeah. And that single point of glass, it's great to have a SOC somewhere where you can see 7,000 cameras. But you better have a secondary SOC. You better have local SOCs at local facilities that can see just inside their region or their area so that you can cordon off parts of your healthcare system if you need to, or even parts of your healthcare facility if you need to so that you can continue operationally where you're at.

But Mike makes a great point. If we're going to use radios, and if those radios go out, we're going to use these radios. And they both work on the same network, but the network's down, you can have as many radios as you want, and many different types and models and everything else that you want. But if the system's down, the system's down.

And Scott, you guys are great at the AHA reminding us. I think I heard, what, 90% of cyber attacks in the United States on a daily basis are aimed at healthcare. Ninety percent, I think somewhere upwards of 10 million a day. Ten million cyber attacks a day aimed at healthcare. And so, that resiliency that Mike talks about and that BJC has put in place and what they work with every day, you just have to have that at top of mind because one of those cyber attacks gets through out of 10 million, and you're playing catch up.

Host: Absolutely. Jason, Mike, thanks very much for joining me today on the podcast and sharing your insights. For our audience, if you'd like to learn more about Evolv Technology, please visit them at evolv.com. This has been the AHA Bringing Value series, brought to you by the American Hospital Association. Thanks for joining us.