In this episode, we explore how cybersecurity is foundational to the Center for Medicare & Medicaid Services (CMS) mission of ensuring access, quality, and continuity of care, why it is rightly considered a patient safety and care delivery issue and not just an information technology (IT) challenge. The conversation highlights what cybersecurity support from a Quality Innovation Network- Quality Improvement Organization (QIN-QIO) means in practical terms, emphasizing partnership, education, and improvement, rather than audits, enforcement, or regulatory inspections. The episode explains why now is the right time to strengthen cybersecurity efforts to protect both patient data and patient care.
#CyberSecurity #HealthIT #QINQIO #PatientSafety #Technology
Selected Podcast
From IT Risk to Care Risk: Cybersecurity in the QIN‑QIO Program
Tara Hatfield, MHA, BSN RN, CPHQ | Brent Amble, PhD, MS, LAT, ATC
Tara is currently serving as the Director of Digital Health at Superior Health Quality Alliance, Region 4’s QIN-QIO. Tara earned a Baccalaureate of Nursing from Indiana University in 2004 and a Masters in Health Administration from the University of Southern Indiana. She is a Certified Professional of Healthcare Quality (CPHQ) through the National Association of Healthcare Quality (NAHQ), and a certified Health IT Provider Consultant through the American Health Information Management Association (AHIMA). Tara has worked in a variety of work-flow redesign and quality improvement roles with Indiana’s Quality Improvement Organization and two Midwest-based HITECH Regional Extension Centers. She has assisted in the Meaningful Use attestation, Physician Quality Reporting System (PQRS), and Merit-based Incentive Payment System (MIPS) submissions for Indiana providers. Her nursing experience includes more than eight years of clinical experience in critical care, oncology, and nursing management. She also has completed courses in the areas of Patient Centered Medical Home (PCMH) Coaching, Lean Six Sigma for Healthcare, and Strategic Doing. In addition, Tara has served as adjunct faculty at the University of Southern Indiana teaching both graduate and undergraduate Health Informatics and Electronic Health Record Enterprise courses.
Brent Amble, PhD, MS, LAT, ATC serves as a Cybersecurity Analyst for Superior Health Quality Alliance with experience as a Health IT Project Specialist with MetaStar, where he focuses on strengthening cybersecurity posture, conducting security risk assessments, and supporting HIPAA Security and Privacy Rule compliance for healthcare organizations. He brings deep experience in healthcare cybersecurity, risk mitigation, and policy development, informed by a longstanding clinical and health administration background. His work emphasizes practical, provider‑centered approaches to protecting ePHI and improving organizational resilience.
From IT Risk to Care Risk: Cybersecurity in the QIN‑QIO Program
Carrie Finley (Host): Welcome to the Superior Health Cast: Quick Takes for Quality Care. Here we explore practical, forward-thinking ways to improve healthcare quality with one quick, meaningful conversation at a time. Before we dive in, this episode is about cybersecurity and the use of technology. And you'll be able to find it and future episodes on the Superior Health Quality Alliance website or your favorite podcast streaming platform.
I'm your host today, and my name is Carrie Finley, and I'm a registered nurse and a quality improvement advisor with Superior Health Quality Alliance. And I'm excited to be here with my two guests, also from Superior Health, who will be sharing their expertise.
Our first guest today is Brent Amble. Brent is a cybersecurity analyst for Superior Health Quality Alliance. He brings strong healthcare cybersecurity expertise from his work focusing on strengthening cybersecurity posture, conducting security risk assessments, and supporting HIPAA security and privacy rule compliance. All of his work is built on a long-standing clinical and health administration background.
Also joining us is Tara Hatfield. Tara serves as the Director of Digital Health at Superior Health Quality Alliance. Tara is a registered nurse with an advanced degree in health administration, in addition to a certified professional in healthcare quality and health IT provider consultant certifications. Tara has extensive experience in workflow redesign, quality improvement, and health IT.
So, thank you, Brent and Tara, for joining us today. In this episode, our focus is going to explore why cybersecurity is essential to patient safety, care delivery, and CMS's mission of access, quality, and continuity of care. Our goal is to highlight how QIN-QIOs partner with providers to reduce cyber risk, strengthen resilience, and protect patients without regulation or punishment.
To start us off on this conversation, Tara, I'd like for you to walk us through how does cybersecurity connect directly to CMS's core mission of ensuring access, quality, and continuity of care?
Tara Hatfield, MHA: Right. Thanks, Carrie. CMS's access goals actually depend on digital pathways such as patient portals, eligibility systems, of course, telehealth, and care coordination platforms. Cybersecurity ensures these pathways remain available and trustworthy, not only to the patient but also to the provider.
When we think about quality, CMS defines quality as safe, effective, and equitable care, all which depend on secure and reliable data systems. Cyber attacks undermine quality by disrupting clinical workflows. They compromise data integrity, they delay care, all of which can lead to errors and poor outcomes. So for this reason, CMS's national quality strategy and cybersecurity requirements emphasize resilient, secure electronic health record or EHR and operational systems as essential to patient safety and high-quality care.
And then, lastly, continuity of care relies on always-on digital systems for records, for payments, and for care coordination. CMS security policies focus on preventing and responding to cyber incidents because outages can delay treatment and care referrals, while ransomware and system disruptions can force care diversions and shutdowns directly interrupting patient care.
Therefore, stable, secure access to clinical and administrative systems are essential to continuous, safe, and quality healthcare and outcomes.
Host: Yeah. Okay, thank you. That leads perfectly into my next question, and this one is for Brent. Brent, CMS often talks about cybersecurity as more than an IT issue. Like, why is it considered a patient safety and a care delivery issue?
Brent Amble, PhD: Yes. Thanks, Carrie. So, CMS views cybersecurity as a patient safety issue because cyber incidents don't just expose data, they disrupt care directly affecting patients. When systems go down due to ransomware or breaches, clinicians can lose access to EHRs, imaging, labs, or medication systems. That can delay treatment, force unsafe workarounds, and ultimately increase the risk of patient harm. If a cyber event interferes with timely, safe care, it becomes a clinical issue, not just an IT problem.
Host: Okay. Well, building on Brent's comments and just given how interconnected healthcare systems are and how disruptive breaches can be, Tara, could you explain why data governance is so critical to preventing incidents and protecting both patient information and care delivery?
Tara Hatfield, MHA: Sure, absolutely. So, healthcare data is vulnerable to breaches because it is a highly valuable, widely shared, and tightly tied not only to patient care information, but also to patient demographics and their financial information. Care delivery depends on complex interconnected systems such as electronic health records, medical devices used not only in the care setting, but now devices used at home, as well as third-party vendor products, many of which are legacy technology or older technology that's difficult to patch or replace without disrupting care.
Operational constraints, fragmented oversight, and workforce pressures, along with competing priorities further increase exposure risks, making security incidents both likely and uniquely disruptive in healthcare. So, this is why data governance is so important. It defines care accountability for who owns, who enters, who modifies, and ultimately who protects the patient data. Data governance protects data integrity so records are not incomplete, so they don't become altered or corrupted. It also ensures appropriate access to information, getting the right data to the right person at the right time. And it reduces the risk of breaches, security incidents by aligning security, privacy, and operational practices under clear and defined guidelines.
Host: Wonderful. Well, like all of that sets the stage. But I know providers, they often ask: What does support actually look like? Brent, for providers listening today, what does cybersecurity support look like from a QIN-QIO in practical terms?
Brent Amble, PhD: Yeah. Sure, Carrie. So really, in the real world, QIN-QIO cybersecurity support means no cost, hands-on help to reduce real risk. It includes readiness assessments, identifying priority gaps, practical improvement roadmaps, and education for leadership and staff. It's tailored to healthcare operations and focused on prevention and preparedness, not theory or punishment. Broadly thinking about cybersecurity, it's not a checklist, it's a partner walking alongside you to help reduce real risk to patient care.
Host: Okay. Well, this one is for Brent too. So, what message would you give providers who feel cybersecurity is overwhelming or outside of their expertise?
Brent Amble, PhD: For sure. Just the word cybersecurity can be a little bit overwhelming, but It's completely understandable. The key message is you're not expected to be an expert. Cybersecurity is a team effort that involves leadership, clinicians, operations, and IT. Small practical steps like improving awareness, access controls, or backup readiness can significantly reduce risk.
The focus should be steady progress, not perfection. And importantly, there are no-cost resources available through the QIN-QIOs to help providers build confidence and resilience without adding unnecessary burden.
Host: Okay. So Brent, could you then expand a little bit on how does the QIN-QIO approach differ from audits or enforcement actions or regulatory inspections?
Brent Amble, PhD: Yeah. So, our approach is not regulatory. So, the QIN-QIO approach is fundamentally different from audits or inspections. QIN-QIOs don't enforce regulations or issue citations or penalize providers. The work is voluntary, confidential, and improvement-focused. We act as trusted partners, helping organizations understand their risks, build capacity, and strengthen resilience over time. The goal is to support providers early before a cyber incident disrupts care, rather than reacting after something has gone wrong.
Host: Okay. Well, Tara, I'm wondering if you could share how providers can get started or like re-engaged in cybersecurity work with their QIN-QIO? And like, why is now the right time?
Tara Hatfield, MHA: Now is definitely the right time because under CMS's 13th scope of work, which we are currently in. Providers can reach out to their QIN-QIO to receive free, confidential, non-punitive cybersecurity and resilience support, just as Brent just mentioned, across all care settings, including hospitals, clinics, and skilled nursing facilities.
Engagement typically begins with a readiness-focused conversation or assessment grounded in real clinical workflows such as EHR access, downtime procedures, and care transition workflows. QIN-QIOs can help connect cybersecurity to patient safety by integrating it into existing quality, risk management, emergency preparedness, and safety efforts, therefore reducing duplication and burden.
Providers also receive practical, actionable support, including gap identification, prioritized next steps, staff and leadership education, and incident preparedness guidance focused on keeping the patient care running during any disruption.
Host: Well, thank you, Brent and Tara, for your time and insights. And thank you listeners for listening. This has been a very informative and a valuable conversation about cybersecurity. You can find all episodes of the Superior HealthCast: Quick Takes for Quality Care on our website, and that's www.superiorhealthqa.org. And you can subscribe on your favorite podcast platform. We love hearing from you, so please send any of your comments, thoughts, questions, or suggestions for future episodes. You can email us at info@superiorhealthqa.org. Your feedback helps shape conversations and especially those conversations that matter most. So until next time, stay inspired and keep striving for quality care.