As healthcare rapidly adopts artificial intelligence, protecting the data behind it has never been more important. In this conversation, Edward You, former FBI Supervisory Special Agent and founder of EHY Consulting, explains why healthcare organizations must look beyond AI tools and focus on protecting the data, governance and supply chains that power them. Edward also shares why health data has become one of the world's most valuable assets, how foreign threats could reshape healthcare innovation, and what leaders should do now to build a secure AI strategy.

Tom Haederle

Welcome to Advancing Health. As artificial intelligence is increasingly embedded into the foundation of modern healthcare - from clinical care to emerging biotechnology to business operations - experts say it's important to focus on the quality of the oil that lubricates AI, the data it runs on.

John Riggi

Hospitals and health systems are rapidly adopting AI to power clinical and business services, advanced research and medical trials, and also using it for emerging biotechnology solutions. Most evaluate these AI powered services and solutions from an operational compliance and cybersecurity lens, and don't always address the related and strategic issues. There are often embedded hidden questions of national security, economic security, and public health and safety facing executive leadership and governing boards when adopting AI solutions.

John Riggi

I'm John Riggi, your national advisor for cybersecurity and risk at the American Hospital Association. Today, so pleased and proud to have with me my good friend and former colleague at the FBI, Ed You. He's president of EHY consulting and a senior advisor to the AHA on foreign threats to the bioeconomy. And Ed is also a former FBI leader on weapons of mass destruction, counterintelligence and biosecurity.

John Riggi

With more than two decades of advising the FBI, the White House and the US intelligence community, Ed brings a rare perspective that bridges science, policy and executive leadership. Ed, thank you so much for joining us today.

Edward You

Oh, it's an absolute pleasure to be here with you, John. I want to thank you and AHA not only for this opportunity, but its an absolute privilege to be a part of the team.

John Riggi

Ed, let's talk about how the convergence between AI and other emerging biotechnologies is actually affecting health care.

Edward You

Yeah, that's such a critical question. So you hit the key term. It's all about convergence. And what I mean by that is everybody is racing to see how they can adopt and implement AI. It could range from something as simple or as complex as designing new drugs, designing new diagnostics, looking at how do you supercharge manufacturing AI for looking at how do you process medical bills, insurance records, all the way to looking at the entire drug supply chain.

Edward You

So everything in between. And that is a recognition not only of how powerful AI is, but it is not just a tool. It is absolutely being embedded in the entire healthcare ecosystem. It's not just about adoption now. It really is AI is becoming a part of the fabric or operating system of modern day healthcare. Building on that, though, we tend to focus on AI almost exclusively and forgetting that AI doesn't do anything without data, right?

Edward You

And so data is absolutely the new oil that AI is going to train on, AI is going to process. And so it's more about protecting the data, the workflows that are associated with the data and the trust that is going to be part of quality of the data. So we had to think beyond just the tool, but looking at the healthcare ecosystem in total.

John Riggi

Totally agree, Ed. And I love the phrase you always say that data is the new oil. And I often say that like oil, the data does not spoil. It has lasting value. It has retentive value for us and our adversaries who are continuously trying to steal our research and innovation and use it for their own economic or national security priorities.

John Riggi

So given all that, how should healthcare leaders approach governance, oversight and organizational considerations surrounding AI enabled and emerging technologies?

Edward You

Everybody is implementing AI. One of the few things that is missing is very few people actually have an AI enterprise strategy. It's more than just looking at how quickly can you adopt and integrate AI. It's not an IT project, right? It's not something that you just ask your resources and your IT folks to integrate. It is potentially transformational aspect of your organization.

Edward You

Therefore, executive leadership should be going into this understanding that there ought to be a strategy and to kind to put a fine point on this, I've engaged with private sector, with academia. I went to a conference just not too long ago, where it was tended by multiple companies, startups to large scale multinationals, and just querying them like, hey, how are you using AI?

Edward You

And they're very easy in explaining, you know, we're doing it for this part of a business and doing this part. And when I asked a simple question, okay, great: what's your AI strategy? And across the board people are like, never really thought about that before. And so there has to be a recognition that technology is always going to be moving faster than true integrated adaptation for organizations, and that really needs to be recognized.

Edward You

And if we don't do it right, then we're going to potentially leave gaping vulnerabilities, which I think we're going to be talking more about later on.

John Riggi

Great points, Ed. You know, when I when I listen to you speak, I think about how technology was adopted, just basic technology and digitization of healthcare records throughout the healthcare sector. It was viewed as a tool. It was plug and play, that common expression. But there wasn't a strategy and there really wasn't a strategy till later on as organizations became more mature.

John Riggi

And then we began to really understand how the technology risk equated to enterprise risk and ultimately a risk to patient care and safety. So we really need to learn some of those from these lessons we adapted to and some of the issues we adapted to back when we had this large scale adoption and digitization of healthcare. So Ed, can you give us an overview of the growing need for biosecurity in the risk associated with foreign collection of health data?

Edward You

Yeah, I mean that that is such a challenging question because AHA and your, your program in particular has been leading the charge and looking at cybersecurity and the cyber threats are absolutely just relentless. However, if you're forward leaning and understand what's coming down the road when it comes to AI, AI amplifies the opportunities, as I mentioned before, but absolutely, it amplifies the potential risks as well.

Edward You

That also means that it translates into a broader vulnerabilities because you mentioned it before. You know, there's always a historical challenges. You know, when you and I were both at the FBI about intellectual property theft and ransomware. And so what I call the traditional but daunting security challenges. But if data is the new oil, then we really need to be paying attention to what are the vulnerabilities, because it's not just about the final, you know, license or patent, but now it's, well, your genetic information, the genetic code that makes up who you are is incredibly valuable.

Edward You

And people tend to forget that once that's gone, once that's taken, there's no getting it back. And once it's gone, it's gone. It's not like a credit card where you can change your credit card. You can change your PIN code. That information that is intimately you is not retrievable. Moving even further with the future of the Internet of Things, of smart homes and smart cities, smart clothing, for example, we're going to be tracking our lifestyle, our behaviors, and those all ultimately going to have a fitness or medical application too.

Edward You

And we really need to start thinking about, wait, who are the end users? Who's going to have access to this data? We need to be asking those questions today.

John Riggi

Would totally agree, Ed, and your comments remind me of our previous conversation a few years ago, and we talked a lot about foreign threats and foreign influence to medical research and innovation. And we were talking about the potential theft, compromise, or misuse of genetic data. And we pointed out to the field that it's not only your personal genetic data which is at risk, it is the genetic data of your future generations.

John Riggi

So your genetics transfer from generation to generation, which again, are placed at risk if again improperly used or accessed. So Ed, if hospitals are contemplating adopting these technologies, what should they consider and how can you help directly?

Edward You

Well, first and foremost, hospitals should be affiliated with AHA and your team. And that's the important start just to get a full understanding of not only the cybersecurity challenges, but the capabilities, the training and the insight that your program already provides. What I hope to bring to the table is - what I kind of mentioned is - don't just think about today's threats, but we really need to think about tomorrow's challenges as well, too.

Edward You

And I don't want to be complete doom and gloom. It's just that there's so much opportunity because we have an opportunity to really protect not only our patients, but the families, the communities that they live in. We can't miss out on that because it's not just about loss of privacy. It's not just about the IP loss I just mentioned before.

Edward You

Yes, those are real felt financial hits. But so what if a foreign entity gets access to your genetic information or your lifestyle information? The "so what" is that if you're utilizing AI, if you're an adversary or competitor, then what might actually happen - and we're starting to see this play out - is that they're going to have first mover advantage for the next breakthrough drug, the next breakthrough therapeutic, to be able to provide more cost effective health care delivery.

Edward You

That is really scary in that we may inadvertently be rendering our patient population completely dependent upon a foreign supply chain. So that's not theft. And so not only is that a huge vulnerability to our population, but that also means that economic loss, potential work opportunities, job losses as well, too. It's a full stack threat that, as I said, it's not just your traditional cybersecurity challenge, which is already a huge issue, but we really need to start thinking about these things a little more proactively.

John Riggi

Thanks for your comments, Ed. And it's no secret that China remains fixated on becoming the world's dominant superpower economically, not necessarily militarily, but their strategy to acquire and develop research, information, expertise on bioeconomy and pharmaceuticals is very, very well known. And again, we have to keep that in mind as China is aggressively seeking to acquire that information from the United States through legitimate commercial means and illegitimate means as well.

John Riggi

Ed, so thanks again for joining us today. Most importantly, thanks again for joining our team as our resident expert on foreign threats to the bioeconomy. Your services and expertise are now available to the entire health care field and our members here at the AHA. To learn more about Ed and his services, please visit www.aha.org/cybersecurity.

John Riggi

Thanks to all our listeners for joining us today, and thanks for what you do every day to defend networks, care for patients and service your communities. Stay safe everyone.

Tom Haederle

Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.