2 Minute Drill: Cybercriminals Weaponize AI: Self-Modifying Malware with Drex DeFord
Episode 10420th November 2025 • UnHack with Drex DeFord • This Week Health
00:00:00 00:05:15

Transcripts

This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

The 229 Podcast: Technology Is Not a Strategy - the Problem-First Approach with Shane Thielman

Bill Russell: [:

Shane Thielman: How do we leverage the digital assets and capabilities that we have to improve quality and outcomes, reduce cost structure. And I really kind of see this as a defining moment from an IT standpoint as to how we can further enable the organization

,

Bill Russell: My name is Bill Russell. I'm a former health system, CIO, and creator of this Week Health, where our mission is to transform healthcare one connection at a time. Welcome to the 2 29 Podcast where we continue the conversations happening at our events with the leaders who are shaping healthcare.

Let's jump into today's conversation.

All right, it's the 2 29 podcast, and today I'm joined by Shane Thielman, Corporate senior Vice President, chief Information Officer, and Digital Officer Scripps Health, San Diego. Shane, welcome back to the show.

Shane Thielman: Thanks, bill. Good morning. Great to be here.

changed since the last time [:

Shane Thielman: Almost 20 years, yeah. I just had my 19 year anniversary back in July.

So, seen it through a variety of different phases and transitions and , occupied a variety of different roles along the way as well.

Bill Russell: When did you guys do your Epic implementation? Was that a while ago?

the organization starting in:

So a little different than the model that Epic has been promoting more recently, which is the. Single big bango live. I'm appreciative that we had the opportunity to deploy the way that we did because we really took the lessons learned in the first deployment and applied those to the second and third in a way that made those successive rollouts much more um, palatable for the organization.

And we were able to apply all of the lessons learned in a way that by the third go live, it was more or less a non-event, which was outstanding.

ssell: How much time did you [:

Shane Thielman: It was always planned as a three wave go live.

But originally we were going to give ourselves six months between the first wave and second wave. We went live across our ambulatory environment and wave one in one of our hospitals. we had some challenges that as we were digesting and working through those, we actually extended the timeline between wave one and wave two to one year.

And then um, the third go live was shortly after wave two. So we fitted in over the course of a year and a half.

m not sure that was a word in:

Shane Thielman: we were more or less consistent with Foundation at the time.

urse of the last seven years [:

Again, it was, much like our third wave of the go live. It's just become something that we've been able to sort of, integrate into the organization relatively seamlessly, and it allows us to stay current and benefit from all of the latest features and workflows and the latest code that's available from Epic.

So. That's been I think an important part of our journey is just that level of consistency and and then making sure that we're staying abreast of all of the work that Epic's doing to unlock new features and capabilities.

Bill Russell: So that was a decision from the Go Live, so you didn't have to do a refuel or anything to that effect.

That was a strategic imperative of your implementation.

Shane Thielman: It was actually a guiding principle and you know, we spent a lot of time talking to other organizations about what they would do differently, not only at Go Live, but thereafter. And we suffered through you know, having two different electronic health records.

tration and billing systems. [:

And increasingly more our patients vary directly in the context of all of the features that are available to patients through MyChart, which we've rebranded as my Scripps.

Bill Russell: All right, so I'm gonna cheat a little bit here. I have a city tour dinner tonight and 2 29 Summit this weekend.

You hosted the San Diego City tour dinner early September. What were the topics? What was what was top of mind for people in that city tour dinner?

Shane Thielman: as I'm talking to. Peers and colleagues and other organizations. I mean, I think all of the change that's coming at the federal level was a consistent theme throughout the dinner and specifically the reimbursement changes that are on the horizon.

contemplated in the future. [:

Improve quality and outcomes, reduce cost structure. And I really kind of see this as a defining moment from an IT standpoint as to how we can further enable the organization, help improve workflows, quality, patient provider experience but as well identify ways in which we can use technology to, to reduce cost structure.

Bill Russell: The last conversation we had it was apparent to me that you guys are as an organization, Scripps is very disciplined in terms of their selection of projects, in terms of measuring projects defining what the objectives are, and then measuring them all along the way.

t's hands. We have tools for [:

Shane Thielman: you, you hit the nail on the head at least in terms of, I think being very pragmatic and methodical about how we select initiatives as an organization that has its challenges because there's no lack of demand for it and analytics in the organization.

think very importantly, help [:

And it seems very foundational and simplistic. We've been on this journey for about seven years now. We have about 40% of our, appointments available to schedule online. So it really speaks to the change management. I think challenge but also imperative that we have in healthcare, which is how do we make ourselves accessible and available to patients and give them alternatives from the traditional phone call in to the physician's office or into a contact center and our patients are responding.

he um, the online scheduling [:

It's gonna be increasingly more important to distinguish ourselves in terms of being a provider of choice for those that, that, that have that choice. And, and so, but that extends well beyond just online scheduling. Everything from enabling, you know, patients to have visibility into wait times in our emergency departments and our urgent care centers.

Being able to hold a place at our lab draw stations and be able to see the wait times across our various draw stations. We've done a lot of work with virtual to enable on-demand virtual visits both in our equivalent of our retail clinics, but also for primary care. And then we've spent a lot of time operationalizing wait list features that are, you know, giving a.

rticularly important in some [:

So. That has been a real core area of focus for us. It will continue to be a core area of focus, and I think that there is really unlimited potential there. There's also a shift, right, in terms of giving patients more ability to self-serve. And that doesn't mean that works for every patient.

And so we also are focusing um, a lot culturally, which is less about it on this mindset of getting to yes. And how do we make sure that we're helping our patients navigate to the right services, recognizing the complexity that's one critical area of strategic importance for us.

m, We focused around patient [:

We've been able to deliver automation and prioritization for some of our support services like EVS and transport. We're seeing improvement in the time from decision to admit to getting a patient into an acute care bed around a 20 to 25% improvement in that cycle time. And then enabling some other capabilities within the electronic health record that really create visual management for the care team around the progression of patient care through their episode of care.

Bill Russell: What,

Shane Thielman: More recently we centralized telemetry as well, and so we took really a function that existed at each of our five hospital campuses. We consolidated that technology sta stack into a single server, and then we took the telemetry technicians and we actually reorganized them, took them out of the hospital.

ds around how we educate and [:

So we've been using really the command center as a mechanism to leverage our human capital and our human talent differently. But then also think differently about how we leverage our technology assets to be more effective and efficient. So just a couple of examples. And then, you know, that sort of third leg of the stool, of course, would be ai, which is its own conversation.

But those are sort of three strategic areas of focus that I have and that the IT department has in really enabling the organization

Bill Russell: I wanted to go through a bunch of those. So just to give people some context here. So Scripps is pretty much San Diego County.

Are you outside of San Diego County at all?

Shane Thielman: No. So, we're specific to at to San Diego County.

u would still do the command [:

Shane Thielman: I think the command center, based on the experience that we've had could certainly contribute.

Um. Across a, a multi region health system. I think there's complexity related to culture change that has to be accounted for, and having an underlying foundation, having a standard technology stack to begin with, would be critical I think, in order to fully realize the outcomes. But I do think that there, and I think there are many organizations that are doing this today across multiple regions successfully.

So I think the answer is yes. There's some caveats to that. I think ultimately to enable the type of outcomes that we've been able to realize to date and really sort of unlock the full potential.

Bill Russell: The uh, patient flow and improvement. I forget the exact me metric, but you were like we improved by 20%.

here an efficiency return to [:

Shane Thielman: Yeah. You know, we spent a lot of time thinking about. Not just the measurement, but how does that translate to overall improvement?

I think the reality is there are so many initiatives that are occurring in most hospitals that are focused on targeting length of stay improvement. And so rather than try to attribute. These enhancements to a length of stay improvement. We've tried to look holistically across the episode of care at all of the white space where patients are waiting.

Um, and, And that's really where we focused our efforts. So we haven't translated in it into a direct length of stay improvement or a direct financial improvement for the organization. But what we have said is that we know that we have , high demand for our emergency department services. We have a need to be able to turn beds over efficiently.

ace, to free up an ed bay um [:

So this has been a little softer in that sense, but we do have KPIs that we track to and manage to on a routine basis. And that's really done in conjunction with clinical operations who really have to be at the table in order to to support those types of process improvements.

Bill Russell: how have you guys attacked discharge time?

I, every now and then I hear stories of, you know, people waiting hours and hours in a bed that we know is in high demand.

Shane Thielman: Yeah. I think it's a great question. We actually started that was our, sort of our first step in addressing flow, which was to adopt a set of discharge milestones that were visible to the care team and created some alerting for members of the care team if.

lestones being completed and [:

The other thing that we've done, we've instituted, a 10 12 2 program. And what we do is we measure ourselves discharge order written by 10:00 AM patient discharged by noon and bed cleaned and available for next patient placement by 2:00 PM And so that is another, sort of operational activity that we've hardwired into the electronic health record as part of our standard work.

And then, you know, I think, bill, the other thing that that we've done is and I think this is, you know, in the future it will be exciting to be able to deliver some um, some predictive analytics as well, is upon admission, there is an expected date of discharge that's documented in the electronic health record.

tand where we have variation [:

But really understanding those outlier cases and how we can do continuous improvement. And again, it's all about how we can utilize the technology that we have to do the visualizations to create awareness across the care team and then really build that into our daily clinical operational huddles as well.

Bill Russell: You know what's interesting earlier on you said, either technology is not a strategy or it is not a strategy. Whatever it was, is some terminology around that. If people are listening to this conversation. It's obvious, like we haven't talked about ambi. We will talk about ambient and we will talk about the technology.

ction. When you guys look at [:

It's not just, Hey we've heard other systems are doing this. Everybody seems to be happy with it, we're gonna do ambient. How did you build that business case and what did that look like?

Shane Thielman: I think it was back in 20 18, 20 19 nuance at the time announced that.

an. And fast forward to early:

Really their roadmap and how they envision this um, rolling out in organizations. And and then COVID descended on us and we were uh, understandably distracted and focused on other things, but we actually were early adopters of DAX back in 2022. This [00:18:00] was before it was fully automated and it was a little bit more it was probably one of those decisions that was less structured around.

Key performance indicators, but more based on I think the cognitive burden and administrative burden that our physicians were experiencing as really the justification to do an experiment. And we brought Dax into the organization. We deployed it with 50 physicians at the time. Um, We learned a tremendous amount around success factors just in terms of cultural readiness and change management, which was probably not a surprise, but obviously it's not as simple as turning it on.

If you want to get the level of adoption that really can be translated into demonstrable improvements in provider experience and patient satisfaction. One of the, probably the most interesting findings that we've had with Ambient is the quality and the fidelity of the note that's generated.

nges that many organizations [:

And I like telling the story because the outcome was that the individual that completed that audit actually changed their primary care physician to a primary care physician that was using ambient listening, because the,

Bill Russell: that's classic

Shane Thielman: fidelity and the quality of the notes was outstanding and. I actually think that's probably overlooked in a lot of the conversations that are happening around ambient.

ows and processes. And as we [:

Future AI enablers that that we see on the horizon. And so, we have actually taken a pretty stepwise approach since then. We've been experimenting on the inpatient side, so specifically with a group of ed physicians and using ambient. It works for some. It's still evolving in terms of the technology itself, at least in terms of the perspective of some of our ED physicians and our as well are looking at exploring some options with our hospitalists in the future.

we're really prepared for a [:

Bill Russell: Yeah. I'm good. You know, you just talked about the person switching their provider based on something. At UGM this year I was sitting next to, or sitting near a physician, CIO and after they showed what what was possible with Cosmos and it's sort of looking over the shoulder of the clinician and providing it like, Hey, what about this?

Maybe take a look at this. You know, outside of the alert fatigue that they already experienced and having cosmos look over your shoulder and the cul cultural change that's required. I did I asked the physician, 'cause I said, you know, my response to this as a patient watching this is, I think I want my physician.

ings. Whereas I know what AI [:

Were you at UGM this year?

Shane Thielman: I was, yeah,

Bill Russell: First of all, as a CIO, how do you walk away from that and sort of package that up and go back to the organization and say, okay, this is what I saw. This is what is potentially around the corner for us. And then how do you, I don't know, socialize that and get that into the process of people evaluating, you know, is this something we should prioritize?

Shane Thielman: I feel incredibly excited and enthusiastic after most egms, and at the same time I feel drained because it's so much information. And I think to your question, it's really around how do we start to plan and meter out the way in which we would adopt some of these new features and capabilities.

we really focus on problems [:

Bill Russell: The problem with the long term is there's gonna be another UGM before you get to your long term.

Shane Thielman: Exactly. Well, and I think you're actually, you know, you're hitting on something else, which is, you know, what is, what is our ability I think as an industry really to increase the cycle time in which we do and sort of, integrate change into the organization and

know, again, this is where I [:

How do you select and how do you prioritize? And then what are the trade-offs, right? Because there's an opportunity cost of selecting. You know, one priority and maybe deprioritizing something else. But I think we have to do that if we're going to be successful because I, you know, my fear with ai is that.

We don't unlock the power and the potential because we don't bring our workforce along in a way that they have an understanding of how to be successful in working with AI based on their role. And ultimately based on the capabilities that we can offer them. And I think, you know, kind of starting with our physician community, I mean, I think that's a group that we absolutely want to gain familiarity and comfort in working successfully with AI and hopefully creating pull where they're reaching into the organization and saying.

really like to you know, to [:

We're not doing anything today in our organization with AI at scale. I think over this next year we're going to get there, whether it's with our nursing community or with our physicians, but that won't happen just because we make the AI available. It actually is going to take some level of effort, both on education and training, but also sort of understanding how this can be assistive and help augment the workforce.

And I think our experience has been when we've invested the time and effort, more narrowly, we've been very successful in level of adoption and receptivity and understanding and almost, you know, kind of driving that demand for more. When we've kind of parsed that against maybe a less involved approach, we don't get the same outcome.

And [:

Bill Russell: So last UGM, they rolled out a hundred and let's just say 150 new AI features. This UGM, they rolled out a hundred and something new AI features. And you know, the first year I think they made a mistake because they sort of talked about it like, Hey, you just switch it on and we're all sitting there going.

No, no I can't just switch it on. However,

Shane Thielman: right.

Bill Russell: That is how AI is sort of showing up at every health system, including Scripps. It's like, you know, Microsoft baked it in Workday's, baked it in, ServiceNow's baked it in.

Shane Thielman: Yeah,

Bill Russell: Epic's baked it in. How do you govern that when it's like all of a sudden there's just another feature that sort of shows up in the application itself?

eresting. We spend some time [:

In the context of a workflow or a process if it's just suddenly enabled. So that's kind of our first, that's our starting point. It's just understanding what are people actually discovering and finding that is available and then being very intentional about the things that we are making available.

And so I'll give you an example, and I don't think that we're different than many organizations, but we have a um, an internal private connection to OpenAI and ChatGPT anybody can access it, we have about a thousand plus employees and physicians that are using it some more than others.

t its limitations are. We've [:

That has actually been very powerful and it actually kind of creates this virtuous cycle where they start talking to their peers and colleagues and suddenly we have people joining these, these meetings where folks are sharing what their experience has been and then they ultimately sort start to use and adopt and start to, you know, kind of apply their creativity to generative ai.

And it's been fantastic in terms of what it's helped to facilitate across the organizations also brought very diverse roles together. Everything from. You know, you know, kind of a frontline practicing physician to administrative support, revenue cycle personnel IT folks. And so I think that's been really exciting.

the software that we use. We [:

Even more importantly, how they can add value.

Bill Russell: The promise of technology has always been that eventually it would become invisible, right? It would sort of go to the background and the example I give, it's not a great example, but the example I give is, in the car you're driving down the road.

All of a sudden, not only does the car beep, if you're getting close to the car in front of you, it actually steps on the brake. And if you go over the line, it sort of rumbles a little bit to sort of. Joel? Yes. It's like it's doing all that stuff in the background. I haven't looked at the stats, but I would imagine each one of these things, I know that when they put that light in the back of our in the back of our car and they elevated it, it took the number of accidents down precipitously.

know, it's imaging reads and [:

That's what we're hoping for, is that technology would, again, move more and more in the background. But there's an awful lot of design and an awful lot of work that goes around doing that. How do you, how does your team partner with the with the frontline organization? It be it administrative, be it clinical to identify the opportunities to, to roll that technology out or roll it out effectively?

ur hospital-based physicians.[:

Working collaboratively with our radiologists and support teams. And so that foundation has been very helpful as we start to more formally evaluate some of these very sophisticated AI capabilities. Just using the example that you shared, bill and imaging obviously we're constrained.

We don't have unlimited resources, and so that prioritization becomes very important. We have some, um. some capabilities that are lined up and prioritized for next year that are going to move us much closer to that sort of target state, right, of truly assistive AI that can help direct a radiologist to a potential, you know, patient concern with an imaging scan and hopefully help improve our ability to deliver a diagnosis in a more timely manner and and start a treatment process. Most of the work that we've been doing with AI to date, I think has really been focused around administrative cognitive burden and sort of the.

ciencies that just naturally [:

And then ultimately, how is that gonna move into helping to inform diagnosis and treatment decision making. The basis for that really is how do we organize ourselves as an IT team? You know, we're not successful if we're not out in the field interacting with our counterparts and our partners. I have to be doing that at the executive level and with our physician leadership.

And so we've really kind of. Leverage that foundation that goes all the way back to pre, you know, EHR implementation and kind of road, that wave of maturity, which I think is very exciting because there's also an understanding to your earlier comment that. We could be doing a lot of things.

or our patient community and [:

Bill Russell: I run the risk of uh, PTSD question here, which is I wanna talk about the 2021 event. Now, Scripps, you guys as a leadership team have been fantastic. I mean, we have a lot of learnings as a result of how open the leadership team has been about it.

don't talk about your cyber [:

You have to go back to, like, reminding people? Or is it like always present where people go no. How are we gonna secure this? Has it changed the culture and how does distance from that event change the culture?

Shane Thielman: it was a traumatic event for the organization. So it's not lost on those that were here today. Um, And I think probably one of the most important things that we've done is we've really translated that experience into set of sort of routine clinical continuity exercises that are.

her it's a cyber incident or [:

Our patients others in the community, other providers so that we're more adequately prepared in the event that there is any sort of catastrophic failure that impacts script. So I don't think that we've lost that, you know, when there's some sort of network issue. I think everybody still holds their breath, hoping that they're not going to hear that, that we're dealing with a cyber issue.

And so, I think there's a deeper understanding and respect as well for the importance of having those safeguards in place and what it can mean in terms of maybe adding a little time to a particular workflow in order to ensure that it's secure or even how we onboard new medical equipment.

[:

Bill Russell: You know what Shane the thing that surprises me still, 'cause we have these 2 29 meetings and we talk about this and the idea of business continuity and resilience.

One of the questions I always throw out there is, okay, who owns it in your health system? And if you haven't gone through an event like that, a lot of times they just sort of look at 'em like, well, I think they think it owns it. I'm like, yeah, it really can't own that. Like, I mean, they're a big part of it, obviously in cyber, but they can't own it from a, you know, from a, a hospital operations standpoint and continuity standpoint, it's got, it's almost owned by the entire organization.

it's a change in the culture and a change in the thought process.

facilitators, but really as [:

We have one actually scheduled next Friday at one of our large hospital campuses. It's co-sponsored by the chief operating executive of that campus, and then our Chief Medical Officer, chief Medical and Operations Officer for the health system. And so it's gonna bring together about 25 to 30 different stakeholders from both.

That site as well as physicians. And then our IT team. And we'll work through that exercise and then we'll debrief and talk about what did we learn, what do we need to change moving forward? What do we need to do to adapt our policies and our standards in order to be successful? And then we share that more broadly across the health system as well.

oof that you guys are really [:

Shane Thielman: Yeah, thanks, bill. I think it goes, uh, goes without saying that really appreciate what you're doing as well with the 2, 2 9 initiative and the way in which you're bringing together various stakeholders across the industry. Routine listener and really appreciate the way in which you sort of facilitate the dialogues and conversations and bring together unique perspectives.

It means a lot and it's certainly assistive to me in my day-to-day work. So appreciate it.

Bill Russell: Appreciate it. Look forward to the next time we get together. Thanks Shane.

Shane Thielman: Absolutely. Thanks.

Bill Russell: Thanks for listening to the 2 29 podcast. The best conversations don't end when the event does. They continue here with our community of healthcare leaders. Join us by subscribing at this week health.com/subscribe.

tive knowledge and transform [:

Chapters

Video

More from YouTube