This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

Today on Town Hall

 Those of us that are in healthcare IT we're generally here because we want to feel like we have an impact. on our patients, it's difficult to transition from giving doctors the tools that they need to care for our patients to finding a way to safely transition their care and their records to a new operator.

My name is Bill Russell. I'm a former CIO for a 16 hospital system and creator of This Week Health.

Where we are dedicated to transforming healthcare, one connection at a time. Our town hall show is designed to bring insights from practitioners and leaders. on the front lines of healthcare.

Today's episode is sponsored by Meditech and Doctor First .

Alright, let's jump right into today's episode.

 Thank you for joining me for Town Hall today where I have the honor of interviewing David Colarusso, who is the CIO of Steward Health. David, you've been there over 13 years and y'all are in the news quite a bit for so many different aspects of what's happening in your healthcare system.

So thank you for taking time to be with This Week Health today. No problem at all. Happy to join. Great. I'm going to jump in with the obvious only because it's something that's top of mind for a lot of people and part of what we have discussed. And that is Steward going through a pretty significant divestiture at this interval.

And it leads to so many conversations and questions about access and equity to care and what To your point, payer mixes are doing to different organizations and that what you are going through very well may be a bellwether for others to really pay attention to because it could also happen to them. I think a bit like ransomware.

It's maybe not a if it's a when in some cases. So Please share with us some of the things that you're experiencing from this and what others should be thinking about as they watch your journey. Sure. I think the biggest takeaway with what's happening with Stuart right now is, I believe, we're the first, but not necessarily the last hospital system to really go through this process.

Our hospitals are high Medicare, Medicaid, payer mix. And after COVID, with the large increase in costs for nursing, costs for providers, supply chain costs, the governmental reimbursement didn't go up, right, and in fact, in many cases like Medicare, they came out with the great news that it was going down only 2%.

So it really became almost impossible to not run the hospitals at a profit, but to run the hospitals at a breakeven. And we tried really hard over the, over that time to, to find a way to overcome the challenges in front of us. And, it was very difficult. We didn't want to get on the road that we've gone down.

And, certainly at this point in time, we've worked with the court and the governmental agencies in the states that we're in. to find new operators for most of our hospitals many of whom are non profits, so that we can, we can ensure those hospitals are providing care to the communities.

At the end of the day, those of us that are in healthcare IT we're generally here because we want to feel like we have an impact. on our patients, right? And so it's difficult to transition from giving doctors the tools that they need to care for our patients or giving our patients the tools they need to care for themselves to finding a way to safely transition their care and their records to a new operator.

But we've had to make that switch. That's the switch we've made over the past six months or so to find out a way that we can easily transition to the new owners Those records and really those workflows so they can continue on in the future. We talk about healthcare being hard, but there are aspects of we choose what we do because if it was easy, someone else would be doing it.

When you forecast how you're working with your team. Having to appreciate really what they're going through right now, that there is an end in sight, that you are part of this equation. What are some of the ways that you're helping them appreciate what it means to have a transition services agreement, what it means to keep systems running, what it means to have cohesion in ensuring that when a patient walks in the door, they're still going to be safe?

So, I think it speaks volumes about the staff that work here. that they're still working hard to ensure that patients have access to their records, providers have access to their records. In many ways there's no reason for them to do that. and what I've told my team is really, each one of them has to look at themselves and determine what's important to them and why they should stay.

I know why I stay, right? I do have a very. Solid thought process of, if not me, then who, right? And, it's important to, to put yourself in the place of the provider, in the place of the nurse, the place of the patient, and say, if the IT group abandons us what would happen?

And the reality is the hospitals would shut down. And that's not what we want, right? Every one of us. has been to our hospitals. Many of us live in the communities where our hospitals are. And so I think the vast majority of the team, they're not there for me. They're not there for Stuart. They're not still working because they think that we should pay off our lenders.

They're working because of their direct leader, who they have a ton of respect for. and they're working because they do understand that they have a direct impact on that patient, that provider on the front lines. And if that they walk away, That's just one more sort of nail coming out of the door that's holding everything together.

Well, you've done over the years. I mean, this is what's happening today. The organization's always been involved in significant M& A activity, growing your reach and capabilities. And then again, the challenges related to balancing financial performance. You still had so many innovations that have occurred in your time there.

And I don't want to ignore those. And so as you think about some of the lessons learned from your larger scale implementations, some of the activity that created Steward in the first place, what do you reflect upon and say, yes, we did that? Well, there's a lot that I could go through, probably fill up, an hour worth of time.

But overall, but by far, we grew from eight hospitals in Massachusetts to to almost 40 hospitals across the country in the course of three months. And that was really a time in my life that I, is a blur. We immediately embarked on installing our EMR at eight of the hospitals that we purchased.

that was a tremendous learning experience for us. You think you understand the process and work it takes to acquire until you get into it, right? But once you get into it and you make all those mistakes the first time, it certainly is quicker and easier the second time. So, we installed those eight hospitals in probably, it took about 13 to 14 months to bring them up on our network, bring them up on our systems.

But when we turned around and did the next 17 all at once. We brought them from the start of the project to live in nine and a half months for 17 hospitals and we did that in the middle of COVID. So, it forced us to do things in ways we never expected. And it forced me, actually, to come out of my comfort zone a ton.

When we were doing the go lives for those hospitals I'm very old school in a lot of ways, right? I believe in FaceTime, I believe you should be on the floors, you should be working directly hand in hand with the, with the nurses, with the docs, with the lab techs, the pharmacy techs, the pharmacists and that presence means a ton.

But certainly, the staff can't be everywhere at once. So even if you have, five staff on site they can't be on every floor, they can't be all over the place and you can only utilize them You know, for a certain amount of the day. I was convinced by my team. And I fought it.

I fought, I'm going to be honest. I fought it. To really do a remote go live have a small contingent on site. Cause it was during COVID people were worried about traveling. I was thinking we couldn't even do the go lives and they came back with a great plan leveraging teams. We got cameras up on all of our devices.

And. We actually got, from that go live, better feedback on our support than when we actually had people on site. Because we had a larger group of people that could support via Teams, and instantaneously someone could get help, right? Whereas on sort of the traditional go live that we had, if they couldn't find a person on the floor, they tried to call the helpdesk had to get to the command center had to find a person, send that person up.

We had 10, 12 people sitting up, waiting on teams from their house at two o'clock in the morning to help anyone. And so when a person needed help, they could get it instantaneously. so since then, all go lives, we've moved that bottle not because people don't travel which certainly is a cost savings and a huge benefit, but because frankly, it is better, it's better support.

And that's probably one of the things I find that I'm most proud of because It wasn't me that thought of it. It was my team who really pushed it. And if anything I think. I take away the fact that they felt comfortable pushing it with me and kind of telling me I was wrong, right?

And then, I've never been so happy to be proved wrong. Well, your sense of humor goes a long way because you, your pragmatism is always an appreciated perspective. And, When you create an environment that's safe for people to push back, they know that if you're going to support it, you mean it, and that's just a really interesting way to lead, and one that is often overlooked, is that can your team push back and feel safe doing so?

from all the work you've done with them, think about, okay, you, Acquired a ton of hospitals and then you would go live during COVID and now you're in that space of having to potentially obviously divest all of these. It's like anything we put together we can take apart and even if it's not something we want to be doing we have those shops we start to learn how.

And you've done more than just the implementation called acquisition, merger, divestiture. You also created an entire organization to support back office. That was a huge innovation as well. What can you share with us about the team that you have built in Columbia? Oh, sure. So, we began looking at obviously cutting costs in IT.

That's a huge item that every C suite looks at. How can we reduce the cost of IT? And so, we had every consultant in the world came in here and told us what we were going to do and how we were going to do it. The reality is the savings that you get from outsourcing to an outsourcer, like Accenture or Tata or, nothing against any of them they're, I have no concerns with them, but for the work involved to moving the outsourcing to them.

For an IT department that frankly at the time was a little bit immature. So it wasn't like we had a, a solid process and procedure for everything we did that we could say, Hey, this is how you do it. really, when I looked at it, the, the juice wasn't worth the squeeze, but there was a big push that you had to actually save dollars.

So what we looked at was, We actually through a series of other connections, have a sister company in Columbia called Stuart Columbia, and they own five hospitals in Columbia. So we work with them to stand up what we call MHS Columbia, Management Health Services Columbia, and they are a separate company in Bogota and Medellin.

And we began hiring there as an adjunct to our staff in the U. S. And so, we went from where we were getting, let's say a 20 to 25 percent savings on staffing to anywhere from a full 3 to 1 to 5 to 1 labor arbitrage down in Columbia. From people that are, highly educated, coming out of university.

My help desk staff, IRIS, FHIR. all hold a college degree which, is kind of amazing when you think about it. And, The salaries that we pay in Columbia are good salaries in the Columbia market. And, from being down there, we feel really comfortable that those folks are happy.

We do what we can to ensure that that they continue to be we actually pay a little over market. And that's a huge benefit for us because it's a giant savings for us, but it allows us to retain staff because of the fact that we're paying a little over market. About a year ago, we were able to fully separate from Steward Columbia.

So it's a freestanding a freestanding company now. We have about a hundred IT employees there and about 20 employees from other areas in Steward, like AP and supply chain. I love the model and I love the asking you, like, how scalable is it? Can others use it? And it's something that could be on the docket.

I mean, it could become a service for others to think about, which lends itself to the ongoing conversation around cyber and resilience and the ability to say, okay, you have a multinational organization. You're going through major TSA activities right now. How are you keeping everything safe? What does that cyber resilience look like for your organization right now?

Well, I generally just. live in a general state of fear. That, that helps to always be on guard. But you know, truthfully, I have an amazing cybersecurity team. It is not a big team but it is an incredibly knowledgeable team. I was very lucky in that the prior CIO before me brought some of these players in who are really just amazing folks.

I have staff that, have been a part of startups and, in the cyber security world. I have staff that were, that are former FBI. I have just amazing staff on the cyber side. Cyber security is a very difficult topic to talk about because I think anyone that's watching this knows that you don't want to say anything because you're convinced that you're going to jinx yourself.

And, we've been lucky so far. We certainly are very worried about all the TSAs and the transitions, because we're going to be, really poking holes in a lot of the fabric of our cyber security design. And that is concerning to us. It has been a concern that we've raised with our executive team here.

It's a concern that the team has on a daily basis. But we also understand that we have to do it and we have to do it in a manner that's as safe as possible. We are very proud of the fact that, we were able as a healthcare organization to stand up Zero Trust over a year and a half ago for all of our hospitals and corporate.

We've been able to implement PKI across the enterprise. So we've been as ahead of the curve as we can be. We recently introduced 16 character passwords for the system. And there was a, I'll just say a little bit of pushback. But, once we gave folks the information on why that is it really helped the pushback a lot.

I still get a lot of jokes from people who get on the phone with me going, Oh, I got my 16 character password. I don't know if I can remember it right now. and I like to remind people that I don't like it either. But when you look at the additional benefits that 16 character password gives you from, anyone trying to brute force, break that password, it's, you move from someone being able to potentially break it in a year to moving to the fact that, it would take someone, I think the the number is like, a million years or something like that to be able to break that password through brute force.

So, I have the document up on my door so everyone can see it as to what it is. So I should go over there and read out what it actually is. But it was a change that not everyone loved, we were able to, we were able to push through with it. And we wanted to do it before the transitions so that all of our buyers when they came along, it was there and that's what the the staff was used obviously we're full MFA. And that has been, a challenge at times as well from folks who feel like they need to be different and not be a part of multifactor. Generally those my peers in the C suite, want to be different. But I've explained to them that they're probably are, they are probably without a shadow of a doubt our biggest risk, right?

Those are the folks that don't think that they need it, are the ones nine times out of ten that get popped, and are the ones that have a breach. So, a lot of working with feelings but explaining to people that they're not different that they're going to, they're going to be the same as everyone else and everyone needs to work together to try and protect the organization.

Well, kudos for getting a 16 character password enabled in your organization. As you're saying that, you could see the look on my face. I'm like, that's a lot of characters, David. It is. Although, I've been there and worked through some of those conversations, because to your point, the C suite, Can now be DeepFate, can be SphereFish most effectively.

And what a perfect time to be going after those titles and those people when you have so much transition occurring in your organization. If you take it back to the clinicians and to some of their workflows, and if you've got those protocols in place, are you also using either tap and go or session broaming?

How did you get that change? pushed through with your clinicians so that they didn't feel like the additional 16 character password with MFA was going to hinder their workflow in providing patient care. So that's a great question. We made sure that we were tap and go in every ED. Before we even broached it.

So we were tap and go in every ED. We were tap and go at the vast majority of our floors at our hospitals before we, we embarked on the 16 character path. There's no way that I could ask an ED physician to be putting in 16 characters every single time they tried to log on somewhere.

We don't have full session roaming yet. We're looking right now in the process of standing up VDI. We're looking at Microsoft AVD in order to do that. And part of the reason why we finally got the approval to do that is because our fleet for front end desktops is ancient. And so handling the Windows 11 requirement in October of next year is going to be borderline impossible if we have to run on the desktops that we're running on.

So, the solution to that, which actually, in the grand scheme of things, saves us money from having to replace all those, is to move to AVD. We're going to use IGEL on the the client itself, run AVD on top of it. That's it. And we're doing something similar to that at our South Florida hospitals, so we know for a fact it works great in our environment.

It really is the future that we're going to try and move to, which then will allow full session rolling. and, really allow us to have a lot more control on the cyber side as well. Because, when we talk to some of the CIOs who have unfortunately been through a cyber attack, the encryption of the front end desktops.

at times is even more difficult to come back from than the server encryption, right? So, 80 percent of your desktops get encrypted and you have to do essentially a full wipe and reload 20, 000 machines across your enterprise. , That's, a month and a half of time before you can get people up and running.

We had IGEL we were working on IGEL in, getting ready for our South Florida go lives. And the, the hospital system we had bought the hospitals from had a ransomware attack, major ransomware attack, brought everything down. And so at the time, the EMR that we were working from was at the EMR company's data center. It wasn't at the hospital system's data center, and it was run through Citrix in that data center.

So while they were struggling to get back online we deployed IGEL. to our laptops and Wows that we had recently brought on board at those hospitals and got them up to the floors. And we were able to get our users at those five hospitals back online in about three days. And the rest of the hospitals that were out there, took them a few weeks before they went back up with the EMRs because they weren't In that available ABD space that we were trying to move into.

So, we've been able to prove out the benefit of it. And that's, a huge thing when you're trying to get the funding to do it. That's not the way I wanted to prove the benefit of it. the hospital system that went through the cyber attack that was a giant a giant issue that they had that I would not wish on anyone.

So it's certainly not saying anything negative about them. But it was able to allow us to prove out some additional technology that would be Well, and it also gives you a chance to then bring forward and say, this is what it's going to take to do these things. And then when you upgrade those desktops and some of those environments, I mean, we can get more time out of some of our machinery these days.

It's also important that it too eventually does have an expiration window and Cyber seems to be the best indicator in many cases, along with the workflows for the clinicians to bring the best ideas forward. It's still tough to fund. I mean, we all face it the moments of do you buy a OR bed or areas, or are you looking at new machinery?

And so I love the creativity that you and your team have put in place. None of that happens without your leadership. And so With everything happening in your orbit throughout the years, when you think about fostering innovation and collaboration, but also CIOs and aspiring CIOs listening to this conversation today, what advice would you give to someone who's an early careerist or that first time CIO knowing what you know today?

So I think the first thing is to realize that you don't know everything. That, that's the, that is by far the most important thing. IT is such a, is such a vast playing field of knowledge requirements that you can't know everything, right? My cybersecurity guys know way more than me. My network guys know way more than me.

Storage, server, way more than me, right? Am I dangerous enough to be able to dabble so I understand what our strategy needs to look like? Absolutely, right? Do I listen to them and have them teach me lot about what. They know what they're doing. Absolutely. But the minute that I think that I know better than most of them is I think when I'm going to fail.

My job, especially in a large organization, a long time ago, moved away from solving technical problems, right? My job now is translating what IT does, the importance of IT, the importance of cybersecurity from the tech speak that we have. into what executives will understand, right? And, that actually is a skill set.

don't realize it until you get into it, until you work with other people who don't necessarily have it, right? But if you don't approach things in the right way, if you can't put things in terminology that other people can understand, You talk for one minute, and their eyes glaze over, and you've lost them, right?

So, what I add to the team is bringing the group together, allowing them to function as a single entity, right? The network guys, the server guys, and the application guys, and the telephony guys, All of them have to work together with cyber security to make this whole thing run, right? And so my job is to keep that team working together in the same direction and also translate our needs to the executive team so that we can actually get some of the, Good things we want to do accomplished.

The one thing about IT is the best people in IT if they are feeling stale, if they're feeling like they're just coming in every day and keeping the motors running, they're going to move on to something else. They want to be doing something new. They want to be doing something cutting edge. They want to move the organization into a better direction.

And if you're not constantly feeding that, if you're not feeding that desire that they have to make things better and to try newer stuff then you will very quickly lose your better staff member. and so that's probably the biggest challenge that I have is how do we keep that innovative spirit alive, especially in the world that I'm in now finding a reason for the staff to go.

Why am I doing something when I'm not really moving things forward is translating to them. We are, you are moving things forward. You just got to look at it in the right way. I can agree with you more. And especially if you think about what you've done and what you're headed for and the level of just of intensity and culture and change management and resiliency, and still the innovation to make all of these things work.

It's one of those opportunities that. You hope you don't have to do it often in your career. And yet to where we started is if this is something that we believe may become commonplace across the country, as health systems consolidate for myriad reasons, inclusive of financial pressures, that ability to still provide great patient care, to have the equity and access that are needed, they're getting it firsthand and you keep reminding them of those pieces.

And so they're actually doing things that other people aren't. in a way that could become incredibly powerful for those that may face it next.

so much for your time today. In the midst of everything you have going on, I am so grateful to have spent time with you today. I look forward to hearing about your continued journey. We know under the leadership that you bring to the table, your organization is in a great place where they need to be from a technology and strategy and forward thinking perspective.

And as soon as some of this dust settles and get into 25, would love to have you back on the show and hear where you are and what you have planned. We'd love to join you. it's going to be great no matter what it is. And as I tell my staff now if we can do what we're doing now, then everything else is going to seem easy after that.

100%. David, thanks so much for joining us. That's all for now. Thanks for listening. Bye.

  📍 📍 📍 Thanks for listening to this week's Town Hall. A big thanks to our hosts and content creators. We really couldn't do it without them. We hope that you're going to share this podcast with a peer or a friend. It's a great chance to discuss and even establish a mentoring relationship along the way.

One way you can support the show is to subscribe and leave us a rating. That would be really appreciated.

Special Thanks to today's episode sponsors Meditech and Doctor First

Check them out at thisweekhealth. com slash partners. Thanks for listening. That's all for now..