July 7, 2025: Mick Coady, CTO at Armis, joins Drex for the news. This episode examines a sobering milestone: the first confirmed patient death directly attributed to a ransomware attack on London's blood distribution system. The conversation explores how a single cyber incident creates cascading effects across entire healthcare networks, flooding neighboring hospitals with redirected patients and overwhelming emergency departments. With 28 healthcare security incidents reported in June alone—many involving third-party vendors—the discussion questions whether the industry fully understands how interconnected systems create compounding vulnerabilities. From agricultural equipment with satellite connectivity to medical devices running outdated firmware, every connected endpoint represents a potential entry point for attackers.

Key Points:

• 01:43 Ransomware Attack Leads to Patient Death
• 06:10 Rural Healthcare During Cyber Attacks
• 09:11 Third-Party Risks in Cybersecurity
• 10:29 Cybersecurity in Agriculture and Implications

News Articles: 

• Ransomware attack contributed to patient’s death, says Britain’s NHS
• HHS Breach Portal
• College students hacked into tractors. Manufacturers wanted them to do it

X: This Week Health

LinkedIn: This Week Health

Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer

There’s no shortage of challenges facing healthcare CIOs, particularly in the current landscape. But perhaps the most significant, according to Brian Lancaster, is a lack of comprehension – not of the technology itself, but rather, everything required to make it work.

“People need and want technology, but they don’t know the cost. They don’t know the cybersecurity risks. They don’t know what a major incident looks like,” he said. “It’s our burden as leaders and technologists to make sure they understand all those factors, and at the end of the day, empower them.”

Brian Lancaster

That’s where the CIO comes in, according to Lancaster, who took on the role at Children’s Mercy Kansas City in 2022. In addition to guiding the IT strategy, leaders must be able to build and maintain relationships, instill confidence in teams, and create momentum for major initiatives – which is precisely what Lancaster is doing as he prepares to lead a migration from Cerner to Epic’s EHR.

In fact, that opportunity is what attracted him to Children’s Mercy, and it was his unique background – which includes 17 years with Cerner, largely in product management, as well as more than 7 years as CIO at Nebraska Medicine – that helped land him the position.

“I thought it would be beneficial from a career standpoint to have pretty deep vendor expertise with Cerner and then start to learn the provider side in an Epic shop,” he noted. Indeed, that experience set him apart during the recruitment process at Children’s Mercy, as the organization ultimately chose Epic, and relied on Lancaster to lead the migration.

As Children’s progresses toward its go-live, scheduled for March 2026, he shared some of the lessons learned and offered best practices for leading teams through periods of dramatic change.

Best Practice: Build Momentum

When organizations transition to Epic – which has become a common trend in recent years – the onus often falls on CIOs not just to help sell it to the board, but also to the staff. One way to do that? By educating teams on the benefits of Epic – and of adopting its doctrine.

Because while that strategy of “here are our standards, here is your grade against those standards” may seem rigid, he believes it’s necessary. “It creates a better implementation and a stronger foundation for innovation,” Lancaster noted. “You can do new things because the basics are in place and that comes from a combination of technology, but also people and processes.”

Part of that philosophy is ensuring that individuals from a variety of areas, including informatics, business, and clinical, among others, are actively engaged in the process. “That’s the way it should work in healthcare – we should understand what their needs are and provide solutions to them. We should not be doing technology to them,” he said. “It’s a fundamental difference in how Epic operates. They get operations and clinicians engaged, and that helps with buy-in.”

Best Practice: Empower Staff

Where it can get “sticky” with Epic, however, is when a suggested practice doesn’t work. In these cases, teams need to be able to ask questions. “We beat this drum that we’re going to follow Epic’s Foundation and leverage what our friends at places like Boston Children’s are doing,” Lancaster said. As a result, “our team wasn’t feeling empowered to say, ‘that’s strange. Maybe we shouldn’t do it that way.’ We have to strike a balance.”

That, interestingly, was one of the most critical lessons he learned. “It wasn’t necessarily how to run a work group or how to make the operational decisions we need to make; it was empowering the team to push back.”

And not in an aggressive way, but in a way that generates a productive conversation, while also helping analysts and informaticists develop new skillsets that will pay dividends in the future. “It’s helping us adopt some modern approaches in how we think about technology and how we continue to empower the frontlines,” he added.

Best Practice: Think Ahead

With an implementation of this magnitude, it can be easy to focus mainly on the clinical and business aspects, but it also creates an opportunity to transform the infrastructure, which is part of Lancaster’s vision. 

In parallel to the EMR modernization effort, Children’s is also developing a more robust data archive and conversation strategy that he believes will yield benefits in the future. “The consistent thing across any healthcare IT department, whether it’s an academic medical center or a children’s hospital, is that people want and need new technology to continue to be relevant. So how do you automate and consolidate to meet those demands?” By modernizing the infrastructure, organizations can “set the stage for a solid foundation to meet all of those demands,” he noted.

As part of that strategy of thinking ahead, his team is deliberately considering platforms that have built-in AI capabilities. “Our current plan is to have a selected ambient documentation vendor at go-live and do a pilot and enterprise rollout as a fast-follow so that we can stage it appropriately,” he said. “One of the compelling parts of Epic is all of the options they have for AI – both what they’re building as well as integrations with partners.”

Best Practice: Create Meaningful Relationships

Introducing ambient tools, however, represents a significant change in the workflow, as do other major initiatives like EHR migrations. CIOs, therefore, need to invest time and energy into creating “meaningful relationships.” And that, according to Lancaster, entails “spending time listening to peers and understanding them so that you can build the foundation to inform them of decisions that need to be made.”

That also means being bold enough to speak up when something doesn’t seem right – or when, for example, a leader is being influenced by a vendor to make a recommendation. “You need to have the confidence and the knowledge to go to them and explain, ‘I know why you want to do system X, but that will create this type of outcome. I think we could also get those outcomes by using this system we already have,’” he explained. “Walk through it from a business case standpoint, but in a very simple manner where it’s time, effort, outcome based.”

Having these types of uncomfortable conversations, Lancaster said, can play an enormous role in helping leaders shift from being an order take to a strategic partner.

Another aspect in that shift comes in how leaders measure key performance indicators. For example, an order taker will focus primarily on turnaround times, satisfaction scores, and availability, while strategic partners ask questions such as, ‘how do I transition to be value-based? How do we enable growth? How do we increase physician satisfaction? By doing so, “we’re creating value for the organization through technology,” he said. “That, to me, is an awesome aspect of change management.”

Best Practice: Consult Like a CEO

On the other hand, one of the more difficult aspects is ensuring the message not only reaches the intended audience, but sinks in. Sometimes it’s as simple as getting what he calls the ‘wait… what?’ response, which happens once individuals have had a chance to absorb the information.

“If you don’t hear that ‘wait… what?’ chances are you’re not going to get adoption. You have to keep communicating and make sure it’s clear,” he said. “Now they get it and understand why we’re no longer allowing you to use personal email, or why we can’t buy a system. And then, you get alignment.”

It’s one of the harsh realities of the CIO role, according to Lancaster. “Sometimes we’re there to enable opportunities and strategy. We're using technology to do something amazing,” he said, citing ambient documentation as an example. “But sometimes it’s explaining that we can’t do that because of the cybersecurity concern, or that you now have to use multi-factor authentication.”

The key is in finding the right way to communicate with different teams and individuals, he noted, citing advice he received years ago from a mentor to “consult like the CEO,” which entails laying out the options and cataloging the pros and cons. “It’s saying, ‘I strongly recommend option A. You can do option B and C, but anticipate that we’re going to have to hire a team, or we won’t get the results.’ And make sure they understand it.”

Another way to think about it? “You can’t cross a 10-foot chasm with two 5-feet jumps,” Lancaster said. “You have to have the ability to jump the whole chasm, or you’re going to break a leg.”