This Week Health

Newsday: Hackers Outpace Healthcare Resilience and Surviving a Merger with Drex and Bill

The episode centers on the looming Sutter‑Alina merger and a recent wave of cyber‑attacks, using the two topics to illustrate how health‑system consolidation and security resilience intersect. Bill Russell and Drex unpack the practical realities of merging two large providers, from the inevitable operational pause of one to three months to the early battles over board seats, naming rights, and state‑level antitrust scrutiny. Key insights include the fact that integration timelines stretch six to nine months, with state attorneys general and federal regulators adding layers of approval. Governance decisions—who sits on the board, which brand survives—can dominate the agenda, while staff are left navigating a rumor mill that saps focus. On the security front, the Striker hack and a 2FA‑bypass gang demonstrated attackers’ new emphasis on rapid restoration, exposing hospitals’ lagging resilience testing and backup practices. Notable moments underscore the urgency: “everything grinds to a halt for at least a month,” a participant warned, and the recurring mantra that “it’s not if they get in, it’s when they get in” highlighted the inevitability of breaches. The discussion also referenced the “devil’s in the details” of Microsoft Intune exploitation, illustrating how a single vector can cripple endpoint devices. The implications are clear for health‑IT leaders: robust integration roadmaps, transparent communication to mute rumor mills, and a shift from preventive security to true operational resilience are essential. Staff should stick to their defined roles, avoid speculation, and treat cyber‑incident response as a core component of any merger plan, ensuring continuity of care and protecting financial stability.