The 2024 ransomware attack on Change Healthcare was a supply-chain earthquake for the U.S. healthcare sector, showcasing how damaging third-party exposure can be, said Erik Decker, CISO of Intermountain Health and co-chair of a federal cyber advisory committee for the healthcare sector.
The attack on UnitedHealth Group’s IT services unit Change Healthcare resulted in massive clinical and billing related disruptions for thousands of healthcare organizations for months. It “was systemic risk materialized about a risk we always had but we didn’t necessarily have the proper lens to find it,” he said in an interview with Information Security Media Group during the HIMSS26 conference in Las Vegas.
“Not every vendor is going to be as critical into the pipeline of the healthcare ecosystem. What we need to do is identify critical functions that are specific to your organization and specific to the caring of patients,” he said.
That ranges from pharmacy, clinical, medical imaging – including diagnostic and therapeutic, laboratory and a wide and vast list of functions and operations, he said.
The Sector Mapping and Risk Management Tool kit – its acronym is SMART – released last October by the Health Sector Coordinating Council’s cybersecurity working group can help healthcare sector entities visualize, prioritize and address these critical third-party risks.
“When you map all of this out and start to understand where certain vendors have market convergence – say more than 30% or 40% of the market – now you have a material supplier to your organization that’s also a chokepoint inside the entire ecosystem,” he said.
“That a potential hot point we should be planning around. Had we done that prior to the Change Healthcare, ideally what we would have seen the continuity and the path to resiliency that we’re all eager to achieve.”
In the interview (see audio link below photo), Decker also discussed:
- The most critical first steps for health sector entities to get started in addressing their systemic risk;
- Artificial intelligence, including agentic AI, as a systemic risk itself;
- The potential of AI tools to help identify and manage systemic risk.
Decker is vice president and CISO at Intermountain Health, a multistate integrated delivery network based in Salt Lake City, Utah. He is a co-leader of a Health Sector Coordinating Council and the U.S. Department of Health and Human Services’ task group of more than 250 industry and government experts across the country for implementing the Cybersecurity Act of 2015, 405D legislation within the healthcare sector. Decker was previously CISO and chief privacy officer at the University of Chicago Medicine.