welcome everyone joining us today for
this critical conversation around the
intersection of cloud computing and
healthcare and life sciences
specifically focused on the secure and
sensitive nature of much of the
information flow that happens in those
types of missions this panel will
discuss recent use cases highlighting
best security practices for cloud
computing and healthcare and life
sciences today we're going to focus on
three main main takeaways and our four
panelists will provide insights on those
areas and we'll also be doing live q a
so roll up your sleeves and get engaged
with us the areas we're covering today
are the benefits of using cloud for
healthcare and life science data and
analysis including scalable resources
ease of collaboration i got amalgamation
of data the use of aiml applications and
replicability of research the second
we'll be focusing on is building
security and privacy needs into
platforms as well as every layer of
cloud-based projects and the final one
is the implications of security for the
data and ip of individual biomedical
project projects organizations not just
specific products and capabilities but
also the broader bioeconomy and
biosecurity we are so lucky today
because we have four of my favorite
people matt has hazel from the fda fda
it's cdrh is our fda regulatory guru
welcome matt uh andrea that's
master sean sorry is our law policy tech
cyber uh guru from penn state and is
really going to be talking to us today
about legal and policy issues dan prieto
us on cyber security from google is our
cyber security guru and finally michelle
holco
hcls sme from google is our biomedical
research guru so with that welcome to
our session today and as you can tell
we're excited we're just going to jump
right in so michelle let's level set
help me understand
you know without going too much into the
basics what is cloud computing and what
are some of the benefits of cloud
computing what are some of the trends
around use in adoption in the healthcare
and life sciences sector
yeah absolutely thank you so much alexis
and thank you um for all of the
panelists for being here and for
everybody who's joining us today for
this discussion
um so this this topic is near and dear
to my heart because i have recently
joined google cloud um and but have been
in the healthcare and life sciences
space for a long time and have actually
used cloud-based uh platforms to do data
and analytics in the biomedical space
so basically you know cloud
cloud-based computing is just leveraging
on-demand compute system resources
including storage
as well as compute
distributed teams sharing resources and
being able to build in economies of
scale
and you know there are a lot of reasons
why
cloud computing is being added to the
healthcare and life sciences space i'm
going to talk through a few of the use
cases that we'll go into a little bit
more detail throughout this discussion
um but some of the driving factors are
you know number one cost um it's
actually a lot easier for young
organizations as they're getting started
instead of investing in a lot of
overhead a lot of you know equipment
they can just kind of spin up some cloud
environments
another really big one is scalability
especially when you're looking at
specific data types that require a lot
of size to store as well as to compute
across including images and genomics
data
and then a third really important reason
is the ease of collaboration
you know one of the reasons
one of the enablers for ai and ml
machine learning and artificial
intelligence based studies is you have
to have a
like a critical mass of data in order to
make those types of studies possible and
so being able to really bring all of
those types of data together across
different organizations across different
laboratories um is really an enabling
factor um and then you know going along
with the collaboration piece is
reproducibility of research um you know
there's uh some types of crazy number
where i think it's like 30 to 50 of
research is actually not reproducible um
and so cloud is actually enabling a lot
of that uh that that type of a barrier
where now you know if if you're if your
data is in a cloud-based system that you
know researchers and reviewers can
access with the tools that you use um
then they can go in and they can look at
those they can tweak some things and see
if you know your research results still
make sense so those are just some of
some of the reasons
why this transition to the cloud why
we're seeing an increased transition to
the cloud
so just to give you a few examples of
what's in scope for this discussion
because this it feels like a very broad
space to a lot of us um and and so it's
kind of comforting to think about well
what are the what are the areas that
we're gonna think about and consider
today um so some of them are certainly
the biomedical research space which i've
already alluded to
and this can be in the clinical
epidemiological
as well as biomedical or molecular space
including omics data um so um
you know again some of the reasons why
this is important is because of the data
types genomics and image data can be
very compute heavy um as well as as
as well as
you know storage heavy
um and then another is the real world
data or personal uh personal generated
data
types and so these are oftentimes coming
off of
devices that are being used either in
the health care phase in as medical
devices or in the health adjacent space
fitness trackers come to mind and these
types of devices are instead of
generating single point of data they're
generating continuous streams of data so
it's actually you know a very
interesting space because there's a lot
of discovery to happen in terms of how
do those continuous data streams relate
back to the physiological state of the
individual
um so there's a lot of interesting
promise there um but it also means that
it's a lot more important to make sure
that those types of devices are secure
um and that those data streams and as
well the analytic algorithms that are
being uh that are trans doing the
translating of the continuous data into
the real world um insights that those
are those are also secure and protected
um another area where we're seeing a lot
of cloud adoption as i i think
previously alluded to is biotech startup
so new organizations coming out of
academia or other companies
that again they don't have a lot of
overhead overhead
overhead yet and and certainly we're
seeing a lot in the times of covid where
people are working from home um so maybe
you know they're they have a work office
space at home where they're they're
doing a lot of their data analytics and
so the cloud makes that really easy so
you don't have to have a lot of hardware
on-site
and then finally hospital systems
you know ehr data electronic health
record data moving from paper-based
systems into a fully
digital type of a system and then all of
the uh the areas of interoperability um
this feeds then back into the research
question because oftentimes you know
it's different data types having to be
combined in order to really have
insights um so really being able to
build interoperable
systems for electronic health record
data that can then be utilized with the
biomedical and molecular data
um and um yeah so that so that's just
you know a basic summary of where where
we're talking about you know in terms of
where we're focusing our discussion on
cloud security in this phase
now i appreciate that and i think one of
the things that i'm really hearing is
that we have the potential you know to
be sharing more information than ever
really to move at light speed but we've
got to be careful right as we do that
for all of the reasons that you
mentioned i want to push this to all of
you so anyone jump in that that wants to
but what are some of the specific
security challenges at the intersection
of cloud computing and healthcare and
life sciences you know are there
examples or you know what can we learn
from these in that idea of moving to
light speed but carefully
dan here i think a couple things i think
when you think about security as it
relates to health care and life sciences
a couple regimes come to play and i
think this will be good setup for for
matt and andrea in that
you know when you think a lot of times
about just plain old information
technology let's not think health for a
minute a lot of times you're thinking
about computers and data but a lot of
times that body of cyber security best
practice can often be treated as
separate from a privacy corpus
of sort of rules and regulations
particularly if you're not dealing with
customer data
in the health and life sciences space
those two regimes automatically overlap
and overlap significantly so you need to
think about security and privacy at the
same time that also then therefore
brings to the fore how you think about
the regulatory regimes there's hipaa
there's sock two there's high trust and
all these best practices that are out
there um just as a general matter for
anything health care related so i i'll
leave further discussion of that to matt
and andrea after that my second comment
which is
michelle did a really good job of
pointing out the different business
models in which cloud and therefore
cloud security is implicated right there
are traditional long-standing models
health records for example
where what is afoot on the technology
side is still
a long-term attempt to transform away
from paper records so there's a huge
piece that's related to digitization
consuming the paper this mound of paper
that you existed on previously and
moving to a new model where you both
have the old paper which is now
digitized but also
have structured sort of digital data
from inception through more you know
user interfaces patient self scheduling
more electronic health records you're
inserting in the middle of an old
business model the cloud and so you need
to ask the security question relative to
what is going to be a long-standing
decades long-standing set of security
practices related to the old stuff
right and so that is going to be an
enormous culture change on other models
where for example it's the internet of
things it's new medical devices it's a
you know adjacent thing like a fitbit or
it's a you know glucose monitor that is
constantly sending telemetry off so that
your doctor your patient uh care
provider and your nurse can see the data
and help you manage for example your
diabetes or some other chronic disease
cloud is native in that business model
right
the device itself can't store the data
so the
so automatically that data needs to be
securely sent to a repository in the
cloud and read by a healthcare provider
from that repository in the cloud so
you're dealing with less legacy security
architectures but now you're also not
dealing with the security of the cloud
where the data exists there's a whole
host of other questions which people
have focused on on the security of the
device itself
where was it made what countries was it
made in where is the software inside of
it coming from how do you do updates and
things like how do you do updates of
particular concern given the breaches
we've seen on on the supply chain side
software updates end up being the vector
for malicious code to enter
and when you get to devices like that
it's no longer just an academic
discussion not even academic it's beyond
a discussion about is the data secure
it's a question as to whether the device
is actually doing the right thing
because there's a risk if data is
um
tampered with or incorrect that all of a
sudden
you know a device that's doing dosing
for you
gives you the wrong dose or sets your
heart rate if it's a heart uh like a
pacemaker at the wrong rate so it's
actually the equivalent for the physical
body of the kind of
um
uh control systems that we've seen be of
concern as relates to utilities
uh water utilities electric utilities
the shutdown of this meat processing
plant which started on the i.t side but
you're starting to see concern about
control systems and then the next model
that michelle brought up again the
security aspects are slightly different
if you have researchers collaborating on
a shared data set right how do you
ensure that the people that are
contributing to the data set using the
data set copying portions of it have are
the right people with the right access
and it really raises the potential there
to begin to implement things that have
been at the forefront of late um
with i.t security zero trust
do i know who you are
do i know what device you're using do i
trust those things when i make an access
decision for you to actually access the
data
do i authenticate properly and does all
the data properly encrypted so it can't
be tampered with or if it's exfiltrated
it does not uh create a data spell that
might be a privacy issue
or overall jeopardize this sort of
research agenda so i think the security
pieces you look at
very much will
ebb and flow or at least be distinct and
different depending on which business
model and which value chain you're
talking about because in each of those
instances the cloud sits in a relatively
different place to the other business
models
thank you for that matt will you want to
follow on that
sure um so definitely from fda's
perspective when we're looking at
medical devices we're looking at cyber
security through the lens of safety and
effectiveness that's our regulatory
mandate that's the way we evaluate
medical devices so when we're looking at
medical devices that are incorporating a
cloud environment we're looking at how
the cloud environment can impact the
safety and effectiveness of the end
device
so some of that is software that lives
in the cloud there's software as a
medical device so some of those are
fully hosted um in a cloud environment
some of it are implanted devices that
are then
communicating with a mobile application
and then transmitting that data into the
cloud for further processing potentially
figuring out treatment parameters and
sending that back
so there's a broad diversity of how
cloud
implementations can be utilized by
medical devices and you see a lot of
medical device manufacturers adding
cloud components into already fielded
devices to increase their abilities for
remote monitoring of the device itself
the patient's
information that's being transmitted and
logged through the medical device you
see it being used for remote support of
medical devices so troubleshooting when
there's an issue
you're starting to see it in terms of
delivering
software updates or firmware updates to
the medical devices themselves and you
also see it in terms of
leveraging the added
computation capability so being able to
implement more complex ai and machine
learning and also
more computational heavy things where
you want to leverage the power of the
cloud environment instead of having a
larger system bedside um so there's a
lot of different factors and the
implications of
the cloud have a very diverse
set of risks that they have based off of
how it's implemented in the medical
device whether the
it was something added to the medical
device after the fact
a lot of people think of these cloud
environments as essentially just someone
else hosting a server for them
that exists in some
ether
when in reality when you look at some of
these cloud environments they're
incredibly complex in terms of the
different services cloud service
providers offer
both in terms of security services as
well as kind of the additional
computation so you look at the
key management services for potentially
being part of authentication schemes or
providing signed software updates
all of these different factors are
load balancing on the front end to make
sure that your environment's protected
all of these things have
a lot of complexity and a lot of weight
that needs to be considered so as you
see this
advent of
new startups migrating into the cloud
it's a very complex environment to
actually
integrate into a medical device platform
i love the fact that you really you
brought it home for me on a personal
level i have two or i had two family
members who were both dependent on
medical device implants and so it was
really interesting because this was uh
you know unfortunately at a time where i
think we didn't have the advancement or
the computational power or even the
security you know that we have now but
you know their their lives were very
dependent on those and i think you know
everyone's really brought up why this is
an exciting time to be moving at warp
speed but but with that level of
carefulness um
you know andrea over to you you know
let's talk about that let's talk about
law ip what are the legal interests that
exist in databases with pii sets what
are the types of concerns people you
know building and caring for these
systems should think about and and what
might keep them up at night
well that's a really uh interesting and
uh
complicated question that will take
decades to resolve for better or worse
in minutia but the short version is that
there is established law around what
constitutes for example uh a
copyrightable interest in in some of
these uh kinds of situations so um let
me just give kind of a little quick uh
intro through the lens of uh medical
devices so increasingly we're moving
toward the world that you've already
heard about i call it the internet of
bodies the idea of devices not only
being attached to human bodies but also
implanted in human bodies or in the
third generation
talking to the cloud so right on point
with this panel with um
potentially live feeds that's the mental
model that no pun intended uh some
companies in the valley are using in
building their
uh recreational augmentation brain
implants or that you see in medical
contexts already in use and treatment of
certain disease diseases
or conditions such as parkinson's or
interesting experiments underway
to alleviate
different kinds of other
brain
connected uh challenges that patients
have with
live data streams that are of course you
know footnote reliant on internet access
reliability among other things but
that's a panel for another day
so when we look at these databases
whether they are
local or remote and the actual
information contained in these databases
the way that a court would probably
analyze these things as a first instance
and this is where the law is going to
develop definitely starts with the
question of exactly what is protectable
in these aggregations as a first matter
so to answer that question the idea of
copyright is that there is
an idea embedded in a tangible medium so
is code a tangible medium yes it is but
the actual information starts to get a
little dicey so
facts themselves are not copyrightable
so what you can copyright is potentially
a creative arrangement but what does it
mean to be creative enough well the
leading case on point is one called
feist publications ancient rural
telephone and what it told us there is
that the white pages for example even
though it took a lot of effort to
aggregate all of that information that
extreme sweat of the brow that's not
enough to by default out of the box give
you a creative arrangement so
when we look at you know say
dropping all this information into a
spreadsheet or into a searchable
database that's probably in itself i
would guess not going to be enough for
courts to find that there's a
protectable interest just in the
information now as we start to talk
about derived information with each
subsequent layer of derivation i think
arguably arguably you have a slightly
stronger case for copyrightability of
those derived databases that are then
creatively arranged
uh and used in those ways um but the
other piece of this that is that i still
see done wrong all the time in uh
legal contexts even by otherwise
sophisticated lawyers is that the
transfer of use and the licenses of
these copyrights needs to be written in
a very particular way so there was a
case uh called new york times v tasini
that talked about the fact that the uh
bundle of rights that are comprised
within the notion of copyright have a
special digital component and so for
example the digital rights to use need
to be transferred separately in any kind
of copyright assignment and that's
something that you know it's a little
drafting point but people still get
wrong all the time um so you'll have
this battle over what is copyrightable
and then you'll have a battle over
whether the right to use has been
appropriately granted and when we look
at whether that right to use has been
appropriately granted we will
increasingly see battles over dignitary
interests particularly in a world where
end user license agreements are longer
than war and peace see a fun project
called eulas of despair that my penn
state pilot lab um is currently
finishing up um that creates lovely
visual models of many of the uh
uh
most um shall we say expansive eula's on
the internet
um so when you get into the world where
the licensing is predicated based on
this fiction that people understand what
they're agreeing to and then you have
maximum repurposing of this information
in ways that are not necessarily
foreseeable to the person clicking yes
and you have no proof that anyone's
actually read it and it's longer than
war and peace and and and we start to
get into a situation where the law is
gonna say okay brass tax
nobody's reading this nobody understands
what's going on nobody's meaningfully
consenting to this and particularly in a
medical device context and in a world
where there's health-ish data being
processed in the cloud you start to have
real concerns that we're moving in those
instances potentially to a world where
we border on
uh maybe doing less to help people and
maybe sometimes doing more to
put them at risk depending on what the
terms are and how things play out and i
should uh caveat all of this which i
should do at the beginning that all of
these opinions are mine and do not
reflect any federal agencies with which
i work um there are multiple agencies
none of them have approved these
comments this is all me being law
professor engineering professor starting
off okay
um so that's the lay of the land and
particularly as we get into a situation
where there are multi-function devices
where there are
opportunities for companies to create
devices that are
medical
in one use but not medical in another
use or they claim it's not medical so
like let's imagine a world where you're
please don't let this device exist where
your artificial pancreas also streams
music to your ears
okay
one is clearly a medical use the other
one
is not a medical use
and one that i really hope nobody has
thought of so please do not make this
device
please don't please don't make this
device but anyway so that's a
non-medical use so we have their uh
really dumb example of a multi-function
device but in that world you have
multiple kinds of data streams being
aggregated together by a single provider
potentially repurposed in various
different ways and then when you have
database mergers across fields of
activity you start to see healthish data
showing up in credit report-ish
information
and this notion of a social credit
monitored society that's connected to
devices embedded inside our bodies
that's not
not the best world we can build i'll
leave it there and um we'll come back to
this hopefully later on
now i appreciate that and actually to
your point my uh my family member
actually was suffering with parkinson's
and so the implant was and i remember
very explicitly a long list of things
for us to sign as as as they were going
under that surgery and and to your point
we had no idea we signed we just had
hope right and so i do think it's really
you know really critical dan over to you
i think one of the things you know you
kind of wet our appetite around you know
a lot of the different elements of
security but you know since we're on
devices let's talk about the device as
an element of the value chain that
includes data source storage components
what do we need to be intentional about
when we think about the value chain and
the role of devices
you know i
i think you need to be intentional about
sort of the
aspects of the security life side life
cycle excuse me um we talked about zero
trust and that really is how do you
protect
the device and protect the data
right and that occurs through all the
things we talked about in passing at the
beginning which is basically
strong identity multi-factor
authentication
role-based access
not just role-based access for the
person but their machine it is the
device in good state what's the device
posture
then there's the encryption of the data
itself
um we also layer things on top uh like
sort of default data loss prevention so
if for example a device or a cloud
environment is leaking sensitive data
that's something we could notice quickly
and and automate the blockage of it or
the masking of it
um and in addition you know for stuff
that sits in google cloud i think i i
would want people to have confidence in
the fact that the infrastructure
we've built it's a proprietary global
network we're very attuned to
um how we manage our own hardware and
software supply chain
we build a lot of our own infrastructure
we lay our own undersea cables and so it
sits all those things i mentioned
strong identity encryption uh proper
authorization and access sits on top of
a strong global infrastructure so that's
the protect piece
i think security in the cloud also gives
one
other capabilities that are going to be
distinct from traditional approaches
you know decades-old approaches to i.t
security around a traditional data
center and one of them is really scale
and analytics if you think about the
proliferation of medical devices and
other iot devices that are throwing off
massive amounts of data
for the most part a lot of organizations
historically have not done a good job
capturing storing
analyzing getting insights and making
decisions on all the
machine data that their organizations
are throwing off but with cloud it
allows you really massive scale
analytics to get end-to-end visibility
um into machine data and so for example
if you're a healthcare provider that's
managing a deployed
you know market of hundreds of thousands
of deployed glucose meters
heart monitors whatever it is
you want to be able to
see patterns in that data to interrogate
that data identify anomalies
look for trends and also proactively
hunt in that data to see if there are
bad actors or malicious code and a lot
of that
is beyond
the normal capability of a traditional
security workforce which tends to have
an over proliferation of cyber security
tools and not enough people so in those
cases there's a flood of data
in fact the tsunami of data but that
more data doesn't actually make you
better at doing security it actually
makes you worse at doing security
because it obfuscates things right so to
counter that
you have to be able to have that massive
scale analytics to proactively look for
bad things to baseline activities to
look for things that are abnormal um and
so the data actually becomes your friend
and i think it's hard to do that with
in-house data analytics platforms i
think cloud capabilities that scale up
scale down and can really make storage
and analytics much more cost effective
and democratize that kind of analytics
is one of the things on the security
side from a visibility standpoint that
the cloud does for you
i think the other piece and that's sort
of the detect piece so we've gone over
protect i've just walked through sort of
the detect piece and then on the
recovery side
whether it's electronic health records
or sort of you know a couple years of
data getting thrown off by these medical
devices or a massive research database
we've seen a massive uptick in
ransomware um and so there's the risk in
general that people are afraid that that
data is going to get um
you know forcibly encrypted and they
can't access it or can't go back to a
sort of valid and known
um accurate restore point and i think
that that's another area where the cloud
can help you really doing
enterprise-wide data backup so that if
that happens and you end up in a
ransomware attack you don't have to pay
the ransom because you're confident that
you have an overarching data strategy
that is tuned with an overarching
security strategy so that you know and
are confident that you can go back to
secure points in time
of dif earlier versions of your data
that are clean from malware and haven't
been tampered with it's basically strong
and confident secure points so again
i've sort of hit the protect
detect and then that's the recover piece
and i think the cloud helps on all those
fronts
dan i love that you're really
introducing that that concept that we
have to be uh we have to be more ready
for more things to happen in the world
right and we have to have kind of some
of those break glass or from a military
parlance kind of go bag right not just
strategies but tactics to be able to
respond and to not be in those positions
i'm actually going to jump matt to you
because i really want to continue this
idea of you know the fact that there has
been you know recent uh
you know recent malware attacks and
ransomware and things like that you know
talk to me a little bit about you know
what what that looks like what do you
think about that from kind of an fda
standpoint and then michelle i'm going
to uh come to you and andrea i'm going
to come to you for a little bit of a
prod more into the idea of kind of that
personal uh the personal impact of a lot
of this but but matt talk to me a little
bit about what what dan said and and
also maybe a little bit about how how
people make decisions around what cloud
uh you know
and and how they go about that
sure um so definitely from
the device standpoint as we start to see
more reliance on cloud-based solutions
and also just networking for that matter
you have a lot more considerations
around device availability so if there
is a part of the device
software that's operating solely in the
cloud you need to start thinking about
what happens with the device when that
becomes unavailable um the different
cloud service providers
indicate that they have like 99 point
whatever percent uptime um but as we
talked about before with the complexity
of those environments that's more of the
face value up time not necessarily every
crook and cranny that the device may be
reliant upon in order to perform its
intended use
and deliver the therapy or perform the
function that it's intended to do
so when we look at things where
ransomware in a cloud instance can
impact the
availability of a treatment device you
start getting into real patient
implications of delays of care um where
that
reliance on that cloud-based data and
that cloud-based computation
um
when that's interrupted whether that
comes from something in the cloud itself
whether that comes from
the hospital being impacted by
ransomware and them severing their
outward connections there's a lot of
different considerations for these
complex systems of systems
medical devices where you have a lot of
these reliances
um where you need to start thinking
about how the end device
that's bedside with the patient that's
implanted in the patient are going to
respond to those scenarios so the
incident response both on the
manufacturer's side of how they're going
to respond and address those situations
as well as what those manufacturers are
telling their users of what to do in the
event and what backup or
fail-safe capabilities the device will
have when that extended function is no
longer available is something that needs
to be closely considered
to your other question around
how cloud service providers are selected
um one common thing that we seem to be
seeing a lot um is that the decision
around which cloud service provider to
use is being made at the c seat level um
these decisions are being made of we
want to
use the technology that's
grabby that everyone's using we want to
use a cloud instance with our devices or
we're going to use this one based off of
some xyz factor so it's being decided by
the c-suite whereas in traditional
medical device development
the
device is set up you make your set of
requirements you're identifying how to
address those requirements with your
device design whether that's using
um software or an architecture that the
manufacturer themselves provide or
whether they go to a third party so much
like using commercial off-the-shelf
software in a medical device using a
cloud service provider is really no
different from fda's perspective in
terms of the response and responsibility
resting on the medical device
manufacturer for what risks those are
imposing on the system
so when you have kind of this
backwards
driven
kind of the ends justifying the means of
you're being told which cloud service
provider to use you're then trying to
back architect the device to address
whichever cloud instance you have
because there's differences among all of
them there's different
capabilities different services
different security
services provided by all the different
providers out there
so really you're trying to
make the solution that was selected work
for you and then you're having to deal
with the
validation of that cloud environment on
a much larger scale
so there's a lot of different factors at
play but from the regulatory perspective
it's really
no different than using an off-the-shelf
software it's just a much more complex
supplier agreement that you're entering
in a much more complex
set of risks that you're
um needing to manage on the medical
device manufacturer side
well i love what you're introducing
really too is this idea that as as more
things become cloud native to dan's
point that that not all clouds are the
same right and that you know we might be
seeing much more of a proliferation in
this area faster than others around
things like multi-cloud right because in
some ways if i can be so bold you know
why would we dumb down the device right
or make it worse if just because we have
you know a cloud that in essence only
allows us to do so much
versus being able to kind of have a
multi-cloud approach and the
complexities may be that you know that
adds but to allow that device to be as
secure or sustainable or the information
or it's uptime to be as robust as you
want it i think it's a really a really
great point and i hadn't thought about
this kind of subject matter really being
at the forefront of kind of that that
multi-cloud or that cloud selection
process being quite critical right to
the performance of what someone actually
experiences every day i think that's
that's
spot on well andrea take us there you
know about what someone experiences
every day you know so what about those
of us who who use you know whose data is
in this database you know what do we
need to be thinking about when i when i
went back in time and was signing away
kind of medical device uh you know
paperwork and agreements you know on
behalf of one of my family members you
know
help me juxtapose what i should be
thinking about what should i be holding
an organization accountable for
so the questions of who is in the best
position to bear certain risks
that question is certainly at the core
of many of the decision-making processes
that we face
um when you are either a patient or
someone deciding on behalf of a patient
um or if you are a corporate decision
maker in thinking through your own risks
in terms of operating
business entity and so just to connect
quickly with something that matt pointed
out
the question of whether you have the
c-suite fully informed of the totality
of risks
that could exist
that's a key thing that not only
security professionals but the general
counsel and individual
constituents patients and other users of
products
can take time to
connect with the organization and inform
the organization about it so let me just
run through a few key points so one of
the common mistakes
or stories that i hear from c-suite
folks is well you know we have to pick
the most flexible cloud system so we can
maximally exploit the data in the future
in ways we have not determined yet
because we are bound by fiduciary duties
to maximally exploit short-term revenue
quarter to quarter
no not what fiduciary duties say
fiduciary duties say that you have to
think about the long-term best interests
of the
enterprise the long-term best interests
of the enterprise may not be aligned
with maximal short-term profit in any
given quarter
and they certainly aren't aligned with
skimping on say cloud security and
losing control of your entire set of
sensitive information connected to
humans who may suffer physical harm in
some cases as a result of your choice of
cloud provider
so usability is another key piece of
this what we see in cloud situations is
that security mistakes often happen
because of weak usability testing and
folks making good faith mistakes because
the design doesn't set them up to
succeed
so when
companies are thinking about cloud
providers and when users are thinking
about
which companies to do business with that
issue of whether
uh companies are setting folks up to
succeed um
should be part of the calculation and
and it's also a risk limitation factor
in terms of potential legal exposure
down the road if you can explain to a
court that you went through a careful
thoughtful process trying to set people
up to succeed and you identified key
mistakes that people interacting with
the system make and you took affirmative
mitigation steps that's a compelling
story talking about a careful entity
trying to make sure that harm does not
happen it's a very different story from
one where the usability testing is slim
to none and and the documents the legal
documents haven't been usability tested
there aren't regular audits not only in
terms of the nuts and bolts of technical
security controls but also in terms of
the way that humans interact with the
system
and when you can tell those good stories
it helps no insurance is one more point
that i'll i'll flag because uh companies
frequently think oh we'll just insure
our way out of this and that short
circuits the threat modeling process and
they they sometimes um
overly optimistically think that that
resolves the uh challenges of cloud
security
provision
it does not and in fact this is one of
the common mistakes that's happening
more frequently is that people don't
necessarily read their insurance
contracts well and that the defined
terms in some of these agreements leave
intentional ambiguity for the insurance
provider to subsequently refuse coverage
after an incident and just pull it into
litigation so a key strategy that exists
in some insurance
companies and in companies across
sectors this is not limited to the
insurance industry
is that when you have deep pockets your
goal is partially as a
an aggressive plaintiff an aggressive
defendant to bankrupt the plaintiff into
settling
so
if you uh
are not that deep pocket provider and
it's very important to not over trust
that your insurance will cover things uh
and the carve-outs really matter
and and so that's just a cautionary note
that i'll i'll flag um the last point
that goes i think most directly to your
question is that there's an inherent
tension in data curation that sometimes
exists between traditional social
science and medical methodology
in thinking through what kinds of
information will lead to the most
significant breakthroughs in terms of
research
and the norms
of some
machine learning systems and other
development processes sit in tension
with this where you just kind of throw
it all into the soup and stir it up and
see what happens
and so when you have two different
models one that's driven by high quality
reliable
slower research and one that's kind of
more on the fly with a little more
everything goes with outliers being
included in
you start to see
new kinds of risks um emerge
that are not necessarily fully
considered and the prior models of
differently curated data
don't adequately encompass because
they've been consciously risk mitigated
so legal liability will take that kind
of an analysis into account at the end
of the day
um so those are just some cautionary
notes that connect with this idea of the
balancing act between individuals and
the companies well this is a quick note
on on that
in a lot of cases you're starting to see
insurance companies since andre you
brought up insurance
balk at the idea of actually being
responsible
for certain types of cyber attacks
particularly the ones where the
malicious actor is a nation state uh and
you see
cases coming to court as to whether
those are sort of normal course of
business cyber things that they need to
pay for or those are basically aspects
of war between nation states that are
exempt
and so it raises a lot of larger issues
right about how risk is addressed in
this space or not
one of the things that you're all making
me think because each of you have
brought really an interesting angle to
this and one of the things i can tell
you is that i have a lot of empathy now
for our you know executives out there
who really are are having to become an
intentional intentionally kind of
digitally savvy right an entirely new
age whether those are our executives in
public sector whether those are device
manufacturers whether those are you know
our uh or other types of providers it's
it's really interesting if you think
about just in the session alone the
different insights and the the
complexity of the things that have to be
thought about and navigated huge amounts
of promise but also just huge amounts of
of you know of making this work i think
you know being savvy in this way um you
know quickly i'll go to you you know
michelle and dan and maybe a little bit
of a twofer here you know what are some
of the things that you know that that
google or that other groups you know
might provide in terms of like
healthcare and life sciences what does
this look like practically and how do
you make sure that they're secure that
that person you know that senior
executive can kind of sleep at night uh
you know after hopefully if they've
gotten all their insurance and other
complexities taken care of but but what
are the things that are out there that
that that help and that work and and how
do you how do you give someone that
ability to sleep at night
yeah absolutely so i can i can start and
then dan if you want to chime in you
know certainly having built-in
healthcare security and compliance tools
is critical
not only for the health care side of
things but also for the research data
side of things um and we definitely have
tools around privacy of research
subjects um but but also around the
healthcare data
and certainly another really interesting
and fun capability is
our tools to aid with the identification
so not only the identification of
records but also of
things like radiology images
and and that's really important because
you know certainly that's an area that
is ripe for research um but again you
know there's also the risk of patient
identification there um and we want to
make sure um to protect individuals and
you know this goes back to what andrea
was saying about you know the the
consent process is also a really
critical piece of this equation and
certainly from a research perspective
i've seen a lot of research studies do a
great job of building in
new ways of doing consent where people
actually understand what they're
consenting to and they're also able to
change their consent choices um over
time so i think that's a really great
innovation um and then going back to
what dan said earlier
the fact of the matter is this is a
because the technology is evolving so
quickly and because we're integrating
the technology into this space so
quickly we have to be really thoughtful
not just to be compliant with current
regulations but also to be forward
thinking
about what are the actual security risks
and how can we start to protect against
them before we have to you know so so
really taking that um taking that to
heart taking that uh that protection
piece to heart i think is really
critical i think another thing alexis is
to make sure
and i hope this goes without saying but
that non-technology and non-security
executives really need to get
comfortable
and understand a couple of things number
one is how does security affect the
mission and your overall business and
reputation right and take that to heart
that itself should be enough of a
motivator to not treat security as a
black box
but even going beyond that i think it's
important as they think about their
business models and how critical
technology and in many cases cloud
technology is in terms of enabling their
business model
they need to be very intentional and
very regularly be aware
of what their value chain and life cycle
of data looks like again whether it's
electronic health records or device or
research right they should understand
you know how data is born or required
how it is handled how it is protected
how it is augmented what metadata gets
created off of it how it is passed on to
other people how people interact with it
how it flows back and forth between them
and the customer how it flows back and
forth between employees and
collaborators right
and that actually
simply being intentional about that i
think takes security out of
what is too often a black box oh it's
the i.t guys it's over there but it
actually puts it in i'm going to ask
basic questions about how to change hand
changes hands and where it sits and when
it sits in certain places how is it
protected right you can ask very lay
questions
but everyone needs an end-to-end mental
model of how data flows through their
enterprise and if they do that again it
really collapses what is often too much
of an arms-length relationship or sort
of like a chasm between tech and
non-tech and if they take that kind of
ownership of it they should be able to
sleep at night because they're
constantly asking tough questions about
how all this stuff is handled and
protected number one number two they
have a mental model for how things flow
and how it relates to their business
success
and therefore by taking ownership of it
right it just arms them much more
readily to not be surprised
to
not be
overwhelmed by a technical security
update that often is filled with jargon
and it's a particular expertise but they
can ask questions and have
be confident that they're getting the
right answers because they have their
own language to deal with these security
things
i think i don't know if you could hear
it dan but i think the whole cadre of
public servant chief data officers are
cheering in the background right this
idea of really getting you know those
c-level executives to really care about
the data these stewards of data and
really in some ways you know what i'm
hearing from all of you is that in some
ways almost every organization is a data
company now right no matter what you're
doing no matter what you're delivering
this idea of being a data company and it
was actually funny someone said to me
the other day what is it that a public
servant does and you know i thought well
you know what i did was i i took in the
best information i could i had a great
privilege of trying to decide where
those resources would go right based on
that information to try to have have
great impact in the world and then
ultimately i looked at more information
to decide whether or not we had done it
right right and how we might tweak it
and so you know what i love that we kind
of brought brought together at the end
of this is all of you really helping you
know the folks out there understand that
this is about you know information
stewardship right this is about data
stewardship this is about that
intentionality that curiosity that we
really all just have to have you know to
be not only up to speed with all of the
things that you raised today each of you
but more importantly to be champions
right and to be pushing the envelope
with that curiosity are we doing it as
safely as we can as effectively as we
can you know to the best stewardship as
we can so i'd love to ask each of you
though to we've talked about a lot of
things people have to think about a lot
of concerns out there hopefully people
are going away with a lot of notes and
hopefully a lot of questions for our q a
that will be coming up soon but what i'd
like to ask each of you to leave and it
can just be you know a quick quick
response
groundness and the fact that this is
still amazing technology that's letting
us do amazing things so you know for
each of you what does getting this right
look like what might be different about
health biomedicine you know what might
those breakthroughs be in five years if
we're really harnessing you know
cloud in a way that is secure and
appropriate and that we're really
leveraging the power of cloud each of
you maybe give me you know a quick
summary of what's that thing you're
hoping will be different because we've
leveraged the power of cloud securely
and appropriately so i'm going to throw
that to michelle first
absolutely yeah so so for me success um
you know really came
very clearly over the last year when
before coming on board to google i was
working with cissa and the national risk
management center um to protect the the
assets around covid and developing the
vaccine
and and really the goal there was to
save lives
because we knew that any delay in
creating a vaccine was going to equal
loss of life and so it was a very it was
a very clear mission set where um you
know the more secure we are in the
healthcare and life sciences space the
more lives we will save um another um
another i have two three so that's
number one number two is precision
medicine i think that there is
tremendous opportunity there to really
crack that code and instead of doing
one-size-fits-all clinical practice to
be able to use genomics bioinformatics
metabolomics etc um to to really um
tailor clinical practice to each
individual and make people healthier um
so that they they not only live longer
lives but that they're healthier and
they have better quality quality of life
throughout their life um and then the
third is you know really protecting um
our nation's bio economy
this is a critical sector i think of
growth and um and really of national
security significance so um you know
making sure that we're able to protect
that and um and and create create nice
uh really amazing technology um you know
for our country security would be
amazing well michelle i know you're
going to do a lot to contribute to all
three of those things matt i'll go over
to you what what's your five-year hope
for us
oh i'd say that definitely in terms of
using the capabilities to be able to
more closely
monitor and
respond to
um the evolving
healthcare challenges that we have by
leveraging these capabilities definitely
the pandemic
drove a massive push into more remote
monitoring more remote care and the
cloud definitely is a important piece of
um enabling that moving forward
and i think just from
the larger fda perspective i think that
in terms of
reframing the cyber security
considerations of the cloud of it
extends beyond just
data security potential phi pii
data releases and data breaches that
patient safety and effectiveness is on
the line that this is a
central to the long term
healthcare delivery
in this country and across the world is
leveraging these systems
and doing so thoughtfully and
putting that careful
thought in consideration because it's
more than just
data on the line it's actual patient
safety and effectiveness
of the medical devices
well i know i speak for everyone here
that i am so glad that there are public
servants like you and your colleagues at
fda that are thinking about these things
and are making them bigger and helping
us think and be more curious about these
larger issues so thank you for the way
you're going to advance us in the next
five years as well dan over to you
um i i think i'd echo what everyone said
i think what's really on offer with the
cloud and new healthcare business models
whether it's devices or research and
collaboration or transforming sort of
you know medical records and the like
is really the fact that all of the
patient outcomes that we think about
really rely inherently on data the
quality of the data the ability to take
lessons off that data the ability to
treat better to make better decisions
and so when you think about data
again what cloud offers are velocity and
scale
and with velocity and scale again you
can get better patient outcomes and as i
said before the cloud sort of enables
that but it is a different
model for a lot of enterprises to be
managing data this way i mean we've been
in this transformation for a while but
it's still relatively new it's still in
the early innings if you're a baseball
fan right
and so for
patients
and caregivers to have confidence in
that and be confident that that that we
can live up to the promise of better
data-driven healthcare decisions in
patient care
we need to make sure and be stewards and
not just technology people need to be
stewards but all other executives who
are not technical also need to be
stewards of that in order for people to
be confident we have to secure things
properly
right we need to make sure that privacy
is protected that privacy data isn't
leaking that the risk of someone
tampering with data or tampering with
the instructions to an implanted medical
device that
that those things are bulletproof that
they're reliable
right and that everyone in that value
chain
is not just thinking about
the business outcome or business risk
everyone that's a business person in
that value chain is also a healthcare
provider right and so in my view all
those people also carry around with them
indirectly the hippocratic oath
right be stewards of the data create
confidence in the new models so that we
can all move forward and get the better
velocity the better scale the better
decision making the better insights that
come with that
well and then i think one of the things
i have to thank you for is i know how
much time you spend every day actually
helping a lot of those senior executives
be curious about these topics and really
investigate and really help them
understand kind of what are those
options what are those trade-offs so
thank you for getting us to where we're
going to be in five years and andrea
bring us home you have been so
interesting this whole panels i had to
give you the last word so please
five years tell me what to expect so uh
in five years i hope that we will have
been
more thoughtful in some ways than we
have been to this point about the
question of metrics
so we talk about innovation progress we
throw them around as buzzwords but
actually the definitions of whether we
have a shared view of what progress is
becomes relevant so legally the word
progress shows up in the constitution
but as a technology
sector broadly speaking
the question of what that next
generation better world looks like is
one that we don't spend enough time
talking about i don't think we're all on
the same page i think we're on very
different pages in some cases of what
that world looks like so progress the
word progress if you look at the
philosophy literature it has three
components the first is a normative
claim about what is that better life and
so we start there and then we get to the
social science claims that's the second
piece so what do we need to figure out
in order to build that world and the
third piece is the implementation
specifics and we need to focus on each
of those sets of questions in order to
achieve some sort of next generation
successful technology society um so
that's the first thing the secondary
concern that's included
is the question of whether we're
building technology for people to help
them achieve that good life or whether
we're building technologies that use
people
toward
other goals that are not necessarily
about building that better world
um and um
as a
kind of quick uh
shared homework assignment i i think we
might all have fun with uh
some beverages of our choice to start
re-watching episodes of the jetsons
which was one of my favorite
shows growing up and as i watch that
show now through the eyes of security i
realized that um what i remembered being
kind of a fun utopian next-gen tech
world is actually a little bit of a
dystopian hellscape where george jetson
gets sucked in by his treadmills and
robots malfunction and people get
ejected out of their flying cars all the
time
so
going back and looking at the lessons of
history and thinking through which
pieces of that
model were good and which pieces of our
historical models have been not so good
um and analyzing technologies with that
critical eye i think it's really
important um
super quick story 1933 world's fair on
one side of the fairway
there were
incubators that were privately funded
and the story is fascinating i go
through it in a future article um but
just um tldr
they were privately funded incubators
that charged admission to let people see
the babies but did a fantastic job
anonymizing the identities of the babies
to the point that some of the babies
when they grew up didn't even know that
they were in those incubators meanwhile
hospitals at the time did not want to
save those babies because they were
deemed to be not worth saving
so you had this doc this doctor question
mark his background is 2vd um saving
kids on a race-blind needs-blind basis
other side of the fairway
the eugenicists who subsequently were
commented on as inspiration by nazi
scientists for quantifying human bodies
in very particular ways
and leading to better baby contests and
other things that um history looks back
on with reproach and scorn
so um
uh i'll leave the social commentary
there um but just on a very concrete
legal point in terms of evolving law
which is the question that companies
always ask how do we anticipate where
the law is going
if you build with an eye on that better
society that better world and you try
not to skirt into the regulatory cracks
but instead just build in line with the
the paradigm that any regulator could
potentially cover you if you think about
it in terms of not causing harm the
medical ethic of do no harm if you live
by those words you won't have regulatory
problems in terms of the general
direction
and
uh decades later you know we have a very
different approach to say incubators
which are state of state-of-the-art uh
now and incorporated in regular settings
um and they're highly regulated by the
the fda but uh nevertheless uh you know
the the goal of saving those uh babies
and doing it in a way with
attention to detail um and care uh
remains uh even though the regulatory
system is very different today than it
was back in 1933
this was amazing thank you all i think
one of the things that i'm walking away
with andrea from your your talk is
the idea that we have to be curious we
have to be proactive but we have to we
have to do no harm right we've got it
we've got to be as good as we can be
together in all of this so thank you all
again for those of you watching i hope
you are just about to jump in with a
million and one questions for this panel
because they are awesome and they are
fearless as you've seen and happy to to
take on this subject because we've all
got to be curious and we've all got to
figure this out together and we all have
to do good so thank you all so much for
coming today thank you to the panelists
and we will see you soon for q a
bye
you