Navigating safety and care in the digital age

Communities are becoming more targeted by sophisticated attacks that exploit vulnerabilities in clinical systems, resident data, payment platforms, and connected building technologies. Meanwhile, we're talking a bit about the predictive analytics and workflows, how those are really transforming operations and care delivery, and how this dual shift offers significant opportunities for cyber attacks, privacy attacks, and regulatory risk.

So I would really like to start out by introducing our guest for today. Our guest is Sean Scranton. Sean is a WTW cyber consultant. Welcome, Sean, so happy to have you join us today.

SEAN SCRANTON: Thank you, Rhonda. I am the resident geek that works with Rhonda. My background is in computer science. I have done things like pen testing, trying to hack into banks and getting paid for it. But then I was also a CISO of a mid-range insurance company, and so I just kind of fell into insurance, became a cyber underwriter. And now I work with brokers and our clients with their security teams and talk about all things insurance and the technical aspects as well. Thank you, Rhonda, and hello, everybody.

RHONDA DEMENO: We're so fortunate to have you join us today, and matter of fact, after Sean and I had a meeting yesterday and right after my meeting, I got a call that one of our clients had a cyber attack. So it's very timely, it happens when you least expect it. You can't let your guard down.

And today's discussion, as I mentioned, will really focus on some of the vulnerabilities focused on senior living. So my first question, Sean, what does make senior living communities vulnerable to cyber attacks as compared to other sectors?

SEAN SCRANTON: Well, it's interesting because senior living kind of sits at the intersection of health care, and housing, and also hospitality. So that kind of creates some unique exposures. You do have sensitive health financial data. Just by the nature, you have 24/7 operations that can't tolerate downtime. And then you often have limited IT resources compared to our hospital brethren.

Add to that, it's usually a very highly distributed environment. You may have multiple communities. You may be dealing with legacy IT systems. Hopefully your workforce is focused first on resident care. And so from that aspect, attackers see an organization that's mission critical, but it may be a little easier to disrupt.

And so that know that our administrators are more likely to prioritize the continuity over care over cybersecurity or prolonged outages, and that just increases pressure when you may have an attack.

RHONDA DEMENO: So, Sean, what types of resident data are most at risk? There's a lot of technology out on the market now, but when we're talking about technology, all these different providers are collecting some form of data. So what type of resident data do you feel that's most at risk?

SEAN SCRANTON: It's interesting because not only do you have resident data, but you also may have financial data from families as well. So you're probably going to have PII, Personally Identifiable Information. You're probably going to have health information. And then combined with that, you're probably going to have financial data. And all this is going to add up to names, dates of birth, Social Security Numbers, insurance details, diagnoses, and then also information on our families as well as far as their payment, their payment habits, if the family is paying.

So there's a lot of, unfortunately, juicy data there, and especially with medical records, unlike a credit card, you can't replace a medical history, you can't replace your-- it's very difficult to change your Social Security Number. And so criminals monetize this data. They get these Social Security Numbers, they do insurance fraud. They kind of wheel and deal them out on the dark web. And so these senior living records are usually more valuable as compared to, say, maybe retail.

RHONDA DEMENO: Yeah, that makes a lot of sense, and I didn't really think about all those exposures. What are the most common cyber threats targeting senior living organizations today?

SEAN SCRANTON: So senior living is not unlike other organizations as far as vulnerability to threats. And so we still see a lot of phishing, ransomware, business email compromise. Phishing is still the main entry point. I think we've all seen phishing emails, and unfortunately, with the advent of AI, they're just getting more and more difficult to detect.

Phishing usually leads to clicking on a link or maybe calling a number, and when you call the number, you're talking to the help desk, quote unquote, "help desk," but it's really not the help desk, it's not the IT service desk. They're really not trying to help you. What they're trying to do is get into your computer, so they'll ask you to download something off the web, and then once they do that, then they say, oh, we're just trying to help you., and you just downloaded their malware, and now they have full access to your system, and then things usually go south from there.

Along with that, we are seeing a rise upticks-- in business email compromise. And so once they have access to your computer, of course, you don't know that they still have access, the bad guys. They have access to your email, and so they will send emails to your colleagues maybe over in accounts payable and say, hey, we need this-- we need this vendor change, we need to change this vendor number.

And so there, we see more on what we call fraudulent instruction. So we want to change this ACH, this banking information, to something else. It's the bank account of the bad guys. And once they do that then, they'll send in a fraudulent invoice. And then from that fraudulent invoice, you're actually sending money to the bad guys. Sometimes you can get the money back, but if it's something more along the lines of like a wire transfer, those are usually a lot more difficult.

So we see not only the-- we see the health care breaches as far as the health data breaches, but we also see the financial aspects as well from what we call fraudulent instruction.

RHONDA DEMENO: I know Willis does a great job with pushing out a lot of education on the topic. And they have good internal ways with the malware and the authentication. And I'm not obviously a cyber person like you are, but from a long-term cybersecurity practices or investments, what should senior living-- where should senior living operators prioritize to stay ahead of all these evolving threats?

SEAN SCRANTON: AI think one of the things I had when I was a CISO is that my executives were understanding that we will be attacked-- it's not an if, but it's when, and so do what you can as far as prioritizing your resilience. You can strive for perfection, but you don't have to be perfect, and that's OK, but make sure you do those cybersecurity practices, the cybersecurity hygiene.

Make sure you have good backups. Identity and access management as far as your logins and who has access to what. Multi-factor authentication as far as type in your password, and then you have to type in a number on your phone because attackers probably don't have access to-- they don't have your phone in hand, but you do, and so that is a great way to protect your not only yourself, and your organization.

And then also, have help from your IT partners, whether that's monitoring from an outsourced provider, or maybe your entire IT infrastructure is outsourced, and that's OK. And sometimes that can be better than having just one person trying to do everything from the IT perspective.

If you're a smaller organization, you have a local firm running your IT, it's going to be their reputation that's on the hook. So they will do what they can to make sure that their reputation stays good, and they will try to-- hopefully try to make you as secure as possible.

But making sure, going back to prioritizing the resilience over perfection, have that full tone in the organization from the exec level down and say, hey, look, we understand that there are threats out there, we're all in this together, and we're going to do what is necessary, and part of that is awareness training for all of our employees.

And have your executives do the awareness training first before you roll it out and say, our executives have already done this, this is how important it is, we want everybody to do this.

It's so much better from a security person standpoint to have a lot of employees telling me where there are threats than having a secret thing-- well, I clicked on this and I shouldn't have, and I'm scared to say anything, that is one of the worst things you can have. You don't want people scared to tell you. You want them to tell you immediately when something happens.

RHONDA DEMENO: And that should really be built into the orientation even on onboarding new employees.

SEAN SCRANTON: Absolutely.

RHONDA DEMENO: So I'm going to go a little bit off-script with-- because senior living communities, they deal with a lot of vendors. Is there anything specific in a vendor contract that the senior living operator should look for if they are dealing with a third-party vendor for IT security?

SEAN SCRANTON: Absolutely. And now we're talking contracts, so I'm going to give my disclaimer of I'm not a lawyer, I don't have a law degree, I don't even-- I don't even pretend to have a law degree on podcasts. So with that, these are the opinions of me and me alone.

So vendor management is, especially as of the last two or three years, attackers are going after vendors. And once they get into these vendors, they then have access to multiple organizations' data. And so we've seen a very large uprise of those types of attacks.

So they are a large source of risk. From a contractual aspect, i would recommend you look at, as far as hold harmless clause, those types of things, the requirements for them to notify you when they do have some of a data incident-- I'll say incident. But basically, it's much more about your own due diligence as far as vendors. You want reputable vendors. There are assurance aspects out there like SOC 1, SOC 2-- we call them SOC 1, SOC 2s, and those provide assurance that vendors are doing what they can to not only make sure that they stay up and they're financially sound, but also they're protecting data as well.

And so having that vendor management program that you review annually. You can also do things-- probably more for smaller vendors as far as requiring them to have insurance, cyber insurance, so that if they do get-- if they do have some of a breach, they are insured for that, and that's obviously going to, I guess, help all of their clients as well.

But understand that if a vendor is breached, your families, your residents' families, they're not going to look really at the vendor, they're going to look at you. They're going to look at you and they're going to ask, OK, what are you doing? How are you handling those kind of things? So remember, your reputation can be on the line as well.

RHONDA DEMENO: Absolutely. It really would be up to the community to communicate any type of breaches. And if the community is looking for new software or say they're adding a new technology, a new AI tool for fall mitigation or elopement prevention, they should always inform and include their IT department or a third-party vendor, if they're using a third-party vendor, of this new technology to make sure that they're aware of it.

Any other specifics-- since I'm such a layperson at this, but is there anything else that community should be communicating to their IT department or their vendors who are managing their cyber program?

SEAN SCRANTON: Absolutely, and I could talk about this for a long time, but I won't. What you what you just described is known what we call shadow IT, and it's IT systems that it doesn't about, and that is extremely risky for an organization. If there are any IT systems that the employees are using that IT is unaware of, we want to make sure we find those and root those out.

And part of that is sending out an email. It's more of a top-down approach. Sending out an email annually maybe during the vendor review process, et cetera, saying, hey, let's do an inventory of what IT systems we're using so that we know what's out there.

What is coming up soon, which I think we're starting to get in the middle of, is with AI. And with AI, you may have employees that are using AI that you don't about, and I call that shadow AI. Again, going back to the shadow IT, that's very risky. We want to know who is using AI and where-- and I'm going to go off here on a little AI tangent if that's OK because I know AI is—

RHONDA DEMENO: Absolutely.

SEAN SCRANTON: --people's minds, anyway. But we want to make sure that we manage those shadow AI risks, and one of the best ways to do that is to just come full front and say, hey, look, this is our AI policy, this is how we should use AI in this organization. These are acceptable ways to use AI. We encourage you to use AI. And we call that-- in cyber world, we call that the carrot versus stick approach, and that's more of the carrot approach, and that's great.

Because what we don't want is employees putting data into an AI system that we don't know about. So having those policies that say something like, please don't put resident data, health care, financial, et cetera into this AI web-based system. Those types of policies where tell them things that they shouldn't do.

But also tell them things that they can do, and especially from a type of AI we have embarked on using this AI-- this brand, this flavor, whether that's Copilot, Teams, Claude, ChatGPT, pick whatever AI, it doesn't really matter, but as long as your organization understands what employees are doing with AI and how they're using it, that's going to go a long way to your organization from any of-- we'll call it an AI incident.

RHONDA DEMENO: That's really good advice, thank you so much for that. So in terms of cybersecurity practices and investments, where should senior living operators prioritize to stay ahead of these evolving threats? Any recommendations there?

SEAN SCRANTON: Yeah, it's very much a top-down approach. You'll hear me say executive tone a couple times, and that's because that's how important that is. The executive tone obviously sets the tone of the organization, but with-- and going back to my CISO days, the CISO having-- or the security team having the support of executives, that goes a long way.

I feel that security teams should not be looked at as the police, nothing wrong with that, but again, that may put a little hesitancy into employees reporting incidents, and that is one thing, as I said, we do not want. And I know I'm repeating myself, but that is how important it is.

And then also going back to the security awareness aspect as well. And doing those and doing those phishing fishing exercises and doing that annual training.

From a cyber spend aspect, I know that cybersecurity is very much a discretionary spend. You get to choose how much or how little you spend on it. And that is one thing I actually looked at as an underwriter, is what is that tone? Because if that tone is good, usually, then, the spend is good, and usually if the spend is good, then we have resources, we have people, we have the techniques, we have the procedures.

All of those go into concert with each other. I would tell my underwriters, think of security as links in a chain, and if you have one link that is weak, you have a much higher potential for bad things to happen. So it is very much-- should take a much more holistic view of security because it is very much an enterprise risk.

RHONDA DEMENO: Really good takeaways. So how can communities build a basic cybersecurity foundation without a large IT staff or budget? Because we just talked about this at the beginning of this conversation. Senior living organizations, we have some that are very large, large-scale, but then we also have some freestanding, meaning they're sole operators, or they may only have two or three communities in their portfolio. So any recommendations on what cybersecurity foundation without that large IT staff or budget?

SEAN SCRANTON: Yeah. And here, probably the most effective way is start simple. Keep it simple, look at potential outsourcing partners. I know what the hiring rate of cybersecurity professionals is. We're not the easiest to find, especially if it is more of a rural-type community.

And so look for those types of local vendors, those outsourcing types of relationships you can make, and then focus-- again. keeping it simple, focus on a small set of your high-impact controls, and that's going to be your email, it's going to be strong passwords with the MFA that I mentioned. If you have an in-house IT systems, then making sure that they're patched regularly, making sure that you have regular backups, and make sure you test your backups.

But a lot of those can be handled by that outsourced provider. It's all about policies. It's all-- going back to that tone again. It's how do you report an incident. It's about having plans. It's understanding that it's going to be when and not an if. And so once you get past that hurdle, it's a lot easier to make plans as far as, OK, when bad things happen, this is what we're going to do.

You don't need the brightest and the shiniest tools and the most expensive tools to dramatically reduce risk. It's more about making sure that your fundamentals of security are consistent and they're holistic across the organization.

RHONDA DEMENO: Really, really good information there. So for our listeners, Sean did a great presentation yesterday to our Client Advisory Board, and we talked about public readiness or public relation readiness in the event of a cyber attack.

So Sean, my next question would be tied into that presentation you did yesterday. Unfortunately, everyone couldn't be in that presentation, but could you really map out the steps that should be taken immediately if a cyber incident or data breach is suspected?

SEAN SCRANTON: Absolutely. Again, going back to my "I'm not a lawyer" speech, once an incident occurs, one of the first things you have to understand is that internally, especially at the CISO level, the one thing they want to do is just to make this go away. And so you have that feeling of angst and anxiety when you're in the middle of an incident.

And so one of the best things you can do is not only have your incident response plans, as I mentioned, but also practice them. And what practicing them-- and I will get to your-- I will get to the heart of your question, but I want to make sure we cover this important point.

You want to practice those plans because what practicing those plans do is they will help alleviate some of that anxiety that you probably will have-- I know I've had when I had incidents under my tenure as a CISO. And so that just-- it just helps the decision-making and those kind of things.

One one of the first things you want to do is understand that you're going to have obligations to the media. You're going to have-- first off, you're going to have obligations to your employees, to your residents, to their families. You're probably going to have media obligations. And then you're also probably going to have, going back to the legal side, legal obligations as well.

So timing is very crucial. It's not just what you say, but it's also when you say it. Taking those three buckets there, starting with the resident and family notifications, you may consider written notice, consider town halls, call centers, hotlines, having frequently asked questions on your website.

Above all, I would say be very honest. We have planned for issues such as these, and we understand this is concerning, and this is what we're doing about it.

As far as on the media side, you may have a media inquiry. So you may not be able to control the narrative at that point. You may have social media spread. Above all, when an incident has occurred, you probably want to tell your employees, do not post anything on social media, do not talk to the media, we have designated media representatives to do that.

So with that designated spokesperson, obviously making sure they're media-trained. Making sure that you have legal and PR alignment before any interviews are done. And from the media aspect, you don't have to tell them everything. You say, yes, brief acknowledgment, we understand what's going on. Stick to the facts. Commitment obviously to employee safety. Continuing the investigation and here's what our next steps are, and we'll get back to as things change.

And then on that third bucket, the public data breach notifications, make sure that you consult a data privacy crisis management firm or at least a data privacy attorney because there are 50 states, and there are just about 50 different data privacy regulations that you're going to have to adhere to.

Now one thing I will mention is, since I work for an insurance broker, is the importance of insurance. Insurance can help with a lot of these things. And so one of your first calls may be to your insurance carrier, or if you're a client of us, it's to us as your broker. And we will provide guidance, provide the assistance that you need-- as I mentioned, the crisis management firms, all things that insurance can help as far as making sure your message is coordinated and consistent. Guidance on speed and transparency.

And then also more of the geeky stuff. The forensic assistance, making sure that the attacker is still not in your systems, determining how this happened in the first place, and then above all, determining what types of data are affected.

RHONDA DEMENO: I always say, cyber needs to be added to a community's emergency management operations plan. There has to be a cyber plan built within that emergency operations plan, so those are all very good takeaways.

Going back to the staff, when we're talking about senior living staff, they all have many different credentials. And what role does staff training play, and what red flags should employees be trained to recognize?

SEAN SCRANTON: Yeah, absolutely. Again, going back to my tone and my security awareness training, it's one of the highest return investments you can make. Having those employees trained to recognize red flags, whether it's payment requests, unexpected password resets.

Hey, we just signed you up for this antivirus, and we just charged-- we just charged your account for it. If you have any issues, make sure you call this number, and that is a great example of a phishing email. I think I got about-- I think I got about two of those this morning, as a matter of fact, unfortunately. As I mentioned, you call the number, and they get in your systems, and bad things happen from there.

So understanding what's out there in the wild and how attackers are trying to use and-- to trick and use employees, that understanding is one of your biggest security controls.

From a leadership aspect, leadership should remember, residents don't really differentiate, going back to that vendor management between the operator and the vendor. If your partner is breached, your reputation is still on the line. So making sure that your employees understand how they're using vendors as far as the vendor management program, those types of things as well.

But above all, it's creating that culture and that cybersecurity culture, which is extremely important. It's not creating a culture of fear, you don't want that. It's creating a culture of openness where staff see something, say something. When I was a CISO, we made pens that say Think Before You Click.

RHONDA DEMENO: That's good, I like that.

SEAN SCRANTON: I can't take credit for that. I stole that from someone else, but that's fine, it worked. And so those are little reminders that they had on their desk that say, hey, I better think before I click this, and that is exactly what it's all about, because they're trying to trick you into just bypassing rational thought for a few seconds. Don't think for a few seconds here, just click on this and away we go, and it's not good.

So if something does happen, if they do click on something, making sure that they report that and say, hey, I'm sorry, I clicked on this. Hey, it's OK, it's OK. We get these all the time. People click on stuff, it's all right. Let's take a look at it and see what's going on. It's very much-- it's very much about that.

RHONDA DEMENO: So, now my next question really is about the resident and residents' experience. And as you're talking, I'm like, maybe the residents in our communities really should have some training as well. Should residents receive cyber training?

SEAN SCRANTON: Yeah. So I guess, first off, as far as cyber training, it's how interactive are the residents with our systems. That kind of leads to systems as far as the goal here is to be secure by default and not to be restrictive by design.

So your security controls, they should protect your backend systems, but that resident-facing technology-- like for instance, you may have iPads that the residents use, you want to make that-- and again, it's all about a balance of security versus convenience. And so for the resident side, you want to make that as convenient as possible, keeping it as simple and accessible.

You can have staff systems that can require strong authentication without burdening the residents. So it's making sure that you take that into account that security versus convenience aspect.

And then also, make sure you have clear communication. Residents and families, they're probably much more accepting of security measures when they understand-- it's like, hey, look, we're protecting your privacy, we're protecting your safety, and we're protecting your dignity as well. So going back to that culture, that cybersecurity culture, it should support that trust that residents have with staff rather than erode it.

RHONDA DEMENO: Really good takeaways. I really liked how you addressed resident dignity and having that built-in trust, hierarchy of trust for organization, it really helps that cybersecurity program.

One final question-- what regulatory requirements affect how residents' data must be protected? And can you share how the regulations really help to protect resident data in senior living settings?

SEAN SCRANTON: Yeah. Senior living organizations are very much like hospitals here. They are affected by a mix of HIPAA. You have state data breach notification laws. You have consumer privacy regulations. It really just depends on what types of services are offered and how that data is handled.

You may have things like care coordination, you may have wellness services, and I'm probably pretty sure you're probably going to have billing as well. So maybe those billings are by credit cards, and you may actually have PCI-- payment card industry taking your credit cards, those regulations.

From the regulatory aspect, we're seeing that regulators are increasingly expecting reasonable safeguards. They want documented policies. And of course, timely breach notification, that's probably one of the bigger ones we're seeing, that you need to notify by such and such of time, whether that's four days or three days or such and such hours.

But from that executive standpoint, that compliance, that regulatory compliance, I see that more as the floor rather than the ceiling. Those are table stakes, those are bare minimums. Just understand that your reputational expectations from your residents and families, those are more than likely, they're going to far exceed what you have as far as from a regulatory minimum. So I would look at more to what your residents and families expect rather than what the regulatory requirements are.

RHONDA DEMENO: Very, very helpful information. So we know that cybersecurity is critically important for senior living operators due to the sensitive nature of personal and medical information senior living communities are handling. Protecting residents' data from cyber threats ensures privacy and maintains trust between the operators, residents, and their families.

Additionally, we hope that Sean's comments today really help you understand how to build robust cybersecurity measures that help prevent financial fraud, operational disruptions that could actually compromise residents' care and safety.

Sean, we really want to thank you very much for giving us your time today, and walking us through some of those very sensitive topics and important facets about cybersecurity, and ensuring that we are keeping senior living operators' reputation safe and imparting sound systems on how to really manage a sound cybersecurity program. We really appreciate you, Sean. Thank you so much for attending today, we really appreciate it.

SEAN SCRANTON: Thank you. And remember that you don't have to be the best, but just that the strongest programs are going to be led from the top, they're going to be reinforced by culture, and they're going to be executed consistently at every level, and that's what you should strive for. And my pleasure, thank you so much for having me.

RHONDA DEMENO: And thanks again to our listeners for attending this Navigating Safety and Care in the Digital Age and the Importance of Cybersecurity. This concludes our podcast for today. Thank you very much for attending. And for those of you that need additional information or want how to get in touch with Sean, his credentials and his contact information will be provided in our podcast link. Thank you very much, and thanks for attending our Senior Advisor podcast.

SPEAKER: Thank you for joining us for this WTW podcast featuring the latest perspectives on the intersection of people, capital, and risk. For more information, visit the Insights section of wtwco.com.

WTW hopes you found the general information provided in this podcast informative and helpful. The information contained herein is not intended to constitute legal or other professional advice and should not be relied upon in lieu of consultation with your own legal advisors.