The Compliance Divas Podcast
Our podcast covers current topics such as infection prevention and control, OSHA and HIPAA compliance for dentistry. We discuss the latest regulatory information, answer frequently asked questions and give suggestions for dental practices to make compliance easy and sustainable. The Compliance Divas are a trusted source for consistent, accurate information based upon current guidelines, standards, science, and recommendations.
The Compliance Divas Podcast
#232 Spare Tire: Charting Through Chaos
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Today's podcast addresses the challenge of staying fully operational when unexpected Internet outages occur. In dentistry, a few minutes of downtime can derail your schedule, delay patient care, and ripple through the entire day. If your office uses a cloud-based software system, definitely lean in. If you are thinking about going to the cloud, this podcast is definitely for you!
- Contact Spare Tire and mention the Compliance Divas: https://shelterzoom.com/contact-us/
- Spare Tire Video: https://shelterzoom.com/spare-tire/
- Facebook: https://www.facebook.com/thecompliancedivas
- Instagram: https://www.instagram.com/thecompliancedivas/
- Linked In: https://www.linkedin.com/company/the-compliance-divas/?viewAsMember=true
Welcome. I'm Leslie Cannum. I'm Mary Gavoni. I'm Linda Harvey. I'm Olivia Wan and together we are the Compliance Divas.
SPEAKER_02Welcome to the Compliance Divas Podcast. This is Linda Harvey, and I'm excited to be your podcast moderator today because we have something entirely different that we'd like to share with you. And it has to do with having a spare tire for your practice. And not so much a spare tire like we think of with your car, but similar because we want to enlighten you about a product, a service you can use to eliminate your IT downtime in your practice. So today it's my pleasure to introduce our guest, Chow Chen Shorlin, who is the co-founder and CEO of a company called Shelter Zoom. Chow has a very impressive background in cybersecurity. And in addition, she's been named the Female Innovator of the Year. So she has a lot of things going on in the world of IT that can help our practices and organizations. Welcome, Chow. Thank you, Linda.
SPEAKER_00It's so lovely to be here.
SPEAKER_02Well, I know this, I just touched the surface of your background. Is there anything else that our listeners should know about you before we jump into spare tire?
SPEAKER_00Um, yeah, probably just a really quick uh introduction. And um apart from um you know being the co-founder and CEO of Shelter Zoom, um, I have a you know a lot of kind of passion, a lot of uh interest in helping solve big problems. So um before I founded Shelter Zoom, I was leading uh several major programs and um you know as a chief architect, always looking for problems to solve. So I kind of carried that tradition into Shelter Zoom, and uh the spare time was really born after learning uh one of the biggest challenges of healthcare is the EHR downtime. So it doesn't matter if dental industry or the uh the acute and other ambigatory kind of uh care, and EHR downtime is generally just so painful and causing so much stress, so much uh inefficiency, a lot of uh cash flow problem as well. So uh that's how actually SpedHigh was uh formed and to uh help solve this problem.
SPEAKER_02So that leads us into our first question with Mary. Mary would like to ask you a bit more about that. Mary?
SPEAKER_03Thank you so much, Chow, for joining us. Um, you briefly mentioned that you um you are the architect problem solver. So can you elaborate on a specific issue that led you to develop spare tire?
SPEAKER_00Yes. So at the start of 2023, uh we already had another product called Document GPS for very secure file sharing and data loss protection and cyber resiliency. And we took that product to several hospitals and uh um you know really kind of try to showcase our innovation. But what we kept hearing from multiple hospital executives is uh, hey, this is really innovative, but that's not our top priority yet. And our top priority is to really figure out a way how we can stay online during EHR downtime. So at the time I thought, wow, how could that be the case? Because hospitals have so many patients, right? And you know, non-stop people coming into the emergency department and people staying in the hospital, and how could the system go down? You don't have anything. So every single hospital told us the current downtime procedure is pen and paper. And we went to uh independent uh industry analyst as well and confirmed, and there's no downtime, no like adjust-in-time or real-time resiliency tool around. So we actually identify a major industry gap because that's a gap. It's not just about compliance risk, about the revenue risk, it's actually risking patient lives. So we're very, very um inspired to help solve this problem because we believe it really is doing the society good.
SPEAKER_02So, Charles, I'd like to piggyback off that because it reminds me of how a local hospital system, and I'm not sure how many of their I'll say sister hospitals, uh, nationwide were went down when Ascension Health went down. But I know that our daughter, who is a nurse practitioner, sees patients in hospitals. And she's from the old school where she knew pen and paper. So she could have easily picked that back up, but there was no paper available because they weren't prepared. And on top of that, you take newer nurses or newer uh healthcare providers or workers in any field, whether it's phlebotomy or you know, x-ray, they were never trained on paper, so it's really even that's all they have, but it was very, I'll say sketchy, you know, at best. So that was it's good to be able to pick up that on that particular need.
SPEAKER_03Mary, did you have a follow-up thought? I did. And as much as many dental practices have gone kicking and screaming into electronic health records, um, now I would say probably 80, maybe even higher than 80% are there. And now what many practices are doing is moving to cloud-based software. And then they're really paralyzed if their internet service is down and or if their internet service is really slow, then they are absolutely stuck.
SPEAKER_02And let's and that brings us to Leslie's next question, Chow. So Leslie wanted to talk with you about the 30,000-foot and how does that happen? Because we you and share with us the whole ADS, pardon me, AWS when that went down.
SPEAKER_00Yeah, so it this is actually quite an interesting story. When we were at the HLTH uh healthcare conference just two months ago in Las Vegas, and all of a sudden um we noticed a lot of vendors you know uh showing uh their products all stopped. So we went around and uh looking at oh, what happened? They said, Oh, it looks like uh AWS went down. And uh we were actually running on AWS as well, but our spare time was still running because we have internal resiliency, we have multi-cloud strategy. So we could uh were very, very um surprised when the large uh cloud vendor goes down, and literally everyone consuming their service goes down. And uh, but that's only one example. And Linda was also really spot on with um, you know, people these days not able to use a pen and paper anymore. So, for example, last year when the crowd strike went down, and 750 hospitals couldn't even uh sustain the operation, then the change healthcare went down. 94% of healthcare actually got impacted because everyone relied on change healthcare as a backbone to operate on uh healthcare. So those are just a few examples and how widely spread this problem is. It's no longer just, oh, we're down for a few minutes, maybe there's some network uh glitch, or there's some um, you know, the work like uh the construction work in the area, nothing like that anymore. It's really when it's down, it can be down for hours, for days, even for months. And I think Leslie has a follow-up comment for you, Chow. Yes, Leslie.
SPEAKER_01Yes, so I wonder how this would look to somebody like me, a layman. I don't uh really know cyberspace, I sort of look off into the abyss and I don't know what I see beyond the monitor. So if someone was uh, let's say in experiencing some kind of uh operational um, I guess you could say, blockage, I know for myself what I do is I keep trying. I think keep thinking thinking it's something I did wrong, and if I go back in and try it again and try it again. So with with your uh system, it it seems like with spare tire things would continue to run. What would it look like to someone who's trying to log in where let's say AWS is down and it's affecting their practice management software or any of the other software that they might use? Maybe they use a payment gateway. Uh, how would they know that it's not them, it's not my missteps, it it's something that's happening outside of my office that I can't control.
SPEAKER_00Yeah, so Speed High is literally an external uh cloud native solution. So it's a very lightweight EHR system and is uh positioned as a backup system. So as soon as the primary EHR system goes down, your practice management or other type of you know, main EHR system, as soon as it goes down, the downtime procedure can uh trigger the spare tie get activated. So once the spare tie gets activated and all the users will receive the notification, now they can divert into spare tie continue operation. So then they come into the spare tie, they uh can continue doing their um uh the documentation, looking at X-ray, looking at the uh notes, do the clinical notes, do the um you know, place the medication orders and uh things like this. So after the downtime is over, and then the um primary EHR system or practice management system comes back, and then the data captured inside spare time will be automatically synced back into the primary EHR system. So in that way, um the clinicians or the physicians, dentists, you know, whoever actually at the front line serving their patients and didn't really see um the pen, so the transition so smooth, and then they as if nothing happened. Um but you know, obviously, as this as if nothing happened is a little bit uh kind of just a way of saying you it is some small change management, but the interface is so simple to use. So they don't really feel, hey, I have to learn, I have to try and how to use spay thigh. So hopefully that answers your question.
SPEAKER_01Thank you very much. And uh again, you know, the what one of the biggest nightmares I think I've ever experienced when uh going from paper records to to electronic or from a paper appointment book to an electronic appointment book is what if it goes down? And and you know, how am I going to face my day? I don't know who's coming in, I don't know how to make appointments for people, I don't know how to tell them how much they owe. So yeah, I can see where that would alleviate a great deal of uh stress and anxiety.
SPEAKER_00Yeah, exactly. And uh now the probably the most common thing when um people know the system goes down, they just call everyone, say, hey, please don't come. We don't have an electronic system. And that's not very efficient because people could have some serious problems, they need to come in. And then that so that's on the dental and the ambulatory side. Uh, in uh the emergency room, you can't say, hey, you can't you can't come because we don't have a system, but it generally slowed down the care delivery so much and it make the uh the care quality is much uh less. So um, yeah, just kind of want to point those out as well.
SPEAKER_02And child, you really capture my heart as a risk manager when you talk about patient safety, because that is just a huge issue. When one of the things I learned about the Ascension Health downtime is that then you have departments that can't speak to one another. How do you order that image because you can't do it electronically? How do you get the lab results you need in a timely fashion because you can't put into the system ordering medications or for the pharmacy to be able to see if that patient has any, to see if the patient has any contraindications or allergic reactions to drugs, right? So there's so many different aspects of patient safety. And for our listeners, I'd like to back up for just a moment and kind of just reiterate the fact because this is such a new concept. I think our listeners are going to be so excited about this, and I can't wait for them to share it with everybody in their practice. Because when you have your electronic health record, your EHR, or your practice management system, your PMS goes down, and you're cloud-based. So this is not effective for if you're using a server. But even so, more than likely, your practice is thinking about going to a cloud-based in the future because that's that's where we are all headed, so we can be compliant with the 21st Century Cures Act. When it comes to being able to share records through the required interoperability, um, that's the only way to be able to be compliant is to be cloud-based. So, Chocol could we back up and just reframe and redefine for our listeners who is ADS, what is ADS, what was CloudStrike, a little bit about that issue. And then just I was surprised when you said 94% of healthcare was affected by change healthcare. I knew from the numbers of individuals it was almost two million people impacted, like their PHI was shared, you know, incorrectly and um inappropriately because it was breached, but I had no idea that was 94%. So can we back up and talk about those three things if you don't mind?
SPEAKER_00Yeah, so uh I just want to make sure I understood it's AWS, right? Yes, AWS, AWS, CloudStrike, and then a little bit more about change healthcare. Right. So yeah, all those three are obviously the major providers, and they really like uh the backbone of the modern-day cloud operations or healthcare operations and uh CrowdStrike uh last year, it was not a um cyber attack, it was more an incident of the release. So when that goes down, and because there are so many um organizations on uh their tech stack using CrowdStrike, and then causing the systems could not actually be activated. So the system actually literally uh got shut down. So that impacted on so many hospitals because the hospitals rely on, say, Microsoft um the authentication to log in and then rely on those uh type of underlying foundational uh infrastructure and um the you know service to run on uh run the EHR system. So when that happened and um you know airline got shut down, lots of financial services, they stopped the trading, and then hospitals went down as well. So that's kind of a um something they didn't really uh you know forecast or predict because engineering mistakes or the patching, the upgrade mistakes, it uh you know, they do happen. So that's a kind of very good use case for spare time, I would say. Then the other one is the um uh the ransom attack. So the trench healthcare ascension, those names you mentioned, uh all around ransom attacks. But people actually um don't know how frequent hospitals get got ransomed. Um even say last year, I already saw the stats 47% of uh hospital systems were ransomed one stage. It's a big number. It's not like oh, just 4% or maybe 0.4%. It's a large number of hospitals, but they probably don't publicize that kind of which uh which hospital got ransomed. But now because of the um a lot of regulation requirements and the things become more and more transparent, and you do have to uh you know the report you have been ransomed. So when the ransom uh attack happens, the first thing is the incident response team will come in and shut you your system down. So when uh even your EHR system was not impacted, but it still goes down because of the whole procedure, right? Because the EHR system typically is linked with the corporate uh system. So you haven't been able to authenticate through, and then you won't be able to use for a long time. So then after the uh the federal government, uh typically the FBI will turn up and then um making sure and everything gets checked where the ransom came from, they do the uh sanitization analysis and uh forensic analysis analysis. So lots of those procedures have to carry through. And by the time your system comes back and then your EHR gets uh reactivated, it could take uh many, many hours. And but in the ransom case it's typically 16 days. And a lot of hospitals, even one year out, never recovered. And I think change healthcare is the same, they never recover from that uh ransom. And I know at least two hospitals in New York never recovered even from the ransom one or two years ago. So uh one of the hospitals I know until today still use pen and paper, and it they just could not get the re uh the EHR system uh rebuilt, and because a lot of data was destroyed as well. So it's it's a very, very serious situation. So, in any of those cases, including the AWS, um the uh the entire uh um service went down, and you can actually immediately switch to spare high. So spare is not like a master and huge, uh, very heavy EHR system because that you wouldn't be able to run as a spare tie, right? SparTai's goal is to be uh frontline clinician-driven. Clinicians need to be uh sure they won't have downtime. They can immediately continue their care operation because they are the ones looking after patients up front. So our uh design uh principle is very much frontline clinician driven rather than just IT system driven. Because if it's IT system driven, you're not really looking at the impact on real-time patient care. It's a very different uh approach. So you will take a few hours to restore your backup, a few days to restore your backup, but the older clinicians and serving patients, they will struggle, right? They will suffer. So now with the spare time, you immediately get you going and then continue the care operation and to the next destination. And it's not like you're carrying that for years. No, that's not our purpose, but enough for you to run for a few hours, a few days, a few weeks, even for you know, two, three months until you get to the destination where your primary system comes back. So that's really the uh how we help those use cases and how we address those problems.
SPEAKER_02Well, that was perfect, child. And I'd like to go back and correct myself. I think I said ADS, which is our association for dental safety instead of AWS, which is Amazon Web Services. So thank you for correcting me on that. So don't confuse everybody who's listening. It's actually AWS. So, and it's just so important because we don't realize how much, you know, I how what can happen and how many hospital systems, 47% were affected. I I would have never known that. And I think there's probably far more dental offices that are affected that go under the radar, though not like some of the big cases where you see where there's been, you know, a DSO that has, you know, multiple offices and many millions or hundreds of thousands of patients who were possibly compromised, you know. So you don't hear about this much in dental, but it happens. And when you look at the Health and Human Services portal for the breach portal, you can query and see how many open dental breach cases are being investigated. They just don't all make frontline news because it's a small number of patients. But and I love how you use the the analogy and the name spare tire for the company because a spare tire, you when you think about it in your mind, it's not the size of a full tire on your car. So smaller tire, it's designed to just get you a short distance to get to help and get the title tire repaired or buy a new tire. So in this case, we don't want to buy a new electronic health system, but we want to be able to get it repaired. And what I'd like to do next, Chow, is um kind of take the conversation to a dental office because they're smaller, they won't have the full-fledged incident response team, like say a hospital or a health, you know, university health system, but they have their IT vendor who can who's on that on that team with them, and they should have an incident response policy as required by the HIPAA laws, the security rule. So they should have something, they should go get a plan. And the divas talk about plans, Chow, in all different areas, whether a plan when you have a medical emergency, a plan when you have a fire, a plan if you have a needle stick. So this is a perfect thing to have a plan for. So um so let's can we go back and just kind of recap about um how that works in dental practice, and then before we do, maybe Mary would like to like to chime in real quick too.
SPEAKER_03Thanks, Linda. Chao and listening to you and and what your um system provides for practices makes me think that it's even more important than ever for dental practices to have specific cybersecurity training. It's beyond their HIPAA update. It's really understanding, you know, for many of our listeners, they may not even know what Amazon Web Services is. And so they do need to understand um how those outages could affect them and what is this infrastructure that they're running on. Because what and and I'll think of what Leslie said earlier that she looks at the screen and she doesn't go kind of beyond that. And that's I think what what our our listeners do. We look at our practice management. Software are EHR, and um we don't understand how complex a system that it is to manage all of that information.
SPEAKER_00Yeah, so my view, right? Um most cloud providers are extremely robust, you know, otherwise wouldn't have you know millions of um customers or hundreds of thousands of customers. The typically uh January is really, really good, but anything could happen. It's just uh, you know, the especially if it happens to um the provider, and the um consequence is just much more profound than uh if it just happened to like a one small uh service provider. So uh my view is that was the reason why the spare time is your second um uh tech stack. So if you build everything together, like you put all the eggs in one basket, and if that basket breaks and you don't have eggs left, but now if you have one stack which is your primary system stack, regardless of what cloud they are on, what um kind of the underlying technology it is, as long as you have the second stack is somewhere else, now the chance for both providers, um, systems to go down, it the chance is so small. And then if you further build resiliency in case, say multi-region or multi-cloud, in case this cloud goes down, automatically quickly point back to somewhere else, and then you will become spare, spare. So you uh you won't have that type of the risk anymore. So it what I try to say is um at the end of the day, we do have to trust our cloud providers, and um, I would say they are doing a great job. And but in case something like a uh you know the very unfortunate incident happens, regardless of cyber attack or something else, and you always will be safer to have an external second tech stack. So hopefully, Mary, that makes sense.
SPEAKER_03It does, and thank you for that um explanation. It again, it's what what comes to mind for me is they don't know what they don't know at this point, and that could be very dangerous.
SPEAKER_02Yes. I think what we'll do today is we'll put uh a link in our show notes to the spare tire video so someone can look at it online. I think you have it on your website or and they can check there, and then we will put some information in the show notes with how they can reach out to you if they'd like more information. Because I think for our cloud-based listeners, this is something that they need to be mindful of. Um, there's just so many things happening because when your cloud system goes down, it may impact one or two offices, or it may be huge, like the Amazon Web Services that went down. But nevertheless, with the growth of class action lawsuits in this area, as well as the potential for patient injury resulting in a potential lawsuit or complaint to the dental board, I think when you consider the risk, having something like a spare tire makes good common sense and good business sense in the end.
SPEAKER_00Yeah, especially the pricing model is extremely affordable, especially for dentals. So, yeah, I think for compliance, um, for risk management, for the patient safety, and a lot of good reasons and carrying a spare tie is always good than not carrying a spare tie. Just like your car when you drive on the freeway, you can't imagine these days don't have a spare tie in your trunk, right? So it's the same scenario. You know, when you run your dental operations, you run your health care, um, you know, care, and uh, you know, it doesn't matter if it's acute or uh ambulatory, you always feel safer to have a spare tie in your trunk. So you can uh activate that anytime your system goes down.
SPEAKER_02Well, thank you so much. Now, this has been so enlightening. And I'd I'd like to thank our listeners for joining the compliance divas today. We bring clarity and simplicity to compliance by navigating the regulatory world to keep you on course. We invite you to subscribe to our podcast through our website at thecompliancedivas.com or on your favorite podcast channel. And we always welcome suggestions and questions, so please submit those to support at thecompliancedivas.com. And we will put the show notes in the show notes, the resources that we spoke about with Chow, a video, a link to the video, and a link for how to contact Chow and the Herc team. And we look forward to seeing you at our next podcast. Thanks for joining us.