How has your MD background shaped how you define and prioritize cybersecurity risk in healthcare, where incidents can affect both sensitive patient data and continuity of care?
My medical background definitely changes how I look at cybersecurity. I don’t see it only as protecting servers, networks, or patient records. I think about the person on the other side of that technology.
In healthcare, a cyber incident can become a patient-care issue very quickly. If clinicians can’t access the EHR, medications, patient history, or critical systems, that’s no longer just an IT outage. So when I prioritize risk, I’m always thinking about three things: patient safety, continuity of care, and protection of patient information. That clinical perspective helps keep cybersecurity connected to the actual mission of the organization.
Coleman delivers behavioral health, rehabilitation, housing, and employment services across 22 Ohio counties. What unique security challenges arise from protecting such a distributed, operationally varied environment?
The biggest challenge is that healthcare is not one nice, clean corporate office where everybody works the same way. We have clinicians, case managers, administrative teams, residential and community-based services, and people working across many different environments.
That creates a very large and constantly changing attack surface. You have different workflows, devices, connectivity requirements, third parties, and different levels of technical comfort among users. So the challenge is creating consistent security without assuming every location or employee operates the same way.
You need centralized standards and visibility, but enough flexibility that security doesn’t interfere with delivering care.
How do you balance stronger security controls with the accessibility and ease of use frontline clinicians, case managers, and care teams need to serve vulnerable populations?
I tell my team that if we make security so difficult that people start looking for ways around it, we haven’t really improved security.
Healthcare workers already have demanding jobs. I don't want a clinician thinking about cybersecurity while they're trying to help someone in crisis. The security should be strong, but whenever possible, it should also be almost invisible.
That means things like SSO, MFA, good identity management, managed devices, sensible conditional access, and automation. My goal is to secure by default, rather than secure because the employee remembered fifteen different rules.
Across your CIO, CTO, CISO, and HIPAA security responsibilities, where do cybersecurity initiatives face the most internal friction: budget, ownership, competing priorities, or translating technical risk into business impact?
For me, the biggest friction is usually competing priorities and translating technical risk into business impact.
If I walk into an executive meeting talking about CVEs, attack vectors, or configuration vulnerabilities, I’m probably going to lose half the room. But if I explain that a particular risk could interrupt clinical operations, expose patient information, create regulatory exposure, or prevent employees from doing their jobs, now we’re having a business conversation.
Budget is always part of it, of course. Nobody has unlimited money. But cybersecurity leadership is really about helping the organization understand which risks deserve investment and why.
There’s no shortage of security data, yet teams still struggle with context. What information do you wish your security stack could connect that remains fragmented across tools, teams, and business systems?
We have an incredible amount of security data. Sometimes the problem is that we have too much data and not enough context.
What I really want is the ability to connect identity, endpoint activity, email, network behavior, cloud activity, vulnerabilities, data sensitivity, application access, and business context into one coherent story.
Don’t just tell me, “This endpoint generated an alert.” Tell me who is using it, what they have access to, what data is involved, whether their behavior is unusual, and what the actual business risk is.
That contextual layer is where I think security platforms still have a lot of room to improve.
Beyond ransomware, PHI protection, and compliance, what underappreciated cybersecurity weaknesses do you see in behavioral healthcare? How do they shape Coleman’s day-to-day security priorities?
Identity is a big one. Third-party access is another. And human workflow is probably one of the most underestimated risks.
Behavioral healthcare is very people-intensive. Staff need information quickly, they collaborate constantly, and they may work from different locations or environments. Attackers understand that. They don’t necessarily need some brilliant zero-day exploit if they can convince someone to click a link, approve an MFA request, share credentials, or change payment information.
So phishing resistance, identity protection, privileged access, vendor risk, endpoint security, data governance, and security awareness are part of the daily operating model. The human layer isn't separate from cybersecurity. It's part of the architecture.
What typically triggers a cybersecurity purchase at Coleman: a newly identified risk, compliance requirement, infrastructure limitation, or a gap in an existing platform? How does that shape the evaluation process?
It can be any of those things, but I try not to buy technology simply because somebody showed me a scary PowerPoint.
Usually, there needs to be a clearly identified problem: a measurable risk, a compliance requirement, a limitation in the existing environment, or a capability gap we can’t reasonably address with tools we already own.
Then we evaluate whether we actually need another product. That part is important because cybersecurity has become very good at creating more cybersecurity products.
If we do go to market, I’m looking at risk reduction, integration, operational overhead, usability, scalability, vendor support, compliance impact, and total cost, not just a feature checklist.
How important is interoperability when you evaluate a vendor? Are you looking for a product that becomes the center of your security architecture, or one that integrates without trying to own the entire stack?
It’s extremely important. I’m generally much more interested in a product that plays well with the rest of the environment than one that arrives saying, “Replace everything and make us the center of your universe.”
We already have major investments across identity, endpoint, cloud, SIEM, email, networking, and data security. A new platform has to fit into that ecosystem.
APIs, automation, telemetry sharing, identity integration, SIEM integration, and the ability to export our own data matter a lot. I don't want another beautiful dashboard that becomes yet another island my team has to stare at all day.
Lastly, in healthcare cybersecurity, what can never be compromised?
Patient safety and trust.
Technology changes. Vendors change. Regulations change. Threats definitely change. But patients have to trust that healthcare organizations will protect their information and that the systems supporting their care will be there when they're needed.
So for me, cybersecurity ultimately comes back to protecting the patient and preserving the organization's ability to care for them.
And I think my medical and technology backgrounds meet right there. Cybersecurity isn't really about protecting computers. It's about protecting what those computers make possible.
