Hospitals depend on information to effectively manage and deliver health services. Given the unremitting escalation in cyber-attacks and patient data breaches at hospitals today, the role of the CISO (Chief Information Security Officer) has moved to centre stage.  
As their own responsibilities have expanded, hospital CISOs have also faced the need to understand perspectives of other boardroom leaders. These range from business practices to risk management, the economics and cost-benefit of security as well as legislation about privacy and liability. Indeed, some American hospitals refer to the CISO as Chief Information Privacy and Security Officer.

Data breaches and ransomware threats escalate
The frequency of reported data breaches at hospitals has grown especially sharply in the US. Over just two days in the middle of September this year, Children’s Hospital Colorado, Morehead Memorial in North Carolina and Georgia’s Augusta University Hospital reported security breaches which potentially affected personal health data of several thousand patients.
Europe has also seen its share of attacks. In May 2017, the National Health Service in Britain was hit by a ransomware attack which crippled the ability of some 16 units to access patient data.  In July, an insider breach at health insurance giant Bupa exposed data of 108,000 customers.
In France, over 1,300 attacks on hospitals and healthcare facilities were voluntarily reported to the Ministry of Health in 2016.

Scale of threat grows, so do delays in response
Nevertheless, a data breach scandal in another business sector depicts the sheer scale and impact of the phenomenon. In September, Equifax, a major US credit reporting agency, announced its IT systems had been compromised, potentially exposing credit card details, Social Security numbers, and other personal information for up to 143 million Americans.
Although critics of Equifax complained about the delay, the longest gap in discovery of a breach concerns Tewksbury Hospital in Massachussets, which took 14 years to discover that a clerk had been inappropriately accessing patient records since 2003.

The role of the CISO
Such events have propelled CISOs to the frontlines of information security, strengthening a trend that dates to the late-2000s.
In 2011, a PricewaterhouseCoopers (PwC) survey found that 80% of businesses had a CISO or equivalent, compared to less than half in 2005. Almost two-thirds reported to the Chief Executive or the Board of Directors, and the rest to a Chief Information Officer (CIO). 

60 percent of US healthcare facilities have CISO role
The situation in the healthcare sector has mirrored, if slightly lagged, this trajectory. In 2017, 71 percent of respondents to a US cybersecurity survey by HIMSS (the Healthcare Information and Management Systems Society) stated their organizations allocated a specific budget for cybersecurity.
Almost half said this was over 3 percent of the budget, while one in ten said the share was more than 10 percent. Another interesting finding from the HIMSS survey was that 60 percent of respondents said their organizations employed a CISO or senior information security leader.

The CISO in Europe
The above figures refer to the US. Europe is likely to be some way behind. Nevertheless, it too is catching up. In France, for example, the Association for the Security of Health Information Systems (APSSIS) made specific recommendations at a recent annual conference on the role of the CISO (known in French as ‘responsable de la sécurité des systèmes d’information or RSSI) and the need for close coordination with the CEO.
In the UK, HCA Healthcare, London’s largest private hospital group (including top facilities such as The Harley Street Clinic, Princess Grace Hospital and The Wellington Hospital) announced an opening for a CISO at the end of August 2017. The HCA described the CISO job as being “responsible for providing strategic leadership and operational oversight for the security of information technology and systems and Information Governance…” Specific tasks which were identified include risk assessment and management, patient privacy, development of policies, standards, procedures, and guidelines, as well as threat/incident response and corporate communications on security.

The CISO and compliance: ISO standards
CISOs are in fact responsible for information-related compliance in all business sectors. Compliance principally involves two information security frameworks published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

IEC/ISO 27001:2013
The first, IEC/ISO 27001:2013 is a guideline with requirements “for establishing, implementing, maintaining and continually improving information security management.”  The second, ISO/IEC 27002:2013, is a standard, and provides implementation rules. It focuses on the confidentiality, integrity and availability of information; it also provides best practice recommendations. Both are applied internationally.

ISO 27799:2016 focuses on healthcare
Hospitals, nevertheless, face very specific information security challenges. These are embodied in another standard, ISO 27799:2016, to protect the confidentiality, integrity and availability of personal health information. This ISO standard provides implementation guidance for the controls in ISO/IEC 27002:2013 and supplements them where necessary, to make them relevant for health-specific information security requirements.

ISO 27799:2016 applies to information in the form of words and numbers, sound recordings, drawings, video or medical images, whether it is stored in print or in writing on paper or electronically. Also covered are the means used to transmit the information – by hand, through fax, over computer networks, or by post.
It is important to note that although ISO 27799:2016 and ISO/IEC 27002:2013 jointly define information security requirements for healthcare, they do not specify how these should be met. In other words, they are technology-neutral.

Differences between ISO and HIPAA
ISO 27799:2016 is, however, not a legal requirement unlike HIPAA (the Health Insurance Portability and Accountability Act) which regulates the security and privacy of health information in the US, though the two have much in common. Nevertheless, for hospital CISOs, the difference is a major factor.
The latest Data Breach Litigation Report from St. Louis law firm Bryan Cave reports 76 class action data breach lawsuits in 2016, up by 7 percent from the previous year.
However, these actions are potentially only the tip of an iceberg, with only 3.3 percent of publicly reported data breaches leading to litigation. What is more pertinent to hospital CISOs is the fact that 70 percent of publicly reported breaches related to the medical industry, with negligence accounting for 95 percent of all cases.

The Common Security Framework
In the late 2000s, an initiative known as the Common Security Framework (CSF) sought to become the overarching framework to comprehensively map different security standards and practices and provide a one-stop solution for hospitals and the healthcare sector. It was established by the Health Information Trust Alliance (HITRUST) – a US-led healthcare industry organization which has sought to ensure that information security becomes central to both the adoption of technology and the exchange of health data.

HITRUST in the US
HITRUST, in many senses, marks the coming of age of the CISO, in the US. Its founders consisted of CISOs from a broad range of healthcare actors, including Blue Cross Blue Shield, CVS Caremark,  Hospital Corporation of America, Humana and Kaiser Permanente, alongside top executives from Cisco Systems, Johnson & Johnson Health Care Systems and Philips Healthcare.
HITRUST has however yet to make any impact in Europe, where attention to healthcare information data security has been directed either to the electronic health record or included within the broader ambit of protecting personal data.

The Smart Hospital in Europe
Indeed, CISOs in Europe’s hospitals pay far greater attention to ISO 27799:2016 and ISO/IEC 27002:2013, with a leadership role at ISO taken by CEN, the European Committee on Standards.  Recently, this has been accompanied by recommendations from ENISA (European Union Agency for Network and Information Security).
As part of the so-called Smart Hospital programme, ENISA has specified good practices for hospitals, with explicit mention of the role of the CISO. Nevertheless, ENISA too takes cognizance of the central role of ISO and the “2700x series of standards.”

National initiatives
There are several national initiatives, too. In France, for example, APSSIS (the Association for the Security of Health Information Systems) has played a major role in charters to be signed by staff within territorial hospital groups (GHT), so as to make them aware of best practices in computer security.

In Germany, ZVEI (the German Electrical and Electronic Manufacturers’ Association) has published guidelines on the use of IT in medicine, including what it calls “secure medical subnetworks”. In February, ZVEI released a position paper on standards for the use of electronic products used in a medical setting and the legal obligations of operators using such systems.
One of the nightmare scenarios here is, of course, the likelihood of hacking of medical devices.  In 2016, Johnson & Johnson warned customers about a security bug in one of its insulin pumps , while St. Jude has sought to deal with the fallout of vulnerabilities in some of its defibrillators and pacemakers.

Health-specific experience
The issue of health-specific technical experience is now driving recruitment of hospital CISOs.  Healthcare has lagged sectors like banking or retail with regard to IT adoption. Indeed, even when hospitals began to implement IT, functionality rather than security was the priority. As a result, most hospitals have a back-office choking with legacy applications, often numbering in  the thousands. Knitting them into a secure architecture is hardly straightforward.
One consequence of such factors is an inadequacy in the number of IT professionals familiar with both healthcare and security. 

Training and certifications
To access the requisite talent, some argue for jettisoning the search for healthcare experience, and focus on hiring an experienced CISO from another industry, followed by training in healthcare issues.  Others favour the opposite – to look for talent in healthcare IT, but train them in security.
The College for Healthcare Information Management Executives (CHIME), and its affiliate, The Association for Executives in Healthcare Information Security (AEHIS) have launched programmes directed wholly at training hospital CISOs.
The CHIME Certified Healthcare CIO (CHCIO) programme, is in fact the first certification programme exclusively for CIOs and IT executives in the healthcare industry. CHIME members who have been in a healthcare CIO or equivalent position for at least three years and want to enhance their professional stature are eligible to become certified. Currently, over 400 IT professionals are CHCIO-certified. This level of figure is also endorsed in a professional forum like LinkedIn, which lists 240 CISOs at hospitals – out of a total of over 7,500.

For now, generally speaking, one is more likely to find CISOs at larger hospitals and academic medical centres in both Europe and the US. Mid-sized facilities still dedicate the CISO role to a CIO (Chief Information Officer), supported by IT staff who devote part of their time to security issues. Such a piecemeal approach is however fast revealing its limitations, as shown by the growing wave of cyberattacks.

According to the World Health Organization’s ‘Global Report on Diabetes’ 2016, diabetes is directly responsible for 1.5 million deaths around the world. This makes it the eighth leading cause of mortality. However, its impact is higher in women, for who diabetes is the fifth leading cause of death. At present, more than 200 million women are estimated to live with diabetes.
One reason for the problem of diabetes in women is the rise in the number of patients with the disease. The prevalence of diabetes, according to the WHO, has doubled since 1980. Moreover, it is no longer a disease that largely affects rich nations. Indeed, prevalence is now growing quickest in middle-income countries. More than half of the total number of women with diabetes today live in southeast Asia and the Western Pacific.
Another issue here is the the lack of healthcare. This means that the management of diabetes is inadequate, particularly for poorer people.

Debate dates to end of 1990s
The debate about gender and diabetes began to intensify at the end of the 1990s, as epidemiology improved, especially outside Western countries.
In January 2001, a report by University of Bristol researchers in ‘Diabetologia’ found geography and gender to be a major factor in Type I diabetes. The report found an excess of male patients in regions with the highest incidence of diabetes, above all in populations of European origin. These showed a roughly 3:2 ratio of males to females in the 15-40 age group. On the other side of the equation, lowest risk populations for Type I diabetes (principally non-European) typically showed a female bias.
The Bristol researchers also observed that Type II diabetes had shown an excess of females in the first half of the 20th century but had become equally prevalent among men and women in most populations, with some evidence of male preponderance in early middle age. Men seemed to also be more susceptible than women “to the consequences of indolence and obesity, possibly due to differences in insulin sensitivity and regional fat deposition.”  In addition, women were more likely to transmit Type II diabetes to their offspring.

Geography and gender
Recent figures from the WHO on mortality from high glucose confirm the dual impact of gender and geography. The data shows a fork in female mortality, from near equivalence to males in the Eastern Mediterranean, Africa and the Western Pacific, to  being about three fourths of male mortality in Europe, the Americas and South-East Asia.
Women may also be more prone to dying from diabetes due to physiological factors. Data show that women with diabetes are more likely than male patients to have poor blood glucose control and be overweight, along with high blood pressure and cholesterol levels. The latter impact directly on cardiac risk factors, and do so in seemingly different ways for men and women.
Male death rates fall, women’s stays unchanged
In 2007, a study in the ‘Annals of Internal Medicine’ revealed a disturbing fact – that women with diabetes fared far worse than men. The study found that in 1971-2000, death rates for diabetic men fell, while the rate for women hardly changed. Worse, while men with diabetes lived on average for 7.5 fewer years than those who did not have the disease, the difference for women was 8.2 years. This disparity is probably due to a combination of multiple factors, according to the study.

Physiological factors and standards of treatment
Most factors are physiological. However, it seems outcomes for women with diabetes may also be worse due to differences in standards of care and treatment. Some of these were highlighted in 2005 in ‘Diabetes Care’, or two years before the ‘Annals of Internal Medicine’ study mentioned above.
The ‘Diabetes Care’ article covered risk factors in coronary heart disease (CHD) and treatment for Type II diabetes. It found that women with diabetes “received less treatment for many modifiable CHD risk factors than diabetic men.” This included staple therapies such as medication for high LDL cholesterol. The authors concluded that “more aggressive treatment of CHD risk factors” in women offered “a specific target for improvement in diabetes care.”
In 2010, a study in ‘Diabetic Medicine’ found the picture to be similar for Type I diabetes. The study by another Massachusetts General Hospital team, led by M.E Clarkin, found women reported lower use than men of medications to reduce CHD risk. These included glycated hemoglobin, as well as aspirin, angiotensin-converting enzyme (ACE) inhibitors, angiotensin II receptor blockers (ARBs) and statins.

The role of cardiac health
Key physiological differences do indeed concern cardiac health.
In the general population, women tend to live longer than men, mainly because of lower rates of heart disease. However, such an advantage becomes insignificant for diabetic women. Indeed, the risk of heart disease is reported to be six times higher for women with diabetes than those without, compared to an increase of just 2-3 times in men.
This impacts directly on mortality for several reasons. One of the most significant is that women can have heart attacks without its most notable symptom in males, namely chest pain. Indeed, women are more likely to experience only nausea, shortness of breath, and back or jaw pain during a heart attack. Many women and medical practitioners in poorer parts of the world do not recognize the latter as warning signs. This lowers the chance of recovery.
One study published in the ‘European Heart Journal’ in 2007 found a stronger association between diabetes and death by heart failure for women than men. A Finnish study also found that heart attacks are more often fatal for women with diabetes than they are for men.
Indeed, perception is linked to less effective health care for women with diabetes, and this is best typified by cardiac health. As women are less likely to have heart attacks than men, a woman may not raise the same alarm bells as a man, especially when she does not experience chest pain.

Renal disease
Women with diabetes face complications from renal disease, too. Men have a higher risk for kidney disease, but this disappears with the onset of diabetes. Women with diabetes are just as likely to get kidney disease as men. Moreover, such a likelihood is not dependent on age, although women tend to be unaffected by kidney disease until menopause, when a drop in oestrogen levels makes the female endocrine system more like a male’s. 
Some studies have found that lower oestrogen levels are associated with kidney disease, but the mechanisms of this association are not yet clear. One theory is that high testosterone, which kicks in as estrogen levels drop, is responsible. Should this be proven clinically, it may be possible for women with diabetes to use hormone therapy to restore the balance between estrogen and testosterone, and thereby improve their kidney health.

Mental health
Depression is about twice as common in women as men and is believed to worsen the outlook for women with diabetes. A study of women in the ‘Archives of Internal Medicine’ in 2010 suggests a two-way relationship between depression and diabetes risk, with each influencing the other. Indeed, some women-only studies have shown women with both conditions are twice as likely to die early as those who had neither. In 2006, a study in ‘Public Health’ extended the scope to men and found that diabetes and depression were not associated in men, unlike in women.

Polycystic ovary syndrome
Women with diabetes are also likely to have several conditions which are female-specific.
One of these is polycystic ovary syndrome (PCOS), a metabolic disorder caused by hormonal imbalance in the female body. PCOS causes irregular periods and can result in fertility problems. It is also associated with acne, darkening of facial skin and hair growth on the face, loss of hair on the head etc. Females with PCOS are at heightened risk of getting diabetes, and the above signs are thus potential indicators of impending diabetes.
The precise mechanism of PCOS is not known, but there is clinical evidence that women with PCOS develop high levels of resistance to insulin and this then leads to development of Type II diabetes.
What has however been confirmed is that women diagnosed with PCOS at an early age show a higher risk of diabetes and fatal heart conditions later in life.

Gestational diabetes mellitus
Women also face the risk of gestational diabetes mellitus (GDM). This is defined as blood glucose values above normal but below those of diabetes. GDM is diagnosed through screening, since several of its symptoms such as increased thirst and urination needs, dry mouth and fatigue are commonplace in pregnancy and are not necessarily a sign of a problem.
Although the true prevalence of GDM is unknown, it is estimated to affect 1-14% of pregnancies in the US, depending on the population studied and the diagnostic tests used. Recent research has focused on high-risk groups. A pan-European study of women with body mass index greater than 29 kg/m2  found prevalence of 24% in early pregnancy, with another 14% developing GDM at mid gestation (24-28 weeks) and 13% at late gestation (35-37 weeks). The study was published in the October 2017 issue of ‘Diabetologia’ and covered women at 11 centres across Europe.
GDM increases the risk of certain complications during pregnancy and delivery, both for the women in question and for their infants. One of these is pre-eclampsia, which causes high blood pressure during pregnancy. Others include the baby growing larger than usual and polyhydramnios, which is the presence of excess amniotic fluid.
Though GDM is a temporary condition, affected women have an over-sevenfold increase in the risk of developing Type II diabetes 5-10 years after delivery. Moreover, children born to mothers with GDM are also more likely to develop impaired glucose tolerance.
Early diagnosis of GDM through testing for blood sugar and modifications to lifestyle can be effective in preventing or delaying the condition and treating its consequences.

Anemia in pregnancy is one of the most common medical problems pregnant women encounter in both low and high income countries. It affects some 32 million pregnant women worldwide each year and is characterized by a lack of red blood cells. Women with severe anemia will have a blood count of less than 70 grams of hemoglobin per litre of blood. It is a dangerous condition and if not prevented or treated correctly can lead to maternal death.
Highlighting the danger, an international study published in May this year, shows that women with severe anemia during pregnancy or up to seven days after delivery have double the risk of dying compared to those who don’t suffer from the condition.
Previous studies had suggested that anemia was strongly associated with maternal death, but they were not clear due to the influence of other clinical factors. This study – the largest of its kind – is the first to control factors that can influence the development of anemia in pregnancy (such as blood loss or malaria infection) and which may have skewed the results of previous studies.

The researchers emphasize that clinicians, policy makers and healthcare professionals should now focus their attention on preventing anemia, using a multifaceted approach, and not just hope that iron tablets will solve the problem.
Although anemia is a readily treatable condition, the existing approaches have so far not been able to tackle the problem, say the researchers who published their study in the MAY/ JUNE 2018  issue of The Lancet Global Health.
For the study they looked at World Health Organization data on 312,281 pregnancies in 29 countries around the world. The study results show that, when all known contributing factors are controlled for, the odds of maternal death are doubled in mothers with severe anemia.
Importantly, the relationship between severe anemia and the increased risk of maternal death is seen in different geographical areas and, by using different statistical approaches, the researchers are able to show an independent relationship between severe anemia and maternal death does exist.
Prior to this research, the absence of robust data showing evidence of the relationship between severe anemia and maternal mortality has led to a relatively low prioritization of anemia as an important condition in its own right. This new research will hopefully motivate health policy makers to sharpen their focus on the prevention of anemia during pregnancy when they shape new policy on the condition.