Ensuring Patient Safety

Indian healthcare sees 8,614 attacks per week, making it one of the most attacked sectors. I’ve been in cybersecurity for over 30+ years. But I’ve never seen hospitals being targeted at this scale. Healthcare was once considered a “low priority” target for threat actors. That’s changed. Today, hospitals run on data. Patient records, insurance logs, prescription systems, lab reports, everything is on the computer system right now. It’s no longer just paper files and stethoscopes. It’s full-stack digital infrastructure. And attackers know that better than most CISOs. In late 2024, 7.2 TB of patient data was stolen from the leading healthcare insurance company, Star Health, impacting over 31 million people. It had policy documents, medical histories, tax IDs, lab reports and every single detail or a patient. All public, via Telegram chatbots and leaked web portals. When Reuters tested, they downloaded over 1,500 sample files across claims and medical documents. The reason healthcare is now the softest target? Because the cost of downtime is too high. And the cost of compliance is too low. You can’t afford to shut down hospital systems during an attack. And the penalties for poor security practices? Still far too lenient. That’s the dangerous equation attackers exploit. At Seqrite, we’ve seen a 3x jump in targeted attempts on healthcare setups over the past 18 months alone. And most of them weren’t even zero-days or complex APTs. From basic phishing emails to compromised vendor credentials and public-facing misconfigurations. The same attack playbooks, just aimed where it hurts most. This isn’t a product problem. It’s a mindset problem. If healthcare institutions treat cybersecurity like an IT purchase instead of critical infrastructure protection, these numbers will keep rising. India doesn’t just need better protection tools. We need frameworks, visibility, and accountability, especially for sectors that protect human lives. Have you seen the inside of a healthcare setup's security posture? Was it better or worse than you expected? Seqrite #CyberSecurity #HealthcareSecurity #DataProtection #Ransomware #Infosec #DigitalIndia #DataPrivacy #CyberAwareness #HealthcareIndustry

Today matters. As of today, the Cybersecurity Information Sharing Act of 2015 (CISA 2015) has expired. That may sound like a policy footnote. It’s not. For the past decade, CISA 2015 quietly enabled real-time cyber threat information sharing between government and the private sector (without adding regulation) by providing liability and antitrust protections. That legal backbone is what made rapid, trusted collaboration possible. With its expiration, that certainty is gone. And nowhere is the risk more immediate than in healthcare. Hospitals, clinics, and health systems are already prime ransomware targets because adversaries know downtime equals patient harm. We’ve seen the data: ransomware attacks have been linked to delayed care, diverted ambulances, cancelled procedures and unfortunately patient deaths. This is not hypothetical. When information sharing slows, even briefly: • Early warnings about new ransomware variants don’t move as fast • Indicators of compromise don’t propagate across the ecosystem • Healthcare CISOs are forced to choose between legal risk and operational risk In medicine, minutes matter. Delays cascade quickly from IT systems to clinical outcomes. This expiration doesn’t just affect large health systems with legal teams on standby. It disproportionately impacts community hospitals, rural providers, and small specialty practices; those same organizations already operating on thin margins and limited cyber resources. We talk a lot about cybersecurity as an enterprise risk. In healthcare, it is a patient safety issue. The intent of CISA 2015 was simple and effective: If you see something, share it without fear that doing the right thing will expose you to liability. Letting that framework lapse weakens our collective defense at a time when ransomware crews and nation-state actors are accelerating, not pausing. This should not be political. It should be urgent. Clean reauthorization is still possible but every day without it increases risk to the systems we trust to keep people alive. Cybersecurity is national security. In healthcare, it is also human security. #HealthcareCybersecurity #PatientSafety #Ransomware #CriticalInfrastructure #CyberPolicy #PublicPrivatePartnerships

Safety, quality and efficiency: these are three non-negotiables when it comes to manufacturing in our industry. I believe one of the biggest possibilities with AI is how it can be applied in this space to safely speed access to medicines while making sure we continually deliver on our commitment for high quality medicines. As I talk to our teams at Takeda about this potential, I like to bring examples of what we’re already doing. Here's a recent one - Freeze-dried injectable medicines, like most vaccines, can be especially hard to inspect. Natural variations in their appearance can trigger a false rejection by traditional vision systems, requiring much of the product to be manually re-inspected. Years ago, our teams began experimenting with AI and sensor technology and developed an automated visual inspection (AVI) system to make this process better. The benefits have been clear. The AVI system reduced process times by 100x, false rejection rates dropped from 30% to less than 2%, and about 16 hours are now saved per batch. By far the biggest benefit is that it helps us ensure that safe and effective medicines are getting to patients more quickly. Thank you to the teams who have collaborated, built and tested new technologies to make our operations better. This is exciting work – and it’s just the beginning of the impact we can bring.

Pt safety for AI safety... A recent conversation gave me one of those "why aren't we already doing this?" moments. We're spending enormous energy figuring out how to make #AI safe in healthcare. And we should be. The risks are real and likely to get more acute over time as the usage of #AI in Healthcare grows. What I've been wondering about is why we are treating this risk as something unusual...we already have a well-established, well-tested infrastructure for managing risk to patients sitting in every health system in the country. It's our existing #patientsafety experts and systems. When an AI model or algorithm produces an erroneous clinical result, we should treat it with the same rigor and scrutiny we'd apply to any patient-facing technology or process failure. What does that mean? → Report it through your existing event reporting systems → Execute comprehensive root cause and common cause analyses → Discuss findings in M&M conferences and risk management committees → Apply the hierarchy of controls to eliminate or mitigate the risk going forward We don't need to build something new from scratch. We need to redeploy what we've already built — the structures, the processes, the culture of safety — and extend them to cover AI-related risks. The discipline of #PatientSafety has spent decades researching and deploying best practices for how to interrogate system failures without blame and facilitating the redesign of systems and processes to prevent recurrence. That's exactly the muscle we need right now. The tools are already in your organization. Let's use them. My patient safety colleagues...what am I missing? How do we need to adapt our safety infrastructure to meet the AI moment? #HealthcareAI #QualityImprovement #PatientSafety #AI

🚨 Listening to Richard Horne, CEO of the National Cyber Security Centre, on BBC Radio 4's Today Programme this morning (whilst navigating school run traffic!) was a stark reminder of the evolving cybersecurity landscape we face in healthcare. His scheduled first major speech today at NCSC headquarters couldn't be more timely. 🏥 The convergence of healthcare and technology brings unprecedented opportunities - but also unique vulnerabilities. Last year, my colleagues (Stephen Gilbert, Francesco Ricciardi, Constantinos Patsakis) and I explored this very theme in Nature Portfolio's digital medicine journal, examining the potentially catastrophic implications of cyber attacks on hospital-at-home platforms. (https://lnkd.in/dyEtNNtd) ⚡️ The reality? The most significant system failures don't have to arise from malicious exploitation but can originate from the mundane - a routine software update gone wrong - that can bring critical healthcare infrastructure to its knees. 📋 With Annex 1 of the EU MDR mandating state-of-the-art protection against unauthorised access, and the FDA's pre-market & post-market cybersecurity requirements under 21 CFR 820.30(g), regulatory bodies are crystal clear: robust cybersecurity isn't optional - it's a fundamental safety requirement for market access. 🔐 Cybersecurity isn't just an IT issue though - it's a patient safety imperative. 📋 Quick checklist to consider: - When did you last review your SBOM and vulnerability management processes? - Have you stress-tested your systems against unexpected scenarios? - Is your security risk management process integrated with ISO 14971? - Are your defence-in-depth strategies up to date with NIST frameworks? - Most importantly: when was the last time you ran a full simulation? 🛠️ Speaking of practical steps, kudos to my colleague Tarik Kobalas for sharing some brilliant GenAI security resources recently, including the new OWASP® Foundation LLM&GenAI Top 10 2025 (https://lnkd.in/e5gS5fEt). As we navigate the rapid evolution of AI in healthcare, these tools become increasingly crucial. 🪙 Let's treat cybersecurity with the same rigour as we do clinical safety - essentially two sides of the same coin. #DigitalHealth #Cybersecurity #PatientSafety #HealthTech #MedicalDevices #SaMD

The most dangerous myth in MedTech? That quality is solely QA’s job. That belief costs companies millions. Think about it: • Remediation • Delayed launches • Damaged reputations The impact is real. Quality is not a department. It is a shared responsibility across product development, operations, leadership, and every function that touches the patient. But here’s the nuance I’ve learned after more than 25 years in biotech, pharmaceuticals, and medical devices: Shared responsibility does not erase individual roles. It clarifies them. Here is how quality ownership should actually be distributed across an organization: 1. What a QA Manager is truly responsible for: • Building and maintaining the QMS • Preparing for FDA, ISO, MDR, IVDR, and MDSAP audits • Leading CAPA management and long-term effectiveness • Overseeing documentation and change control • Ensuring compliance with all regulatory requirements 2. Where companies consistently go wrong: • Expecting QA to catch every defect or oversight • Asking QA to write technical procedures for other departments • Isolating risk management within QA instead of placing it with departmental or process experts • Pushing last-minute compliance cleanups onto QA • Treating quality as the “police” instead of a strategic partner 3. What requires real cross-functional partnership: • Partnering with engineering on strong design controls • Closing CAPAs by fixing systemic issues • Monitoring post-market performance • Improving supplier quality with shared ownership • Helping teams use documentation for safety and consistency QA managers cannot and should not function as quality superheroes. You need an entire organization of quality champions. Here are questions that every team should think about: • Who actually owns design controls? • Is QA guiding or just cleaning up? • Has anyone outside QA had recent compliance training? • Are we fixing root causes or patching symptoms? • Do non-QA teams see how their choices affect audits and patients? Shifting from “quality is their job” to “quality is our job” takes discipline, but the payoff is undeniable: • Higher team alignment • Safer, more reliable products • Stronger relationships with regulators • Faster readiness for certification and market entry The results speak for themselves when quality becomes part of the culture, not just the checklist. P.S. If you asked me how to explain to a CEO that QA is not a document-writing silo, I’d say this: Quality protects the patient, the brand, and the business. Its value comes from partnership, not paperwork. As someone who has spent decades in biotech and MedTech quality and compliance, I continue to help teams strengthen this mindset. I’m also opening new training sessions on ISO certification, internal auditing, and compliance fundamentals for cross-functional teams, ensuring compliance with ISO, FDA, and any other applicable requirements. Let me know if you’d like the details.

Part 8: ICH M7(R2) and ICH Q3E together highlight an important principle in pharmaceutical development: quality should be built through scientific understanding, proactive risk assessment, and well-designed controls across the product lifecycle. ICH M7(R2) provides a framework for identifying, assessing, and controlling DNA-reactive mutagenic impurities in drug substances and drug products to reduce potential carcinogenic risk. ICH Q3E focuses on extractables and leachables chemicals that may arise from packaging materials, container closure systems, manufacturing components, and other product-contact materials. What makes these guidelines especially relevant is their common scientific foundation: • risk-based assessment • exposure-based evaluation • patient-focused decision-making • strong regulatory justification In today’s pharmaceutical systems, risk does not arise only from the synthetic route. It can also emerge from: - reagents, solvents, and intermediates - degradation pathways - packaging and contact materials - storage conditions - dose, duration, and route of administration This is why a lifecycle-based approach is so important. The goal is not only to test for risk at the final stage, but to understand where it may originate, evaluate its significance, and establish suitable controls early in development. When viewed together, ICH M7(R2) and ICH Q3E strengthen a broader quality mindset: one addresses mutagenic impurity risk, while the other addresses material-associated chemical exposure risk. Both support the same objective safe, scientifically justified, and compliant medicines for patients. The earlier risk is understood, the more effectively it can be controlled through process design, material selection, and a robust control strategy. #ICHM7 #ICHM7R2 #ICHQ3E #GenotoxicImpurities #MutagenicImpurities #PharmaceuticalQuality #QualityRiskManagement #DrugSafety #RegulatoryAffairs #AnalyticalRAndD #PharmaCompliance

HealthTech CEOs obsess over encryption. And ignore the real threat. Your HealthTech security budget isn't enough. Because the biggest threat isn't a hack; it's a breach of trust. In HealthTech, we talk a lot about firewalls, encryption, and compliance. We invest heavily to protect patient data from cyberattacks. But what happens when, despite all the technical safeguards, a breach occurs? The fallout extends far beyond the immediate financial cost or regulatory fines. The true devastation of a healthcare cyberattack is the erosion of patient trust. Patients feel betrayed. Their most sensitive information, the very essence of their health journey, has been exposed. This isn't just data; it's deeply personal. Clinicians become hesitant. If systems are compromised, providers lose confidence in the tools meant to support them, impacting care delivery and potentially leading to burnout. Reputation takes a hit. In a sector built on confidentiality and integrity, a security incident can shatter years of brand building overnight, making it incredibly difficult to attract new patients or partners. Operational paralysis. Beyond data loss, attacks like ransomware can halt critical hospital functions, directly impacting patient care and even leading to adverse outcomes. Our focus can't just be on preventing the how of a breach, but on fortifying against the what if – safeguarding the patient-provider relationship above all else. This means comprehensive strategies that account for third-party risks, legacy system vulnerabilities, and a culture of security that pervades every level of your organisation.

The Australian healthcare sector is confronting an unprecedented cybersecurity crisis that threatens the very foundation of patient trust and the integrity of our health system. Recent incidents, including the catastrophic MediSecure breach affecting 12.9 million Australians, highlight a disturbing trend that demands immediate attention from every healthcare leader across the nation. The statistics paint an alarming picture of our healthcare cybersecurity landscape. In 2024, Australia recorded its highest number of data breach notifications since the Notifiable Data Breaches scheme commenced in 2018, with the Office of the Australian Information Commissioner (OAIC) receiving 1,122 notifications throughout the year. The healthcare sector led all industries, accounting for 20% of all reported data breaches, with 102 incidents reported in just the first half of 2024 alone. Medical identity theft creates lasting consequences that extend far beyond financial fraud. The MediSecure breach exposed comprehensive prescription data including medication names, strengths, quantities, and reasons for prescription, creating unprecedented opportunities for medical identity theft and pharmaceutical fraud. Australian Privacy Commissioner Carly Kind emphasised that data breach harm "can range from an increase in scams and the risk of identity theft to emotional distress and even physical harm". Unlike other forms of identity theft, medical identity theft can be life-threatening when fraudulent information contaminates legitimate medical records, potentially leading to incorrect treatments or dangerous medication interactions. Healthcare cybersecurity is not merely an IT issue—it's a patient safety imperative that requires board-level attention and systematic organisational commitment. As Carly Kind stated, "Privacy and security measures are not keeping up with the threats facing Australians' personal information and addressing this must be a priority". The question isn't whether your organisation will face a cyber threat—it's whether you'll be prepared when it happens. The cost of inaction is measured not just in millions of dollars in penalties, but in Australian lives and the erosion of the patient-provider relationship that forms the cornerstone of our healthcare system. Is your organisation taking steps to strengthen its cybersecurity posture in line with Australian regulatory expectations?

When Quality Becomes Culture: How the Best Hospitals Make Excellence a Daily Habit There is a meaningful difference between a hospital that has quality systems and a hospital where quality is the culture. The first one passes accreditations. The second one delivers consistently outstanding care, every shift, every day, whether or not an audit is scheduled. The hospitals that have made this leap share something inspiring: they have found ways to make quality feel like a shared mission rather than a compliance exercise. Three approaches that make quality come alive in a hospital: 1) They connect quality metrics to patient stories. Numbers matter. Infection rates, medication error rates, patient safety incident reports. But numbers alone do not change behaviour. The hospitals that build a genuine quality culture regularly share the human stories behind the metrics. A near miss that was caught because a nurse followed protocol. A patient whose outcome improved because a checklist was completed with care. When teams see the real impact of their discipline, quality stops being a burden and becomes a source of pride. 2) They make reporting safe and celebrated. In a true quality culture, reporting an error or a near miss is not a career risk. It is a contribution. The best hospitals actively celebrate the teams and individuals who report safety concerns, because every report is an opportunity to prevent harm. When staff feel psychologically safe to speak up, the organisation learns faster and patients benefit directly. 3) They embed quality into daily routines, not just annual audits. Morning safety huddles. Bedside handover protocols. Real time dashboards that make quality data visible to frontline teams. These small, consistent practices do more for quality than any periodic accreditation review. They make excellence a habit, not an event. Accreditation is important. Standards are essential. But the real magic happens when quality becomes something that every person in the hospital owns, understands, and takes pride in. That is when a hospital moves from being compliant to being truly excellent. What is one quality practice at your hospital that has become genuinely embedded in daily culture? I would love to learn from your experience and share it with this community. #HealthcareQuality #PatientSafety #HospitalAccreditation #QualityImprovement #ClinicalExcellence #IndianHealthcare