Three questions a hospital CISO should ask a healthcare fintech vendor
Cylerity CTO/CISO Drew McCombs explains separating PHI from bank partners, keeping humans in the loop for AI decisions, and enabling email MFA at small practices.
In a Help Net Security interview, Drew McCombs, who holds both CTO and CISO roles at healthcare fintech Cylerity, describes embedding security into every sprint and prioritizing issues affecting patient data or funds disbursement. He outlines how Cylerity keeps PHI away from its lending bank partner by using summarized data and custom identifiers, and insists AI models only recommend while a human approves actions touching money or patient data. He names MFA on email as the cheapest, highest-impact control for small practices, and lists due-diligence questions hospital CISOs should ask fintech vendors.
- Security work is scheduled into every sprint; patient data and funds issues take priority.
- PHI is kept separate from financing data using summaries and custom identifiers.
- AI models recommend only; a human always approves actions touching funds or patient data.
- Email MFA is called the cheapest fix against account takeover and payment fraud.
- Organizations
- CylerityDrew McCombsHelp Net Security
From the original article
5 min read at helpnetsecurity.com
In this Help Net Security video, Drew McCombs, CTO and CISO at Cylerity, explains how he balances both roles. Security work is scheduled into every sprint, and issues touching patient data or funds disbursement come first. He covers how Cylerity keeps PHI away from its bank partner, why AI models recommend but never act, and why turning on MFA for email is the cheapest fix for small practices.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.