Though I am a Michigander by birth and at heart, I have lived in Kansas for the past seven years. For those of you curious as to the “Why”…let’s just say that when you had the bad luck to graduate from college in 2008 in a state that had already been suffering from the economic downturn of the auto industry for several years, leaving the state to find work was the only choice you were left with, short of bunking down on your parent’s couch until the recession was over. Like many new graduates in my original career path of Museum Studies and Management, I wound up in a small town in a rural part of the state because larger museums weren’t hiring. When I moved into the technology sector I moved to a larger city nearby, but most people still consider Hutchinson to be rural…or at the very least the dividing line between rural and suburban.
In my time here, I have learned a lot of lessons and seen a lot of things that have made me appreciate other perspectives. Of course there has also been a fair bit of craziness, such as everyone’s insistence in pronouncing the Arkansas and Little Arkansas rivers that flow through the state as “Ar-Kansas”, despite still pronouncing the state they were named after “Ar-Kan-Saw”. But some of it was a real look at issues facing people who live in this area of the country which I had never really experienced before.
Case in point: When I first moved here, I did not have a car until I had been here for nearly two years. I had the good luck to be renting a place which was one block away from a Dollar General and only three blocks away from the grocery store, so I could walk to get to those places. But the doctor’s office was several miles away on the other side of town…quite a hike when you were healthy, and nearly impossible when you were ill. Until living here, in an area that was predominantly populated with people over the age of 55, I had only heard on news reports of how citizens in rural American who were elderly or impoverished or both lacked easy access to medical care; now I was living it and seeing it. It puts an entirely different spin on things, especially when you stop to consider the possibility that you may have a serious condition which requires followup or care from a specialist located 80+ miles away in Wichita. If you can’t drive yourself or have no one to drive you there, it becomes a lot easier to see why people can rationally make the decision to not get the care that they need.
I can comfortably say that living in an environment likes this does tend to change the way that you think about things. Because you are rather far away from the major cities where things are happening and changing, their distance and remoteness gives the citizens of rural areas a false sense of security. Many of the towns and people out here operate as if they are stuck in an episode of Leave It To Beaver, only with slightly updated clothes and vehicles. The idea that threats or changes they see on the news could ever really affect them was either something to chuckle at or something to greet with immediate hostility and fear. But most of the time, it was simply dismissed with, “It will never happen here. We will keep going on as we’ve always done, and everything will be fine.”
Of course that kind of attitude is dangerous, particularly in the rapidly expanding Medical IT world. In one way, it has been absolutely fascinating to watch the effects that these changes have had in a rural area, from seeing clinical reactions to it to seeing the response from patients. But in other ways, it has been unnerving to watch as EMR’s are established, networks are constructed, patient portals are created and everyone’s data is put within easier access of those who should not have access to it and to have data security and integrity be an afterthought. “We will never get hacked…it can’t happen here. We are just a small medical center in rural Kansas. Only the big guys are targets for that kind of stuff.” When your security procedure relies on flying under the radar of hackers because you are too small or unimportant to be noticed, you have adopted an ostrich mentality which, as a quote I heard puts it, “…perfectly exposes your thinking parts”
This kind of thinking immediately puts you in a reactive position. You are reacting to the events, like a data breach, after they happen. Most successful businesses will tell you this kind of reactive thinking is a sure way to run your business into the ground. It’s also a far more expensive way to do business. It will cost money and time and you may require outside expertise to properly vet your vendors, making sure that they are giving you a product which will protect your data during transit to their systems and as the data moves throughout their systems. But how much is it costing in fines, investigations, credit monitoring for victims, lost reputation, staff time AND the network repairs when something does happen? Far more than it would have cost you to be proactive and tackling security on your network and with your vendors in the first place.
Why do I bring all of this up? Because it has happened. KWCH out of Wichita reported several days ago on a data breach affected at least 18 hospitals and clinics in Kansas when the parent company that was providing the patient portals many of these clinics and hospitals use was the victim of a cyber attack. A complete list of affected hospitals can be found here. I can guarantee you that the people of Ellinwood (population 2,120) never thought that they would be the victims of a data breach. Neither did the people of Hutchinson (population 41,889), which is much larger and is better positioned to be proactive in their approaches to these questions. But now they have been victims, and it forces them into an immediately reactive position. Investigations will be conducted, the particular holes that allowed the attack will be patched up, letters of apology will be issued and free credit monitoring will be offered. But the damage is already done. This is the real difference between proactive and reactive thinking. Let’s hope that this serves as a wake up call to other smaller facilities in rural areas; it has happened and it can happen to you. The choice that you have is how and when you respond to the threat.