A cyber incident in healthcare doesn’t just expose records. It can stall billing, knock critical systems offline, and force clinicians into manual workarounds when every minute matters. We sit down with cybersecurity leader Jason Elrod to unpack what real operational resilience looks like inside hospitals and health systems, and why the security mission is ultimately about protecting people.

We start with Jason’s journey from the late 1990s “wild west” of defending ISP infrastructure to building healthcare cybersecurity programs where availability and patient care drive every decision. Along the way, he draws a clean line between information security and cybersecurity, then explains how that distinction shapes team design across GRC, identity and access management, and application security. He also gets blunt about hiring: the most technically gifted person can still be the wrong hire if they damage the team’s ecosystem.

Then we zoom out to today’s threat landscape, where third party risk and vendor concentration can turn a single outage into a system wide problem. Jason shares a practical framework for defining a “minimum viable hospital,” mapping critical workflows end to end, and planning for downtime in ways that go beyond backups. Finally, we tackle AI in healthcare, from job redesign to AI governance that avoids “governance theater” and demands named accountability, monitoring, logging, and clear data access controls.

Subscribe to Cyber Survivor, share this with a healthcare leader in your world, and leave a review with your biggest takeaway or question.