Are you tired of the friction between IT and Legal? In this episode of The Legal Department podcast, Sarah Richardson of This Week Health, shares her insights on what the CIO wants in a GC partner. Discover how IT and Legal can become strategic allies, collaborating on everything from cybersecurity to vendor negotiations. Learn about the importance of proactive communication, clear advice, and a shared understanding of the business. Plus, hear Sarah’s personal story of navigating a challenging situation involving a vendor-imposed solution. Don’t miss this episode for valuable tips on building a stronger partnership between IT and Legal.
—
Listen to the episode here
C-Suite Series: How to Partner with the CIO and IT Sarah Richardson This Week Health
My name is Sarah Richardson. I am the President of the 229 Executive Development Community at This Week Health. A fun fact about me is I have over 1,500 logged scuba dives.
—
I’m excited to welcome Sarah Richardson. She is the President of the 229 Executive Development Community at This Week Health. She’s also been a Chief Information Officer and in IT for more than 30 years. She’s worked at Fortune 100 companies, community organizations, academic medical centers, for-profit health, all over the spectrum of healthcare IT. Sarah, welcome to the show.
Thank you for having me on.
I’m really excited. This is the latest installment in what I call my C-suite series. The goal of these conversations is to help in-house counsel to help lawyers learn how to best support their C-suite colleagues. IT, especially in healthcare, is being integrated into the fabric of the organization. IT is everything, really. If you could, without getting too techie on us, talk a little bit about what is in your span of control as a Chief Information Officer. What are you responsible for?
The Span Of Control
I love just the aspect of the span of control. Probably one of the most important things for any C-suite executive is to appreciate that you cannot control everything. You really have to have the opportunity to partner, coordinate, and influence decisions that are made. As a healthcare CIO, the primary role is to really ensure that the organization’s IT systems support and enhance patient care, operational efficiency, and compliance with regulatory requirements. Those things are buttoned down. Those are the brass tacks and table stakes.
It’s Just like making sure that when you turn your computer on, it works. When you turn the water on, it flows from a plumber’s perspective. The blocking and tackling, that first level of Maslow, was really the key. Where it gets more nuanced in each organization are the key accountabilities, overseeing IT strategy, managing the IT budget, ensuring cybersecurity, and driving digital transformation.
What is most notable about the role of the CIO in most companies is that strategy, budget, and cyber are probably 90% of your responsibility now. The digital transformation is actually a system-wide endeavor that comes together through all of the other activities you are performing. Your key stakeholders are obviously your CEO, your CFO, clinical leaders, department heads, and ultimately the patients who we care for and support.
I’ll tell you, though, I’ve always had a really tight relationship with internal audit, human resources, legal, and risk compliance. All the people that help you get things done are the people you spend the most time with organizationally. Everything else surrounds that capability and capacity for the organization as a whole.
Let’s just call them the key three, strategy, budget, and cyber. From the legal lens, cyber is what I’m focused on most of the time with IT. We’re going to talk about contracting and those kinds of big enterprise software or whatever systems you’re working on with the CIO, but cyber is what keeps me up at night. Obviously, that’s a key component, but how much of your bandwidth or brainwaves are taken up when thinking about cyber?
What I love about the cyber posture in an organization, and you can break it down from a reporting structure hierarchy any way you want, is that you want to make sure your CISO or the CISO equivalent has a seat at the table so that the board can appreciate what needs to happen organizationally. When you think about cyber, and I will go back literally 24 years when I had a cyber role with HCA, when we taught people good security practices, that wasn’t something that only happened at work. That is something that carries over into your personal life.
When you think about password complexity, or you think about multi-factor authentication as the brass tacks of the things you do, that’s important at home and at work. It continues to get nuanced from there. It’s like, do you have the right testing environments? Do you have the right patch and release policies? Are you getting your board and your C-suite involved in your desktop activities and your core root cause analysis?
When your CEO or any key stakeholder can tell the story about the importance of a cyber posture and your cyber positioning in an organization, then it’s happening everywhere. I recall when I was also with HCA at one point, security reported to IT. After some major activities, Paul Connolly was masterful as the CISO of HCA. He retired and continues to contribute to the cyber community. He ended up reporting to the chief compliance officer because, at that point, it was everybody’s responsibility.
Cyber is something you’re thinking about all the time. You need to make sure you’re funding it in a way that’s thoughtful to your organization because IT gets right in the middle of it. Do we buy new medical equipment, or do we pay for cyber? As the general counsel, you’re in those conversations all the time. How much insurance do we need to be safe enough? How much coverage do we need on certain systems to be safe enough? If you’re doing everything right, regardless of your budget, you’re still always going to be at risk. The bad guys are spending more time than the good guys trying to figure out how to make these things happen nefariously.
Did you feel in any of those roles that you talked about, the key colleagues, etc., and the CEO certainly leading the charge around the risk profile on cyber, but did you feel like the cyber safety of the organization was squarely only on your shoulders? Did you carry that with you all the time like, “If anything happens, it’s my fault?”
Responsibility Of A CIO
When cyber first started to take more of a front seat, asking people to have complex passwords or two-factor authentication, etc., in the beginning, yes, it was IT doing this to me. It’s the story of any CIO’s career. “IT’s doing this next thing to me,” until people started to realize that when it comes to policy, regulation, compliance, etc., those things are happening to us organizationally. More importantly, any executive leader, anybody in the organization, when something happens in your org that is not what you intended, there’s a personal sense of responsibility.
If there’s a cyberattack, IT is going to be on the front line first, and it’s going to hit some kind of technical system. IT leaders think about cyber all the time because how many times has your data been breached personally this year? Did you get a response from Rite Aid, Ticketmaster, or different agencies? I have credit monitoring for life thanks to all these breaches that are occurring.
Cyber’s always on your mind. What I’ve seen as a sea change in the industry is that everybody’s paying attention to what it means, and it’s not a fad. It’s not a Y2K thing, meaningful use, or HIPAA. It’s going to continue to escalate to an extent where you probably don’t even have cyber insurance from a third party anymore. It’s about how safe you are internally because the insurance companies can’t even keep up with the cyber payments and the premiums.
Just the insurance application in and of itself, it used to be so simple, and now they want to know everything about everything. I’m hoping through this conversation to help the audience appreciate what your role is like because I think IT is similar to legal in that you are service providers. As you said before, being part of the fabric of the organization. I’m here to help the doctors, nurses, and whoever do their job. I’m here to help the organization stay safe, but you’re not necessarily accountable for delivering the product of the business. You’re a support to the business.
We’re an enabler for all the right reasons. We enable the technology to improve workflows, opportunities, and outcomes in the facilities. What’s so interesting, though, is that you think about how the legal and IT teams should be really tightly connected and have each other’s backs all the time. What’s sometimes a little fun, when you dig a couple of layers under the covers, is the fact that IT and legal are probably having mini fistfights behind the scenes to bring the right things forward because you’ll hear in different meetings, you walk through the doctor’s lounge, you meet with your different groups, they’re like, “IT and legal won’t let us.”
I’m like, “The important thing is to explain why we won’t let you, but we will let you. Here’s an alternative way to think about it.” The creativity that emerges from keeping people safe, keeping people legally compliant, all those aspects, there’s a huge piece of it. When I started out in my career, if I knew how much time I would spend with legal, compliance, risk, audit, human resources, and finance, they don’t teach you those things in school. There’s no crash course for those aspects of where you’ll spend some of that time. It’s one of those things where, what does everybody need to care about? Let those voices be heard.
As you were talking, I was thinking, your training, IT is so technical. It’s all about technology and learning technology and systems and all that. Just like legal, it is a very technical area where you learn substantive legal issues, but you have to translate that, and you have to be able to build relationships with colleagues and partner with people where there’s a knowledge gap. I don’t know how many times you’ve heard, “I’m not a techie. I don’t know how to do this.” They look to you as an authority on the technology, but it’s not just the technology that we need to get things done.
Storytelling is very likely the most important skill I learned throughout my career. How do you tell a story that resonates with people about the technology that has nothing to do with the technology itself on the back end? The technology is already there. How you influence, how you inform, and how you tell a story that resonates with people so that they have a stake in it too is what is going to matter in the end.
Are you well-spoken? Do you understand the technology but also the implications for the organization? How well do you build bridges? How well do you actually create a community of other people that supports you when things happen? I had a boss one time who said, “Good news takes the stairs. Bad news takes the elevator.” You can have all the goodwill in the world built up around you and your team, and then something bad happens. Let’s be honest: sometimes you create the oopses, and that’s another set of conversations.
As long as everyone's aligned on the importance and the capabilities, even if something bad happens, you're likely to have less impact on the community and recover faster than if you just hoped it didn't happen to you. Share on XLately, the things happening in organizations are happening to them. Let’s say you and I are in the same organization. We’ve done everything right. Change Healthcare and CrowdStrike happened to us if those were our partners or our vendors. No matter what you and I did on our two sides of the equation, because of that, our recovery opportunity and how we respond to it, does that then allow us to continue to have goodwill in the organization? 100%. In a worst-case scenario environment, that is the best outcome you could aim for. Those are the kinds of conversations you want to be having with your peer group in an organization.
Proactive. Be ready. What’s our recovery time? What’s our plan? That CrowdStrike, it’s very fresh. Our IT team did an amazing job with that. Our whole team did. What you’re saying is how something can be done to you because that was a “fix” that was pushed out by CrowdStrike. I don’t know that your IT team could have done anything to prevent that from interrupting the whole business.
It’s how you responded to it, how were your protocols set up? What kind of devices did you have? What it has started, though, are two conversations among CIOs. First is what is your cloud SaaS strategy? How are you recovering or backing yourself up in the event that there’s an issue with a third party that’s SaaS-based? Your whole cloud strategy is part of it.
The second is CrowdStrike is one of those products that works all the time. You’re letting it constantly deploy in real time to the root of your machine. Do you now have a small, contained test environment where you’re just making sure, even if it’s a 10 or 20-minute delay, that what gets pushed out is not going to systematically break something else? That gets really nuanced in organizations that have a lot of tech debt or a lot of different groups, but you had Linux, Unix, or Apple, nothing happened.
To me, the next level of conversation is, why do most of these major outages or issues happen to Microsoft operating systems? I’ve been in this business long enough to say every major issue has been with Microsoft operating systems, primarily because those are the environments we ran in. Those are the next level of conversations we’re digging into.
Have that conversation with Microsoft, have that conversation with CrowdStrike, have that conversation with your backup and recovery partners. How do I create a safe environment for products in my organization that doesn’t have a window of testing to make sure that it’s going to be okay before it goes out into production?
Is that a conversation you could see legal being part of?
I would absolutely want legal as part of that conversation. I’d actually probably buzz into your office and be like, “Here’s what I’m thinking. What’s the best way for us to approach this conversation?” Every company I’ve worked in, legal is that person where I’m like, “How do we do this?” It’s not that you’re going after your partner, that’s not the intent, but you need your partners to show up for you differently than they used to because, even though they’re creating the problems unintentionally, they’re still being created. Help me be safer by helping you have a better environment as well.
How is legal or GC the right partner for that? Why is that an important partner for you in that conversation?
Challenges In IT Contracting
When you look at our contracts, often they are three years in nature. Sometimes, they have longer-term renewal opportunities, especially when we think about ways to control cost over time, like putting a cap on certain incremental raises of maintenance and licensing, etc. When you look at a lot of the contracts, they’re pretty vanilla, and most of the partners don’t take on any of the risk.
If you look at any of your contracts, half the time when you’re doing the negotiation to get somebody in the door, think about where it gets stuck. If the red lines are getting stuck on things like indemnification, risk assumption, storage of data and information, code escrow if something happens to them, etc. What are those core things that the information is yours, the environment is yours? How are they also taking on a bit of the responsibility of what it means to keep you safer, to keep you operational and running? Those aren’t built in. We just did a city tour dinner in Dallas, and that whole group was really fired up.
If you want to do business with us, you need to take on some of the risk. You need to care about indemnification. Here’s what HIPAA actually means in these environments. Legal being able to point out where there needs to be a shared level of responsibility or building into your contractor some mechanism that says, “If you harm us, here’s what happens.” I’ve been having these fights. I had this fight with a phone company in 2000 when they had an outage during a major event when I still worked in the casino business. They’re like, “Sorry.” We’re like, “You took us down for a day at one of the biggest casinos in Las Vegas because someone stole copper out of one of your sites.”
I’m glad we’re getting into contracting because I feel, first of all, there’s a huge volume of IT contracts, huge. Many places I’ve been have a dedicated IT contracting team. We have that at my current organization. One of the challenges, among many challenges, is that there is pressure. There’s pressure from IT or from the end user. We must have this. The end user, many times, has already made the deal with the vendor. My ability to get better terms is compromised.
You’re referencing what I’ve experienced as a cultural thing among IT vendors, which is like, “Not my problem. If you want my solution, you’re going to take my crappy terms.” All of those things, and nobody thinks, “If this vendor could take us down,” nobody thinks about that in the moment. “They’ve got this slick solution. It’s really going to help us.” The CIO and the GC are in the same boat in some of those situations.
We are in the same boat because we’re the ones telling other people no. It’s not a hard no. It’s, “No, what about these aspects?” What I share with everybody in these conversations, because this is the constant conversation, is that contract and vendor management and partner management are among the number one topics that I have in every CIO group with whom I spend time. What I love about This Week Health is that I’m facilitating partners and CIOs in almost every conversation that I have. They’re asking each other for certain things.
What becomes really interesting in big, huge organizations is that you’re going to have ghost IT floating around no matter what you do. When you start to create a synergy organizationally that says, “If you guys don’t actually talk to legal, risk, compliance, and IT first, it’s just not going to happen.” That’s a cultural thing from the top.
However, let’s assume that we’ve done the things we’re supposed to do to get to a point with the new partner or even a renewal. What we’ve shared with the partner vendors is this. Help us with the business case. Help us with the true ROI. Make sure when it comes to budget season, you’re preparing that packet for and with us in some cases, especially the bigger ones. When it comes to, “Did it do what it said it was going to do? Here’s how much it actually means to the organization,” create that storyline with us as well. It’s not just, “This vendor shows up and everybody has to do all this heavy lifting.” They need to be equally invested.
That’s great advice, actually.
That continuum, Stacy, if a vendor partner comes in and does all of those things with you, you want them at the table with you all the time because they’re helping you build a better mousetrap.
I want to say again, for the in-house audience, that’s a great suggestion if your CIO or IT team isn’t as strategic as you are to say, “Why don’t we get that potential partner and a potential vendor on board with us so that they can see why it’s in their interest to help us run through these traps, as opposed to being in an adversarial posture.”
Negotiating With Vendors
This is what I say to people all the time. “Do you want to be the reason that your whole system came down?” If you say, “I have to have this one widget,” it’s like that widget exists in multiple formats. It’s about doing your homework. There are partners who do that for you. You say, “I want XYZ contraption.” There are partners who, that’s what they do. They’re a marketplace for vetting out all these different digital solutions, not just the IT solution.
Remember, IT is serving the whole organization. If marketing comes to you and you want some widget capability, ask this marketplace aggregator, and they will help you with everything we just talked about. That’s why they’re such a great partner with us. I can refer them out to our CIO community with confidence, knowing that they’re going to do the right thing.
As I said, I’m sure you have had the experience where a business user has arrived on pricing and they will only give us this pricing if it’s a 3 or 5-year term. You’re pregnant with whatever pre-conversations the end user has had. You have to be the bad guy or suck it up and take crappy terms.
I’ll share with you, and this was a really uncomfortable, and I would almost say detrimental, decision at the time, I worked at an organization where the board made a lot of the technology decisions because they owned the companies that had the solutions. This was a very high-end board with a lot of money and a lot of influence. They said, “You’re going to go install my XYZ.” When I looked at it with our security and legal teams, we were like, “This is a really bad idea. Here’s what could happen.” We were told, “It doesn’t matter. Do it anyway.”
I said, “Let’s make sure that the organization, from the CEO and chief of staff level who were supporting the decision, does it. Would you be willing to sign an assumption of risk agreement? If something goes wrong with this, it’s going to land on my team. You’re the one saying we should do it. I’m telling you it’s a bad idea. Would you be willing to sign this?”
They said, “Absolutely not.” Here I was, implementing technology that I knew was a bad idea, that I didn’t want to support, that my team vehemently disagreed with, and being told by the board and the CEO, “You have to do it anyway.” That was just awkward. I didn’t say that for a long time, but I will tell you that when people asking you to do something aren’t also willing to assume the risk, that’s a sign for you that you may be in or can be culturally in the wrong organization. It’s just a tough place to be in. I stood by my guns, though. When you know what’s right is right, what are you willing to do for it?
When people ask you to do something yet aren't willing to assume the risk, that's a sign that you may be in the wrong organization, culturally. Share on XI think in an extreme case where you’ve got a self-interested board and everybody in the room knows that this is not a great solution, but in the day-to-day, and I got to say, I do a little bit of tech purchasing for the legal department. You do feel like, “I’m the subject matter expert. I know what I need.” You don’t really know when to bring in IT. Maybe that’s another way to ask the question. Especially in healthcare, IT is such a big part of the organization. I always feel like I don’t want to bother you. Let me do the homework for you. For the legal and non-legal readers here, when is the best time to bring in IT when you’re considering software or other solutions?
I would always bring IT at the very beginning because when you think about how both counsel and IT support it by being proactive in the selection process, you’re drafting a clear contract, addressing risks, and ensuring compliance and regulations. You’d be amazed at the number of vendors out there nowadays that don’t have a healthcare vertical. They want to get into healthcare because they think it’s just this hugely lucrative environment, which we both know, once you start getting in there and dealing with different regulations, the complexity, and the volume of contracts, it takes a while.
When you have clear communication and expectations from the start, then that’s how we can be helpful in identifying and addressing any potential risks. I’ve had solutions brought to me where, in partnership with that potential vendor partner, we’re like, “If you shore up these 1 or 2 things, we can do business with you.” They’re like, “Thank you for giving us that perspective.”
You negotiate in, “We’re going to help you be better prepared for healthcare delivery. Therefore, perhaps you cut us a discount on licensing or processing,” or however we want to do these things. Get them involved in the very beginning because the one thing IT is incredibly good at is gathering business requirements.
That’s what we do. Most of us started out in an analyst fashion one way or the other. When you’re the analyst, you’re the middle, you’re the one that’s the go-between for all these different organizations. The same thing happens when you’re a paralegal, you see all those different pieces and parts. As you work your way up the food chain, you’ve seen all the pieces that make things possible and the pitfalls to avoid.
Never assume that the partner or the vendor that’s at the table understands your environment. In general, from a healthcare perspective. They definitely don’t understand your environment. Healthcare is local. Everybody’s unique to the 20th percentile. Eighty percent of it can be the same. You can actually help shape the success of a future partner as much as they can help shape your success.
That’s a great perspective. Likewise, I would say the kind of coaching that you talked about earlier, that you could give to a vendor about helping me get my budget package together, this is not just a healthcare show, but it’s very hard to sell to healthcare. To the extent that the in-house legal team and the IT team can work together to help these tech vendors learn how to do that, we should get credit for that. I like the idea of getting some discount. I do want to talk about the fact that there can be tension and friction between IT and legal, and I have experienced that as well. I want to avoid that. What advice would you have for in-house lawyers on how to be better partners and avoid that? How to avoid those kinds of friction moments?
One of the things I loved about meeting you was you saying, “I’m going to Epic UGM with my CIO.” I don’t know if any other CIO-GC partnership is going together. Think about the absolute impact that’s going to have organizationally for you because there are point solutions out there that you two may say, “We need for the next 3 or 4 years. We know that it’s going to be provided by the EMR vendor in 2027. Here’s why we need it now.”
It’s a much more compelling story to be able to put in potentially interim solutions and negotiate the right rates and contracts. The volume, to your point earlier, of contracts that are constantly coming through, especially for renewal, when you’ve been in an organization for a long time, you tend to know where everything is. When you get to an organization, the handoff is never usually smooth. I’ve never replaced somebody who was amazing.
I’ve always replaced people where it’s a little bit of a turnaround. It doesn’t matter why, but I think about what a CIO needs from in-house legal and also what can create a better partnership, someone who understands the unique challenges of healthcare IT. Now, if you’re new to healthcare and you’re really well-versed in GC activities, then get a sense of how this place works. What does it mean to run a hospital or healthcare system?
What can create a better partnership is someone who understands the unique challenges of healthcare. Share on XParticularly around compliance, data security is tremendous. A department can purchase a solution that needs access to certain data. You’re like, hold on, we actually can’t de-identify that data in a way that can be used by marketing, for example. The vendor management aspect of all those pieces. The most important qualities in a GC are a proactive approach, strong communication skills, and the ability to provide clear, actionable advice in a fast-paced environment. I had a partner recently say to us, “It takes 12 to 18 months in their experience to get a contract through.”
More money was spent on redlining the contract than was spent on the actual solution. Once deployed, the ROI was within three months. When you know that ahead of time, Stacy, you and I would prioritize that entire conversation because why would we have just spent more getting to where we needed to be versus just doing it in the first place? It wasn’t because this organization or this vendor didn’t know what they were doing. They’d been around for a while. It’s just because that’s the way it worked in some cases. 12 to 18 months is such a long time.
It’s not, that’s a failure. I would say there is such a volume, and you have this cacophony of business users, and everybody thinks their widget is the most important widget, and the smart users have an ROI case to tell you why it’s needed. It is, at least as one of the service providers to that function, hard to figure out really where you should prioritize because I would bet that 12 to 18-month situation is like, “Whatever. I’ve got twenty other things. John isn’t bothering me about this. John’s passive. He’ll wait.”
Governance And Priotization
Think about it like this, too. One of my favorite places I ever worked, “You got it ahead of time. You went to the budgeting big powwow, a two-and-a-half-day offsite session, and everyone decided then,” and that was it. Towards the end of the year, if we’d had some trade-offs, you go back to the well, and it’s like, “No, decisions have already been made. Put it on next year’s plan.” Prove it. It created a lot of frustration in the organization, like, “We can’t move fast enough or we’re not doing this, etc.”
We spent exactly what we said we were going to spend. We evaluated if it was worth it. We decided if we had any funds left over, where we would spend them. That’s what happens when you work in a really cash-strapped environment. It’s like running a household budget with kids going to college and all these other aspects. You only have so much money. If the well is dry, go ask for it next year. You’re not going to get it right now.
That would be amazing to have that forethought. Actually, our IT department does, this is a really great thing. I want to give them credit for what they do. I’m going to call it a tracker, but we meet as a group and prioritize, “Here’s all the projects. What’s most important?” We score them. They’ve done a really good job of having an infrastructure for decision-making.
However, I think there’s some amnesia that occurs between that priority setting and when somebody needs their widget to be deployed. You’re like, “Remember, yours was 36th on the list.” It’s hard. I feel like legal and IT tend to be front-facing with what I call my internal clients. You’ve got to be the bearer of bad news or disappointment sometimes. That’s a bummer.
Governance, what you just mentioned, and kudos to Sherry and her team for having it in place for all of you supporting that process, there is not a single place I have worked in 30 years where governance wasn’t the conversation we had every single week. I say it like that because you would believe that if everybody’s always talking about it, we’d actually be really good at it in some places. Yet it’s just hard.
The relentless prioritization has to be a thing that everybody cares about. It starts, like everything else, at the top. If the C-suite is not aligned on governance and strategy and the things that need to be done in a current organization, that just creates multiple points of failure as it flows downhill. I’ve seen it every single time. It got to the point where I was like, “What do I want to do next?”
In joining This Week Health, that was a big decision because I thought, “I could do these things, but I’ve done them 5 times in 20 years. I actually don’t want to go set up governance again right now. I don’t want to do certain things again right now. I want to help other people do that in more of a mass environment, still customized and boutique in its nature.” Now, I’m helping multiple CIOs versus just putting all that focus and energy into one organization.
Thanks for opening that part of the conversation. This isn’t necessarily pertinent to the legal audience, but I think it’s interesting from your career standpoint and what could be possible for lawyers in the legal industry. Maybe talk a little bit about what This Week Health is and your role as a community. I’m going to call you convener. I know that you have a bigger, longer title than that.
I have a long name and a long title. I’m always like, “Why can’t I have a counterpart?” His name is Drex. Drex at This Week Health. I’m like, “If I had a cool first name, I would have to be able to do that. No, it has to be my whole name.” It is still relevant to GC because This Week Health is all about shows, events, and awareness of what’s happening in healthcare and IT.
Our founder and CEO, Bill Russell, every weekday, does a newsday briefing on his podcast channel. It’s like ten minutes. If I was in any role in an organization anywhere, I would be listening to him in the morning because he’s giving you the latest FYI and something he’s curated from the media that’s important to share. He puts in his perspective.
For example, he talked about the failure of Watson at MD Anderson, $62 million. This is back in 2017. That project got shut down. What is front and center right now? Aggregation, the use of AI to create all these amazing data models and all these outcomes. The look on your face says it all. Now, what can be learned from that case study years later so that we don’t repeat our mistakes?
Every day, he’s talking about something that’s happening out there. Whether you’re the chief legal officer, the compliance officer, or the CEO, you’re going to get a ten-minute nugget of information about healthcare and IT that is probably touching on aspects of what you do in your role every day as well. To your point at the very beginning, technology is everywhere, but it’s the process and the humans that really make it possible or impossible inside an organization. That’s where I would lean in and listen to it.
We do city tour dinners and two-and-a-half-day summits. We bring people together in really small boutique environments so they can talk about real challenges and walk away with solutions. That’s what we all need. A community that lets us know we are not alone. Also, it gives us an opportunity to figure out how to fix the things that aren’t working and share the things that are so that collectively, you can now call ten other CIOs who have a life like yours and realize you can get this fixed or figured out much faster than you could on your own.
The model is really smart. There are some tech GCs as a community. There are some other legal communities where the industry is focused. I’ve got what I call my kitchen cabinet or my coffee klatch of healthcare GCs that we get together. I think I like it. I’m going to take a note and check out the daily podcast, but I feel there can be a lot to understand around technology.
I’m sure this is your experience as well. It feels like there’s such a learning curve to understand the technology. You said this before, like understanding the business. I have to understand how we deliver healthcare, but I also have to understand data management. I have to understand IT systems. I have to understand cyber. What other advice, besides Bill’s podcast, would you give to lawyers who need to stay current or get up to speed on tech issues?
Absolutely. I love the question because how often do other teams want to learn about the teams they are supporting? You and I lived, and you still live in an interesting environment where we actually do have to know a little bit about everything that happens everywhere in our facility. That whole stakeholder management perspective, that ability to truly get to know people organizationally, is so important.
I get that, especially in those first 100 days or first few months that you’re in an organization, you’re really on a listening tour. What is happening in the organization? How does this place run? Even if you think you know something from a previous lifetime, there’s going to be something happening in your organization that’s slightly nuanced or different.
I always look for the people that I call the historians who’s been around for about 25 years in that org and knows where everything is happening. Who came from other systems that have new perspectives. However, our co-responsibility to each other is to cultivate a deep understanding of the business and operational challenges by staying informed about the latest technology advancements, regulatory changes and spending time together to understand who can inform me about strategic advice that aligns business goals with compliance requirements. I had one-on-ones with everybody we’ve been talking about in our conversation.
Our co-responsibility to each other is to cultivate a deep understanding of the business and operational challenges. Share on XI do, too.
Regularly. I’m like, “What did you learn? You and Sherry are going to UGM. What needs to come back and be shared with the rest of the C-suite or the board?” You two will have that figured out before you even get home.
I’m actually really pumped about this, by the way. For the non-healthcare listeners, Epic is 1 of 2 very large providers of electronic medical records. You may have been paying attention in 2013 when the government mandated that healthcare providers use electronic medical records. It is imperative for all healthcare providers to have it. Epic, the company we use, hosts a conference at their home campus in Wisconsin. I’m going with a bunch of people. This is the first time they have actually devoted a whole day to legal. I’m excited about it. I’ve got to tell you, I’m a little nervous. I have a lot of nerves around not knowing, not understanding technology. I’m excited but also wondering, “Am I going to know what they’re talking about?”
You’ll know because think about what you’ve been exposed to organizationally. The EMR, while it’s technologically based, is really about workflow. It’s really about reporting and functionality and the aggregation of data to have the insights or the things that you need to have, where it gets stored, in whatever table, on whatever server, etc. Yes, you care because if it gets breached, it matters, etc. As far as what the teams need from you legally as a perspective to get things to happen in the organization, that’s going to be key. What brings the joy to caregiving for physicians, clinicians, and providers?
How do we have workflows that make sense? If we are bringing in these single-point solutions and other things that integrate thoughtfully, what does that mean for us? Those are the conversations that, most of the time, you don’t hear legal facilitating or being a part of, but at the end of the day, that is what we’re responsible for. Can patients come to our hospitals and get great care and great outcomes? Can our providers love doing that? Do we make sure that all the trains are running on time?
That’s helpful. Thanks for addressing my anxiety. We’re getting to the end here. I want to ask you a less heady question. I have used music throughout my career to help me through hard times and to get me pumped up and excited. Like I said, I’m going to figure out a good pump-up song to go to Epic in a couple of weeks, but what is your pump-up song?
Jump in the Line by Harry Belafonte. Shake, shake, shake, Sonora. When I taught for CHIME for several years, that was my walk-up song. I actually stole the walk-up song idea from my days at DaVita because you had to have a walk-up song, and I originally wanted it to be Don’t Stop Believin’ by Journey, but someone else at DaVita already had it. I was like, “Who’s obscure enough that no one else is going to have it?” For sure, it was Harry Belafonte.
My standard go-to for everything, Stacy, is Jimmy Buffett. I’m a lifetime fan and still super devastated over him passing. Yet, every time I listen to Harry Belafonte, I get totally pumped. It was one of my mom’s favorites as well. It’s a good memory of her. To your point, what gets you going in the day or the morning needs to be something that keeps you motivated all day long.
Thanks for being in the show. I really learned a lot. I’m excited for your new role, but I’m bummed that you’re not in health IT anymore.
I’m at the center of it. My goal is to continue to create communities that are transforming healthcare one connection at a time. This is exactly how we do it. Conversations like ours, it’s an honor to be on the show. Thank you for having me.
Thanks so much.
Important Links:
About Sarah Richardson
Sarah Richardson is the President, 229 Executive Development Community. Richardson is a transformative, innovative, and results-driven healthcare and technology executive with experience in large-scale healthcare environments. Through comprehensive, human centered design, she enables digital and organizational transformation of multiple organizational domains utilizing proven methods of engagement resulting in improved experiences across the continuum. Prior to joining This Week Health, Richardson served as the SVP for Tivity Health and the Vice President of IT Change Leadership for OptumCare. Richardson also has significant health system experience, serving as CIO of NCH Healthcare System in Naples, FL and as a Division CIO with HCA Healthcare. Richardson is an active member of CHIME as a Certified Healthcare CIO (CHCIO), board and faculty member, and fellow. She regularly publishes industry relevant content on her website at www.conciergeleadership.com. She is an Associate Certified Coach with the ICF and Distinguished Toastmaster, as well as the chair for members in transition for the SoCal Chapter of the Society for Information Management (SCSIM). Richardson holds a BS from the University of Nevada -Las Vegas, and an MBA from the University of Phoenix. Sarah Richardson is one of those people who ‘gets things done’ and has a penchant for bringing out the best in people. With an enthusiastic and genuinely friendly attitude, Sarah radiates a sincere passion for delivering value and benefits to the teams she leads and serves. She has built award-winning teams and has been recognized by The Kansas City Business Journal as a ‘Woman Who Means Business’, a “Next Gen Leader’ and ‘Rising Star’ by KC Business Magazine, and an Outstanding Executive by Advancing Women in Technology.
