ismg summit logo

september 18, 2025

Healthcare Security Summit: New York

9:00 AM ET - 5:00 PM ET

Hosted By

Event Overview

In 2025, healthcare security leaders are under unprecedented pressure. With the fallout from the Change Healthcare breach still reverberating across the industry, adversaries continue to refine their tactics—leveraging ransomware, AI-generated deepfakes, and third-party vulnerabilities to exploit gaps in identity systems, medical devices, and cloud infrastructure. At the same time, regulatory momentum is shifting, with states like New York stepping in to mandate stronger protections and incident response requirements, signaling a new era of decentralized cybersecurity oversight.

The 2025 Healthcare Security Summit will bring together CISOs, technology leaders, and government officials to address the expanding threat environment and reimagine what resilient, secure care looks like in practice. From safeguarding digital identities and operational technology to building continuity plans that ensure patient care during outages, the summit offers a comprehensive look at the challenges—and opportunities—facing the sector. Attendees will explore how to manage the explosive growth of health data, operationalize AI-driven detection, and strengthen supply chain defenses across complex ecosystems. With a focus on pragmatic solutions and cross-functional collaboration, this year’s event equips leaders to move beyond reactive security and build lasting resilience across clinical, operational, and digital domains.

View our ISMG Event Experience video to see what your peers are saying about their participation. 

Topic Highlights

  • CISA’s Vital Role in Safeguarding Healthcare Infrastructure

  • Generative AI in Cyber Healthcare

  • Essential Considerations for HIPAA Compliance and Data Protection

  • Updates and Enhancements to the HICP Guide

Speakers

Thought Leaders on Stage and Leading Deep Dive Discussions

ISMG Summits bring the foremost thought leaders and educators in the security space to the stage, interactive workshops and networking events. Learn from the “who’s who” in Cybersecurity passionate about the latest tools and technology to defend against threats 

2024 Keynote Speaker

John Riggi, National Advisor for Cybersecurity & Risk, American Hospital Association

Start your day with an enlightening session with Riggi, who will explore the latest cyber threats impacting healthcare, including ransomware and data breaches. Gain insights into managing third-party risks, emerging regulations, and enhancing your incident response strategies to ensure resilient and secure healthcare delivery. Don’t miss this opportunity to hear from an esteemed thought leader during the keynote address. 

John Riggi

National Advisor for Cybersecurity & Risk, American Hospital Association

Christopher Frenz

AVP of IT Security, Mount Sinai South Nassau

Ravi Thatavarthy

CISO, Rite Aid

Melanie Fontes Rainer

Director, Office for Civil Rights, U.S. Department of Health & Human Services

Errol Weiss

CSO, Health-ISAC

Lynette Sherrill

Deputy Assistant Secretary of Information Security & Chief Information Security Officer, U.S. Department of Veterans Affairs

Sunil Dadlani

Global CIDO & CISO, Atlantic Health System

Hugo Lai

CISO, Temple Health – Temple University Health System

Cory Brennan

Associate Senior Counsel of Technology & Commercial Transactions, Johns Hopkins Medicine

Karen Habercoss

Chief Privacy Officer, UChicago Medicine

Aaron Weismann

CISO, Main Line Health

Phil Englert

VP, Medical Device Security, Health-ISAC

Past Speakers

Thought Leaders Leading Deep-Dive Discussions on Stage

ISMG Summits bring the foremost thought leaders and educators in the security space to the stage, at interactive workshops and networking events. Learn from the who’s who in the cybersecurity industry, passionate about the latest tools and technology to defend against threats.

Agenda

Given the ever-evolving nature of cybersecurity, the agenda will be continually updated to feature the most timely and relevant sessions.

You can now view or download a PDF version of the attendee guide.

Registration and Breakfast

Opening Remarks

Healthcare Security Summit: New York

Managing the Explosion of Health Data: Security Challenges and Strategies

Hospitals alone produce an average of 50 petabytes of data each year, encompassing electronic health records, medical imaging, genomic data, and information from wearable devices. This rapid expansion presents significant security, privacy, and compliance challenges for healthcare organizations. As the volume of health data continues to grow, projected to reach 36% compound annual growth this year, it becomes imperative to implement robust strategies to manage and protect this sensitive information.

Key Discussion Points:

  • Data Security Implications: Understanding the risks associated with large-scale health data storage, including potential breaches and unauthorized access.
  • Leveraging Advanced Technologies: Exploring the role of artificial intelligence and automation in organizing, analyzing, and securing vast datasets without compromising patient privacy.
  • Regulatory Compliance: Navigating complex regulations governing health data, particularly concerning cloud storage solutions and hybrid environments.
  • Best Practices in Data Governance: Implementing effective data governance frameworks, including encryption, access controls, and regular audits, to ensure data integrity and confidentiality.

John Riggi, National Advisor for Cybersecurity & Risk, American Hospital

Association

Healthcare Security Summit: New York

The Necessity of Proactive Threat Detection in a Breach-Filled World

As security leaders continue to grapple with these threats, lessons from the past year remain critical. The 2024 Change Healthcare ransomware attack—one of the largest healthcare breaches in U.S. history—disrupted medical claims processing nationwide, exposed sensitive data of approximately 190 million individuals, and resulted in a $22 million ransom payment that failed to prevent data leaks. Meanwhile, the Texas Tech University Health Sciences Center (TTUHSC) breach compromised the records of 1.46 million patients, disrupting clinical and research operations. These attacks reveal how AI-enhanced threats, supply chain vulnerabilities, and stealthy intrusion techniques are outpacing traditional detection methods.

This session will equip security leaders with modern approaches to detecting and responding to advanced cyber threats before they escalate. Attendees will explore how AI-driven threat intelligence, behavioral analytics, and real-time monitoring can enhance detection capabilities, reduce false positives, and strengthen resilience against cyberattacks.

Key Takeaways:

  • AI-Augmented Threat Detection: Leveraging machine learning to identify real-time attack patterns, enhance anomaly detection, and reduce response times.
  • Behavior-Based Analytics: Using attack path mapping and behavioral profiling to detect stealthy threats that evade signature-based defenses.
  • Supply Chain and Vendor Monitoring: Strengthening third-party risk assessments, vendor access controls, and device monitoring to prevent indirect compromises.
  • Operationalizing Threat Detection: Implementing threat prioritization frameworks to reduce alert fatigue and ensure SOC teams focus on the highest-risk threats.

Theresa Lanowitz, Chief Evangelist, LevelBlue

Healthcare Security Summit: New York

State-Led Cybersecurity Initiatives: New York's Model and Its Implications for Healthcare Nationwide

New York has taken the boldest step yet with 10 NYCRR 405.46, a sweeping cybersecurity mandate requiring all licensed hospitals to implement robust security programs, appoint a Chief Information Security Officer, and report cyber incidents within 72 hours.

As the October 2025 compliance deadline rapidly approaches, this summit offers a final opportunity for security leaders to ensure readiness, address implementation challenges, and assess the broader implications of New York’s regulation as a potential model for other states.

For healthcare security leaders, the implications are clear: even if federal regulations remain unchanged, organizations may soon face a complex patchwork of state-driven mandates. This session will explore how New York’s regulations could shape the future of healthcare cybersecurity nationwide, what organizations can learn from this model, and how to proactively prepare for new compliance considerations.

Key Discussion Points:

  • Breaking Down New York’s Cybersecurity Mandate – Understanding the key requirements, enforcement mechanisms, and compliance strategies ahead of the October deadline.
  • Impact on Healthcare Security Programs – How new mandates affect security budgets, staffing, and incident response planning.
  • State-Level Regulations as a National Model – Could other states adopt similar frameworks, and what role does this play in federal policy discussions?
  • Navigating Compliance Across Jurisdictions – Strategies for multi-state healthcare organizations to prepare for and adapt to state-driven cybersecurity mandates.

Lynette Sherrill, Deputy Assistant Secretary of Information Security

& Chief Information Security Officer, U.S. Department of Veterans Affairs

Healthcare Security Summit: New York

One Year After Change Healthcare: How Ransomware Is Changing the Game for Healthcare Security

A year later, what has actually changed? Have security postures improved, or are healthcare organizations still at risk of the same weaknesses?

Meanwhile, ransomware tactics have become more sophisticated, going beyond traditional encryption attacks. Healthcare organizations now face double extortion, persistent network access, and destructive wiper malware designed to cause lasting damage. This session will examine the lasting lessons of Change Healthcare while equipping CISOs with strategies to detect, prevent, and recover from ransomware’s latest threats.

Key Discussion Points:

  • Lessons from the Change Healthcare Breach – How has the industry responded, and what critical security gaps remain?
  • Ransomware’s New Tactics in 2025 and Beyond – How threat actors have refined extortion, data theft, and operational disruption beyond simple encryption.
  • Strengthening Cyber Resilience – What security leaders should prioritize in incident response, backup strategies, and third-party risk management.
  • Beyond Reactive Defenses – How AI-driven threat intelligence, behavioral monitoring, and zero-trust approaches can prevent attacks before they happen.

Neal Quinn, Head of Cloud Security Services Business, Radware

Healthcare Security Summit: New York

Protecting Healthcare's Operational Technology from Cyber Disruption

But this increasing reliance on operational technology has created a new frontier for cyberattacks—one that many healthcare security teams are struggling to protect. Ransomware groups, nation-state actors, and cybercriminals are now exploiting OT vulnerabilities to disrupt patient care, exfiltrate data, and even manipulate critical medical equipment.

The urgency to secure OT is growing. Healthcare organizations must address thousands of unpatched, legacy, and manufacturer-controlled devices, while regulatory pressure continues to push for better visibility, monitoring, and segmentation of OT environments. But how can CISOs ensure OT security doesn’t remain healthcare’s weakest link—and do so without disrupting clinical operations?

Key Discussion Points:

  • The New Era of Healthcare OT Threats – How modern ransomware, extortion tactics, and supply chain attacks are increasingly targeting hospital infrastructure and connected medical devices.
  • Regulatory Pressure and Compliance Readiness – What new state-level regulations and HHS cybersecurity initiatives mean for OT security in healthcare.
  • Defensive Strategies for Medical OT – Practical steps for network segmentation, continuous monitoring, and risk-based security controls to protect OT assets.
  • From IT to OT: Bridging the Security Gap – How CISOs can integrate OT security into broader enterprise risk management without disrupting clinical operations.

Shasta Turney, Director of Solution Marketing, Ping Identity 

Networking and Exhibition Break

Healthcare Security Summit: New York

Healthcare Security Summit: New York

Healthcare Security Summit: New York

Healthcare Security Summit: New York

Securing Digital Identity in Healthcare

Unlike other industries, healthcare must balance fraud prevention with seamless access to time-sensitive medical care—a challenge that cybercriminals exploit. Attackers are leveraging AI-generated provider identities, hijacked patient records, and compromised remote access credentials to infiltrate electronic health records (EHRs), insurance claims systems, and telehealth platforms.

Traditional identity proofing and authentication methods are no longer sufficient in the face of AI-enabled adversaries. This session will explore how healthcare security leaders can implement cryptographic defenses, risk-based authentication, and continuous identity verification to prevent unauthorized access while ensuring clinicians, patients, and staff can securely navigate critical systems without friction.

This Session Will Cover:

  • AI-Powered Identity Fraud in Healthcare – How attackers use deepfake-enhanced medical fraud, synthetic patient identities, and stolen credentials to exploit healthcare identity systems.
  • Strengthening Identity Proofing and Authentication – The role of digitally signed credentials, biometric verification, and risk-based identity scoring in stopping fraudulent access.
  • Beyond Passwords: Phishing-Resistant Authentication for Healthcare – Implementing passkeys, FIDO2, and adaptive MFA to secure EHRs, patient portals, and remote provider logins.
  • Creating a Unified Identity Framework – How healthcare organizations can align with HHS-backed identity modernization efforts and build a federated approach to authentication across systems and vendors.

Karen Habercoss, Chief Privacy Officer, UChicago Medicine

Greg Garcia, Executive Director, Health Sector Coordinating Council

Cybersecurity Working Group

Anahi Santiago, CISO, ChristianaCare

Puja Khare, VP for Legal, Regulatory, and Professional Affairs, Greater New York

Hospital Association

Healthcare Security Summit: New York

Building Resilience and Ensuring Continuity Beyond the Breach

Yet, many healthcare organizations remain ill-prepared for cascading failures, supply chain disruptions, and extended outages caused by third-party compromises. When an EHR system, cloud provider, or medical device network goes down, the consequences extend far beyond data loss—patient care is on the line.

This session will take a tactical approach to cyber resilience in healthcare, focusing on how CISOs can build continuity plans that account for real-world dependencies and operational risks. Experts will share strategies to minimize downtime, strengthen third-party risk management, and create redundancy across critical healthcare systems.

Key Takeaways:

  • Beyond Ransomware: Cyber Risks That Can Shut Down Healthcare – Addressing third-party outages, IT supply chain failures, and cloud dependency risks that threaten care delivery.
  • Maintaining Continuity When EHRs and Critical Systems Go Down – Strategies for ensuring patient access to records, medication tracking, and care coordination when digital systems are unavailable.
  • Third-Party and Supply Chain Resilience – How to mitigate vendor failures, reduce reliance on single points of failure, and establish redundancy across key service providers.
  • Operationalizing Cyber Resilience Across Healthcare Teams – Strengthening collaboration between security, IT, and clinical operations to prepare for disruptions before they happen.

Shane Hasert, Director, Threat Research & Cybersecurity Standards, ProcessUnity

Healthcare Security Summit: New York

Protecting Healthcare's Interconnected Systems from Supply Chain Risk

Recent attacks have shown that healthcare networks, insurers, cloud providers, and medical device manufacturers all represent potential entry points for adversaries—often compromising entire ecosystems rather than just individual organizations.

This session will explore how healthcare CISOs can assess, mitigate, and plan for supply chain risks that extend far beyond their own walls, ensuring resilience even when the weakest link in their network isn’t under their direct control.

Key Discussion Points:

  • Why Healthcare’s Cyber Risk is Bigger Than Any One Organization – How service providers, cloud vendors, and business partners introduce risk even for well-secured entities.
  • Mapping Interdependencies to Identify Hidden Weaknesses – Strategies for supply chain risk assessments, third-party incident response planning, and regulatory alignment.
  • Lessons from Major Healthcare Supply Chain Breaches – Analyzing how downstream attacks on vendors and IT service providers have led to industry-wide disruptions.
  • Strengthening Contracts, Monitoring, and Cyber Resilience Across Partnerships – How to enforce security requirements, establish visibility into vendor security practices, and build stronger response mechanisms for supply chain incidents.

Sumant Mauskar, Senior Vice President, Sales and Global Partnerships, Pindrop

Healthcare Security Summit: New York

Solving the Healthcare Cybersecurity Talent Crisis

As threats against the industry intensify, many healthcare organizations lack the in-house expertise needed to manage complex security challenges, respond to incidents, and implement advanced threat defenses. While financial services and tech firms attract cybersecurity professionals with high salaries and cutting-edge tools, how can healthcare organizations recruit and retain the talent they need to defend patient data and critical systems?

To build sustainable cybersecurity programs, healthcare leaders must rethink hiring strategies, internal training initiatives, and workforce augmentation through automation and outsourcing. This discussion will explore how organizations can compete for skilled professionals, upskill internal teams, and adapt to ongoing staffing shortages without compromising security.

Our Panel of Experts Will Discuss:

  • Competing for cyber talent in a highly competitive market – How healthcare CISOs can rethink hiring strategies, restructure compensation models, and build a security culture that attracts top professionals.
  • Bridging the skill gap from within – Developing internal cybersecurity training programs to upskill IT teams, clinicians, and operational staff on critical security concepts.
  • Leveraging automation and outsourcing to fill workforce gaps – How AI-driven security tools and strategic partnerships can reduce the burden on understaffed security teams.
  • Retaining cybersecurity talent in healthcare – Addressing burnout, career development opportunities, and leadership pathways to keep top talent engaged and committed.

Josh Wasserman, Northeast Area Vice President, Semperis

Lunch and Exhibition Break

Healthcare Security Summit: New York

Healthcare Security Summit: New York

Healthcare Security Summit: New York

Healthcare Security Summit: New York

Strengthening Healthcare Security: Advanced Supply Chain Risk Mitigation Strategies

From vulnerabilities in medical devices, to securing legacy systems and managing third-party risk, a single vulnerable link in your supply chain can compromise the security of your entire organization, posing significant risks to patient safety and data integrity. Recent cyberattacks against Change Healthcare, Philips and others exemplify the critical need for robust supply chain security measures, including comprehensive vendor risk assessments, securing medical devices and software, and the necessity of continuous monitoring and rigorous security protocols.
Recognition that each interaction and transaction within the supply chain can introduce potential risks is crucial for maintaining a comprehensive security framework. This session will take a deep dive into the many aspects of supply chain security, emphasizing a holistic approach to preventing, detecting, and mitigating threats to critical operations and delivery of care.


Key strategies to be explored include:

  • Vendor Risk Assessments: Evaluate the security posture of suppliers and third-party vendors, focusing on those handling sensitive patient data and critical infrastructure.
  • Advanced Security Controls: Implement measures like code signing, software integrity verification, and secure boot mechanisms to protect connected medical devices and other components.
  • Contractual Security Requirements: Establish SLAs and contracts with stringent security clauses to ensure vendor accountability.

Hugo Lai, CISO, Temple University Health System 

Errol Weiss, CSO, Health-ISAC

Christopher Frenz, AVP of IT Security, Mount Sinai South Nassau 

John Banghart, Senior Director for Cybersecurity Services, Venable LLP

Healthcare Security Summit: New York

Healthcare Security Summit: New York

Healthcare Security Summit: New York

Healthcare Security Summit: New York

Deep Fakes, Real Stakes: Unmasking Cyber Deception in a High-Stakes Tabletop Simulation

What You Will Gain From This Experience

  • Enhanced Organizational Readiness: To critically assess and improve organizational preparedness in responding to intricate cyber incidents involving deep fake technology and social engineering.
  • Interagency Collaboration and Knowledge Exchange: To strengthen the partnership and information sharing between the U.S. Secret Service and leaders in the private sector cybersecurity community.
  • Strategic Response Development: To create all-encompassing incident response strategies that cover legal, technical, and communicational facets, while also identifying and rectifying weaknesses in existing cybersecurity policies and governance.

Randy Guerette, HC Solutions Engineer, Claroty

Todd Felker, Executive Strategist, Healthcare, CrowdStrike

Matthew Oelsner, Network Intrusion Forensic Analyst, United States Secret Service

Networking and Exhibition Break

Healthcare Security Summit: New York

Healthcare Security Summit: New York

Latest Cyber Expectations for Medical Devices

That briefing will be followed by discussion with our esteemed panel of experts, including Phil Englert, vice president of medical devices security at the Heath Information Sharing and Analysis Center.


This session will explore:

  • How the FDA is vetting cybersecurity of new medical device pre-market submissions,
  • How these new regulatory developments are affect device makers and healthcare entities
  • Other emerging cyber threats and challenges involving medical devices

 

Aftin Ross, Deputy Director, Office of Readiness and Response, Office of Strategic

Partnerships & Technology Innovation, Center for Devices and Radiological Health

Phil Englert, VP,  Medical Device Security, Health-ISAC

Healthcare Security Summit: New York

Essential Considerations for HIPAA Compliance and Data Protection: Expert Advice From Director Fontes Rainer

In this exclusive session, attendees will:

  • Gain insight into the latest HHS OCR guidance materials that cover topics such as the use of online tracking technologies and HIPAA considerations;
  • Stay informed about the agency’s HIPAA rulemaking activities and gain an understanding of their enforcement priorities;
  • Discover critical considerations that are essential for HIPAA-covered entities and business associates to ensure compliance and protect sensitive health information.

Melanie Fontes Rainer, Director, Department of Health and Human Services’ Office

for Civil Rights

Healthcare Security Summit: New York

Healthcare Security Summit: New York

Healthcare Security Summit: New York

AI in Healthcare: Addressing Bias and Security Risks

However, as AI algorithms increasingly influence medical decision-making, concerns about bias and discrimination have become increasingly apparent. These biases can arise from inherent issues in AI datasets, algorithmic design, and implementation, potentially perpetuating disparities in healthcare delivery and outcomes.


This session will delve into the ethical, legal, and security implications of healthcare discrimination facilitated by AI, including the erosion of trust, patient harm, and legal challenges. We will explore how AI’s blind spots can inadvertently reinforce existing biases and how representative datasets can help mitigate these challenges.


Join us to examine the following key areas:


Biases in AI Datasets: Understand how biases in training data can lead to unequal healthcare outcomes and discuss the importance of using diverse and representative datasets.
Algorithmic Design, Implementation, and Security: Analyze how design choices and system vulnerabilities can influence the fairness and safety of AI applications.
• Mitigation and Protection Strategies: Discuss effective strategies to mitigate bias in AI healthcare applications, emphasizing the need for ongoing oversight, ethical standards, and robust security measures to ensure equitable and ethical use of AI in healthcare.

Cory Brennan,  Associate Senior Counsel of Technology & Commercial Transactions,

Johns Hopkins Medicine 

Aaron Weismann, CISO, Main Line Health 

David Hoffman, Assistant Professor of Bioethics, Columbia University 

Closing Comments

Sponsors

Register

RSVP here to attend our events. You can select for multiple or individual tickets. 

NOTE:  All requests to attend will be reviewed by event staff and approved based on professional qualifications and event capacity.

Venue

Well& by Durst - One World Trade Center

285 Fulton Street, 64th Floor 

 

NOTE:  All requests to attend will be reviewed by event staff and approved based on professional qualifications and event capacity.

CPE Credits

Our Summits offer Continuing Education Credits. Learn informative and engaging content created specifically for security professionals.

The Summit Experience

Upcoming ISMG Events

June 5, 2025

AI-Driven Advantage: Streamlined Operations, Loyal Customers

June 12, 2025

AI Security Imperatives: Protecting Your Enterprise in the Age of GenAI

June 10, 2025

Hybrid Identity Under Siege: Defending AD & Cloud-Based Identity

June 19, 2025

Building Next-Gen Applications with Serverless: Accelerating Development for Data-Intensive Workloads

June 18, 2025

Threat Exposure Management: How Do You Prioritize Vulnerabilities?

Upcoming ISMG Events

June 5, 2025

AI-Driven Advantage: Streamlined Operations, Loyal Customers

June 10, 2025

Hybrid Identity Under Siege: Defending AD & Cloud-Based Identity

June 12, 2025

AI Security Imperatives: Protecting Your Enterprise in the Age of GenAI