Hospital margins have narrowed considerably since the pandemic, but cybersecurity budgets have kept climbing — and health system IT leaders say they are now facing sharper questions from their CFOs about why.
The tension is already showing up in the numbers. An October Moody’s analysis found some hospitals devoting a smaller share of their IT budgets to cybersecurity than they were two years earlier, citing thin margins as one reason — even as the healthcare cyber threat is ever present.
Brian Lancaster, senior vice president and CIO of Children’s Mercy Kansas City (Mo.), recently went to his board to secure funding for a disaster recovery buildout, making the case in operational terms: how long a recovery would take without the investment, and what that downtime would cost the health system.
“But then the next year, the CFO shows up and says, ‘Why did your IT budget go up this much?’” Mr. Lancaster recalled during a Sept. 14 panel discussion at Becker’s IT + Revenue Cycle Conference in Chicago. “So I think it’s that constant kind of just education on what it takes, the value of the technology across the board, certainly for cybersecurity, but then also doing good old-fashioned application rationalization to take things out of the system that you can to kind of cost justify the asset forward.”
For Anahi Santiago, chief information security officer of Newark, Del.-based ChristianaCare, the answer has been to reframe budget conversations around demonstrated savings rather than repeated requests.
“There are a lot of really good platforms out there that have enabled us to consolidate our portfolio into bigger vendors and solutions providers, so it’s easier to then go back to leadership to say, ‘Here’s where we realize cost savings,’” she said. “And yes, budgets are still growing, but here’s the why, and here’s how we’re being responsible. So we’re not just going to the table and asking for more and more money, but we’re demonstrating that we’re being good [stewards], because margins are shrinking.”
“I remember pre-COVID we used to enjoy 10% operating margins, and that’s just not the case anymore,” Ms. Santiago said. “And so we need to be good stewards in how we demonstrate that we are adding value to the organization.”
Prakash Gatta, MD, medical director of complex foregut disease at Arlington-based Texas Health Resources, argued that the math around cybersecurity spending cannot be separated from the broader financial pressure hospitals are under.
“I think it’s impossible to balance a budget, keep a hospital solvent with a 0.5% margin,” he said, adding that the risks tied to cybersecurity incidents are only set to grow. “I do think that new technologies will help raise revenue. I don’t see any other solution other than using new technologies to raise revenue in sort of a minimal IT lift way. I don’t know how else you can balance keeping a hospital solvent, and to look for those solutions is what I’d like to tell the leadership to do.”
