The University of Kansas Health System, one of the largest medical providers in the Midwest, serves approximately 2.5 million patients across three hospitals and more than 100 provider locations. Michael Meis, the Associate Chief Information Security Officer (CISO), oversees the cybersecurity program for the University of Kansas Health System in partnership with the University of Kansas Medical Center in a shared environment.
When Meis joined the health system three years ago, the security program was growing, but incident response was managed by just a few employees who were taking on multiple roles, putting them at risk of burnout.
Compounding the problem, Meis was working with two separate security teams: one each from the University of Kansas Medical Center and the University of Kansas Health System. Visibility into the environment was poor, and the teams lacked insight into the state of the overall program. Each team used different toolsets and collected disparate data, making coordinated incident response nearly impossible.
“Incidents would occur and be responded to in a vacuum, depending on which side of the house detected it first,” Meis said. “There was really no ability to see the larger picture and no consistent way to respond to incidents, regardless of where they occurred across both organizations.”
All communication was conducted via email, including during incidents, leading to inefficiencies and delays in incident response. The fragmented approach posed a danger to patient care as threat actors could move undetected for longer periods of time.
To address these challenges, the healthcare provider needed a partner that could bring in the necessary technology and expertise to mature their security operations—so Michael Meis turned to ReliaQuest and the GreyMatter security operations platform.
