If health systems aren't fully protected, Mikael Öhman has a dire warning: “People die if there's a breach."
Öhman, a long-time health technology executive, observed that firsthand when a friend was admitted to the hospital for heart condition. A cyberattack disrupted the hospital's normal operations, forcing employees to turn to pen and paper. Care for his friend was not as good as it would have been if the hospital's systems had been running normally, Ohman said.
Now Öhman is taking over as CEO of two companies that help prevent such attacks: CORL Technologies and Meditology Services, both of which are based in Chamblee. He replaces the companies' founder and former CEO Cliff Baker.
CORL and Meditology employ about 150, two-thirds of whom live in Atlanta. Clients include large health systems Piedmont, Emory, Northside, Grady, and Children’s Healthcare of Atlanta. The two firms' services help the systems protect sensitive information and maintain normal operations as cyberattacks on health systems increase in frequency and scale.
Growth market
The increasing complexity of health care systems provides many opportunities for cyberattackers to infiltrate and steal data or block normal operations through ransomware attacks, Öhman said.
Cyberattacks on health care systems can also be very costly, with an average cost of almost $11 million, according to IBM's 2023 Cost of a Data Breach Report.
Large health systems work with thousands of vendors, Öhman said.
These third-party services, whether online file storage, medical devices, supply chain applications, or others, can be an entry point for cyberattacks, leading to the release of private data or the hobbling of the hospital's technology systems.
"It's a massive problem for health care," Öhman said.
This is where Meditology comes in. The firm conducts in-depth reviews of the security infrastructure and processes for health care systems, health care vendors, or some combination of both. That includes what Öhman calls “penetration testing,” where staff hackers try to hack into companies’ systems in order to identify vulnerabilities.
CORL is a software company that lets health systems assess the security and risk of a particular vendor both at the time the health system signs on with the vendor and on an ongoing basis as threats change.
"There's no human being that can review and look at every detail of every vendor at any given point in time," Öhman said. CORL's software-driven approach addresses that problem.
Artificial intelligence
AI presents a number of additional threats to health care systems, Öhman said. He predicts that soon people will receive AI-powered video calls imitating a spouse asking for passwords or other sensitive information.
In addition, AI serves a multiplier for the power of hackers, who will likely become more effective at breaking into health IT systems.
“You can do hacking at a pace you couldn’t do before,” Öhman said.
Hospitals and clinicians may also inadvertently expose their patients to privacy threats. For example, a doctor may enter information about a patient’s medical record into ChatGPT without making adequate privacy provisions.
“That may very well be fabulous down the road … but you got to make sure it’s done in a secure and safe way,” Öhman said.
‘Certified Southerner’
After almost 25 years in the city, Öhman considers himself “almost a certified southerner.”
Öhman grew up in Sweden and first came to the United States to study at engineering at Case Western Reseve University in Cleveland. While there, he met his wife, a speech pathologist. After returning to Sweden, he decided to move back to the U.S. to be with her.
Öhman first started working in health cybersecurity as a consultant for McKinsey, going on to take senior roles at Cerner Corp. and McKesson. He most recently served as CEO of Atlanta's KMS Healthcare.
Öhman also got direct experience managing a health care business when he and his business partner founded urgent care clinics in Atlanta. Those eventually sold to WellStreet, a subsidiary of Piedmont Health System.
