Preserving the Hospital's Reputation
In our last post, the CIO told the tale to the Director of Security and the CEO made priorities and told the HR VP to plan for staff messaging and potential changes.
The CEO paced back and forth as the General Counsel explained legal strategy. She interrupted him and said, “It sounds fascinating, but we need to restore the hospital’s reputation. I think we’re new talent on the team is likely. We need to clearly demonstrate changes and new talent is one way. How long before we have to go public?”
Internally, the CEO knew this was really her reputation as well – not just her hospital’s.
The General Counsel sat deep in his chair,
“We don’t really have choices. If we don’t pay the hackers, they may go public. If we pay, they may sell anyway for additional money. We’ve held back telling the internal team, but people aren’t stupid, they can tell we’re upset, and it’s possible an employee may leak this story. We need to be ready to deal with this asap.”
The CEO looked upset and said – “Trust me. Heads will roll over this, and it won’t be mine!”
The GC knew an upset CEO was unpredictable.
“I’m waiting for decisions from our insurers, but it’s likely they’ll tell us it’s all our problem. They’re not likely to help pay now, and we’ll have to track our costs to make a claim in excess of our $500,000 deductible.
Either way, you’ll have to decide to pay or not.
We’ll still have to tell the government and make a public announcement. The outside firm told me that their Health Data Privacy practices billing estimates for incidents like ours run into the hundreds of thousands of dollars. Talent costs.”
The General Counsel’s advice only reinforced the CEO’s concern about the hospital and her reputation. Action needed to be taken.
Next up – Whose heads? These heads!
Comments