AWS re:Invent 2024 - Data security in the cloud, from Xsolis, an AI leader in healthcare (SEC224)

hello everyone my name is Mike Milner this is really echoey volume here I hope I don't sound too intimidating I am the vice president of product management at Trend Micro and I spend a lot of my time talking with customers to understand their needs and today we're going to talk about healthc care and it's interesting healthc care records are one of the hottest targets for the criminal underground 20 39% increase in hacked healthc care records over the past 5 years 27 8% increase in ransomware attacks against Healthcare organizations 133 million healthc care records exposed last year alone that's Healthcare records of of people individuals you me families and one of the largest breaches occurred last year 11.2 million healthc care records lost in one breach so it's a major problem and I'm not an expert in health care security but as we go through the session here today we have the privilege of being joined by Zack Evans CTO at exus Zach s thanks so much for joining us great to be here Mike just really appreciate the opportunity yeah Zach why don't you kick us off by telling us a little bit about exist absolutely so exess is an AI Healthcare company uh we were founded in National Tennessee in 2013 um we were we have been doing artificial intelligence well all right echoey sound and all right we're back we've been doing artificial intelligence before artificial intelligence was even cool to talk about um and so was really formed uh because we saw need in the US Healthcare Market there's a tremendous amount of silos that exists within the US Healthcare market and if you notice our name our name is actually silos spelled backwards with that's in front of because our job is to break down silos in healthcare and we do that by applying human centered artificial intelligence to clinical and financial workflows to help reduce waste so in the US Healthcare Market annually we spend about $4 trillion on healthare in the US every year by some estimates 25% of that $1 trillion is spent on administrative tasks not even clinical care administrative tasks and about 25% of that or about $240 billion is estimated to be waste in the system that if we were just better at what we did more efficient at what we did we could take that cost out of the US healthare system and so that's what we do we use real time Predictive Analytics to provide transparency to drive workflows and to really focus on that relationship that exists between payers in our case primarily Hospital systems and providers or insurance companies both of which play an important role in the experience of the patient but sometimes are at odds at how they have to achieve that goal and so we try to bring Insanity to that to that relationship to really reduce friction to address that 200 and some odd billion dollar problem in healthcare so as a CTO right one of the things that we like to do is we like to bring Technology Solutions to problems right and so I have the privilege of of leading a really talented experienced Healthcare technology team but as part of the journey that we're going to to be going on here over the next couple minutes we really had to kind of uh create a a a philosophy for how we wanted to attack problems and so you know what what do they say you know really smart people create but Geniuses kind of Steal right so several of these ideas we actually borrowed from uh some of the work that AWS itself has done uh and I really have challenged my team over the last several years to really think about how we can solve these complex problems through the use of Technology by empowering our clients through SAS models delivered through AWS in the cloud so we really favor Cloud first Cloud native Solutions we build highly scalable Solutions uh because we'll talk about some of the scale of the data that we deal with here in a couple minutes um we also really invest heavily in in kind of our API infrastructure the way our services can talk to one another uh and we invest heavily in traceability because we have to be very very careful because we are safeguarding our clients data and so we have to be very very careful how we handle that data and how we can ensure that we have high levels of observability and traceability in everything that we do it's interesting we heard the statistics at the start of the presentation it's a challenging environment to work in if you look at the risks that a Healthcare company has to deal with it's all the same companies that all the same risks that any company has to deal with you've got ransomware threats you've got um you know all those threats see what we're all our game here regulated environments like healthcare have a huge amount of requirements that they need to meet you've got supply chain vulnerabilities all those issues that any security company has and then layered on top of that you've got additional issues specific to healthcare you've got patient data hippo requirements depending on where you're working healthcare companies sometimes have Legacy devices you might have an MRI machine that has to be running this ancient version of the operating system because it can't be updated you might have to deal with fax machines it's a challenging environment to deal with these threats how have you evolved that over time how have you evolved your organization to handle those you know like it's been it has been a journey um when I joined exus almost seven years ago we had a s platform we've been Cloud native from the beginning uh but we were growing rapidly and we were implementing we implemented more clients in the year that I joined xist and we had done in the previous five years combined and so we knew that we needed a technology platform that would allow us to scale to not only handle all of this data that we were taking in but to handle it in a really secure Manner and so we've been on a a journey uh for the last couple years uh we uh even though we were Cloud native from the beginning we embarked on a digital transformation project we rewrote 100% of our our application code uh we changed Tech Stacks uh we really uh invested heavily um in those those Cloud native and manage services that we talked about earlier but one of the best things about about our partnership with trend is that as we were going on this journey our relationship with Trend grew along the way as well so so from a security perspective we started our relationship with Tren with one very small project we were doing a cloud Conformity project just we wanted to get our our arms around our Cloud environment and make sure that we had some um just a really Firm Foundation to build on and that's where we started but over the last three or four years we've just continued to grow as our security needs have Chang as we've gotten smarter about how we want to do business have we've really tried to consolidate vendors to approach that goal of having a single pane of glass we we just continued to invest in the partnership and bring on even more solutions so we brought on workload security we brought on asrm uh We've now launched container security we've got some other things that are coming in 2025 and in the middle of that we launched our brand new platform which we named dragonfly and we're in the midst of a migration project right now so we are we are officially beyond the 50% Mark so a lot of digal transformation projects never make it off the ground uh but we've been migrating clients um actually uh two days ago we had 26 additional hospitals migrate uh in one day uh so that was uh that was a great day it was a very early morning for some of my team being here uh on Los on Las Vegas time uh but they did a great job and so this journey and our not only the Journey of our digital transformation but our journey with Trend just continues to evolve uh to meet these highly complex everchanging needs both of our clients but again primarily about how we secure that data because we typically get two we get asked two questions very early on in an implementation I'm sorry you want how much of our data very quickly followed by and how are you going to secure that and so we have to be able to have very honest and transparent conversations with our clients to ensure that they're comfortable with what we are wanting to do because as I mentioned earlier what we are at our core is we're an AI company and the lifeblood of artificial intelligence is data and so if we don't have ready access to that data we're not able to do what we need to be able to do so since 2013 we've been using predictive AI in machine learning models to Pro to provide real-time insights to our clients now that real time word we'll we'll come back in in our discussion here in a couple minutes when you think about the volume of data and and the rapid Pace at which we have to be able to consume that data and so we want to be able to surface clinically relevant and financial information rapidly for our clients to be able to drive workflows to improve the way that they operate and so we create a real-time patient profile we create um these predictive alerts we provide or create triggering events that can drive those workflows and and they come out in a couple different uh ways so one of the things we have is uh We've created what's called our care level score or our CLS score uh which is really a measure of a patient's Acuity how sick they are now if you don't work in a clinical environment you may say well I don't understand why is that so hard you're in the hospital you must be really sick well in the hospital there's all there's all sorts of ranges of illness that you have to do deal with and there's a tremendous amount of information that's flowing at these clinicians every day every minute of every day and so our CLS score really helps uh helps provide a a a rapid snapshot of how sick that patient is uh and really what that helps Empower is this concept of utilization review which we won't go into that too deeply but that is the key construct that governs that relationship between the payer and that provider okay um and that payer collaboration is really what allows us to break down those silos because for one of the first times we are using objective predictive data to allow payers and providers to have a parallel conversation and a parallel understanding of the picture of the patient it's not open for necessarily clinical interpretation although the human is always in the loop but it provides that objective relative score of how sick that patient is and then one of our most exciting places we've been uh diving into for the last year is around length of stay manag management or losos management so it may surprise some of you that when you're sick and you go to the hospital it's absolutely right that you go to the hospital but the most dangerous place to be when you are sick is in a hospital that's where Hospital acquired conditions and Hospital acquired infections come in can come into play hospitals are at their core challenging environments to exist in and so length of State Management really tries to get the patient out of the hospital as soon as is clinically appropriate but that's really hard to to really try to pinpoint that early in the stay so some of our Predictive Analytics like our uh what we call our p24 or the likelihood of discharging within 24 hours or our predictions that say we think this is how long a patient will stay in a hospital within 12 hours of presenting at the hospital really allows that hospital to to manage their beds that much more efficiently really address some of the Staffing shortages and manage the risk of the patients yeah I love actually you know all the technology we're talking about here but being applied to real human outcomes and I know you've been doing AI since what 2013 you said now we're here at reinvent and everyone's talking about AI what about generative AI yeah so this little thing happened a couple years ago right chat GTP came on to the scene and all of a sudden everyone said hey we need to be an AI company um we kind of looked at looked around and said well welcome to the party where have you been um but we but we had too have been investing wanting to move Beyond predictive AI uh into the generative AI space and so we've got uh some really uh exciting things that that we're working on right now in that space to to provide even more uh efficient workflows for our clinicians so uh one of the things that we will launch uh before the end of the year so we've got a couple weeks left but one of the things exactly the time is ticking right one of the things that we will launch before the end of the year is our first generative AI module within dragonfly and really what that is focused on so when you when you are admitted into a hospital uh usually within the first 24 uh hours of admission a nurse uh what's called a utilization review nurse will review your case and will provide a clinical summary to the insurance company and uh sometimes that's the first indication to the insurance company that that patient is in the hospital like if it was some type of an emergent situation or something like that and so it's a notification that they're there it provides a clinical summary it provides that first glimpse of what we think the diagnosis is and maybe how long the patient needs to be in the hospital and that initial review has to be done on every patient that's admitted to the hospital well as many of you know in healthcare today they don't have enough staff to begin with and so when you have a a a short staffed unit that is supposed to touch every patient within 24 hours of admission anything that we can do to make that process more efficient is going to be hugely beneficial so by allowing that initial review to be automatically generated um and then be reviewed by the utilization review nurse for any uh you know to append any information or to edit any information or anything like that we can provide and offer a a much more streamlined workflow and so that that module will launch before the end of the year right after right after that we're going to turn our our heads to a different uh problem that we have okay um and that's the problem of of claims denials and for any of you that work in healthcare you know that a lot of healthcare claims get initially denied by the insurance company and so when when an insurance claim is is denied what happens is um there's a a an adjudication process that is kicked off there is an appeals process that is enabled within that payer contract with the hospital but it's kicked off by this letter that gets submitted to the insurance company that's called a denials appeals letter and that that is a a highly clinical but also in some respects a highly technical document that takes a very special specially trained and experienced resource to be able to craft because they have to be able to pull out all of the relevant clinical information to put into that appeals letter to kick off the adjudication process it's very very time consuming and so the module that we're going to launch in the first quarter of next year is a denials and appeals letter module uh that will generate the first draft of that appeals letter for that that appeals nurse to be able to review and then submit that on to the payer we believe it will it will provide a tremendous efficiency gain and because um the the the llm will actually be self-reinforced and learned what appeals letters result in overturned claims because of the quality of the clinical argument that's being made it will get smarter over time even as it it reacts to the different policies of different insurance companies right so we'll move beyond that into some other specialized workflows in the second half of the year um there's this construct of what's called a physician advisor or a PA workflow where we feel like um there are Physicians out there that review cases uh for medical necessity and for insurance verification it's the most expensive resource in a hospital that you can have doing what amounts to administrative work and so our ability to generate those second level re second level reviews or that peer-to-peer review support and therefore uh free up some of that very expensive time for Physicians can be hugely beneficial um to our clients and so all of this is being built right now uh one of the the most fun things listening to all all of the uh the sessions this week is all of this is built on top of AWS Bedrock so we're really excited to be launching that uh again the first module will launch before the end of this year and then we'll be rolling right into next year as well it's amazing what does that look like on Bedrock so what we're using and and this is just this is just one example right so this is that that clinical review summary um and so without giving away too much of of the secret sauce right so we are using rag uh to to pull out uh the pertinent information out of the clinical documents the most relevant information out of the clinical documents now sometimes that's discret data right that's a lab result that's a medication that's a that's a a diagnosis code or something like that but often times that do that data is coming from unstructured data so it's coming from a postoper report or from a physician's note or from a pathology report or something like that and so rag allows us after we OCR those documents rag allows us to pull out the most relevant information to start answering questions about the case which then feeds into a summary prompt that then generates that automated clinical summary and so uh it's been really interesting our our data science team has done a tremendous amount of experiment in this in this space and Bedrock um has really helped us be able to experiment much much faster in that depending on the insurance company that we're working with depending on even the the um uh the clinical summary that we are seeing uh we're able to use uh different llms that we get better results from and so as part of that of that question and answer uh kind of construct that gets generated by rag that then generates that summary prompt we've built in automation that that allows us to pick what will be the best case scenario llm to use so it's not just one llm it's not just one version of an llm and we are constantly uh testing and reevaluating that to tweak uh that that kind of selection process to really generate um uh to really generate that best case clinical summary it's amazing and I have to say a trend we love partnering with our customers and I think you know we think about the raw technology and it's very very cool but seeing those real outcomes and seeing how you've leveraged that technology to move faster to deliver this value to your customers and ultimately to to people is just amazing we love that type of partnership now as we think about all that you've done so far and all that you moved and all that you've your journey there that you described where is that going now how is that scaling how is that growing so as a company as I mentioned we've been growing really rapidly for the last several years and so I I I mentioned earlier kind of that that realtime data construct right and so uh we have built our system really to be able to respond to very small data sets and so um as much as I love fire as a standard uh we still leverage uh traditional HL messages because we're able to bring in that data one message at a time so as soon as a um as soon as a lab result is posted to the EMR we usually have it within a matter of seconds to minutes well soon as that uh posttop report is filed into the EMR we're able to receive that document feed near real time send it through our our OCR Services hand it off to our machine learning model to be able to drive predictions at times within a matter of minutes of that of that document even being available so right now today we're processing about 3.2 billion hl7 messages every year it's about 9 million messages a day wow um now and one message may have multiple data points in it uh but it's a tremendous amount of data that we are having to bring into our system and process near real time every day and it's also a tremendous amount of data to protect every day right because it amounts to one message at a time the entire medical record we receive store process analyze predict on and then present back to the end user so I mentioned all those documents um we are a very large textract user AWS textract user we we are ocing about 60 million documents a year um uh for those you that don't know text track has limits on the number of documents L OCR on any given day uh we have consistently had to go back to AWS to have those limits uh lifted uh and they're more than happy to do that for us but uh we OCR and bring in a tremendous amount of unstructured data um uh every day and that the OCR data only actually represents a relatively small portion of that data of the of the unstructured data because we also bring in a tremendous amount of flat text files or Rich Text files or those sort to things that don't necessarily have to go through an OCR process to be able to bring in that unstructured data into into our systems and then all of that data you know because we're trying to to uh separate the wheat from the chaff right so not every data element necessitates a a prediction to be made uh so we are able to uh abstract the most relevant clinical data points to be able to provide a prediction back to our clients and so today um uh to this point in time we've we've provided about 2.7 billion

predictions back to our clients Each of which has the ability to drive a a workflow that can end up impacting uh the patient's care [Music] Journey so the way that we've done that um is in our new platform dragonfly uh we me I mentioned earlier we've really uh invested heavily in a lot of AWS uh Native and managed services and we won't talk about all of these but I'll point out a couple that have been uh hugely valuable to us uh because of that velocity of data and that velocity that velocity of our data being intake um has only continued to grow we needed to be able to build a really robust uh data platform and so uh we we're a a very big um uh Amazon managed Kafka uh or or msk client uh to that's what we use to power our data platform uh and and as we started bringing our first clients live on that so we in our Legacy platform we had a very kind of traditional ETL process leveraging uh a SQL Server to be able to to Stage data to be able to process data to move it in into a uh what we call a scrubbed State um we did some clock we did some time studies on data velocity and so on average um in our Legacy platform uh to to receive an hl7 message to the to the point where we could present that data to our client um on average it would take somewhere around seven or eight minutes to process that data all the way through the system which in in Internet time is that's an eternity right uh so we uh because we're still running our two systems in parallel we were able to look at those same message sets that on average we're taking that seven to eight minutes to be able to process that data because as soon as the data is processed that's what allows us to make the prediction um those same messages now process in less than 2 seconds oh wow so it was a 99% uh increase in speed in our data processing speed at scale uh to be able to to drive these predictions for our clients um we're also a big uh Aurora uh Aurora RDS customer uh so that's what that's where we we store all of our structured data we use Dynamo DB for documents uh we're using red shift for edw we'll go we go on and on about the tools that we're using um but really what we built uh was what we felt like was was a really modern architecture uh for how we can bring in our data and and really process it quickly and be able to present those U those predictions and those analytics back to our clients so it's a modern Service uh service architecture uh so we've built Standalone highly scalable uh microservices that handle and process much of this data with everything um underly or with an underlayment of that that manage kofka service from from a data platform perspective uh we do use a couple uh open source tools we use MTH as our kind of uh data integration engine uh we're using OCTA for our identity access management uh which have been uh great solutions for us uh but really uh what we found along the way and we highlighted some of these areas was as we uh migrated from our old platform to our new platform we had to really think about security quite differently right so in our Legacy platform we were all about inpoint management that's kind of all that we we not all that we worried about but that was what we primarily wor worried about right vulnerabilities and endpoint management um as we came into our new environment we knew that we had to think much more holistically um and and really uh partner with Trend to bring a lot of additional tools to the marketplace um probably most exciting thing that that that we've brought forward um in the last couple months was the container security solution uh which which is uh which has been hugely valuable to us to help us ensure that as as our containers uh scale uh uh scale up and scale down that that they're highly secure um and that we have uh that we're taking care of our clients data and so that's been of a of a huge value to us yeah it's amazing to hear our our mission really is to help our customers innovate and adopt new technology and move fast and really it is our goal so that we're there first right we have that protect so that when you start using containers we're ready to protect you right keep you safe and help you stay secure I love this quote here this is uh from Dr Andrew Adams and you know working at a Healthcare Company it could be confusing he's not a medical doctor despite the uh the picture we put up there next to his quote here but he's a doctor in cyber security so actually it probably makes this quote a bit more relevant if you're GP was telling you about Trend Micro you might want to have a different GP but Dr Andrew Adams who's a really smart guy and um what I like about this is he kind of calls out two different concepts right there's looking at your attack surface and we saw the architecture diagram there with the Trend Micro icons love seeing us protecting that architecture and it's interesting because we're looking at two things right the attack surface right what is there how is it configured how is it set up but we're also looking at what's happening just like you said with you processing hl7 messages in real time we're processing Telemetry from all these security sensors in real time and those two big Concepts really complement each other well we call them attack surface risk management and then that Telemetry is kind of a detection and response we call it xdrx for kind of everything because we've gone through a journey ourselves over the past 10 years we've moved from lots of separate security tools to really a combined platform that embodies these two big Concepts we've got our attack surface risk management that's looking not just on your Cloud resources and your containers and that side of things but also the rest of your Enterprise resources so that every bit of information every bit of configuration in your organization we're looking at all of that from a security perspective and then that xdr pulling in all that Telemetry from your cloud from your containers but also from your endpoints from every sensor in our system so that we can bring in that technology to protect you everywhere you are and like you we've been a leader in AI we've been using AI for years like you initially for prediction classification but also now in some of this newer technology so we take our threat intelligence and we merge that together with what we know about your environment and then we can actually use AI to think like an attacker leverage that best of breed threat intelligence to try to predict where an attacker might go after that sensitive Health Data how are they going to get through what attack path are they going to use so then we can prioritize and tell you where to look to put your security effort where it matters most this lets us help our customers move fast which which I love it's our goal to help accelerate our customers and we do that with technology with AI but also with our people we've got Professional Services so that we can help you get set up we've got managed xdr so that you know you mentioned Health Care Resources Staffing is a challenge so US security Staffing right we want to extend your team you're absolutely right if I could interrupt for one second xdr has been a huge uh value ad for my team you know we still have a a relatively small cyber security team and so our ability to partner with a a a best of breed vendor that can wrap Us in these services that can help us provide 24x7 monitoring threat response risk mitigation uh it's really allowed me as a CTO to be able to scale my security operations uh without uh you know as much as I would love to hire a bunch of you know additional phds in cyber security those are really hard to find right and so it it allows us to really extend that security for our clients 24 with 24 by7 threat response that's right we can do a lot of the heavy lifting right if we get paged on the weekend instead of you and then we can just escalate what's important and if the wor should happen incident response if you do have an incident we're there to actually come and help you respond to that incident so that you can get back to your business faster so that we don't slow down the the uh the creativity and the I think really groundbreaking technology that you're working on we also make it easier all the way back to the maybe less exciting purchasing and procurement process we're here at AWS reinvent so of course we're talking about Marketplace you can buy everything in Vision one on Marketplace either by consumption or all the normal purchasing agreements but you can do it right through Marketplace and if you are going through a transition like xlist from one type of Technology moving over to Containers we've also got a credit-based procurement system so you can buy the technology you need today for your existing system and as you adopt new technologies you can just move those credits over to use the new technologies in our vision one platform we're trying to make this easier for our customers so you mentioned the container security you've mentioned what you're working on what's next from a security perspective for exus yeah you know I I I wish that we had everything already solved right but you know the the threat Matrix evolves every day and so we're constantly having to think about what's next and where we want to go uh we are also as part of our commitment to security to our clients we're we are high trust certified for example uh so one of the things we're going to work on uh next year is both the right thing to do for our clients it will also help us with our our high trust recertification next year on version 11 uh and that's what we're going to implement zero trust right uh which is it'll be a a pretty big change for our organization uh but we're really excited about that to be able to implement that next year to really just provide that next level of security again not only in the cloud but even even within uh our Enterprise Network as well uh which we we're really excited about in 2025 uh we're going to continue to expand our container security um as we continue to build out our platform we are I mentioned the the generative AI modules but we're working on a couple other new uh products that we'll launch in 2025 all container-based all need to be secured uh so we'll continue to expand um uh those uh security Investments uh and then we're also going to invest in some of the security for AI as well so as I mentioned we're using llms we have a lot of predictive AI models out there we want to make sure that those are are highly secured for our clients as well so those are certainly three areas that we're going to invest in already on our road map for 2025 actually some of those I believe have already even been purchased through Marketplace um and so we're we're ready to to launch uh launch those initiatives right after the first of the year awesome awesome and then additionally we'll have one other uh kind of continual investment because as much as we've really tried to and we have successfully kind of really streamlined our vendor base uh and gotten very much closer to that single pane of glass uh there is still um additional information that we need to bring in uh from whether it's static source code analysis or or other tooling that are kind of outside of vision one's perview uh perhaps uh and so we're we are going to continue to invest in uh amazon security Lake uh we're already a very large uh security Lake customer uh have done uh some I think some really Innovative things even some uh some items that we've shared back with Amazon some ways that we're implementing it and so we're going to continue uh to invest in that in 2025 as well excellent excellent Zach I know I keep saying this but this is such an amazing story uh I love seeing these real world outcomes and it makes me proud to be a trender to be able to support companies like yours it's it's just so impressive and if if any of you want to learn more we've got a full case study on the story our partnership with exellis you can scan this link uh which will take you right to the case study to find out more so let's recap where have we where have we gone what have we gone through I think this partnership is very powerful it's a powerful concept and it's what we want at Trend to do with all of our customers so when you think about picking a security vendor when you think about who you're going to work with to secure your environment I think you talked about it earlier that trust is very important you need to think that you want this information together you you want to be able to bring your security information together so make sure you've got a platform that brings your entire security needs into one place that single pane of glass that you mentioned there and find a partner that you trust to work with someone who's going to invest deeply to help you move fast and of course so that we can focus on the security to secure your mission and we talked about that attack surface risk management I think it's important to realize that you're always managing risk businesses manage risk health risk and cyber security risk is business risk so when you think about a partnership make sure you're thinking about somebody who understands that that the platform supports managing risk identifying where there are weaknesses and helping you prioritize so that you can fix it effectively if you want to learn more about the platform I know it's Thursday afternoon but at our booth we are running competitions every half hour and we are giving away drones there are still drones left so if you're interested in actually trying our vision one platform getting your hands on actually seeing how it works and if you think you're good enough you could win this drone we're going after and we're going to try to beat everyone and you know nail this drone competition here and with that thank you very much thank you Zach for joining us thank you Mike thank you

2024-12-12 07:14

Other news