Health Catalyst, Inc · NASDAQ:HCAT
Health Catalyst — Conference Presentation (April 2025)
41 slides from Health Catalyst's conference presentation, Apr 2, 2025
Slide 1: Managing Your Risk Universe: Cybersecurity Strategies for a Secure and Scalable Future
Managing Your Risk Universe: Cybersecurity Strategies for a Secure and Scalable Future April 2, 2025
Slide 2: Your Presenter
Your Presenter Replace circle with Scott Mattila, MHI, MIS your image in CSO and COO the same shape 2
Slide 3: Agenda
Agenda 1 Enterprise Complexities 2 Building a TPRM Program 3 About Intraprise Health 4 Adopting a Cybersecurity Holistic Approach 5 Jump-Starting Your Security Program 6 Q&A 3
Slide 4: Poll Question
Poll Question What are your priorities for 2025? A Investigating AI to gain care delivery efficiencies B Automating your Third-Party/Vendor Exposure C Adopting a New Framework (i.e. HITRUST and NIST CSF) D Reducing Cloud Vulnerabilities E Securing Additional Investment Funding 4
Slide 5: The Complexities of Enterprise Environments
The Complexities of Enterprise Environments Healthcare IoT & IOMT Security and Compliance +10-15 Connected + 1,300 vendors Medical Devices1 System Fragmented + 1,000 unique + 70% rely on legacy Modernization Ecosystem applications in use information systems 2 + 13 EHRs on avg Operational and + Staff
Slide 6: Cybersecurity Program Outlook
Cybersecurity Program Outlook 2025 Security Readiness 6
Slide 7: Third-Party Risk Top Cybersecurity Claims
Third-Party Risk Top Cybersecurity Claims Ransomware – The largest share of insurance claims 7 Source: Third-Party Risk Tops Cybersecurity Claims, DarkReading.com, February 28, 2025
Slide 8: The Cost of a Breach
The Cost of a Breach Third-Party Partner Risks 35% 40% 23% Third-Party Signed Contracts Mortality Rate Attacks against healthcare were caused are finalized with third-party of attacked healthcare organizations by vendors1 vendors without conducting a experience increased mortality rates3 risk assess
Slide 9: Latest Trends
Latest Trends Landscape and Cyber Opportunities The healthcare Regulation changes, Massive shortage in Under threat, short Cybercrime is sector is hit more vendor risks, and cybersecurity talent. staff, limited expected to reach than any other assessment fatigue Expected job growth leadership buy-in
Slide 10: Building a Third-Party Risk Program
Building a Third-Party Risk Program Getting Started with BluePrint Protect
Slide 11: Poll Question
Poll Question Which methods is your organization using to manage third-party risk? A Manual Solutions (i.e. Spreadsheets, paper) B A Governance, Risk, and Compliance (GRC) Platform C A Third-Party Risk Management Platform D Consultants are Managing our Vendor Risk Program E A Mixture of the Above So
Slide 12: What is BluePrint Protect?
What is BluePrint Protect ? A Holistic Approach to Risk Management • Enables seamless risk management and collaboration through a unified, actionable dashboard • Delivers a unified risk view by integrating internal and third-party risk, and compliance assessments • Seamless integration with existing
Slide 13: Common Manual Process in Health Systems
Common Manual Process in Health Systems Intake Third Party Risk Assessment Reporting 30 – 60 Days Typical Manual with Email and Spreadsheets Email Contract IS Review Worksheet Assessor Report Checklist Questions? Status? Approve Deny Accept Risk Third Party SME’s 14
Slide 14: BluePrint Protect Third Party Risk Management
BluePrint Protect Third Party Risk Management Automated Assessment Workflow with Validation < 10 Days Typical with Workflow Automation & AI Protect Assistant Assessment Request Risk Rating & IS Team Reporting Assessment Response Approve Deny Third Party 75% Faster! Accept Risk Real-Time Assessment R
Slide 15: Use Case: Automation and Integration
Use Case: Automation and Integration
Slide 16: Assessment Management
Assessment Management New Additions - Organizational and Application/System Management Assessments 17
Slide 17: Assessment Management
Assessment Management Simplified Policy and Procedure workflows 18
Slide 18: Vendor Questionnaires
Vendor Questionnaires Reduce the time and effort to evaluate third-party partners 19
Slide 19: Third-Party Risk Management
Third-Party Risk Management TPRM Dashboard with risk scoring and organization impact insights 20
Slide 20: Holistic Risk View
Holistic Risk View Real-time risk management to strengthen program effectiveness and security 21
Slide 21: Open Risks and Exceptions
Open Risks and Exceptions 360-degree risk insights for proactive planning and remediation 22
Slide 22: Accepted Risks and Exceptions
Accepted Risks and Exceptions Centralized risk acceptance monitoring 23
Slide 23: Remediation Planning
Remediation Planning Monitor all assessments to enhance risk posture continuously 24
Slide 24: Exception Management
Exception Management Centralize, analyze, and minimize accepted risks 25
Slide 25: Who is Intraprise Health?
Who is Intraprise Health? <9 Intraprise HEALTH ‘by @HealthCatalyst™
Slide 26: About Intraprise Health
About Intraprise Health We’re an industry-leading, tech-enabled cybersecurity services provider offering an end-to-end cybersecurity risk management platform and services to protect from cyberattacks and manage follow-on liability in the event of an incident. We adhere to compliance frameworks, iden
Slide 27: Unifying Risk Pyramid
Unifying Risk Pyramid Building Blocks for Cybersecurity Resilience Centralize all risks layers into one view for monitoring, Unified corrective action, and remediation. Risk Integrate multiple industry risk management frameworks Agnostic to amplify readiness and remediation Risk Aggregate and normal
Slide 28: Intraprise Health 101
Intraprise Health 101 BluePrint Protect™ Platform Solutions Services OD Integrated Risk Management Risk Management and Remediation Third-Party Risk Management (TPRM) Y= vCISO Security Program Management g HIPAA Security & Privacy Assessments OG Cybersecurity Assessments Eliminate data silos, automat
Slide 29: KLAS Research Cybersecurity Analysis
KLAS Research Cybersecurity Analysis We achieved the highest KLAS score for Security and Privacy Consulting Services and Product Companies in the September 2024 Report. Average Score Score Breakdown Greatest Differentiators Would you buy again? 100% Yes vs. Our Competition: 95.0 Likely to Recommend
Slide 30: Pathway to Prevention: Adopting a Holistic Cybersecurity Program
Pathway to Prevention: Adopting a Holistic Cybersecurity Program
Slide 31: Pathway to Prevention: Building Your Program
Pathway to Prevention: Building Your Program Meeting Clients Where They Are At Unify Risks Services HIPAA Compliance IRM vCISO & Consulting HIPAA One Automating HIPAA Delivering a holistic risk Expert guidance from Compliance view seasoned leaders Vendor Risk Assessments TPRM NIST CSF, CPG & HIPAA I
Slide 32: Pathway to Prevention: Consulting Services
Pathway to Prevention: Consulting Services Program Assessment Services Educate Board and Implement Cybersecurity Design Governance Leadership Teams Best Practices with Models and Seasoned vCISOs Response Protocols Policy and Process Develop Tailored, Optimization Actionable Plans to Meet/Exceed CPGs
Slide 33: Poll Question
Poll Question Is your organization certified in these assessments and frameworks? A HITRUST B NIST CSF C HIPAA Security Risk Assessment (SRA) D 405(d) Health Industry Cybersecurity Practices (HICP) E I am not sure 34
Slide 34: Questions to Ask to Jump-Start Your TPRM Program
Questions to Ask to Jump-Start Your TPRM Program
Slide 35: Secure Executive Buy-in
Secure Executive Buy-in Leadership Engagement - Keep It Simple Keep It High-Level • Share insights on current state of cybersecurity Know Your Issues • Leaders have a vested interest • Share operational gaps Define Your Risk Tolerance • Ensure alignment with cybersecurity strategy, priorities, and f
Slide 36: Reimagining Cybersecurity
Reimagining Cybersecurity Modernizing Your Cybersecurity Program Gather Describe Your Tech Stack Open Risks Questionnaire(s) Documentation Current State Review • List all Open Risks • Collect third-party • Risk management •Share state of • Collect an inventory for import into questionnaires in polic
Slide 37: Valley Health System's Story
Valley Health System’s Story Challenge • Scaling and Managing Vendor Risk • Managing IoT Solution • Deployed an Agnostic Risk Management Platform • Aggregates Third-Party Frameworks, Assessments • Delivers a 360-Risk View 38 Client: A 451- Bed Healthcare System
Slide 38: Customer testimonial: Valley Health System
We’ve streamlined our risk management initiatives, allowing us to meet operational goals and deliver high-quality, patient care with minimal project delays. Miroslav Belote Valley Health System 39
Slide 39: Intraprise Health by Health Catalyst
40 oy Intraprise HEALTH by ()Healthcatalyst’
Slide 40: Contact Us
Contact Us If you have any questions or would like to explore how Intraprise Health by Health Catalyst can enhance your cybersecurity program, please reach out to our team. We look forward to working with you! Contact Information Social Media Email Intraprise Health Comprehensive Support hcwebinars@
Slide 41: Thank You!
Thank You! oy Intraprise HEALTH ‘by @HealthCatalyst™
Health Catalyst — Conference Presentation (April 2025) on 6ix