"Protecting patient records remains fundamental, and the risks today have expanded," Wai Kit Cheah, CISO for Asia‑Pacific at Lumen Technologies, said.
Why connectivity creates both gains and new risks
The healthcare sector's growing interconnection — sharing patient data across providers, applications and cloud environments — has improved efficiency and continuity of care, the source reports. But that same connectivity enlarges the attack surface and complicates protection of sensitive information. Cheah emphasised that visibility into where data travels, who can access it and how it is processed is now essential, and that understanding must extend to third‑party providers, cloud platforms and AI‑enabled workflows.
Wai Kit Cheah on building security into architecture from day one
Security cannot be an afterthought, Cheah told iTNews Asia. He said security should be incorporated when systems are first designed rather than being bolted on after integrations are established. He named specific architectural building blocks that should be present from the outset: identity and access controls, visibility, segmentation, governance and incident response. Connectivity is not inherently a weakness, he noted, but inadequate security across an interconnected environment introduces risk.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildClinical operations: resilience measured by continuity of care
Cheah pushed the conversation beyond IT metrics such as uptime. "The final measure of resilience is not just about availability and uptime," he said, arguing that resilience must be judged by whether clinicians can continue essential activities during a disruption — for example, emergency care, access to critical patient information, diagnostics and laboratory results, and the functioning of pharmacy and scheduling systems. Meeting that standard requires technology teams to work closely with clinical leadership, operations, procurement and governance, and to treat cyber resilience as an operational responsibility with clear ownership of risks and decisions.
Ransomware recovery: resilience‑as‑a‑service and immutable backups
Lumen has developed resilience‑as‑a‑service arrangements that bundle ransomware response planning, incident‑response structures and immutable data backups, Cheah said. While he declined to name customers, he asserted that with preparation these arrangements can reduce recovery time to minutes rather than days or weeks. The message was clear: recovery planning, not just prevention, is a core part of resilience — organisations must map critical services, their dependencies on third parties and cloud platforms, and the steps to take when those systems are disrupted.
AI‑enabled workflows: map the data path and plan for failure
AI brings new dimensions to data security and accountability. Cheah recommended mapping the full workflow around any AI model: where patient data originates, which applications touch it, whether external models or third parties are involved, and where the data is stored. Controls he named include identity and access management, encryption, logging and, where appropriate, data masking to reduce exposure of personally identifiable information used in AI prompts. He also warned organisations to plan for model errors, unavailability or compromise, and to preserve traceability so the data behind an AI conclusion can be examined. "The goal is not to slow down innovation but is to make AI safe so that we can scale with it," Cheah said.
How technologists, clinical leadership, and procurement must act
- Technologists and security teams: build security architecture and incident‑response capabilities into system design; map dependencies across vendors, cloud platforms and devices; test response arrangements under realistic disruption scenarios rather than relying only on tabletop exercises.
- Clinical leadership and operations: define which clinical activities must continue during disruption, agree fallback processes for when digital systems fail, and establish who makes decisions during an incident.
- Procurement and governance: factor third parties, cloud platforms and AI suppliers into resilience planning; insist on contractual and technical measures such as immutable backups and clearly defined incident‑response roles.
Cheah's prescription is concise: bring security architecture, governance, procurement and clinical operations together from the start; identify the most critical services; test recovery arrangements; and assign clear responsibilities before an incident occurs. The practical question the sector faces now is whether healthcare organisations will make those steps routine, so that patient safety and data protection are reinforced together rather than traded off against each other.
