From Servers to Cybersecurity: My Journey as a Community Hospital CIO

Hospital CIO 2006–2023 shares how the role evolved—and why downtime preparedness is essential.

When I accepted my first CIO role at a community hospital in the early 2000s, it was classic “learn as you go.” My job was keeping the servers in the datacenter cool (with a box fan from Kmart), making sure desktops worked, and explaining firewalls to the CEO without using too many acronyms.

Security wasn’t top of mind, in fact, if I’m honest, wasn’t even a consideration. Uptime mattered mostly so people might use the EMR.

Back then, budgets were tight, training was limited, and downtime was handled with dusty binders and hope someone was keeping them updated. If the EMR went down, departments reached for “downtime folders”—which rarely matched reality. Unscheduled downtime meant chaos.

The HITECH Act of 2009 and the Meaningful Use program pushed hospitals to adopt and use certified EHRs. It worked—sort of. The EMR evolved from a digital chart into the backbone of clinical operations. With that dependency came risk.

Security started creeping into our consciousness, but we were still focused on tape backups and nightly restores. Did we ever test them? Maybe once.

Ransomware changed that.

Cybersecurity moved from the sidelines to center stage. Suddenly, CIOs weren’t just supporting operations—we were defending them.

We adopted a defense-in-depth strategy: firewalls, MFA, endpoint protection, SIEM tools, phishing training, incident drills, and recovery plans. Even routine patches became coordinated events with clinical teams.

The old three-ring downtime binders? Useless. So, we implemented Acmeware’s Downtime Defender—a modern solution that captures snapshots of EMR data every 15 minutes, stores them securely, and makes them accessible even when the EMR is offline.

It was a game changer.

Nurses could still see allergies, meds, and orders. Providers could round. Registration didn’t stop. Most importantly, we trained regularly—because no downtime plan matters if no one knows how to use it.

In full disclosure, my team chose Downtime Defender based on its merits. I had worked with Acmeware for years as a customer. A year later, I was asked to lead the company as President and CEO. I’ve long believed in their mission—and now I help guide it.

Today, every hospital CIO needs to be prepared. Downtime will happen—whether from cyberattacks, updates, or outages. The question is: Will you be ready?

Here’s the 20-point checklist my team used to prepare, respond, and recover.

Hospital Downtime Checklist: Before, During & After

Before (Preparation):

• Implement a real downtime solution (e.g., Downtime Defender).
• Train across all shifts.
• Run live downtime drills twice a year.
• Form a multidisciplinary response team.
• Know your app interdependencies.
• Maintain manual workflows.
• Test backups and restores.
• Use MFA and endpoint detection tools.
• Create a comms plan for outages.
• Stock downtime printers/supplies.

During (Execution):

• Activate team and comms immediately.
• Provide snapshot access.
• Switch to paper workflows—prioritize patient safety.
• Set up a command center.
• Log manual entries and preserve forensics.

After (Recovery):

• Communicate restoration status.
• Reconcile paper data into EMR.
• Conduct an after-action review.
• Update procedures based on lessons learned.

Being a CIO used to mean managing infrastructure. Today, it means defending care delivery in a digital, high-risk environment.

Downtime will happen. The question is—are you ready?