As vice president and chief risk officer at Blue Cross & Blue Shield of Rhode Island, Jon Fredrickson oversees efforts to keep the insurer’s member, employee and proprietary information safe from ransomware and other digital attacks. He was promoted to the position in early March after serving as managing director of risk management, information security and privacy for Blue Cross.
Fredrickson discusses his new responsibilities, current events as they relate to cybersecurity and the unique challenge posed by the need to keep member information safe while still allowing accessibility required by law.
Seifert Systems Invests in Energy Efficiency to Strengthen Operations
For manufacturers, energy is more than just another operating expense. It plays a critical role…
Learn More
PBN: What is at the top of your to-do list as you’re settling into your new role?
FREDRICKSON: Always at the top of my list is keeping our member and customer information safe. We are even more vigilant now, as the crisis in Ukraine continues to unfold. More specifically related to my new responsibilities, I am learning more about health care fraud, waste and abuse, a new area of oversight for me that clearly overlaps with privacy and information security. Whenever I start anything new, I always try to listen more than I speak.
PBN: Are there any new security or risk programs on the horizon that you are looking forward to tackling?
FREDICKSON: Currently, our enterprise risk management program is focused on what we call “top risks,” or high-level risks that may affect our organization’s ability to achieve our strategic objectives. At the same time, we’re often asked to help with more immediate, tangible risks. This year, we’re developing an operational risk management program that will allow us to embed ourselves into key operational areas to assist in identifying risks, measuring key compensating controls and helping drive success through the organization.
PBN: We’ve heard warnings urging United States businesses to brace for potential cyberattacks from other countries, especially Russia, as the war in Ukraine escalates. How much of a concern to Blue Cross is a threat like this?
FREDRICKSON: The current war in Ukraine is troubling on many levels, including in the cybersecurity arena. We’ve already seen sophisticated cyberattacks on both sides of this war. A number of the tactics are well established, like denial-of-service attacks, but new methods, like satellite internet jamming, have also been implemented.
Blue Cross & Blue Shield of Rhode Island falls within the Healthcare and Public Health Sector, one of 16 sectors designated as critical infrastructure by the Cybersecurity & Infrastructure Security Agency. This designation has facilitated our partnership with the state and federal government agencies to gather as much threat intelligence as possible so that we can stay one step ahead of any potential attacks, both directly and collaterally, coming out of this war.
PBN: In addition to your job at Blue Cross, you are a member of numerous boards and associations, all focused on health care data security. Is there anything about health care data that poses a particular challenge to keep private?
FREDRICKSON: At its most basic level, securing health care data is no more challenging than securing credit card information, for example. However, there is a unique challenge balancing the security and privacy of health care information with accessibility. For example, within the 2021 Cures Act, there is something called the Interoperability and Patient Access final rule. Part of this rule mandates payers like BCBSRI to allow our Medicare members to authorize claims data sharing with third-party applications. This presents a unique challenge to ensure the data exchange is secure and our members are making safe, educated decisions on sharing their data. On the other side of this equation, we are striving to make the exchanges quick, easy and user friendly to drive adoption. It’s a delicate balance.
PBN: You have data from both Blue Cross employees and members to protect – that’s a lot of information. How do you juggle the two?
FREDRICKSON: We don’t necessarily treat them any differently from a security or privacy perspective. A few years back, a mentor of mine reminded me that, “This is not BCBSRI’s data; it is the members’ data.” I’ve never forgotten that. As both members and employees, my team is in a great position to gauge the potential impact of our security decisions. At the end of the day, we have to be successful in securing our data 100% of the time, but the attacker only needs to be successful once. That is the relentless challenge we face. But with the great teams here at BCBSRI, I couldn’t see myself doing anything else.
Elizabeth Graham is a PBN contributing writer.
