Interview with Lisa Kilgore [Podcast]

[00:00] Intros  

[01:26] Lisa’s unconventional path to healthcare 

[08:26] Why medical devices are not standalone tools 

[12:08] The power, and necessity of standardization 

[17:10] The importance of strong cybersecurity in the medical device world 

[18:48] Designing technology for real clinical environments 

[24:31] Lisa’s favorite well-designed tool 

[28:35] Outros  

Transcript: 

Dr. Craig Joseph MD, FAAP, FAMIA: 

Hello and welcome to the designing for health podcast. I'm Nordics chief medical officer Doctor Craig Joseph. On this episode, I'm joined by Baylor Scott and White's Lisa Kilgore for a wide ranging conversation about the hidden infrastructure that keeps modern health care safe and what happens when we take it for granted. We talk about why medical devices can't be treated as isolated tools, but instead as part of a tightly coupled ecosystem.  

Lisa draws on her unusual career path to explain why standardization, reliability and cybersecurity in medical devices are fundamentally patient safety issues, not just it concerns. We also dig into why designing for the real world means getting out of conference rooms and onto clinical units, and how leaders can use data and narrative to drive change. It's a practical, grounded discussion for health care executives and physician leaders responsible for outcomes, risk and resilience. 

Let's plug in. Lisa. It is a pleasure to have you on the pod. Let's start with your current situation. Where are you now and how did you get here? 

Lisa Kilgore: 

What I do now. I spend so much time really focused on bringing clinical thought process and technology solutions and medical device solutions and finding the right way to marry them all, whether it's a NICQ or an ED. But the journey to here is an interesting one. I became a single mom in my 20s and four amazing children and realized at that big life choice and the chaos that was happening, that I didn't really have a lot of work experience. 

You know, I grew up working on cars and different kinds of engines in my dad's shop, so I was pretty comfortable with mechanical things. But then I worked for my dad and in his various shops, and we did work on everything from lawn mower, to fixing. I mean, just to see if it had an engine at some point. 

We probably worked on it, right? So it was pretty fun. But not a lot of translatable, like could put on a resume. Right. And then while I was married, my, my husband was in the Air Force. He was an aircraft mechanics for the C 130s. And I actually when we got married, we were both very young, and I knew engines a lot better then than he did actually did. All of our car maintenance and things. And so when he was going through school, I would help him study. And we got into an interesting debate one evening. And the gist of it is, at a point of principle, I took my airframe test because you have to get your A&P license to really be an aircraft mechanic, especially outside of the military. 

So I had my airframe. I didn't go for powerplants. I never actually intended to be an aircraft mechanic in that. In my late 20s, when I'm now a single mom, I guess I went to a staffing agency, actually manpower and needed a job. I took a ridiculous pink resume. Actually, it was it was not very professional and went and talked to them, but they put me through. They were pretty smart. They put me through some assessment tests and almost immediately placed me my first real job. That wasn't like waiting tables or working at a truck cleaner was for American Airlines out at Alliance Airport. I was hired on to be their technical database engineer because the two things I knew, one of which I really didn't realize I was that proficient at, was computers and engines and, and pretty, pretty comprehensive knowledge of aircraft. So they had these old Fox Pro and DB1 access databases, and he did some really bad stuff, and they were getting the new Trent Seven set of seven because rolls built engines for aircraft, and they had a satellite office out at Alliance. So I got hired on there to help convert their databases and actually translate some of what they call the TV's, the technical revisions for their engines and, and put them into relatable instruction guides for aircraft mechanic. 

 So which is a really bizarre thing to do. But it was comfortable. I actually felt really comfortable doing it, and I began to grasp pretty quickly that when it came to technology engineering, I had a really good understanding of it. I picked it up really fast. I was really, really good at it. But the leadership there, roles were all out of like Scotland. The main headquarters was in East Kilbride, Scotland, in Europe and so my leadership about a year into my employment sat down and wanted to help me move up in the company, but I couldn't. I had four children. 

 I wasn't moving to another country. Right. They were all in their little I mean, one was still in diapers and so he actually got me a job interview over the phone at southwest with one of their technical managers, and I was hired a song after just one interview, and I got into working for hospitals. At that point, I started out as a night operator, working on servers and data centers. But pretty quickly I'm a problem solver. That's how my brain works. And these kinds of technology and mechanics worked really well to me. But also looking at situations where there's a problem, I need to get to a solution, right? And so from a critical thinking aspect, working in that environment in the 90s, a lot of IT shops, particularly in hospitals, were not very evolved. 

And one of the hospitals I worked with and I I'm going to avoid seeing hospital names going forward. I went into hospitals. I worked for the group would kind of shut down and do peer to peer doom and, you know, around 4:00 and because this was the mindset, right. So most of the people that I worked with were really amazing computer people. I mean, IT centric people, but not necessarily. It wasn't like I was asking these, the grown up in the room, right? The one that was going, okay, but we have to like work now and... 

Dr. Craig Joseph MD, FAAP, FAMIA: 

Solve this problem. 

Lisa Kilgore: 

Yes. So very quickly I became the supervisor and manager for desktop and data center operations. I over service desk for a while. You know, organizing the group and using that the skills to improve process, solve problems. You know we were doing a lot of sneaker net again, but not a very mature environment. I actually see a lot of parallels to how we're managing and engaging with medical devices to the 90s and how it evolved. And so the thinking is, is not dissimilar. My leadership was pretty much willing to let me do whatever I kind of wanted to do. As long as I was taking on the work, if I would do the work now, most of the time it was without additional pay or title. I was the only girl in the in the IT team, but I really loved it and I wanted to get better. 

And I saw this, this chance while I was working out on the actual hospital floors to help to use what I was doing and actually help, and that that kind of became the theme of, of everything I started to do. I mean, later on, I eventually pursued my EMT and paramedic certification and, and the whole purpose was to, to make sure I could better understand specific workflows and technology and, and begin to look at it from more of a clinical lens, the nurses and the providers and the anesthesiologists that I've worked with over the years have all been incredibly patient, where it's my more geek I.T brain and helping me learn what I don't know around clinical practice. And so I've really invested. It's been a constant journey of education to know as much as I can and from all of the different perspectives, you know, how we can do better in health care. But, but that's kind of my journey. 

Dr. Craig Joseph MD, FAAP, FAMIA: 

I love it because, it's kind of like you were the Go-Between between kind of airlines or, you know, aircraft mechanics and the I.T world. And now you're the Go-Between. Between health care systems and the IT world. You mentioned medical devices, and I'd like to kind of pick up on that, because that's a lot of what you do or have done in the past. And, you know, one of the things when we were preparing for this call was that you mentioned that I hadn't really thought about before is that a lot of people, make a mistake of thinking of these devices as kind of just, a one off thing, but not understanding. It's not isolated. It's part of this big, whole connected ecosystem. Did I get that right? And how is that important? 

Lisa Kilgore: 

You did. And while there are still there are still some devices that work in a kind of a standalone fashion. You know, you've got your mobile ultrasound that they can take up and grab images, and it doesn't necessarily have to talk to something. But most of our critical, particularly our critical life safety systems, depend on infrastructure to actually function. When you think about that cardiac patient in the bed and the nurses jobs, the clinical teams jobs there to make sure that that they're doing that constant monitoring, I can guarantee you they've got some orders from their provider to be monitored 24 over seven looking for, you know, any potential issue of decompensation or critical arrhythmia or they're going, you know, tachycardia or any of those things that that they need to see in order to immediately respond. 

Take the correct action and, and make sure the patient has a good outcome. Well, the only way that works is if the monitor that's connected to the patient, those sensors connected to the monitor and the monitor is talking to those external components, typically in what we would call a maybe a central monitoring unit, or at the nurse's station, a central station, and then of course, to be truly as evolved as we should be at this stage of development, the data should be present in all of the charts. 

So providers that are checking on their patients are getting a notification from a nurse to do an intervention or from a telemetry technician. They need to be able to have immediate access to those cardiac waveforms, to those vitals, the heart rate, the saturation level. They need to be able to see that where they are, if they're going to take correct and quick action to keep patients safe. And that's where we are today. I mean, our job really is to make sure that the patient survives whatever brought them to the hospital and has the best possible outcome. But the medical equipment that's, associated to that, the critical tools that the clinicians need to use, they require infrastructure, they require stable infrastructure that's not interrupted in an unplanned fashion that doesn't have, you know, an unexpected power outage or a server crash, you know, that would prevent it from functioning the way the clinical teams need it to function. 

And going further, how the clinical teams have become dependent on it functioning. If you know your tools are not going to work, maybe it would take human intervention to compensate for that and try to be sure that the patient is more closely monitored. But all hospitals today, their staffing models are really designed. Their clinical practices are designed around these tools are functioning. Right. So we have to do that job and make sure it's the right tool, that it's the right design and that the foundation that it sits on, the technology foundation that it sits on is performing as well and as safely and consistently as we can make it. So that really is most of my job now. 

Dr. Craig Joseph MD, FAAP, FAMIA: 

You said, you know, it's got to be stable and it's got to be consistent. And that leads me to a word that clinicians call the s word. It's not that word. It's not that standardization. Standardization. And so it's important to get all to kind of meet those criteria that you just mentioned to kind of standardize as much of it as possible, while still allowing, you know, this unit uses that equipment in a slightly different way that that unit over there. How do you kind of thread that needle, that standardization needle? 

Lisa Kilgore: 

Well, a couple of things. And you're exactly right on standardization. It is it is so key to consistency, to stability, to safe unit. But you have to think further than even just so there's the aspect of we can improve our technical design if we are not trying to design the backing infrastructure for 100 different flavors, you know, and trying to uniquely model and keep it stable, especially even in a single hospital, but in large editions, the more standard, the higher availability you're going to be able to achieve. But the other piece that sometimes isn't is immediately obvious is clinical practice. The actual complexity of the devices we're putting in the hands of the nurses and the providers. They don't all function the same way, and learning how to use it safely and optimally for your patient, it's also critical. So if you've got a nurse that from room to room or suddenly, department to department, you know, they're moving slowly, possibly from the EDI back up to the ICU, and you don't have continuity in that medical system. 

You're also introducing a lot of risks there. You know, it's really a huge burden, this beautiful, improved technology environment that we're enabling for patients. There's a significant burden being placed on our clinical teams. And standardization is a way to help relieve that burden, because then you can build in good training practice, even annual training practices. And allowing the clinician to become proficient with that medical equipment and comfortable with it, because, you know, that safe operation is as important as that consistent network design. 

I think one of the ways that you can really achieve standardization, and I've had a fair degree of success, is being able to see from a financial lens and from a patient safety lens, make sure that you've got your data points correct. I have found it's not a difficult math equation. If you do your homework and you assess an environment, you can look at aging out equipment, you can look out at the equipment that it's going to most accurately meet the clinical need. 

But then from that list of equipment that truly meets the clinical need being driven from that clinical voice, which ones can you build a large platform for? Which ones can you keep compliant and stable? Which ones can you protect from cyber threats? Because the list then narrows pretty quickly when you can present that data to the clinical decision makers and to the financial decision makers, then you're more effective at achieving standardization. You can also show them the risk and cost of trying to maintain the environment without standardization. I'll tell you hospitals that that has two fractured of environment and a lot of them do where you have maybe ten or more different models of just even your core patient monitor. They're bleeding out, money, unplanned dollars, a lot. You can't keep enough trained people parts service contracts, the each one of those systems, you know, a trigger system has completely different communication requirements than a GE or a Philips. 

So the networks are not the same. And if you've got all of those flavors in there and you're trying to keep them stable, even turned over before they age out and fail in an unplanned fashion, which is not optimal and certainly dangerous, and keep trained people for it. That's very expensive. I mean, it's just the math equation is obvious. It's very expensive. So if you can make the case, do your homework. I mean, it's not sexy work. You got to roll your sleeves up and get your hands dirty. But do the homework and show what is current and the roadmap to getting standard and stable and what cost you're going to, save Rose Lloyd all along the way, doing bulk purchases. By the States, there is an opportunity, especially if you partner with like your strategic sourcing people in this journey and your security people and your server people, you can holistically build a picture that is a very attractive and compelling story. And, and your clinical teams, which are used to making evidence based decisions, will help support you through that. But your financial people and your security people will jump on board too. So then you come out with a plan that has a whole community around, you know, executing it, and, and you will be more successful. It's not a fast answer, but it's an effective answer. 

Dr. Craig Joseph MD, FAAP, FAMIA: 

You know, it's funny, I thought you were going to say, oh, well, to get to be successful, you know, you got to kind of play the political game and know who the decision makers are. But it sounds like the two things that I just took away, if I were to boil all that down, is one come with the data. And two, it's not just the data, it's the story that the data you use, the data help paint and so you need that story. And then maybe three is, hey, here's where we want to go. And here's what's going to happen if we don't write. So that you're going to break that story into the good, the good parts and the bad parts. I get that that right. 

Lisa Kilgore: 

Yeah. But you're not wrong in the politics and relationships. It's just that I think that you can you can soften the pain of that by building those relationships and creating those allies, so to speak. As you're collecting the data, when you're walking the floors and doing the hard work, getting the right answers, listening to the people that are dealing with it, whether you're listening to the difficulty strategic sourcing house or trying to figure out what is the right answer when they're not necessarily medical device experts, they're finance experts, right? They're purchasing experts and listening to the pain point that the nurse has, you know, in the in the emergency department or the anesthesiologist has in the Or when you're listening to them, you're going to find opportunities to help them along this journey. So by the time you present your data, you actually have a community of allies. So it does make that that political, landscape a lot easier to navigate if you can do it that way. Again, these aren't super fast answers. I do think you have to prioritize a little bit, but I think that's how you can do it. 

Dr. Craig Joseph MD, FAAP, FAMIA: 

One of the things that folks are often, coming to the conclusion I think nowadays is, security, security we all know about, you know, cyber and phishing and those kinds of things. But some of these devices that you don't think are potential security problems because no one really interacts with the monitor, just connects to the patient and feeds out data. But in fact, if it connects to your network it's an opportunity for evil doers. And so what have been some kind of changes that you've seen in the last 5 or 10 years with respect to security and how important it's become? 

Lisa Kilgore: 

So some of the cyber security standpoint, there's a couple of key things. I think one of the biggest challenges is getting people to speak the same language. Right. A lot of hospitals, if you talk to them, even clinicians or decision makers, when you talk to them, you know, you're going to ask about cyber security. They're going to defer you to the security team or the IT cyber security team, which when it comes to medical devices, these people are not looking at it from that perspective. 

You're your patient monitor and a machine perfusion pump nurse call system. These are FDA regulated systems. So the solutions that you apply to your computers and your printers, you cannot apply safely, effectively to these medical systems, not without running the risk of, seriously impacting patient care and violating the FDA regulations that they're being governed by. So, so this is probably one of the biggest areas that is a challenge for hospitals, because most hospitals don't have a dedicated team designed to to handle the medical device part of it. 

Now, some of them are taking some interesting approaches to solve it. You know, you've got to your biomed teams, your health technology management groups. The new rebrand for biomed that are very knowledgeable of the medical devices. And if you're going to ask them about PMS or inventory, this is the people to talk to. But most of these teams don't have the training or experience or skills bandwidth to actually think about medical device security. So then, yeah, you're not talking to it and you're not talking to biomed, but you have a genuine problem because bad actors are absolutely exploiting the vulnerabilities. And when it comes to vulnerabilities, this unmanaged environment of medical devices huge risk, you know, from infusion pumps that all are online today to your cardiac telemetry monitors or your nurse call system. 

These things are plugged in. They're pulling IP addresses. Many of them use windows based operating systems in the back end. So, when someone is exploiting Microsoft vulnerability, they're exploiting these systems too, right. So, you have to actually have a plan for it. The foundation of the plan though, back to our conversation really around standardization, but a little deeper. Even in design, you have to be thinking about cybersecurity from the moment that you consider your purchase of your equipment all the way through its lifecycle and planning for it if you can't, if you don't have visibility into your medical device environment, it's pretty hard to have a good security posture or plan for it. And if you don't understand exactly what your exposure is by medical type, because they don't all communicate the same way, some store data, some do not store data, some of them transmit sensitive data, others do not. 

You know, some use proprietary OS medical device language and others use windows based or Linux based. So you have to understand these components in order to design a security program that's truly going to mitigate your risk. And then you have to take it a step further. I recently did some tabletop exercises with some medical device vendors, and it's interesting because when I scheduled them to plan them with all of our awesome technical partners at the table, I was just told flat out, nobody does this. Nobody said schedules to do it because whatever your security plan is, you don't test it, you don't fit it, and how do you know it's going to work? We've had a lot of hospitals across the nation who have experienced genuine cyber attacks, ransomware attacks. We've had a pseudo kind of zero day event a few times. And in those scenarios, your medical systems, when they go into quarantine, they could be in quarantine for months, not days, not hours, but months, because they have to get whatever solution is going to mitigate the risk or resolve. 

The vulnerability has to also then be approved for that medical system along the same regulatory requirements that they were vetted for patient care to begin with. So it's a complicated problem, but I think the answers to the problem it is, is having the right people at the table that understand both your medical technology and your traditional technology, and how they come together and then designing the solutions and programs to find that balance between patient safety and patient care and securing your environment, mitigating the risks. So it's a lot of different kind of thinking and tools that need to be applied. There are some great technology tools out there, you know, from X-Com to some of the newer cortex and palatal tools. But none of the tools will solve the problem for you. If you don't understand your environment and have some intentional design and expertise at the table to manage that environment, you can't slap a technology Band-Aid on it. 

Call it good, right? You've got to have some thinking of strategy. And there's such a gap between what is the highest priority in hospitals. It happens a lot, but understanding where the risk is and medical devices, then I think it's a serious challenge for our health care world right now. 

Dr. Craig Joseph MD, FAAP, FAMIA: 

Yeah. I well I you really kind of hit that message. All the way out of the ballpark, which is, you have to design for the environment that the device is actually being used in, right? You have to get your hands dirty, which I love it. And, I'm as guilty as anyone when I have my it hat on. You know, we love to kind of sit in our office and talk about this ideal workflow and this ideal location. And, you know, if you're not out there in the operating room, in the in the ICU, in the clinic, you don't see the real world and you can't make sure that the devices are going to work. That's a take home message, that I think a lot of people don't get. 

And, and they're, they're burned by it in the end. Well, this has been a great conversation. I've certainly learned a lot. You know, we always like to end with the same question of all of our guests. Lisa, is there something in your life, personal or work that's so well designed? It brings you joy when ever you interact with it. Does anything come to mind? 

Lisa Kilgore: 

Well, I have to admit, you gave me this question, and a lot of things went through my head, that I wanted to, to share. You know, I certainly have a love of screwdrivers and mechanical, I always have, but I have to say, daily I have an Android, the fold flip phone, and, and I've had the same model. I'm actually way overdue for an upgrade now, about 3 or 4 years. But I use it because to your point, I do get in the hospital. I actually you can't be on the team that I work on that I manage. If you are not willing to go in the hospital, I just I won't hire you and you have to put on scrubs and you have to learn their language because we can't do our jobs unless we can get up close and personal to what they need. 

But my staff becomes my strongest ally. It folds up, fits in my pocket, but I can take it out. I can take pictures in my teams chat, pictures in my OneNote. It's become such a crutch. And I know that's terrible because people are very tied to their phones. But, I mean, I think from a different reason you know, I find that it's a it's a strong tool for me, when I'm trying to do a walk through assessment, I can pretty easily report without carrying a lot of equipment. 

I can pretty easily report what I'm observing. I live by documentation and everything we do. My favorite saying is if it's not documented, it didn't happen, right? If you can't prove it, if you can't measure it, hearsay is not admissible. So I need the evidence. Right. So this tool maybe for different reasons, I'm not into social media or any of the other things. I think people maybe are normally thinking of when their phone is. But it has become I walk a lot of hospital floors, I spend a lot of time in the hospital and that's on. Has become probably my favorite piece of equipment to help me document, manage and chronicle what I'm doing so I can get back to those answers quickly. Who I'm talking to, what they specifically said geographically, what are my concerns in the landscape of the of the clinical unit? And so maybe it's kind of a lame answer. I would not say it's my talk wrench. 

Dr. Craig Joseph MD, FAAP, FAMIA: 

Well, you know, talk wrench would be a great answer as well. But it sounds like, you know, part of it, it's the fact that it opens and so that you have more screen area, I'm assuming to either take notes or, or show someone something else that you don't get on a phone that doesn't it doesn't have such a big screen unless you're carrying around your, your, iPad, which does not often fit in your hospital scrubs. 

Lisa Kilgore: 

It does open. And I can also prop it up and sit it down and record well and using my hands for other things. It kind of has its own little stand for it that works really well, but it's fairly compact. And I always have my usually have my Bluetooth on. So when it's in my pocket, I can also do because I'm always doing multiple things right. I am a crazy multitasker and so I can answer those because I'm like in the halls of one hospital, all the other one's calling me and I can do that. So, it's multi-purpose. I only need one tool, right, to do all those things. 

Dr. Craig Joseph MD, FAAP, FAMIA: 

I love it. Well, thank you so much. This was this was great. And it really kind of hits home. You know about technology doesn't live by itself. It needs to work and to make it work. Ideally you really have to understand everything that's around it. So thank you for helping us learn or relearn that lesson. It's been great talking to you. 

Lisa Kilgore: 

Well, I appreciate the time and the interest. I, favorite topic. And I think if we all had this kind of mindset together, our nurses and doctors want to teach us to do better. But the patient in the bed, it's our responsibility for all of us that are involved. And so if more of us could just kind of get to that mindset, we could do better for patients every day. 

Dr. Craig Joseph MD, FAAP, FAMIA: 

Great. Thank you so much. 

Thanks for tuning in. We hope you enjoyed today's episode. For more on Lisa, follow her on LinkedIn. Check back for more episodes of designing for health wherever you listen to podcasts, or a no to global.com. We'll see you again next time on designing for Health. If you enjoyed this episode, please leave us a five star rating and a review.