Welcome to the IT Matters podcast, where we explore why IT matters and matters pertaining to IT.
Todd, welcome to the IT Matters podcast. It's great to have you.
Thanks, Keith.
Appreciate it. It's nice being here. And thanks for finding me.
You know, I'm known to find people. So it's, it's a pleasure. I picked you out of a lot of the IT leaders that I was looking to bring on, particularly around your experience in the healthcare industry, and the unique challenges that are beset upon IT leaders that are tasked with securing sensitive patient data, and the healthcare industry is the number one target for malicious cybercriminals today.
So glad to have you on. Before we dive into some of your unique experiences, Todd, can you tell our listeners a little bit about where you came from? I know you grew up in Philly. How did you get to where you gare today?
What's the short and sweet story of how you got to where you are?
I mean, great question. I grew up in Philly, born and raised, I've lived there most of my life. I no longer live there. I ended up with the hospitals working for another company in Virginia running their IT shop. And they were having a lot of issues regarding, you know, sustainability, a lot of issues with their technology stack that I tried to fix. And this will probably play out in your questions later. The issue was around the problem of listening and doing. My job currently is in Wahiawa, Hawaii. I live in Charlotte, but I was out there for two years. I've lived here for about a year and changed.
There's a lot of challenges in Hawaii in general. But my job there, you know, I got the offer when I was sort of talking to them around COVID. When COVID first started, they really needed somebody to come out there. The CFO out there is my former boss from a health care company I worked for in Wilmington, Delaware. He sort of picked my brain while I was with the manufacturing company in Virginia, about different problems they were having at the hospital. And you know, what my thoughts were around the hospital and, and sort of how I would help them. And, you know, They're called Aloha shirts. That's like their I tried to tell them different things. And I would... you know, we had a... we have a really good relationship. So giving them advice is not a real issue for me. So I sort of told them what I thought about problems they were having, stability version of a... that's their version of a dress shirt in issues they were running into. I had no idea of the scope of the stability issues when I was having those conversations. So you know, I just gave them basic advice. And sort of he kept calling me or emailing me and asking me for more and more Hawaii. That's how they look at it. It's a dress... it's a dress advice, and would I be willing to help? And I said, "Yeah, sure, whatever you need." So I guess it sort of went down the road. I talked to the CEO, who's now my boss, we started talking about stuff at the hospital. And he was saying how dissatisfied shirt. So I said, "Well, you know, I have to talk to my wife he was with IT in general. And I, again, tried to give him advice about what I would do and how I would address things and not ever thinking for one second that I was going to become the first next CIO of, of this hospitals. So I think we had and, you know, we have to uproot and it'd be big deal." So I like three conversations. And third conversation, he finally sort of said, "Well, you know, I'd like... I'd like to hire a CIO." I'm like, "Okay. I mean, it's a lot different than having think we had a couple more conversations. And I told my a director and you all you've had is directors. And so, here's what I think you should be looking for. And I'm happy to help you find one." And, you know, that's what I thought the process was going to be. I thought he just wanted to help wife and my wife's a trooper, she's the best. She'll go me find their next, you know, their first CIO. Because I never thought I would go there... I never thought that I would, you know, just pick up and go. And so he goes, "No, you don't understand." And I was like,"What are you talking about?" anywhere, pretty much. And she already worked remotely, so it And he's like, "No, I want you to be my CIO." And I'm like,"What?" He's like, "You're in Hawaii." I said, "I'm in Philadelphia." Well, I was in Virginia at the time. I said,"I'm in Virginia, you know?" And my CIO is from Philadelphia, he's born... he's born and raised in Philadelphia, too.
didn't matter to her. Her office was going to let her work from And, you know, CFO, he's born and raised in Delaware. So I mean, we all have that sort of East Coast mentality. And let me tell you having the East Coast mentality in Hawaii is a whole different animal because they're nothing like East Coast people.
So...
How many Hawaiian shirts did you own before you wherever she wanted to. So, we decided to go. So, off we went.
moved down there?
Zero. Now I own one. They're not called the Hawaiian shirts, they're called Aloha shirts. Yeah, that's what they're called. They don't call them Hawaiian shirts.
They're called what?
Now, going to Hawaii is a whole different thing. Because you're... you know, I took 20 boxes of stuff with me. You don't take furniture, you don't take... you just take whatever you need, and go.
I can imagine of all the places, you tried to convince your wife to move to Hawaii, it wasn't too hard of a sell.
Well, you know, I didn't know how I felt about it. Because, I mean, yeah, the weather's great. But there's so many other factors. You know, moving to an island is a weird thing. Again, you're going from the mainland. Yeah, it's a state, it does not feel like, you know, a state. It feels like a different country.
Yeah. From an IT and technology standpoint down there, are there any solution providers that are local to Hawaii? Any startups? I mean, is it mostly organizations that have, you know, the footprint in Silicon Valley that might have reps down there? Like, what is the... what does the environment look like, from a technology solution standpoint?
I didn't have an issue finding them. There's MSPs. So I didn't have an issue finding somebody I needed, but they're all... you know, everybody's in sort of a hodgepodge. And they're not...
this is gonna sound weird, but like when you land in the airport in Hawaii, it's like going back in time. Because you see film booths, you see... you see payphones. You see... it's very old and a lot of old in Hawaii. It is beautiful. Don't get me wrong, but it is a lot of old. and a lot of poor, a lot of poverty. That's one of the challenges is trying to sort of find your way. And the community I work in, the hospital is very old. It's an older community, very impoverished. So being at the hospital, you're serving that community, and you want to do the best you can because you want to help these people.
That's sort of how I look at it.
I mean, the technology stack in Hawaii is, is fine. I mean, it's different, maybe less providers than placed on the mainland, but I haven't had an issue finding people. Tt hasn't been an issue for me. The issue... the bigger issue is finding people to work.
That's the challenge.
Are there any universities in Hawaii that have, you know, a decent... a decent computer science school?
The University of Hawaii, I don't really know much about their, their programs and stuff. It's... that's the biggest school.
Did you guys recruit out of University of Hawaii? You know, some of the...?
No, I found people who were like ex-military or just native, you know, island people. So it's a huge military presence there. So that's why the technology is still decent.
I see. Okay. So, you pack your bags, you tell the wife, "Hey, you know, gotta new job as the CIO."
Well, I told her, I told her I had an offer.
And we talked about the offer.
And I said, "You know, we'd have to go." And I said, "What do you want to do?" And she's like,"Okay." That's pretty much the conversation. She's great. My wife is... my wife is awesome.
And I'll say that on a public forum. She is awesome. She's not afraid to just do and, you know... but I want to do less now because I wanted to sort of stay where I am, stay grounded for a while. I don't want to...
I'm not ready to pick up and go again. So, that was my big adventure.
It's good. It's good to get out... get it out of the system. So you guys head off to Hawaii and you are now the CIO of Wahiawa Hospital.
Wahiawa General Hospital.
Wahiawa. Wahiawa Hospital. And what what did you walk into? What was... what did the IT team look like? What were some of the major challenges the hospital was dealing with at the time? And what were your first steps to helping solve some of those problems?
Okay, so I walked into a hospital that's, you know, an older hospital in the older community. I remember my first day and I sort of looked around in the data center, and I was trying to get a lay... my biggest problem I had was, I had no documentation of any kind. Nothing. So I had no idea what was what, what was where. I had... we had to create it all. So my team, when I got there, was two people, and one person had just given their notice. Others had already had either left or left before I got there, so you know, or let go.
So my biggest issue coming in was to sort of try to get a lay of the land and understand what I had that was good and what I had that was not so good. The problem I was running into was the network had about a 75% up time. So it kept going down every day. Went down. I want to say this in a nice way, I don't want to sound harsh, but the biggest problem that I saw...
and I'm a guy who grew up in infrastructure, so I understand the infrastructure really well.
You know, we all grow up somewhere in IT, software, you know, application cloud now. I mean, it's just all depends. So I came up through infrastructure, I was a network admin, I was a helpdesk guy, you know, I was... I came... I was the lowest of the low and now I'm where I am. And that's... it just is what it is. But some people look their nose down, and people from infrastructure, they think, oh. You know, I always say the same thing. "Well, without my infrastructure, your stuff won't work." So what I saw was, I had switches that were neglected, I had servers that were neglected. I had a fairly new server instance that was built on a platform, a virtual platform that I would never use.
I had a lot of stuff that wasn't really working together. And...
Were those the sources of the downtime? What was bringing the network down?
Too many VLANs.
The switches just couldn't handle that because the switches were 12 years old. I would say that the network was in serious decline and neglect was probably part of it. And the guy who was the director before me, did a really poor job of identifying what's wrong, and how to really fix it. And so my challenge was, well, how do I do a strategic assessment, a SWOT analysis, while I'm trying to stabilize the network? I mean, I was in there regularly at 2am trying to get this thing working. I mean, from day one. I was... I left and I came back at 2am. And I was on the phone with people trying to figure out what's going on. Because I didn't know at the time the VLANs were the problem. I didn't know at the time the switches were the problem. I just got there. And I'm like, what's going on? And so I brought in a friend of mine, a guy who's worked with me for the last... now 10 years, sort of helped me virtually, with some of the stuff. He's now my senior network admin. And I managed to find the former consulting MSP that was working with the hospital and helped design a lot of the network. So I got them, and I reengaged them, you know, because they were fired by the guy before me.
And I was like, "Why would he fire you if you guys have all these problems?" And he's like... they're like, "We don't know." So anyway, so I worked with them to get the network stable. So we got rid of about 50 VLANs. I think we had something like 125 or so. Now we have like 30ish. I stabilized the network, immediately, just to sort of get it to a place where I know that it's going to stay up every day, and not go down. And that's sort of how we did it over the period of however long it took us, a week or so.
Why were there so many VLANs? What was the strategy around the segmentation of all of these VLANs?
I think that they thought, you know, that the people in IT thought that they needed a VLAN for everything.
And that's not the way it works.
So I was... you know, I tried to talk to the people who were there before they left and they just... they were all siloed.
So, they didn't know. And so, you know, they did their thing and whatever, whatever that was, and just tried to sort of, again, not get involved. And I don't work that way. So to me, it was all foreign. I was like,"What are you talking about?
Like why are you not involved?
You're in IT. Why are you not saying something? Why are you guys not doing this?" They just didn't know how. They were never trained. So once I figured out sort of what was going on and then I brought those consultants in, like they were on island so I could bring them in. And I had them sort of sit in IT for like the first couple of couple of weeks just to keep things stable. I bought my network guy.
And then we started to go to work on what we're going to do to sort of fix this network. Now wrap this all around the fact that we're in COVID. So everything is, you know, stopped. And getting stuff, procuring... procurement is really difficult. So let's cut through it, I'll give you the short version. So we went through my analysis, and I thought to myself and my network guy agreed, I said, "We're never gonna be able to fix this. Why don't we just build a brand new instance? And then we can bring that up, separate from the rest of the network, move everything we need to move on the new instance, onto the new... new VSAN and... or new... they're with Dell, so VxRail and, you know, build the backups off of there and make that a whole VMware instance, then we can figure out what to do with the second instance when we're done.
And then he had some ideas which I liked. And so, he did that.
And then, you know, he's, he's like, "Obviously, well, how are we gonna address security?" I said, "We can't address that today. So we got to fix the infrastructure before we can worry about fixing security." So we have what we have now, it will work for now, it just won't work long term. So once we did that, you know, with all stuff.
And again, as a CIO, or as anybody who runs IT, you know, as a new person, the worst thing, at least I feel that you can do is go to your, your boss, who's the CEO, and, and bring the CFO into the conversation and say, "Oh, hey, by the way, I have to rip everything out and start again."
Yeah, that's... it typically doesn't go very well, unless it was planned.
This is... this was the third time I've had to have that conversation. In my last... three out of my last three jobs have been this way.
And I like being in that sort of fire. It's just who I am. I've responded really well under pressure. And I just like working in that environment. So, I had that conversation. And I said to them, "This is how we're going to do it. And there's no way around it, there's no way I can sort of mitigate this stuff, I can put stuff, make stuff more stable, as you've seen. But I can't fix neglect, and it's already too far gone. And the equipment is too old, just has to... it has to be changed out." And they listened. And they heard me and they had a shared vision with me. And that's sort of how it's been since day one is that we've all sort of been in sync with each other, and how we want to approach, how the business wants to approach things and how IT can help the business.
These conversations can be difficult, especially if there's not a vision of how this transformation affects the bottom line. So if the network is down, if you're up 75% of the time, and you're able to increase that to 95% or 99% or higher, what does that do to the bottom line? And, and does that help justify the investment in new infrastructure? Were you able to illustrate that in bits and numbers to them?
Well, yeah, I mean, I have a really good relationship with the CFO obviously, we worked together for a long time, so he understands where I'm coming from when I talk about things.
So, I don't have to get into that detail. I do. With him, I don't need to. A lot of times before I even talk to the CEO, I'll talk to him first and sort of use him as my sort of sounding board and I call him the bank. And that's what he is.
And he'll, he'll say to me,"Okay, well, that makes sense.
But can we do this?" And I'll say yes or no. And most times, it's no. It's not no because I want to say no, it's no because it's only a way to get things done partially. Like I... the problem I have, and what I really love working for the hospital, but it's like a love hate kind of thing. It's nonprofit. It's small as far as hospitals go. A very small, 125 bed hospital/ I'd have to stretch the dollar, you know, 10 times around the block and then go for 11. So I love that but I also don't love it. Does that make sense?
Yeah. It's a challenge. If you had... if you had a budget, a comfortable budget, then you just run out and you grab the solutions that you need. You got the stack and you implement it. But narrowing down where the best ROI is, what needs to happen now versus next year on a limited budget, doing the negotiations with the vendors making sure that you size properly, you're not overspending yeah, that...
that's a unique challenge in and of itself.
Yeah so it's a place I love to be and a place I don't want to be because I'd rather just have the money and just go out and get it. But I'm not built that way. So I go through vendors and beat them up, and they'll get my number.
And we'll have to come up with out-of-the-box solutions to get things moving. So that's sort of what I did. I did all that prep work before I even had the conversation so I was ready with all my numbers. And I had everything, which I try to do. I try to always get everything in front of me so I see it first.
Because there are times when I'll see something and it doesn't make any sense to me. So I'm not going to try to sell it to my boss. Because if I can't justify it, how am I going to justify it to them?
You brought in all this new equipment, you stood it up. Well, I am assuming the switching,,, switches and servers, and firewalls. Yeah, so okay, you stand it up, and what was the result? Like what...
what did you see change after this new equipment was implemented?
Well, it couldn't have been at once.
Servers were first, then the switches, then the firewalls.
Because you cannot just changed everything at the same time. So luckily, I was getting the servers in pretty quick. But the switches took probably six to eight weeks. Yeah, about eight weeks, and then the firewalls around the same time. The instant notice one of the servers situation was there was no more space issues. So when they're in old instance, they were always running into space issues, because they had these, you know, they do a lot of imaging. So they have these giant image files that were eating up tons and tons of space in the center. They weren't...
again, that piece of the hospital wasn't being run correctly, but I couldn't address that until after this was done. That was my... when I bought the servers and all the virtual stuff and I loaded everything up, immediately there was a speed increase.
Immediately noticed stability.
You know, everything runs as it should because they're all working off of one another.
That's sort of how it's supposed to work. Now all I care about for the users is they have...
there's not outages. You're going to have an outage, for whatever reason, every once in a while. But to be consistently 99% uptime is what I... that's what I got. 99.9%, whatever.
Switching gears here, the healthcare industry is probably the number one targeted industry for hacking and malware, cybercriminals, because of all this sensitive data, PII data, everything you have is HIPAA compliant. What, you know, especially with aging infrastructure, a hospital that is running very lean, the financial situations for a lot of smaller hospitals can be quite dire at times. What do you do if you're in a situation where you have to protect all this data? What are the basics?
What are the like... let's say you're giving advice to an IT leader accepting a new job in a similar situation and they don't have any experience in the healthcare industry. What advice would you tell them when it...
when it comes to securing the data? What are the basics?
What's the next step? Where do you want to be in a few years?
Are there any strategies that you found that are particular to health care?
That's where listening comes in and understanding what's in front of you. It's a gigantic task. And the biggest problem of being a small hospital is that I don't have... like I had a CISO on that, on my network engineering.
So it's about hands and feet.
And so it's about what can I manage that will work for me on the budget that I have. So how do I make this place as robust as possible on the dollars that I have or that I can find?
That's always for me. I'm always trying to find the money. I'm always trying to structure deals that work for the hospital. You know, instead of doing giant deals where I'm having to pay X upfront, I'm breaking it down.
Or if I can finance something for x, say five years, I'm just using an example, three years, you know, I would do that versus trying to do something all...
again, I'm always trying to find the best way to make it work.
And I'll keep going at it until I make it work. That's the drive. So I would say to you that you have to make sure that you have good backups, you have to make sure you're backing up somewhere to some kind of off-site storage.
Did you back up outside of Hawaii? Seems like that would make sense.
I do now. Yeah.
But at first when I got there, there were no backups. So you got to make sure you have, obviously, something...
antivirus, got to make sure you have something that defends you from external threats. Outside, you have to make sure your endpoints are being protected.
And then, you know, for me, I made sure that I have the SIM that sits in the middle of all of my security, and aggregating all my security data, plus acts as my sort of hands and feet when I'm on the office. That's sort of how I built out the security stack.
Did your team manage the SIM?
We manage it.
Yes. But when we're not in the office, they handle things, the company that I worked with.
I see, okay. So there's the most... you have a third party.
The company I bought the SIM from, they also do the monitoring 24/7.
Yeah, making sure that the integrations are all up to date. Okay. End points, SIM, making sure you're backing up off site. I was reading the news this this morning, and saw an article come across that public cloud service rep revenue jumped 19% this year. 45% of that are SaaS applications, 20% of that represented in Iaas, infrastructure as a service, you've got 18% platform as a service. Microsoft is leading overall over Amazon and as far as growth goes. I know Amazon has the bulk of the business today. And then you have GCP, probably the smallest footprint, but what does that tell you about where the industry is going? I know that cloud typically... moving to especially a public cloud, hyperscaler is not the most cost-effective, effective option. But Microsoft is leading in the growth. They partially...
they kind of remind me of Apple where there's an ecosystem.
They're developing that ecosystem that makes it difficult to buy anything outside of Apple, because you don't have all the visibility that you have within all of your other device if you buy an Android or buy a PC. And Microsoft, it seems like they're, they're adopting a similar strategy with their security stack and how you can spin up Sentinel pretty easily if you have the right licensing.
And then they make it very easy to say, "Hey, well, why don't you back up here in Azure?" And we'll, just like the all the other providers, provide some upfront funding for it. Does that... does that surprise you about Microsoft taking the lion's share of the growth?
Where do you see this going?
I mean, the products are good. I like their products. I don't deal with them, because they won't give me nonprofit pricing, where Amazon does. So they lump all hospitals in the same buckets, doesn't matter small, big whatever, and there's no appeal. There's really nothing. That's their decision. And that's... so to me, it's not financially feasible to work with Microsoft, when Amazon said, "Yeah, whatever you need." You know, and Google, because that's what the hospital had when I got there. I'd rather use 365. It is what it is. I don't really like Google's public cloud, I'm not a fan of their stuff. Amazon's been good. I mean, their stuff is good. I mean, it all works for me. I have a cloud presence now where I didn't before. It's not a gigantic cloud presence, but it's something and it's...
you know, I move more workloads up there a bit and I have my dev up there and backups up there. I think they're both good. You're right. Microsoft is probably trying to create that ecosystem like Apple. You know, their Azure Site Recovery is excellent. You know, Azure itself is a great... is a great product. Does a lot of great things. Just my issues are strictly from a pricing perspective. I won't denigrate their product, but I will say that they stink when it comes to, you know, giving nonprofit pricing or even having some kind of process. But that seems to be the nature of the world with regard to dealing with these kinds of companies and trying to sort of have an appeal process or some kind of way to talk to somebody and getting some answers. It just doesn't exist.
Yeah, I see that as well. That's a really good point. We're coming up on time here and Todd, what we really like to do before we conclude is, as an IT leader, if you could display a message on every billboard in the world for other folks in IT, a simple message that you find helpful, what would you tell the world of IT?
What is being missed today? What do you think is a message that would bring it back to those that are leading it today?
Be a better listener.
Be a better listener?
Yeah.
I don't think I can complain about that response.
It's easy to do.
It's hard to listen and then do.
But if you take a breath and stop running 50 miles, you know, 500 miles an hour, actually listen to what your people are telling you. Because trust me, I do it all the time. My brain is always running. And my guys will stop me and say, "You know, what about this, what about this?" Then I'll stop myself and I'll listen. That happened yesterday.
I was talking about something and just talking to my network guy, and my, my senior IT guy and I was saying, "Well, you know, what do you guys think about where I'm going here?" And they're like, "Well, you know, I think that you could do this or that." I'm not gonna get into specifics, but my network guy said, "Well, no, I'd rather do this than that." And so I thought about it. And I said,"Okay, we'll do it that way." But a lot of IT people are very stuck in their ways and want to do it their way. Or, you know, they're into that mode, which I hate, which is we've always done it this way. I can't stand that phrase. People are afraid to do it a different way. You got to be willing to adapt, to pivot.
Because you're not always gonna be right. It's not about being right. It's about, you know, getting it done correctly and not about getting it done correctly your way.
It's about being adaptable.
Yeah, right.
Resilient, you know, things like that. Just listen to your people because sometimes they can
I think that's an excellent note to leave on, is really make a lot of sense. You know, my biggest problem walking into the hospital was a perception of IT. Because I, you know, the thing I heard over and over again, was, "Well, we talked to IT. Their answer is always no." And so I said,"Well, no. It should never be no, it should always be yes. And if it's not yes, let me find out about that." You know, that's sort of how I, I broach the listening. Like, if you don't listen, then what's the point?
You're going to pull through and try to get things done? You might, but would it be the right way to do it? Will align with the business needs? I don't know. I don't think so. It's like it's not my stuff. That's how I look at... you know, this isn't my stuff. And you'll think like you're in IT. Oh, you just... you know, get all the toys, you get... you get to do it your way." And I'm like,"It's not my stuff. It's the hospital stuff, or it's whoever you're working for." It's their stuff. All I am is the caretaker for the stuff. It's not mine where I have... like, I'm just going crazy or, "Hey look what I could do." That's not the way it works. All we are are drivers for, we are a business driving entity. That's it. It's not black magic. It's just IT.
how important IT is to the business. And you're right, it's not your stuff. It's, it's the organization that you work for.
And you know, your job is a lot of times viewed as a gatekeeper.
But it should be viewed as an enabler. And I think if more IT leaders listen, instead of, you know, dictate and speak, then it's easy to bring that reputation to a change. Where can people find you, Todd, if some of our listeners would like to reach out and pick your brain?
I'm on LinkedIn.
LinkedIn, okay.
Well, we'll add your LinkedIn to the shownotes here. Todd, really appreciate your time today.
Thank you very much. I really appreciate you having me. It was really a great conversation.
Yeah. Yeah. I couldn't agree more and look out for the episode, and we'll catch you next time.
Awesome. Thank you.
Thanks for listening.
The IT Matters podcast is produced by Opkalla, an IT advisory firm that helps businesses navigate the vast and complex IT marketplace. Learn more about Opkalla at opkalla.com.