At the HIMSS 2026 Global Health Conference & Exhibition, one session stood out for its practical, real-world approach to one of healthcare’s most pressing challenges: detecting data breaches as they happen. Featuring Celerium’s Chief Strategy Officer, Vince Crisler, and John Gresham, CIO of Reeves Regional Health, the discussion moved beyond theory to explore how modern breach detection actually works in a healthcare environment.
Vince Crisler, representing Celerium, opened with a critical point: ransomware today is no longer just about encrypting systems—it’s about data exfiltration.
Even organizations with strong backups remain vulnerable because attackers now use stolen data as leverage. As Crisler put it, the real question becomes:
Do you have a way to detect data leaving your network while it’s happening?
This shift has exposed a major gap in many healthcare environments—visibility.
John Gresham, CIO of Reeves Regional Health, brought that reality into focus.
Operating a rural critical access hospital in Texas, Gresham described a familiar situation across healthcare: small teams, limited resources, and expanding threat surfaces.
Despite having tools like firewalls, Gresham highlighted a key issue:
“There was no easy visibility into the traffic on our network… until trouble started.”
In other words, data existed—but actionable insight did not.
One of the most important insights from the session was how blind spots emerge—not from lack of tools, but from lack of usable intelligence.
Healthcare organizations often rely on:
But without clear visibility, teams cannot easily answer:
Crisler emphasized a particularly concerning trend: attackers using legitimate backup services (like cloud storage) to quietly extract data.
A key highlight of the session was how quickly Reeves Regional Health was able to deploy Celerium’s Data Breach Defender®.
According to Gresham:
“At the end of that 30 minutes, we were getting actionable information.”
Within a week, the team had a detailed understanding of all network traffic—something they previously lacked.
One of the biggest improvements wasn’t just visibility—it was signal clarity.
Instead of overwhelming teams with alerts, the platform focused on meaningful anomalies:
Gresham noted:
“If we hear from the dashboard, it’s something we really need to take a look at.”
This reduction in noise is critical for small teams that simply don’t have time to chase false positives.
Gresham shared a real incident where the system proved its value.
When the hospital experienced a surge in network traffic severe enough to impact operations, the immediate concern was:
Using the platform, the team quickly identified the cause—a combination of vendor and Microsoft updates—not malicious activity.
The key takeaway: rapid visibility enabled fast decision-making and avoided unnecessary panic.
Another powerful use case discussed was shadow IT—especially in healthcare environments where:
Gresham candidly noted that unauthorized deployments do happen:
Doctors occasionally deploy systems on guest Wi-Fi without IT approval.
With better traffic visibility, these activities can be identified and controlled before they introduce risk.
When asked to summarize the impact, Gresham didn’t focus on features—he focused on outcomes:
“Ease of mind… to know if anything’s changed or abnormal—it’s just a great ease of mind.”
For small healthcare organizations managing complex ecosystems, that confidence is invaluable.
The session closed with practical advice for healthcare CISOs and CIOs:
This HIMSS session reinforced a simple but powerful idea: modern healthcare security isn’t just about prevention—it’s about visibility and response.
By combining real-world experience from Reeves Regional Health with Celerium’s automated breach-detection approach, the session highlighted a path forward for organizations struggling to keep up with evolving threats.
As Crisler concluded:
If you don’t understand how your data is moving, you may already be at risk.
To hear Vince Crisler and John Gresham’s full insights, watch the video from the HIMSS Cybersecurity Command Center Stage Presentation.
Want to learn how hospitals are using Data Breach Defender® to detect and contain data breaches before they escalate?