Daniel Pitis, Managing Director at Stinoctis, delivered a presentation on managing third-party digital security risk. He warned that over 60% of breaches in healthcare and insurance now originate from vendors, often due to weak safeguards, legacy systems or lack of visibility. Examples of security breaches at Change Healthcare and Oracle were cited to demonstrate how even large providers can pose critical risks if oversight is insufficient.

Daniel emphasised that effective vendor risk management requires leadership and multi-departmental ownership and must go beyond surface-level compliance. He proposed a practical strategy.

Key Recommendations:

• Map all vendors and data flows
• Prioritise assessment based on vendor criticality and security posture
• Include breach notification and encryption in contracts
• Apply rigorous oversight to high-risk vendors
• Form a cross-functional task force (legal, procurement, IT)
• Adopt frameworks like ISO 27001 and explore automated risk platforms

Discussion Highlights:

The Q&A session surfaced scepticism about the adequacy of ISO 27001. Participants noted it often reflects an organisation’s risk appetite rather than actual security maturity. Even certified vendors may not meet practical expectations, prompting requests for further evidence. The SOC 2 framework was discussed as an alternative but recognised as similarly limited in scope. Declining trust in large vendors was a shared concern, reinforcing the need for transparency, strong audit trails and risk-based oversight.

Annual audit reviews and proactive governance were strongly recommended.

If you are a member of the network and would like to continue the conversation, check out our iFHP Member’s Connect site.