A conversation with healthcare IT and cybersecurity researcher Ambika Baniya Bhandari on patient-data protection, identity governance, cloud security, electronic health records, and building more secure and resilient healthcare information systems.
- Please introduce yourself and describe the area you work in.
My name is Ambika Baniya Bhandari. My academic and professional journey combines expertise in public health and information technology, with a particular focus on leveraging technology to improve the security, efficiency, and reliability of healthcare systems.
I earned a Bachelor’s degree in Public Health from Pokhara University and subsequently completed a Master of Science in Information Technology Management from Webster University in the United States. Through my education and professional experiences, I have developed a multidisciplinary understanding of healthcare operations, public health research, information systems, and technology-driven solutions.
My professional background includes working with health records, public health research data, and information management processes, which provided valuable insight into the importance of data quality, privacy, security, and effective healthcare delivery. Currently, I serve as a Software Developer/Programmer Analyst, where I contribute to software development initiatives, technology project coordination, systems analysis, and information systems management. In this role, I collaborate with stakeholders, support technology projects, and help organizations utilize technology solutions to achieve operational and business objectives.
My long-term professional interests focus on advancing secure digital infrastructure, identity and access management, cloud technologies, and healthcare information systems. I am particularly interested in exploring how these technologies can strengthen healthcare organizations, protect sensitive health information, improve regulatory compliance, and support better public health outcomes. Through my work and research, I seek to contribute to the development of secure, resilient, and efficient healthcare information environments that enhance both patient care and data protection.
- You started in public health before moving more deeply into information technology. What prompted that transition?
I see it less as leaving public health and more as expanding the tools I can use to address public health challenges.
My public health training taught me that effective healthcare and public health decision-making depend on reliable information. Healthcare providers need accurate patient records, public health agencies rely on trustworthy data to monitor populations, and researchers depend on high-quality datasets to generate evidence-based insights.
As a Medical Record Officer, I experienced the information side of healthcare firsthand. I worked with medical records, ICD-10 coding, insurance-related data validation, reporting, and data quality processes. That experience reinforced the idea that health information creates value only when it is accurate, accessible to authorized users, and properly protected.
Information technology therefore became a natural extension of my public health interests. I wanted to understand not only how health information is used, but also the systems, databases, networks, access controls, and security frameworks that enable healthcare organizations to manage information securely and efficiently.
Pursuing a Master’s degree in IT Management allowed me to develop expertise in information systems, cybersecurity, networking, project management, and technology governance. Today, my interests lie at the intersection of public health, healthcare information management, and cybersecurity, where I can contribute to improving the quality, security, and accessibility of health information systems.
- How did working with medical records influence the way you think about healthcare cybersecurity?
It made cybersecurity tangible.
When people hear “cybersecurity,” they may picture hackers, firewalls, passwords, or technical teams working behind computers. When you work with health records, you see the person behind the data.
A medical record can contain diagnoses, treatment histories, medications, insurance information, and other highly sensitive information. Accuracy also matters. Protecting a record means more than preventing unauthorized disclosure. It means preserving its confidentiality, integrity, and availability.
That experience is one reason I approach healthcare cybersecurity from both a technical and a health-information perspective. The objective is not simply to secure a computer system. Ultimately, it is to support trustworthy information and continuity of healthcare.
- Why do you consider healthcare cybersecurity a public health issue and not simply an IT problem?
Because healthcare increasingly depends on digital infrastructure.
Electronic health records, laboratory systems, pharmacy systems, medical devices, scheduling platforms, insurance systems, public health databases, and communication technologies are interconnected with healthcare delivery.
If those systems become unavailable or their information becomes unreliable, the effects can extend beyond an IT department. Healthcare workers may struggle to access the information they need, organizations may experience operational disruption, and sensitive patient information may be exposed.
My public health background helps me view cybersecurity through that broader lens. Protecting healthcare infrastructure also means protecting the systems communities rely on for care.
- One of your recent publications examines the divide between public health and cloud security. What is that divide?
The divide is partly a workforce and knowledge problem.
Public health professionals traditionally develop expertise in epidemiology, health systems, population health, program management, and health data. Cybersecurity and cloud professionals develop a different technical vocabulary around identity management, network security, infrastructure, access control, logging, threat detection, and cloud architecture.
Modern healthcare increasingly requires those worlds to communicate.
As healthcare organizations adopt cloud services and interconnected digital platforms, we need people who understand what health information means and why it is sensitive, but who can also understand the technical controls needed to protect it.
My own career has developed at that intersection. My public health background helps me understand the purpose and sensitivity of health information, while my IT work lets me examine the infrastructure and security mechanisms around it.
- Your research discusses modernization of the HIPAA Security Rule. Why does healthcare security need to evolve?
Technology has changed significantly.
Healthcare organizations increasingly work with cloud platforms, remote access, interconnected applications, third-party services, mobile technologies, and more complex digital environments. At the same time, cyber threats keep evolving.
Compliance cannot therefore become a checklist that an organization completes once and considers finished. Security needs to reflect the environment in which healthcare organizations actually operate.
My interest is in how healthcare organizations can translate regulatory expectations into practical security measures—strong identity governance, appropriate access controls, effective monitoring, resilient infrastructure, and data-governance processes that work in everyday operations.
- Identity and access management is central to your work. Why is identity so important in healthcare cybersecurity?
Because one of the fundamental questions in cybersecurity is very simple: Who should be able to access what?
Healthcare environments make that question complicated. Physicians, nurses, administrative staff, researchers, contractors, vendors, students, and other professionals may require different levels of access to different systems.
Broad access is dangerous, but overly restrictive access can interfere with legitimate work.
That is why I am interested in identity governance and least-privilege principles. Access should match a person’s responsibilities, be reviewed when those responsibilities change, and be removed when it is no longer needed.
Identity governance turns access management from a one-time administrative action into an ongoing security process.
- For readers who may not be technical, what exactly is “identity governance”?
I would describe it as managing the lifecycle of digital access.
Imagine a hospital employee joining an organization. That person receives access to certain systems based on their job. Later, they change departments, receive different responsibilities, or eventually leave the organization.
Identity governance asks whether their access changes with them.
Who approved the access? Why does the person need it? Is the access still appropriate six months later? Did old privileges remain after the employee changed roles? Was access removed promptly when the person left?
Those questions sound administrative, but collectively they are an important part of cybersecurity. Strong security is not only about keeping outsiders out. It is also about ensuring legitimate users have the right level of access for the right period.
- You currently work as a Software Developer. How has hands-on operational work influenced your research?
It keeps my research connected to implementation.
Software systems operate in complex environments where applications, databases, users, cloud services, and business processes are tightly interconnected. A change intended to improve security can introduce performance issues, usability challenges, or unintended system disruptions if it is not designed and implemented carefully.
Working as a Software Developer has taught me to approach problems from both a technical and operational perspective. When developing or modifying software systems, I routinely consider questions such as: What problems are we solving? How will this change affect users and existing workflows? What security risks could be introduced? How will the solution be tested and validated? How will it be maintained and documented over time?
This practical experience has significantly influenced my research in healthcare IT and cybersecurity. It has shown me that effective security solutions must be technically sound, scalable, and compatible with real-world operational requirements.
- Cloud computing is increasingly important in healthcare. Is moving healthcare information to the cloud inherently more secure?
I would not describe cloud computing as automatically secure or insecure. Security depends heavily on architecture, configuration, governance, and operational discipline.
Cloud platforms can provide organizations with powerful capabilities for scalability, logging, monitoring, resilience, identity management, and infrastructure management. But those capabilities still need to be configured and governed correctly.
For healthcare organizations, migration should therefore be more than moving an application from one location to another. Organizations need to think carefully about identity, permissions, logging, network architecture, data protection, availability, and incident response.
Cloud modernization creates opportunities, but security has to be designed into migration rather than added afterward.
- Zero Trust is another one of your research interests. What does it mean?
At a high level, Zero Trust challenges the assumption that a user or device should automatically be trusted simply because it is already inside an organization’s network.
Instead, access decisions should consider identity, authorization, context, and the requested resource.
That concept is especially relevant to modern healthcare environments because the traditional network boundary has become much less clear. Healthcare organizations may have remote employees, cloud applications, vendors, contractors, multiple facilities, and many interconnected systems.
Zero Trust is therefore not simply a product that an organization purchases. I see it as an architectural and governance approach that encourages continuous verification and more deliberate access control.
- Another of your publications examines quality-control frameworks for electronic health record data. Why is data quality important to cybersecurity?
Cybersecurity is often discussed primarily in terms of confidentiality, preventing unauthorized people from seeing information. But integrity and availability are also fundamental.
Healthcare professionals need information they can trust.
If information is incomplete, inconsistent, duplicated, entered incorrectly, or unavailable when needed, it creates a different type of information risk. This is why my interest in healthcare and cybersecurity overlaps with data governance and quality control.
My earlier work with medical records and public health research data showed me that security and quality should not be treated as completely separate disciplines. A trustworthy health-information system should protect information while also maintaining its accuracy, consistency, and usability.
- What challenges do resource-constrained healthcare organizations face when trying to improve cybersecurity and data quality?
Resources matter. Smaller organizations may have limited budgets, fewer specialized personnel, legacy technology, or competing operational priorities.
But strengthening security doesn’t always start with buying the most expensive technology.
Organizations can make meaningful improvements by understanding what systems and information they have, controlling access appropriately, reviewing privileges, maintaining good documentation, strengthening authentication, improving backup and recovery processes, monitoring key systems, training employees, and establishing clear incident-response procedures.
Technology matters, but governance and operational discipline matter as well.
- You have also contributed to research involving local large language models and natural-language-to-SQL querying. What interested you about that area?
I am interested in how emerging technologies can make complex information systems more accessible while still preserving security and governance.
Natural-language-to-SQL technology is interesting because it could let users interact with structured databases using ordinary language rather than manually constructing every query.
But convenience creates important questions. Who is permitted to ask the question? What underlying information can the system access? Could sensitive information be exposed? How accurate is the generated query? How do we validate the result?
Those governance questions become even more important if similar technologies are used around sensitive healthcare information.
- Are healthcare organizations adopting artificial intelligence faster than governance and security can keep pace?
AI is developing very rapidly, so organizations need to be deliberate.
Healthcare has enormous potential to benefit from AI and advanced data technologies, but healthcare information is unusually sensitive, and errors can have significant consequences.
Before integrating AI into sensitive information environments, organizations should understand what information the system receives, where it goes, who can access it, how outputs are validated, and what controls govern its use.
Innovation and security should not be treated as opposing goals. Good governance is what allows innovation to be adopted responsibly.
- How does your public health background change the way you approach technical cybersecurity problems?
It makes me start with the system’s human purpose.
A cybersecurity professional may understandably begin with infrastructure, vulnerabilities, authentication, or network architecture. My public health background also makes me ask: Who depends on this information? What happens if it is unavailable? What population could be affected? What does an error mean in a healthcare context?
Technical controls are essential, but healthcare systems exist to serve people.
That perspective is one reason I value interdisciplinary work. Healthcare cybersecurity needs professionals who can communicate across technical, clinical, administrative, and public health environments.
- You have experience in both resource-constrained health settings and technology-driven environments. What has that taught you?
It has taught me not to assume that one solution fits every environment.
Organizations differ in resources, infrastructure, workforce capacity, regulatory context, and technical maturity. A sophisticated solution that works well in a large organization may not be realistic for a small health facility.
But the underlying principles travel well: protect sensitive information, control access, maintain data quality, document processes, build resilience, and design systems around actual operational needs.
Effective modernization should begin with understanding the environment rather than simply importing technology into it.
- How important is the human workforce in healthcare cybersecurity?
Extremely important.
An organization can invest in sophisticated technology, but people still configure systems, approve access, respond to alerts, handle information, make changes, and make everyday security decisions.
That means workforce development is part of cybersecurity.
Employees need to understand not just that a policy exists but why it matters and what action is expected of them. Technical teams also need enough understanding of healthcare workflows to avoid designing controls that unintentionally interfere with legitimate clinical or operational needs.
Cybersecurity works best when people, processes, and technology reinforce one another.
- How can healthcare organizations balance strong cybersecurity with the need for healthcare workers to access information quickly?
That is one of the challenges of central design.
Security that prevents legitimate work is not sustainable. At the same time, convenience cannot justify uncontrolled access to sensitive information.
The answer is thoughtful access design: role-based permissions, least privilege, appropriate authentication, efficient workflows, and periodic access review.
The objective should be to make the secure way of working also the practical way of working.
That requires cybersecurity teams to understand the workflows of the people they protect, rather than designing security entirely in isolation.
- What are some of the cybersecurity issues that deserve greater attention in healthcare?
Identity and access governance is one. Third-party access is another. Legacy systems, cloud configuration, ransomware resilience, employee awareness, data quality, and the security implications of increasing interoperability also deserve sustained attention.
Complexity connects many of these issues.
Healthcare organizations increasingly depend on interconnected systems operated by different teams and sometimes different organizations. Every connection can provide value, but it also creates a relationship that needs to be understood and governed.
For me, the bigger question is how we modernize healthcare infrastructure without letting complexity make the system more fragile.
- Your proposed professional work emphasizes interoperability. Why is interoperability important?
Healthcare information is most useful when it can appropriately follow the patient and support legitimate healthcare needs.
A patient may interact with different physicians, hospitals, laboratories, pharmacies, insurers, and other organizations. Systems that cannot communicate effectively can create fragmented information.
But interoperability also creates a security challenge. The more systems exchange information, the more important authentication, authorization, standards, governance, and monitoring become.
So I do not see interoperability and security as competing goals. The challenge is to build systems where information can move appropriately while maintaining clear controls over who can access it and why.
- How important is collaboration in addressing healthcare cybersecurity?
It is essential because no single profession has the entire problem.
Cybersecurity professionals understand threats and technical controls. Healthcare professionals understand clinical workflows. Health-information specialists understand records and data standards. Public health professionals understand the implications at the population level. Administrators understand organizational constraints, and policymakers establish regulatory expectations.
If those groups operate separately, important information gets lost between them.
A major part of my professional interest is precisely that intersection, creating stronger communication between healthcare, public health, information management, and cybersecurity.
- What informed your decision to pursue a master’s degree in information technology management?
My earlier healthcare and public health work made me increasingly interested in the systems behind the information.
I already understood why health information mattered. I wanted deeper knowledge of how organizations design, manage, secure, and integrate information systems.
The master’s program allowed me to develop that technology-management perspective through areas such as systems and network design, information security, system architecture, project management, and IT management.
It gave me a bridge between my public health foundation and the technology-focused work I wanted to pursue.
- How demanding is it to work at the intersection of healthcare and cybersecurity?
It requires continuous learning because neither field stands still.
Technology changes, cyber threats evolve, regulations develop, healthcare organizations modernize their infrastructure, and new technologies such as artificial intelligence introduce new opportunities and new questions.
The challenge is that you cannot understand only technology. You also need to understand the environment where the technology is being used.
That is demanding, but it is also what makes the field meaningful to me. There is always another problem to understand and another opportunity to make systems more reliable and secure.
- What advice would you give a public health professional who wants to enter healthcare IT or cybersecurity?
I would tell them not to underestimate the value of their public health background.
Healthcare cybersecurity needs people who understand why health information matters, how healthcare systems operate, and how technical failures can affect individuals and populations.
At the same time, they should deliberately build technical skills. Learn networking, operating systems, cloud technologies, databases, identity and access management, and basic security principles. Certifications can help structure that learning, but hands-on experience matters just as much.
Most importantly, learn to communicate between disciplines. Someone who can understand both the healthcare problem and the technical solution can be very valuable.
- Where do you see healthcare cybersecurity going over the next five to ten years?
I expect identity to become even more central.
Healthcare organizations will continue adopting cloud platforms, AI-enabled systems, interconnected applications, remote services, and data-sharing technologies. As the traditional network perimeter becomes less important, understanding identities, devices, permissions, and data flows will become increasingly critical.
I also expect security and interoperability to become more closely connected. We will need systems that exchange information more effectively while maintaining strong governance.
AI will add another layer. The challenge will not simply be whether healthcare can use AI, but whether organizations can use it securely, transparently, and responsibly.
- What research questions would you like to pursue next?
I am particularly interested in practical models for healthcare identity governance and secure cloud adoption.
I would like to examine how healthcare organizations can implement stronger access governance without creating unnecessary administrative or clinical burdens. I am also interested in how Zero Trust principles can be adapted to healthcare environments and how organizations can measure whether security controls improve resilience rather than simply satisfy documentation requirements.
Another important area for me is the intersection of AI, databases, and healthcare information governance. As natural-language interfaces make data easier to access, we need equally strong mechanisms governing what information those systems can retrieve and expose.
- How do you define success in your work?
I define success by whether the work improves the trustworthiness and resilience of the systems people depend on.
A cybersecurity framework is useful only if an organization can implement it. Research is valuable when it helps people understand a problem more clearly or leads to better practice.
In healthcare, success means authorized professionals can get accurate information when they need it, while patients can trust their information is properly protected.
I want my work to connect research with implementation rather than allowing the two to remain separate.
- What would you like healthcare leaders and policymakers to understand about cybersecurity?
Cybersecurity should not be treated solely as an IT expense or something addressed after a problem occurs.
Digital infrastructure is now part of healthcare infrastructure.
If an organization depends on electronic information to deliver care, then protecting the confidentiality, integrity, and availability of that information is part of maintaining the organization’s ability to function.
That means cybersecurity decisions deserve strategic attention alongside other questions of healthcare quality, resilience, and patient safety.
- Looking ahead, what contribution do you hope to make to healthcare information technology in the United States?
I want to contribute to healthcare systems that are secure without being unnecessarily restrictive, interoperable without compromising privacy, and technologically advanced without becoming fragile.
My background has allowed me to see health information from several perspectives: as public health data, as medical records, as information moving through technology systems, and as data that must be protected through appropriate network and access controls.
I want to continue bringing those perspectives together through research and practical work in healthcare cybersecurity, cloud security, identity governance, and health information management.
Ultimately, my goal is to help develop approaches that healthcare organizations can implement, approaches that strengthen security and resilience while supporting the fundamental purpose of healthcare technology: giving the right people trustworthy information when they need it to serve patients and communities.
