MultiCare Health System
MultiCare Health System is a nonprofit, locally governed healthcare network operating across Washington, Idaho, and Oregon. Founded in 1882, it runs more than 300 care locations - hospitals, primary and urgent care facilities, pediatric and specialty clinics - supporting over 20,000 team members. That surface area matters: every connected medical device, EHR system, and patient portal across that footprint represents a target, and the threat model for a health system this size is relentless - ransomware crews actively hunt healthcare organizations, PHI exfiltration carries regulatory and human cost, and operational downtime can directly affect patient outcomes. Security teams here aren't defending a startup's cloud-native stack; they're working across a sprawling hybrid environment where legacy clinical systems coexist with modern infrastructure. The domains span network segmentation across hundreds of facilities, identity and access management for tens of thousands of users, endpoint protection on devices that often can't be easily patched, and compliance regimes including HIPAA and state-level privacy laws. Incident response in this context means coordinating with clinical operations, not just IT - getting the right people on a call when a segment goes dark during a shift change. The organization's core values emphasize stewardship and integrity, which in practice means security is positioned as a patient-safety function rather than a back-office cost center. MultiCare's mission-driven structure - no shareholders, locally accountable governance - shapes how security investments are prioritized: risk reduction tied to care continuity, not quarterly earnings. For anyone building or defending healthcare infrastructure at scale, this is a shop where the stakes are legible and the work directly connects to people walking through the door needing help.
MultiCare Health System is a nonprofit, locally governed healthcare network operating across Washington, Idaho, and Oregon. Founded in 1882, it runs more than 300 care locations - hospitals, primary and urgent care facilities, pediatric and specialty clinics - supporting over 20,000 team members. That surface area matters: every connected medical device, EHR system, and patient portal across that footprint represents a target, and the threat model for a health system this size is relentless - ransomware crews actively hunt healthcare organizations, PHI exfiltration carries regulatory and human cost, and operational downtime can directly affect patient outcomes.
Security teams here aren't defending a startup's cloud-native stack; they're working across a sprawling hybrid environment where legacy clinical systems coexist with modern infrastructure. The domains span network segmentation across hundreds of facilities, identity and access management for tens of thousands of users, endpoint protection on devices that often can't be easily patched, and compliance regimes including HIPAA and state-level privacy laws. Incident response in this context means coordinating with clinical operations, not just IT - getting the right people on a call when a segment goes dark during a shift change.
The organization's core values emphasize stewardship and integrity, which in practice means security is positioned as a patient-safety function rather than a back-office cost center. MultiCare's mission-driven structure - no shareholders, locally accountable governance - shapes how security investments are prioritized: risk reduction tied to care continuity, not quarterly earnings. For anyone building or defending healthcare infrastructure at scale, this is a shop where the stakes are legible and the work directly connects to people walking through the door needing help.