Riviera Health Resort

Efren Olamendiz

Hybrid Security Steward

Efren Olamendiz is the director of IT at Riviera Health Resort, where he leads infrastructure and security initiatives across hybrid environments. With a career spent at the intersection of enterprise IT and healthcare operations, he focuses on building resilient, secure systems that protect patient data while supporting clinical continuity. His work centers on operational resilience and data protection, ensuring that security keeps pace with the rapid modernization healthcare organizations face today—always with an eye toward how technology ultimately shapes the patient experience.

Why This Problem Keeps Me Up at Night

Patient data isn't just a compliance checkbox. It's the foundation of trust between a healthcare organization and the people it serves. As facilities like ours move more systems into the cloud while still relying on equipment and records on-site, the number of places a breach could start keeps growing. Every new connection point is a new door someone could try to open. For a director of IT overseeing multiple facilities, that's not an abstract risk; it's a daily responsibility to patients, families and care teams who trust us to keep their information safe.

Learning to Trust Nothing by Default

Early in our modernization efforts, I realized the old way of thinking: "if you're inside our network, you're safe,” which simply doesn't hold up anymore. Staff work remotely, vendors need access and data moves between our facilities and cloud providers constantly. So, we shifted to a mindset where nothing is automatically trusted, no matter where it's coming from. In practice, that means every person and device has to prove who they are, every time.

“Hybrid cloud adoption in healthcare isn't a trend. It's the new normal.”

Turning Strategy into a Practical, Layered Defense

Zero Trust sounds good in a presentation, but it only works if you back it with the right combination of tools. We built our approach around three layers that reinforce each other. First, we moved to hardware-based security keys for authentication, so a stolen password alone can no longer open the door to our systems; someone would need the physical key in hand. Second, since email remains one of the most common ways attackers try to reach healthcare organizations, we strengthened our email security and data-loss-prevention tools to catch malicious messages and block sensitive data from leaving through the wrong channel. Third, we added continuous endpoint monitoring across every device, on-site or remote, so unusual activity gets flagged and investigated immediately rather than discovered after the fact. None of these tools solve the problem alone; it's the combination, each covering a gap the others don't, that gives us real confidence in our defenses.

Making Sure Data is Protected Everywhere It Lives

Alongside that layered defense, we made sure data itself is protected at every stage—encrypted while stored, encrypted while moving between systems and increasingly protected even while it's actively being used. Think of it like sealing a letter the moment it's written, keeping it sealed in transit and only opening it in a secure room. That consistency, across both our on-site systems and our cloud partners, is what closes the gaps attackers look for.

Knowing What You Have Before You Can Protect It

A lot of security failures don't come from sophisticated hacking; they come from organizations simply not knowing where their sensitive data lives or who has access to it. That's why we invested time in building a clear inventory of our data, classifying it by sensitivity and regularly auditing who can see what. It's not the most exciting work, but it's often the difference between catching a problem early and discovering it only after it's become a headline.

Where This Leaves Us

Hybrid cloud adoption in healthcare isn't a trend. It's the new normal. My advice to other leaders is to stop treating security as a one-time project and start treating it as a daily discipline. Build layered defenses, know what you're protecting and never assume yesterday's safeguards are enough for tomorrow's risks. Most importantly, never lose sight of why any of these matters: behind every system we secure is a patient trusting us to get it right, every single day.