Clinical Informatics for Surgeons, Episode 2: Legal Discovery and Cybersecurity When a Case Goes Wrong

Scott Steele: Hi again, all you BTK fans, and welcome back. So you are in the middle of a miniseries that I've been building we call Clinical Informatics for Surgeons. This is Scott here, and if you have been with us you already know the premise.

Your operation is not just a procedure anymore, it's a data event, video, device logs, the EHR

trail. And increasingly, the outputs of AI tools are all being generated while you work, whether you think about them or not. So today we are extremely excited to have one of our BTK education fellows, who's here with us, as well as Dr.

Teodor Grantcharov, who's our featured guest, a professor of surgery at

Stanford, and a founder of Surgical Safety Technologies and the creator of the OR Black Box platform. Mason, take it away.

Mason Pearce: Thanks, Dr. Steele. I'm Mason Pierce. I'm a general surgery resident and clinical informatics fellow at the University of South Florida.

In episode one, we talked about what informatics is.

Today, we go into the place surgeons actually lose sleep over. A case goes wrong, there's a complication, maybe a lawsuit, and suddenly the question is not just what happened in the room, it is what got recorded, who owns it, what a plaintiff's attorney can pull into discovery, and whether that same pile of

data is a target for people who want to steal it.

Scott Steele: So there is nobody better to have this conversation with. As I said today, our guest has probably thought harder and brought more to life than anybody that ever happened before, specifically at what happens to intraoperative data. So Dr. Teodor Grantcharov is a

professor of surgery, as I said, but he's also a practicing minimally invasive surgeon, the founder of Surgical Safety Technologies and the company behind the OR Black Box.

Teodor, welcome to BTK.

Teodor Grantcharov: Thank you so much, Scott. really nice to see you again, and really nice to meet you, Mason. It's a really pleasure to be here. And I've been a fan of Behind the Knife

for a very long time. I remember a few years ago, I participated in one of the episodes where we had a great discussion about the power of video and power of data to, shape, the future of, surgical education.

I think this topic is extremely important. I need to say it up front, this is exactly where the conversation, we need to have,

and, we need to address some of these concerns that keep many of us up at night, head-on. we spent probably a decade proving that we could capture everything in the operating room, the holistically, the environment around every surgical procedure.

But, there are hard questions here. They're not related to technology, and you just, named them. So who owns the

data? Who can see it? How can we keep it safe? These are not technical questions. This is not about technology. These are questions about trust, and trust is the foundation here. If surgeons and hospitals don't trust how data is collected, governed, protected, and retained, this technology will never

achieve, its purpose and promise.

everything We've built over the past decade has been designed around earning and maintaining that trust. And, it's important, thing to mention now, we started as Surgical Safety Technologies. We started this platform as OR Black Box. A couple weeks ago, we actually rebranded. we call it

now Ambient or Ambient Suite.

And it reflects, the power that I think Ambient AI will have in the coming months and years on our practice. So excited about this conversation with you guys.

Mason Pearce: Absolutely. Well said, and I completely agree. Dr. Grantrof, let's ground some of our

listeners first. So for a surgeon who has never seen your platform, describe what actually gets captured in a fully instrumented OR.

What is the raw material that we are arguing about?

Teodor Grantcharov: Yeah. Sure. so, the Platform, it started, as, uh, the OR Black Box and now part of Ambient is modeled on aviation. And many of us, who

have studied aviation have been fascinated by this transition, this industry, and other high-risk industries like, nuclear, oil, have, have done from, safe to ultra safe.

And many of us probably don't know, or many of the listeners probably don't know that, the, the Black Box in, in a-aviation is not just the orange box that is, opened

when there is a crash or ~a, ~a catastrophic event. Every modern aircraft has a secondary Black Box that captures thousands of parameters.

Even on flights that took off and landed safely, there is always something to improve. There is something to learn. There are so many near misses that, ~uh,~ this industry captures, studies, and continuously uses to improve.

So, we modeled it, behind these, uh, principles and, as we all know, in an aircraft, the Black Box records data and audio, so, they've used it to improve.

And the key here is the cultural aspects of it. This is not used to blame, shame, punish, or discipline individuals. This is used, to continuously improve as an industry

and deliver the best possible experience for, everybody using the industry. So we built the equivalent for surgery. ~So~ in a fully instrumented room, we capture video of the surgical field, video of the room.

we capture audio. We capture device telemetry. We capture data from the electronic health record. We capture procedural video, not only from

laparoscopic and robotic procedures, but also open, in trauma. And now we're expanding beyond the operating room to other high-risk procedural areas.

Once we capture this multi-model dataset- we run a number of AI models on top of it that it can help us identify steps, ~uh,~ stop steps, events,

safety, ~uh, ~relevant moments. We capture thirty-day clinical outcomes that help us for the first time make this link, this correlation between intraoperative process, what we do as a team in the operating room, and what happens to our patient, the outcome.

This is the holy grail of quality improvement,the link between process and outcomes,

because we can improve process, and if we do that, we believe outcomes always follow. So to give you a sense of the scale, the platform has now been trained on more than fifteen million hours of real procedural data from more than sixtyhealthcare institutions, ~uh,~ around the world.

This is the largest procedural dataset in healthcare.

And ~we--~ today, ~uh,~ we study more than five hundred procedural rooms across, ~uh,~ North America and Europe. And as I said before, everything started in the OR, but today it spans our, uh, cath labs, endoscopy suites, labor and delivery, trauma, ~uh,~ soon in intensive care units as well.

So, a lot of work, has been done and so much more that needs to be done.

Scott Steele: 15 million hours. OMG. So I guess, ~so~ when Mason says that the operation is a data event, that's not just a metaphor. There's literally terabytes per case that is sitting somewhere.

Teodor Grantcharov: Yeah, absolutely. So we capture today about 20 gigabytes per OR per hour.

so you can imagine the

amount of data that flows from over 500 ORs at the same time, and we'll probably double by the end of the year. So there is a key point to your listeners. The data exists whether or not it's captured ~in, uh, in--~ through the Black Box platform. The robot logs every instrument exchange, the anesthesia machine logs every vital, the

electronic health record timestamps every, ~uh,~ order.

So the video and audio may or may not, ~uh,~ be captured, but the surrounding records always, almost always is. So the question is not whether surgery generates legal and security footprint. It already does. The question is, ~uh,~ who is being intentional

about it, and how can we use this to the benefit of our colleagues and our patients?

Mason Pearce: Exactly. So let's take that ownership question head on. A complication happens, the patient says, "I want the recording, the device logs, the AI inputs." Who actually owns that record? Is it

the surgeon, the hospital, the patient, or the vendor?

Teodor Grantcharov: ~You see,~ that's a great question, and, ~uh,~ I don't think I can give a easy answer.

I think if you ask ten different, healthcare executives or surgeons or patients they will give you probably different answers. So it's, ~uh,~ generally layered here, ~uh,~ and this is where many

surgeons get surprised. ~Often sur--~ I hear surgeons at meetings say, my OR, my rules, m-my room my data. " and, ~uh,~ the United States the general rule is that the physical medical record, and that includes imaging and recording that become part of the record, is owned by the provider or the institution that created it.

The patient owns ~the ri- ~the right to access the

information and get the copy under HIPAA, but not the physical artifact. ~So the layer, uh,~ n-now we are layering OR video and device data, and there is a lot here. There is a lot of fine prints in contracts. A lot of vendors sees this as their asset. A lot of hospitals see it as their asset.

~Uh,~ but I think it's important to remember that, this

is still a question that, ~uh,~ needs to be addressed and, addressed heads on. Our philosophy has always been that the institution owns the audio visual data. ~Uh,~ it should never be the vendor. I don't think, any vendor can make a case that they should own, ~uh,~ this sensitive data.

Scott Steele: So that should make every surgeon listen and sit up. ~So ~Teo, in your

model, who is the custodian, and what did you deliberately design so that the surgeon is not the last person to find out their case is being reviewed?

Teodor Grantcharov: Yeah. we Made a deliberate philosophical choice. we, wanted to, make It very clear.

One of the first things that I learned, when I studied aviation and nuclear and oil industry is thatif this

process would benefit, ~uh,~ the profession and benefit the patient, the process has to be confidential and non-punitive. ~So~ we see this platform as a quality and safety tool, not a surveillance tool, not a big brother.

And that's why, from even before we launched ~the f-~ the first system in the field we created this principle. We call it

de-identified by design. the first AI algorithm that we launched some years ago was the de-identification algorithm. They blur faces, they cartoonified bodies, and make sure that individuals cannot be recognized.

The audio visual data is deleted ~also~ 30 days within the capture. So, ~uh,~ we extract ~the dig-~ the digital footprint. We

identify learning opportunities. We aggregate them. We use them to benchmark, but we don't need to identify who was the surgeon, who was the nurse, and who was the patient. We wanna know what happened and how can we make sure that it doesn't happen again.

~So, uh,~ this is governed like a peer review and quality improvement program with, the institution as a steward,

not as a weapon pointed at any surgeon. And I think this is very important. ~And~ this framing for us is not just cosmetic. It determines that the legal protections on the data, that this data qualifies for, ~uh,~ and which is exactly the discovery question you wanna get into, that are in place and properly addressed before we even launch this program.

Mason Pearce: And that's the perfect bridge because intent and governance are what decide whether this stuff is shielded or wide open

Scott Steele: So walk us through it. Complication, lawsuit, plaintiff's attorney sends the discovery request. What can they actually get?

Teodor Grantcharov: ~Uh, so~ there are a bunch of things that are almost certainly discoverable ~without,~ with

or without, ~uh,~ this platform.

~So~ the medical record, as we all know, medical record itself, the OR note, the anesthesia record, the device logs, they're all incorporated in the record. They exist there today with or without any layers. There are, business records of care and, they always come in. so the contested territory here is the intraoperative

video and the quality review analytics.

In the US, that is generated as part of a formal peer review or quality improvement process, and this is protected from discovery under the Healthcare Quality Improvement Act. ~And ~there are many state peer review statutes. ~The, ~And this is to benefit the society. The logic is purely

societal. We want clinicians, we want all of us to review the adverse events.

We don't wanna ignore them. We don't wanna deny them or forget them. We want to review them honestly and use this to improve the system. Not focus on individuals, but always with the system in mind. That can only happen if, that review process cannot be,

weaponized or cannot be turned around and against, ~uh, uh,~ us and our colleagues and our institutions

Mason Pearce: Right, and that distinction matters because the privilege protects the process, not the underlying facts

Teodor Grantcharov: Yeah. ~Uh, it, uh, it, uh, it--~ this is correct, and this is one of the nuances, ~uh,~ people miss.

Peer review privilege protects the review, not the underlying facts. So if a recording exists but, ~uh,~ is never actually put into a peer review process, a plaintiff attorney can argue, ~uh,~ that that's just raw evidence, not privileged material, and some courts may agree to that.

the Privilege also varies enormously

state to state, and it generally does not shield the original clinical facts, and what happened to a patient. ~So~ the same, ~uh,~ video can be protected in one program and exposed in another, depending entirely on how the program is structured and whether the data was genuinely used for quality improvement.

there Is no universal answer here. As you can see,

discoverability depends on the jurisdiction and even more how the hospital has structured its quality improvement program. This is very important thing to, ~um,~ pay attention to because, hospital governance is extremely valuable.

And it's, ~uh,~ ultimately a legal question, not a technological question. What I can offer is pattern

recognition. across More than sixty institution that have adopted, ~uh,~ our technology, we have seen what a well-governed quality improvement program supported by ambient artificial intelligence looks like.

~And~ we work, ~uh,~ with hospitals, and we help hospitals structure their programs accordingly. ~And~

I think this is, ~uh,~ often something that many institution under prioritize. They focus on technology. They focus on some of the technical facts of the implementation, not necessarily on the governance facts.

~And~ I think this is something that's is worth talking about.

Scott Steele: So to kind of break that down a little bit, the honest answer to a nervous surgeon is

it really depends on the governance that you probably did not set up yourself, and it's institutional dependent.

Teodor Grantcharov: Yes, that's absolutely right. ~Uh,~ and I'll add to the AI piece, ~uh,~ because your series is, about, informatics.

~uh,~ if an algorithm flags something intraoperatively or a predictive model produced a risk score,

these inputs and outputs can also become, ~uh, dis- uh,~ discoverable. A plaintiff can ask, the model warned you, what did you do to respond to that? Or conversely, ~yeah,~ why, ~uh,~ did you rely on a model that was not validated for this patient?

~So~ the AI does not just help you in the room, it creates new, ~uh,~ layer that, ~uh,~ did not exist a few years ago.

the Documentation around why you did and why you did not follow, it starts to matter, and ~it, ~it adds another layer of complexity that we as clinicians and entrepreneurs and, ~uh,~ people interested ~in, ~in this field will have to address at some point.

Mason Pearce: Absolutely. And Dr. Georgoff, that evidentiary layer that you're talking about,

that's the fear that surgeons have. ~So ~we really fear that that recording of the OR is just handing the plaintiff a highlight reel, but the actual experience with recordings has been more surprising than that. What does the evidence actually show about those who these recordings tend to help?

Teodor Grantcharov: ~So~ this is quite, uh, counterintuitive. ~Uh, ~actually, the fear is

that video is a liability. But in practice an objective record what actually happened has more often protected surgeons, uh, than expose them. None of us wakes up in the morning with a thought, "I'm gonna harm some patients today." ~Uh, ~all of us go to work with the intention to make, ~uh, ~our workspace, which for

us is the operating room, the safest, the most collaborative and most fun, and do the best possible job we can do for our patients.

And usually, an objective record will document that. ~Uh, ~there are a number of malpractice claims where the surgeon was able to use the video of the procedure, ~uh, and~ to demonstrate, ~uh, ~that the standard of care was met

despite a complication. this Is not a result of negligence, this is a result of the business we're in.

~It's a...~ Surgery is a high-risk business, and despite our best efforts, inevitably, there will be complications. and There are studies around that protective for surgeons. Memory is fallible, and juries run

often on narrative and, ~uh, ~a timestamp record that replaces she said," with "actually occurred," I believe protects us more than it harms us.

~So when, ~when care is appropriate, ~uh, ~that's the surgeon's best friend. The ob-objective data, the video is surgeon's best friends. The re-recordings that worry me are the ones with no governance,

no de-identification, no clear purpose, because these are the ones that sit in a legal gray zone. ~So~ recording isn't, ~uh,~ the real risk.

~I think~ unstructured recording is, and we see a lot of that. ~You--~ I can guarantee if you walk on the hallways or in the offices of, ~uh, ~your institution, you'll see USB keys and external hard drives with, videos,

unstructured video capture. ~Uh, that, ~that is a massive liability. ~So~ capturing data without a defined purpose, without a governance model, without retention strategy is a risk, and we need to address that.

This is, the case in current practice, And we've been constantly working with many hospitals and many clinicians to mitigate the risks. And

we've done this in more than sixty institutions ac-across the nation, and we feel that we've made a tremendous progress of turning video into an asset, not liability.

Scott Steele: Yeah, ~I, ~I would just say that obviously as a practicing surgeon myself, you know, we understand that complications can happen intraoperatively,

but you have to do the right thing for your patients ~and, ~and ~you know, not, it- it's~ the takeaway here is not don't record, it's don't record carelessly. So Mason, ~let's, ~let's move on a little bit.

Let's widen the lens, if you will.

Mason Pearce: Absolutely. ~So~ everything we just described, the video, the logs, the EHR trail, is also an asset

somebody wants to steal. Healthcare is one of the most heavily targeted sectors, and by one hard measure, it is the worst hit of all. It has the highest average breach cost of any industry for well over a decade, and the scale of a single event is hard to overstate.

Dr. Steele, the number that reframed this for me was Change Healthcare.

Scott Steele:

Lay it out for us.

Mason Pearce: In February 2024, Change Healthcare, which is a UnitedHealth subsidiary that processes something like one in three patient records in the country, was hit by a ransomware attack. The final count reported to the HHS Office of Civil Rights was roughly 192.7 million

individuals affected.

That is one of the largest healthcare data breaches in US history, more than half of everyone in the country. It also froze pharmacy and insurance processing nationwide, so it was not just a privacy event, it was an operational one

Scott Steele: That's unbelievably scary. And just remember, that's just one

breach.

So Tio, you're the person now that's putting cameras and microphones in operating rooms. When you tell a hospital that, the first question has to be, you just created the richest target in the building. How do you answer that question?

Teodor Grantcharov: Yeah, you're right. ~Uh, ~this is the first question, and it actually should be.

In healthcare,

cybersecurity is a patient safety requirement, ~uh, ~so we treat it as a design constraint from day one. And, ~uh, ~we have four layers, ~uh, ~that, can explain our approach. And first is we always intend to minimize what we collect and retain. Different products have different purposes,

and when the raw audiovisual data does not need to persist, we delete it quickly.

With our efficiency module, we call it room state, for example, room images exist for only a few seconds while the AI model performs its analysis and anonymization, and then the raw images are permanently deleted. You cannot lose what you

don't keep. Second, ~uh, ~we de-identify as early as possible.

This is an important principle. And depending on the data stream, ~uh,~ that can include anonymizing people in the room imagery, detecting and excluding out-of-body portions of surgical video, blurring faces where relevant, and removing identifying information before that is used more

broadly. So we treat HIPAA as a minimum requirement.

We also support institutions in Europe where information remains personal data under GDPR, and only truly anonymized information falls outside that scope. Third, ~uh, ~we encrypt the data in transit and, ~uh, ~at rest, and tightly control who

can access through, ~uh, ~least privilege and mandatory multi-factor authentication.

And fourth, ~uh, ~we independently test whether these controls actually work. We undergo recurring SOC 2 Type 2 audits and independent penetration testing. you Need outside experts actively testing your controls and trying to find

weaknesses before the attacker does. That, overarching philosophy is simple: collect only what creates clinical value, make it identifiable for the shortest possible time, give access to fewest possible people, and retain it only as long as the purpose requires it.

I think these are important principles that have governed our approach and

our philosophy from day one, and, ~uh, ~that's why to date we have not experienced anychallenges.

Mason Pearce: Awesome. That's a great overview. And that data minimization point is underrated. The AMA has been making a version of it at the level of the whole practice, that cybersecurity is not an IT problem ~off to the side.~

It's a patient safety issue.

When a healthcare system gets ransomwared, clinicians lose access to medication lists, diagnoses, and lab results, and care stops. patients Get diverted, procedures get delayed, so the security of this data is downstream patient safety, not just compliance

Teodor Grantcharov: Yeah, absolutely, and this is the right frame.

~Uh,~ cybersecurity

is not separate from patient safety. It's part of clinical reliability. If ransomware, as you said, if ransomware takes down the electronic health record on the morning of a full operative schedule, patients are delayed, diverted, or treated without the systems clinicians normally rely on.

~Uh, ~this is not just

an IT or a compliance problem. It's a clinical harm. The fundamentals are simple, but ~I think, uh, ~non-negotiable. Regular training, penetration testing, least privilege access, tested backups, independent audits such as SOC 2 Type 2, and multi-factor authentication for every human account.

Many

major breaches begin with a failure to execute one of those basics. Change Healthcare that you, ~uh, ~highlighted here is a clear example. Attackers entered through compromised credentials on a system without, ~uh, ~multi-factor authentication. We, ~uh, ~at Ambient have had zero ~secure-late uh, ~security-related safety events in the company's history of over 10

years, and we're very proud of that.

This is a very important part of what we do together with all the other initiatives that, ~uh, ~we lead. ~Uh, ~but as you know, ~uh, ~just like in, ~uh, ~patient safety, you can never declare victory in cybersecurity. You have to earn that every single day.

Mason Pearce: Absolutely. It's definitely something you

have to keep working at.

~Um, ~and it's very admirable what you've done with your company. ~Um, ~as you mentioned, the regulators are watching the hygiene, not just the headline breaches. ~So~ the HIPAA Journal's 2025 report is a good barometer of what our enforcement data looks like. ~So~ there are large healthcare breaches, which are breaches that affect anywhere

from 500 or more individuals, and these are running around 700 to 750 a year, which is roughly two big breaches per day.

And when the Office for Civil Rights issue penalties, the single most common reason in about three-quarters of the enforcement actions was failure to do a basic security

risk analysis. ~So~ regulators are not only punishing the breach, they are punishing the practice that never did the fundamental homework.

Scott Steele: Mm-hmm.

Mason Pearce: So, Dr. Grantcharov, let's make this usable. Most of our listeners are residents and practicing surgeons, not compliance officers. If informatics is now generating a legal and

security footprint around every case, what should they actually do about it?

Teodor Grantcharov: ~Uh, ~that's a great point. And, ~uh, ~I think there are a few concrete things here.

First you have to know where intraoperative data lives and who the custodian is. ~I think, uh, ~it is important to read the section of contracts, and hospitals and clinicians

are becoming more savvy in understanding, ~uh, ~the fine print there. ~So you-- so~ they have to read, ~uh, ~that section of the contract or the platform agreement that covers data ownership and access.

If you don't know whether your OR video is owned by you, the hospital, or the vendor, that's the first gap to

close. ~Important question.~ The second is, ~uh, uh,~ we have to insist that any recording ~on a--~ or analytics program is run as a governed quality and peer review process, not unstructured data capture, which we see so often in clinical practice.

It's important to study what is the de-identification process and what is the

purpose of capturing this data. This is not data for data's sake. This is not technology for technology's sake. The purpose has always been to improve education, to improve quality and safety, to im-improve operational efficiency.

And I think this is what earns the legal protection and what protects

us and our patients. Third, we need to engage with, ~uh, ~cybersecurity as a clinical issue. Uh, we have to ask ~how, uh, uh, and ~whether our departments and hospitals have done a security risk analysis, which is a

critical part of, ~uh,~ vetting any new vendor. ~Uh, ~because this is, ~uh, uh,~ the exact thing a regulator cite. You do not need

to become an engineer. You need to be the surgeon in the room who asks the question ~and get the satisfactory answer.~ I think this is something, ~uh, ~that, ~uh, ~we need to understand better and get more formal education and, ~uh, ~explanation around.

Mason Pearce: Absolutely. Couldn't agree more. ~And~ I do wanna circle back to the cultural piece. ~So~ for years, the

instinct with anything recorded in the OR was fear, hide it, don't capture it. What I'm hearing from you is that the mature move is the opposite. Capture it deliberately, govern it well, and it becomes both a safety engine and, when a case goes wrong, often your best defense

Teodor Grantcharov: Yes.

~Uh, I think that's, uh, ~I completely

agree, and that's our whole thesis here. Aviation, nuclear, oil industry did not get safer by hiding, ~uh, ~the data capture platform or the aviation black box. It got safer by protecting it, by learning from it, and, ~um, ~being very disciplined and intentional about how data is captured and

used.

~And~ surgery is at the same~ uh, ~point right now. Surgeons who thrive, ~uh, ~and continuously improve will be the one who stop treating their operative data as a threat to be minimized and, ~uh, ~start ~thinking it or thinking about it and~ treating it as an asset to be governed and heavily incorporated in our improvement workflows.

~And ~this is where the opportunity gets bigger

than the retrospective re-record. For the first time, teams can generate insight before a procedure begins, understand care as it's delivered, and continuously learn, ~uh, ~after, ~uh, ~it, it is, ~uh, ~complete. ~So~ this shift from reactive to proactive, identifying the conditions that precede harm and addressing them before they become patient ~farm-- uh, ~

harm is critical.

A platform like, ~uh, ~Ambien does not just record what happened. It helps teams improve~ and, uh, ~and predict, anticipate what happens next. ~It-- The next-- ~It helps us deliver much more precise postoperative care, and I think everybody will benefit. We will benefit as a profession, and I

think our patients will benefit.

~And, uh, ~as we've shown in multiple papers, ~uh, ~over a hundred, ~uh, ~peer-reviewed publications done using our platform, ~uh, ~if we understand intraoperative process and we improve intraoperative process, outcomes will follow. And I think there is a lot we can and we should do as surgeons and healthcare leaders

to continuously improve~ uh, ~clinical outcomes for our patients.

Mason Pearce: That's great. Awesome. And it sounds like we could really revamp our morbidity and mortality case conferences with this as well, ~um, ~given that those conferences are primarily used for quality improvement in ~our~ patient safety. So Dr. Grantcharov, give us your take-home points

for the surgeon driving home from a tough case.

Teodor Grantcharov: Yeah, that's... ~I, ~I've done this so many times in my career. ~Uh, ~I remember ~in my, one of the,~ in the early days, ~uh, ~of my career driving home after a tough case or driving home after a complication and, ~uh, ~always thinking, ~uh, ~I'll just go home, have a beer ~and ~and forget about it and hope tomorrow will be a different day.

So ~I think there is a lot, uh, ~a lot has changed

since then. And, ~uh, ~I think there are a couple of important points to make here based on ~Ben, uh, ~our conversation. ~I think, uh, ~number one it's, ~uh, ~important to remember that the operation is already a record, and we have to be intentional about it rather than be, ~uh, ~surprised about it.

I think two, ~uh, and maybe that will be a surprise for too many, uh, listener, uh, ~governance is

important, and governance actually is everything here in this process. Whether your data protects you or exposes you in litigation depends on how the program is structured, not on whether the camera was on or off and three, ~uh, ~also very important, ~uh, ~theme that, ~uh, ~we don't think

enough as, ~uh, ~clinicians is that security is patient safety.

The data that makes surgery safer is only an asset if you keep it safe, and, ~uh, ~data you never stored is data no one can steal.

Mason Pearce: Beautifully put. Thank you, Dr. Georgoff, for your time, and for genuinely reshaping

how surgeons should think about their own data. To our listeners, ~next episode, we close the series by looking forward at predictive analytics and risk scoring, and what it means to let a model help you decide.~

~Until then,~ from all of us at Behind the Knife, dominate the day.

​