A single cyberattack could cost your practice $10 million, or shut it down completely. That’s just one of the threats healthcare providers are facing today, and Long Island plastic surgeon Dr. Mark Epstein is sharing simple ways to protect your practice, from strong passwords and staff training to cloud backups and cyber insurance.
Known for being at the forefront of surgical innovation, Dr. Epstein shares his excitement about new, minimally invasive breast augmentation techniques coming soon to the U.S., offering tiny incisions, fewer complications, and lightning-fast recoveries.
Add in smart software tools like Nextech and a seamless blend of surgical and non-surgical services under one roof, and it’s clear: Dr. Epstein’s approach is all about smarter systems and better results.
Listen
Watch
Guest
Mark Epstein, MD
Epstein Plastic Surgery
Dr. Epstein is a dual board-certified plastic surgeon with over 30 years of experience using the most cutting-edge technology and surgical techniques. Dr. Epstein is the inventor of many surgical instruments and stays on the forefront of surgical technology.
Learn more about Long Island plastic surgeon Dr. Mark Epstein
Follow Dr. Epstein on Instagram @dr.markepstein
Connect with Dr. Epstein on LinkedIn
Request a demo for TouchMD
Learn more about Clarity Performance
Host
Tyler Terry, Director of Sales, MedSpa
Nextech
Transcript
Announcer (00:06):
You are listening to the Aesthetically Speaking podcast presented by Nextech.
Tyler Terry (00:11):
Hey guys. Welcome back to the Aesthetically Speaking podcast presented by Nextech. I'm your host, Tyler Terry, and we are coming to you live from beautiful Austin, Texas at the Aesthetic Meet, which is formerly known as asaps. Today I have a very special guest. His name is Dr. Mark Epstein. Dr. Epstein is a dual board certified plastic surgeon in Long Island, New York. Dr. Epstein, welcome to the podcast.
Dr. Epstein (00:40):
Thank you so much for having me, Tyler.
Tyler Terry (00:42):
Of course, of course. How has the show been so far?
Dr. Epstein (00:44):
Show's awesome. Show's awesome. I love the shows.
Tyler Terry (00:47):
Yeah. Yeah. This is one of the best, I would say, one of the best aesthetic meanings of the year, right?
Dr. Epstein (00:51):
Oh, absolutely.
Tyler Terry (00:53):
Yeah,
Dr. Epstein (00:53):
Absolutely. It's my favorite.
Tyler Terry (00:54):
Yeah, it seems like a lot of your colleagues are here. You get to hang out, catch up with everybody, which is great. So Dr. Epstein, tell us a little bit about yourself.
Dr. Epstein (01:03):
Well, I'm a dual board plastic surgeon. I've been in practice for just over 30 years.
Tyler Terry (01:08):
Wow.
Dr. Epstein (01:09):
We have a big focus on breast and body, but we also do face, we have not only the surgery side, but we have a fully equipped med spa with all the latest technologies and lasers and a wellness center, we can focus on weight control and sexual wellness.
Tyler Terry (01:26):
What are some of the things you're offering in that wellness side, or what are you seeing?
Dr. Epstein (01:29):
On the wellness side, the main things that people are interested in is weight control with the GLP one medications, and the other thing that is really big is sexual wellness. We are offering a hormone replacement and we don't do a turnkey method where you just subscribe to something and send a bunch of pills. We actually do a thorough analysis of your body's hormones and chemistries and then figure out how to put you back to an equivalent ideal state using a combination of testosterone, progesterone, and other medications. We also offer vaginal rejuvenation using radio frequency. We have O shots and P shots and clitoxin, which is a combination of neurotoxin like [neuromodulator injection brand name] and PRP and all these things work very well together to rejuvenate you sexually in terms of your mental state, your hormonal state, and we're going to be incorporating the new medication ADDIE in as well, which acts to adjust the dopamine serotonin balance in your brain and actually stimulates sexual desire as well as improving orgasm. Who doesn't want that?
Tyler Terry (02:45):
Yeah, no, that's amazing. Who doesn't want that? It sounds like you offer a vast array of services. You're tailoring the service to the patient because you're actually understanding what they need in terms of their chemistry and all the different things. What is that intake form like if a patient was to first come to your practice, what is that experience like?
Dr. Epstein (03:06):
Well, when the patient calls, if they're interested in the wellness component, then they come to the practice, they meet with my PA, Janet, who is absolutely amazing. She's also a phenomenal injector as well, and Janet will then direct an interview and find out exactly what their questions are, what their desires are, where they feel deficient, and what their goals are.
Tyler Terry (03:28):
Okay. Yeah, so it's very much in tune with what the patient needs and what their desires are to your point. So let's talk a little bit about cybersecurity. What are you seeing? Why is it so important to protect your practice and to be mindful of cybersecurity?
Dr. Epstein (03:44):
Well, everyone has data to protect. That goes without saying, but in the aesthetic space, we have very, very sensitive data. We have not only the usual name, social security number, address, that sort of thing, but we also have photographs. Photographs are highly sensitive data, and even though you should be taking your photos where you keep faces off bodies, there's no reason to combine the two.
(04:13):
A threat actor, if they get into your data, they can still figure out which photos go with who, and then take that data and publish it on a website and use it for ransom. So my mission is to educate my colleagues and those in this space about all the special precautions they need to take. Most of the precautions, it's really all about risk management, and if you do simple steps, even steps that don't cost much money, you can substantially lower your risk from being attacked. Some of the worst attacks were done by ignoring some very, very simple concepts in data protection.
Tyler Terry (04:55):
What are some of those essential precautions? If a practice is just starting out, they're listening to this and they're thinking, I don't even do this. Wow, I need to do this every day. What are some basic things they should be doing?
Dr. Epstein (05:07):
Looking at what are the most common causes of why there's a data breach? I can break this down to just a few categories. The first has to do with weak and stolen passwords. How many people out there are putting passwords on little stickies on their computers or under their keyboards? That's just common sense. You should have strong passwords and change them regulate. That doesn't cost any money. The next thing has to do with unpatched applications. If you are an aesthetic practice or a physician, hopefully your computers are being maintained by a managed service provider. The days of the IT guy is long gone. Having one guy who is there when you need to hook up a printer or you have a problem, you can't get into something that's antiquated and that's a setup for disaster. A managed service provider is someone who provides computer support, hopefully you get it 24 7, and they're there for different aspects of your IT infrastructure.
(06:06):
Data security is just one of them, and managed service providers have specialists on board who are data security experts in addition to people who manage setting up the architecture where your data is stored and debugging issues with computers and things like that. So your managed service provider is responsible for making sure that all your software is updated. One of the biggest breaches was the SolarWinds breach, and that breach was a supply chain attack because SolarWinds didn't update a certain piece of security software, the threat actor got into their network and SolarWinds distribute software to all its vendors. So all that software they distributed was now infected and they basically infected all their customers. So it's very important to patch your applications. Had they done that one patch, they would've never had that disaster. The malware itself is very, very cleverly designed to compromise systems. It gets in there and it sits undetected for these days, 200 days, while the threat actor is pulling your data off, looking at it, figuring out your business finances, whether or not you have cyber insurance, how much money you can afford to pay for an attack as a ransom, and they're pulling off your photos and your patient data and all of that.
Tyler Terry (07:23):
Wow.
Dr. Epstein (07:23):
Social engineering is another big way they do attacks. For instance, if they do an attack on the Aesthetic Society, they can go grab the Aesthetic Society database and not do anything further, not scramble their data, not threaten them, not ransom them because all they want is that data. And then what happens once they have the data, they now know all our identities and all our aesthetic society info. So you can get a spear phishing email that will have your name on it, your Aesthetic Society membership. It might have your current balance of your annual dues, and maybe there's a little button click to update and pay your due, and that is where you launch the malware.
(08:07):
So they're using the data taken from one place as a means to create a socially engineered attack on a large group of people. And then less commonly or physical attacks on the network or even insider attacks. Someone can come in to do a repair on your computers disguised as the computer or printer repair guy, and they stick a USB drive into a computer and now they've launched malware or it can be an actual insider, an employee who steals data. So those are the ways that these attacks occur. Now, my recommendations for a practice, the Medi Spa, whatever the business is, is you must have cyber insurance a minimum of a million dollars. The cyber insurance that your regular business insurance gives is simply not enough. Cloud migration I think is very important these days. I think everyone should have their data stored on the cloud. The cloud is not necessarily more secure than if you hosted your own server and put all the necessary software in, but what the cloud migration does is allows you to take that off your list of things you have to personally worry about maintaining and being responsible for. Regular assessment of your security status is very important. You do that with your managed service provider. You do an annual vulnerability assessment you see with recent attacks, and you should be able to be guided by your managed service provider what you might need to button up and make a little bit tighter. And again, as I said before, protecting your passwords, very, very important. Another thing that should be done, it's not always done, but penetration testing, you actually hire a third party, not your managed service provider to try and get into your network. If you have your managed service provider, that's kind of conflict of interest. So it's best that you hire an outside party to try and hack in.
Tyler Terry (10:04):
Yeah, because of course if they were to get into their own network, they don't want to tell you that.
Dr. Epstein (10:08):
And my last recommendation is some form of multifactor authentication. So for instance, when my users go to log onto the windows on their desktops, we use a product called duo and there's a lot of them out there that do this. So something pops up on their phone that's basically is making sure that that is the person who's trying to log in. So if someone has my username and my password, but they don't have my iPhone, they're not going to be able to get into my computer, at least not on the inside or remotely. So that's a very important thing. And I think any company that has web portals with data should have multifactor authentication. That's basically becoming a standard.
Tyler Terry (10:51):
Certainly. With your staff. How are you constantly maintaining training for cybersecurity? Is that something that you do a couple times a year when you have a new employee? I'm sure I could tell just by talking to you, this is of the utmost importance to you.
Dr. Epstein (11:05):
Well, you just beat me to the punch because what you need to do is engender a culture of cybersecurity. Everyone takes ownership in some of the worst attacks. I know it was a low level employee who got an email that turned out to have malware in it and launched the whole attack.
(11:23):
So what we do is we use a service, we use know before, but there are several of them out there. And what they do is they have a wonderful series. Know Before has about 80 videos, they take 30 seconds to watch and all the employees are required to watch the entire set, and we get a dashboard. So we know that they've watched all of them and it instructs you on all the different things that you can do to be cyber secure. And it's amazing. Every week I get emails from my staff and we have about 15 people and they'll forward me suspicious emails. They are constantly picking up, I would say 98% of the time the emails they forward me are actual malicious attacks on our servers. And the other thing that we do is our managed service provider that furnishes the know before will actually do fake attacks on my staff. So they'll get an email which is malicious except it's not really malicious, but it's not a real email. It if they fall for it, they then open up a video that explains, oh, you opened up this video. There's a problem. This is a simulated attack of this type.
(12:38):
And the staff get graded on their performance, and my staff pretty much pick up every one of 'em. They don't fall for any of these fake attacks, which means we are actually successful in engendering a culture of cybersecurity. All it takes is one bad click to destroy your entire business. And I have a colleague who lost one of the most successful aesthetic practices in the country. He had a lot of A list celebrity clients, you name it. And he is uninsurable after his attack, it cost him over a million dollars and a lot of grief and anguish, and it was all because one receptionist opened up an email that she shouldn't have.
Tyler Terry (13:22):
Wow. That is so sad to hear. Thank you for talking about know before. That's actually something that we do at Nextech as well. We use know before and we have to constantly learn and be trained and even have those simulated attacks where congratulations, thank you for reporting it. If you did it right and if you didn't do it right, you have to watch a video and your manager knows. And that's really, really important. This has been very buttoned up in terms of how you're protecting your practice.
Dr. Epstein (13:49):
And it's funny, if you want to get cyber insurance these days for the last couple of years, the carriers will send you a very detailed questionnaire that your IT people, your managed service provider needs to fill out and you have to be able to check all the boxes that you have, all these different features enabled or they're not going to give you insurance. And just to give you an idea of the cost of an attack, my attack in 2021, which resulted in no loss of data and no exfiltration, no one got my data, cost $114,000. I had a $10,000 deductible on my cyber policy, so it cost me 10 and they carry 104,000. The forensic evaluation alone, I believe was about $80,000 and it was another 10 or 15,000 for the IT people to mitigate the attack and reload the machines and restore backups. If you have to pay a ransom, it becomes a lot worse. The average cost of a breach right now in the world is about $5 million according to the IBM Panama Institute report. And in the United States, the average cost of a breach is twice that. Healthcare has been number one, highest cost of breach, 13 years running with a cost of about $10 million.
Tyler Terry (15:17):
Wow. Wow. Just that alone, I mean, that's reason enough to make sure you have all of these necessities in place.
Dr. Epstein (15:25):
So if you don't have insurance and you're in a position where you have to pay a ransom to keep your data, you stand a very good chance of losing your practice or losing a good substantial amount of money.
Tyler Terry (15:39):
Yeah. So let's shift gears a little bit and talk about a mini procedure. Can you tell us what a mini procedure is?
Dr. Epstein (15:49):
I hate the term mini procedure. To me, mini procedures mean mini results, but there are procedures that are micro invasive or mini invasive, less invasive that do produce significant results. I'll give you an example of what I'm thinking. People will come in and say, I want a mini facelift. Well, if you ask plastic surgeons what a mini facelift is or you go in the books, there's no such procedure. You have a certain amount of anatomical issues that you need to correct, and if you do anything less than that, you're going to get a substandard result.
(16:25):
So it's going to be a mini result. Now, if we're talking about a procedure such as breast augmentation, there are different ways to do breast augmentation and you can do it with standard incisions and cutting the muscle or going above the muscle, or there are some new procedures that have come out and will be available in the United States in a matter of months that will allow you to do the procedure with very small incisions, couple centimeters with a super fast recovery, less complications and better longstanding results.
Tyler Terry (17:05):
Really? That's incredible.
Dr. Epstein (17:07):
Stay tuned. There'll be more on that. I'm not permitted at this time to discuss.
Tyler Terry (17:11):
I was gonna say, Dr. Epstein, come on
Dr. Epstein (17:13):
Any more about the procedure, but if you follow me and you follow my Instagram, Dr. Mark Epstein, you will learn about these procedures when they come out. So stay tuned for the summer.
Tyler Terry (17:25):
And those who are listening to that, we'll be sure to include links to follow Dr. Epstein in the show notes. So what types of patients are most drawn to these types of, I don't want to call 'em many, but these types of procedures?
Dr. Epstein (17:39):
Well, I don't look at like patients being drawn to the procedures. Everyone wants less surgery and better results.
Tyler Terry (17:45):
Maximum results, right? Minimum downtime.
Dr. Epstein (17:48):
So everything do I try and do in that regard. Some things still require a bigger surgery, some things don't. But even when you go back 21 years ago when breast augmentation was a super painful procedure and not much has changed currently from back then I started doing a one day recovery breast augmentation, which still involved in incision, but the way the surgery was conducted, the pre-op preparation, the post-op care and just the overall process made it so that I can perform the surgery and have my patients out to dinner and shopping the day of surgery. And I've even had a patient who went to the gym the day of surgery.
Tyler Terry (18:29):
No way.
Dr. Epstein (18:31):
Way.
Tyler Terry (18:32):
That's incredible.
Dr. Epstein (18:33):
So there are ways to enhance recovery and of course no narcotic use goes without saying. So this has been the focus of my practice for over the last 20 years. So I'm always looking for a better way to deliver better results with less complications, less downtime, less pain, less risk.
Tyler Terry (18:53):
How can surgeons balance meeting patients' short-term desires with long-term aesthetic goals?
Dr. Epstein (19:01):
That's an interesting trick because you know the saying you want something good, you want something fast, and you want something cheap. Can have two, but you can't have all three. That's the problem sometimes. So I'll have a patient, I remember I had a very, very petite woman come in with no breast tissue to speak of, and she wanted to go from AA to a D, but she said, make it look natural. And she asked for a 450 cc implant. I said, I assume you just want one across the entire chest. No way I could fit a 450 in each breast. It's impossible. And a situation like that you can't do, or if you try and do it, you may get very good short-term results and then a matter of months later you create a disaster of complications and potentially create uncorrectable deformities.
Tyler Terry (19:58):
With these types of patients, how are you educating them? How are you studying the tone? Is that before they come in? Is that something that your staff does? Is that something that you're doing in that consultation?
Dr. Epstein (20:07):
Great question. Great question. My website has a tremendous amount of information and it's available in three forms on the website, depending how you like to learn. Every three years, I change my website for the last 20 some odd years. If you go on the website, there's written information and it reads like an online encyclopedia, but the advantage to the website is I can change it on the fly. I can add and remove text, add videos, illustrations, and we use all these things. The second place is the video gallery. The video gallery has a couple hundred videos I recorded with the Plastic surgery channel. I record about 20 to 30 videos a year with them.
Tyler Terry (20:46):
That's a lot. I've never heard somebody have that many videos. It's hard for me to get somebody to do 10 videos.
Dr. Epstein (20:51):
Oh, we have over 200. In fact, I recorded about 15 yesterday and I recorded videos for a procedure that I'm not going to be performing until this summer. So where in anticipation of all of that, and the third place is the photo gallery, we have almost 700 before and after cases of different procedures. So you can go on there and hopefully find someone similar to you that you can relate to and see what we can do with the surgery.
Tyler Terry (21:20):
Yeah, I love that you're feeding different mediums of content. I call this the Amazon like experience. You go to Amazon, Amazon's feeding us everything that we need to be more confident and comfortable to drop it into our cart. So on your website, you've got texts if you want to read it, get videos if you want to watch 'em, or you have before and afters if you want to look through them, whatever you want. Or maybe it's all of 'em, but it all there.
Dr. Epstein (21:40):
There's another opportunity that frequently is missed when the patient calls and makes an appointment to see you, there is a duration of time until they see you. The question is what are you doing with that duration of time? So we are using a partnership with Clarity Performance. And what Clarity Performance does is it allows me to leverage all the videos that I've made that are on my website and drip them to patients. What Clarity does right now is they have something called Journeys and Journey is like pick a procedure. You can have a breast aug journey, a lipo journey, a tummy tuck journey. So when the patient calls and makes an appointment, they with permission give their cell phone to my coordinator and my coordinator puts that into the Clarity website, and then they will be dripped videos based on the journey that they pick. The journeys and the videos are all very well done prerecorded videos, they are generic, but my patients say they've been quite good and they're happy with them. So I've taken it to the next level and I've created my own journeys using my own content. So in the next week or two, we're going to be launching all those journeys. So instead of hearing Katie, your host talking about breast aug, it's going to be Dr. Epstein talking about breast aug the way Dr. Epstein performs the surgery and what he feels that you need to know best. So the level of education is stepped up several fold.
Tyler Terry (23:09):
Wow, I've never heard of that before. Typically maybe watching one video if you're lucky to get the patient to do that, but the fact that you have journeys that are going to be tailored to the procedure on some type of cadence, I don't know if that's a weekly or every couple days or whatever it is. That's pretty next level. I'm very passionate about patient education and I love that.
Dr. Epstein (23:29):
The patients come in and they say, I feel like I know you. And when they come in for a consultation for say, a breast augmentation, which is a lot of information, it's a lot to know, if they take the time to learn the information before they come in, we take the discussion on a much higher level and the consult time is much better spent.
Tyler Terry (23:47):
You know that they're serious about what they're getting. They have better questions for you, right,
Dr. Epstein (23:50):
Better questions. And they're better empowered to make a decision that's right for them.
Tyler Terry (23:55):
I love that.
Dr. Epstein (23:55):
Because a lot of times there's options in surgery and this gives them a chance to learn more about the options and think about it and come in knowing what they think is best. And then we go through some questions and it's just a much better experience.
Tyler Terry (24:11):
Yeah, I love that you say that. So I've been with TouchMD all my career and then now Nextech, the last few years since the acquisition and TouchMD sales pitch has been, part of it has been, Hey, we're going to help you increase your conversion rates. And people would quiz me on that and say, well, what are you doing that's increasing the conversion rate? And it took me a while to figure out that it's the formula in which we're educating a patient and then a better educated patient has better questions for the surgeon and with better questions for the surgeon, the surgeon's going to be more teed up to get better answers. And he or she's obviously very professional in what they do, but they're going to be able to use that time to your point, that time with you during that consultation is more valued and they're going to be more empowered to make a better decision. And that's where the increased conversion rate happens because they're better educated and had a better consult.
Dr. Epstein (24:58):
Well, I got a great TouchMD story because
Tyler Terry (25:00):
I'd love to hear it
Dr. Epstein (25:01):
About maybe 10 years ago, no, actually more than 10 years ago, I was at the meeting and I met Carrie Smith and Jason Whitesides and looked at TouchMD and I said, wow, this is cool. I should get it. And I got it. But the problem was with every patient you enrolled, I had to manually enroll their name and their demographic info, which takes time during my consult, and it had an ability to mirror the data on an iPad to an Apple screen, but the technology was very poor, so the images weren't good,
(25:32):
It just wasn't working for me, and so I bailed. And I did without it for several years. Then I was back at the meeting and I run into Carrie and Jason again, and the pitching to me TouchMD, oh, I tried it. It didn't work. It wasn't any good for me. Oh, well lemme show you the new version. And I look at it, the ability to mirror using the Apple TV was phenomenal. The images were great. Now the data is integrating with Nextech through an API Active programming interface, which allows the data as soon as a new patient registers into Nextech, they're already in TouchMD, so I don't have to enter any demographic info.
