Judy Molenaar, known for the majority of her career as Judy Hatchett, holds the title of Vice President and Chief Information Security Officer at Surescripts, the nation’s largest health information network. In that seat, she carries responsibility for the systems that move prescriptions, medication histories, and benefit information between pharmacies, prescribers, and care teams across the country, a network that connected 2.29 million healthcare professionals and organizations and enabled 27.2 billion exchanges of clinical and benefit information in 2024 alone, according to Surescripts’ own reporting.
Healthcare cybersecurity is a strange balancing act. Lock a network down too tightly and a pharmacist cannot pull up a patient’s medication history fast enough to catch a dangerous drug interaction. Leave it too open, and you invite the kind of breach that, as she has pointed out in her own writing, ends with a patient standing at a pharmacy counter being told to come back tomorrow. Her career, spanning retail, manufacturing, and now healthcare, has been built around solving exactly that tension. Today, Surescripts publishes her insights under the byline Judy Molenaar, while her professional history, industry credentials, and public speaking engagements are still widely indexed under Judy Hatchett, a naming bridge that shows up consistently across LinkedIn, industry event listings, and healthcare security publications.
Who Is Judy Hatchett?
Judy Hatchett is a veteran information security executive based in Minneapolis, Minnesota, with more than two decades of cybersecurity expertise, a description used in her own May 2025 CyberRisk Collaborative speaker bio. As CISO at Surescripts, she is responsible for the strategic direction of enterprise data protection, physical security, business continuity, and enterprise risk management across an organization that effectively touches the medication history of virtually every insured American.
Before stepping into her current role, she built her reputation across several highly regulated industries. Her earlier leadership included global governance and identity management work at 3M, enterprise risk oversight at SUPERVALU and Best Buy, and advisory work at Accenture, according to professional profiles compiled by The Org and RocketReach. Immediately before joining Surescripts, she served as VP of Information Security and CISO at Fairview Health Services, a Minnesota health system made up of a dozen hospitals and dozens of specialty clinics, where she managed HIPAA security programs and shared oversight of PCI-DSS compliance, per her IANS Research faculty profile.
Her professional identity spans two names for a simple reason: she has continued her career under a new surname while her earlier body of published work, credentials, and industry recognition remain attached to her original one. Event organizers and professional networks have adapted by referring to her as Judy (Hatchett) Molenaar, a convention used by both JM Search and the CyberRisk Collaborative in their 2025 coverage.
Judy Hatchett’s Role as Chief Information Security Officer at Surescripts
At Surescripts, the CISO role is not confined to firewalls and patch cycles. According to her own author profile on the Surescripts Intelligence in Action platform, she sets the vision, develops plans, and oversees execution of the company’s Enterprise Information and Physical Security, Business Continuity, and Risk Management programs, all in direct support of business goals rather than as a separate compliance exercise bolted onto operations.
That distinction matters more in healthcare than almost anywhere else. A delayed login or an overcautious access control does not just slow down an employee’s workday. It can delay a prescription reaching a pharmacy, or a clinician pulling up a patient’s medication history during an emergency room visit. In a 2023 interview for Surescripts’ Data Privacy Day coverage, she described her team’s approach as leveraging “people, technology, automation and processes to monitor, detect and react,” with a guiding principle she summarized as “see something, say something.” Rather than treating employees as the weakest link in the security chain, she frames them as her strongest asset, capable of spotting anomalies that automated tools miss, a point she made directly in the Surescripts Q&A on network integrity.
Her operational scope covers the full range of what keeps a national health information network trustworthy: continuous threat monitoring, incident response planning, third-party vendor risk assessment, and alignment of security spending with the clinical outcomes Surescripts exists to support. That last piece, tying security budgets to business and patient outcomes rather than treating security as pure overhead, is a theme that runs through nearly everything she has published.
Security Leadership Across the Surescripts Network
Running security for a nationwide health exchange means treating uptime as a patient safety issue, not just an IT metric. In her August 2026 article for Surescripts, Weathering Every Storm: What Industry-Leading Cyber Resilience Looks Like, she laid out the numbers behind that philosophy: Surescripts maintained 99.998% average network uptime in 2025, translating to roughly two minutes of downtime per month. That level of reliability, she explained, is not accidental. It comes from multiple active regions and zones, a dedicated disaster recovery region, and teams that run tabletop exercises simulating real attack scenarios before they ever happen for real.
Her framework for network resilience centers on three categories of disruption. The first is a direct cyberattack aimed at Surescripts itself. The second is an outage that originates on a partner’s system, where, without safeguards, a single pharmacy’s or EHR vendor’s technical failure could cascade into failed transactions across the whole network. The third is a physical disaster, a hurricane, wildfire, or winter storm that displaces patients and shuts down pharmacies with little warning.
For the second scenario, Surescripts built what she describes as a message queue service that holds e-prescribing messages in place when a receiving system goes down, so that once the system comes back online, prescriptions are delivered in order and intact rather than lost or requiring a doctor to rewrite them. This is the kind of architectural detail that separates a marketing claim about “taking security seriously” from an actual engineering commitment, and it is central to how she talks about resilience publicly.
The stakes behind this work are stark. In 2025, 20% of all data breach and ransomware complaints received by the FBI’s Internet Crime Complaint Center came from the healthcare and public health sector, more than any other industry, a figure sourced directly from the FBI’s 2025 Internet Crime Report. The economic logic behind that targeting is equally direct: researchers estimate a single medical record sells for roughly $60 on the dark web, compared with about $15 for a Social Security number and just $3 for credit card information, according to reporting cited from CNBC.
Judy Hatchett’s Cybersecurity Career
Her career did not start in healthcare. It started in some of the most transaction-heavy, loss-prevention-conscious sectors in corporate America, and that background shaped how she approaches health data protection today.
Fairview Health Services was her direct entry point into clinical risk management, where she served as VP of Information Security and CISO overseeing HIPAA security programs and PCI-DSS compliance across a health system with dozens of hospitals, clinics, and pharmacy locations. 3M gave her global governance experience, including a role helping one of the company’s critical healthcare business units achieve HIPAA compliance, according to her profile on The Org. Earlier still, SUPERVALU and Best Buy put her in charge of enterprise risk management, identity architecture, and regulatory audit operations inside two of the country’s largest retail organizations, while a stint at Accenture added consulting experience in enterprise technology transformation.
By the time she reached Surescripts, she had spent well over a decade managing the identity, access, and compliance problems that come with running large, distributed corporate networks, exactly the skill set a national health exchange needs.
From Enterprise Security to Healthcare Cybersecurity
The jump from retail and manufacturing into healthcare shifted her priority from protecting commercial transactions to protecting clinical decisions. A stolen credit card number is a financial headache. A compromised medication record can lead to a dangerous prescribing error or a fraudulent controlled-substance prescription.
That cross-industry background shows up in how she talks about underinvestment as a systemic risk. In a 2025 interview with JM Search, she was blunt about the gap between large health systems and smaller providers: “Lots of small to medium healthcare delivery companies do not have the budget to invest and stay on top of these new technologies,” she said, adding that for those organizations “it is not a matter of if there will be an attack, but a matter of when,” language drawn from her interview published on JM Search’s blog. In the same interview, she pointed to the pandemic-era shift to remote work as a moment when many healthcare organizations moved fast without fully rethinking access permissions, a decision many are still going back to correct.
Her Work in Healthcare Cybersecurity
Healthcare data commands a premium on the black market precisely because it is so hard to change once exposed. You can cancel a credit card. You cannot cancel your medical history. Her work at Surescripts centers on four consistent priorities.
Protecting Patient Health Information (PHI) means enforcing access limits so that only verified, credentialed users can reach stored or moving clinical records. Securing the Health Information Exchange means protecting electronic prescriptions and record transfers from interception as they move in real time between systems. Third-party risk management means every vendor or partner application connecting to the Surescripts network is validated against strict security baselines before it is allowed anywhere near patient data. Clinical system uptime means structuring threat monitoring so that anomalies are caught before they ever escalate into a service outage that a pharmacist or physician would notice.
The through-line across all four is that she builds these controls to work invisibly. Clinicians should not have to think about the security architecture behind their EHR login. They should just be able to do their jobs.
Identity Security and Network Integrity
If there is one idea she has returned to more than any other in her public writing, it is that identity is the real perimeter of a modern healthcare network. In her January 2025 article for Surescripts, Cybersecurity in Healthcare Starts with 1 Question, she opened with exactly that question: “Are you who you say you are?”
She pointed to guidance from the U.S. Department of Health and Human Services showing that many cyberattacks on healthcare organizations begin with phishing and identity theft, psychological attacks that exploit human error rather than technical vulnerabilities, drawn from an HHS report on healthcare ransomware. Her answer to that vulnerability was Surescripts’ partnership with CLEAR, the identity verification company best known for its airport security lanes. She noted that CLEAR’s David Bardan describes identity as the root of most healthcare cybersecurity challenges, and that CLEAR brought its experience from the “zero-fail environment” of aviation into the equally unforgiving environment of healthcare.
The CLEAR technology she championed is built on federated, networked identity, meaning a single set of verified credentials can grant access across multiple applications rather than forcing clinicians to juggle separate logins for every system they touch, an approach that reduces both friction and the attack surface tied to weak or reused passwords. As she put it in the article, paying attention on the network comes down to knowing who is on it, why they are on it, and what they are doing on it, a repeated formulation that has become something of a personal mantra across her public appearances.
Judy Hatchett’s Approach to Cybersecurity Leadership
Her leadership style treats security spending as an investment in business growth rather than a defensive cost center. Instead of auditing systems after they launch, she has consistently pushed to embed risk assessment into early product development, so that security is designed in rather than bolted on.
Three operational principles run through her public commentary. Risk-based resource allocation means directing security budgets toward the highest-vulnerability targets and the clinical data pipelines that matter most, rather than spreading resources evenly across every system regardless of exposure. Shared enterprise responsibility means cultivating security awareness across every department, not just the security team, so that a billing analyst or a customer support rep is just as alert to phishing as an engineer. Unobtrusive safeguards means building background controls that protect data without slowing down the clinician trying to use it.
Certifications play a large role in how she builds external trust in that approach. Surescripts’ achievement of HITRUST r2 Certification, announced in April 2025, is one of the clearest examples. As she wrote in It’s good to be HITRUST, the certification demonstrates that Surescripts’ technology and data infrastructure meets demanding regulatory and industry-defined requirements, placing the company in an elite group of organizations worldwide that have earned it. The scope was broad, covering platforms including Clinical Direct Messaging, E-Prescribing, Electronic Prior Authorization, the Master Patient Index, and the core Surescripts Health Information Network Interconnect, among others named in the certification announcement.
The timing mattered. In 2024, health data breaches impacted 53% of the U.S. population, the worst year on record by scope of breaches, with over 185 million individual records exposed according to figures cited from the HITRUST Trust Report 2025 and HIPAA Journal. As HITRUST’s Chief Innovation Officer Jeremy Huval noted in the same piece, HITRUST certification is considered the gold standard in the industry precisely because of the depth of its assurance process and the level of oversight involved.
Cyber Resilience and Protecting Healthcare Operations
Resilience, in her framing, is not the same thing as prevention. It is the ability to keep essential services running even after something has already gone wrong. That distinction is the entire premise of her Weathering Every Storm article, published on Surescripts’ Intelligence in Action platform in August 2026.
Her protection framework rests on continuous monitoring paired with layered defenses: adherence to the NIST Cybersecurity Framework, HITRUST r2 Certification, and certifications from the Electronic Healthcare Network Accreditation Commission and DirectTrust, alongside tightly controlled network access that transmits only the data required for a specific, agreed-upon use case. Regular tabletop exercises put her team through realistic attack scenarios so that, in her words, the response is practiced before it’s needed.
She is equally direct about the limits of prevention alone. Redundant systems and the message queue architecture described earlier exist precisely because some disruptions cannot be stopped, only absorbed. As she summarized it, “a defense that can’t recover isn’t a defense,” a line that captures the resilience-first philosophy running through her entire body of published work at Surescripts.
Judy Hatchett’s Industry and Professional Leadership
Beyond her day-to-day executive responsibilities, she has taken on a series of industry roles aimed at raising security standards across the broader healthcare sector, not just within Surescripts.
She was appointed a commissioner of the Electronic Healthcare Network Accreditation Commission (EHNAC), a non-profit standards body focused on transactional quality and data security across healthcare, an appointment announced by Surescripts that ran through 2023. At the time of her appointment, EHNAC’s executive director Lee Barrett said he looked forward to “the great work we’ll do together” in helping stakeholders achieve trust in healthcare information exchange. For her part, she noted that the pandemic-driven shift to virtual care and remote work had heightened the threat of breach “exponentially,” language she used directly in the announcement.
She has also served as President of the Minnesota Affiliate of Women in Cybersecurity (WiCyS), a role confirmed across multiple 2025 speaker bios including her listing with the Cyber Security Summit, where she has also appeared as a co-chair. Her advocacy work extends into mentoring, and she has spoken at multiple industry gatherings including CISO Executive Summit panels and events hosted by security vendors like Proofpoint and research firms like IANS Research, where she has served as faculty.
Education and Professional Background
Her academic path pairs organizational leadership training with deep technical study. She earned a Bachelor’s degree in Organizational Studies from Bethel University, a Minnesota liberal arts institution, and later completed a Master of Science in Security Technologies from the University of Minnesota, according to her IANS Research faculty profile, which lists her graduate degree as completed in 2018.
That combination, organizational management on one side and enterprise risk architecture on the other, mirrors the dual nature of her actual job. A CISO at her level spends as much time managing people, budgets, and cross-departmental buy-in as she does evaluating technical controls, and her educational background reflects that split directly.
Judy Hatchett and Judy Molenaar: Understanding the Name
Anyone researching her background will run into both names, sometimes in the same document. Both refer to the same person: the Vice President and CISO of Surescripts.
Earlier in her career, essentially everything published about her, from the 2021 CyAlliance interview to her EHNAC commissioner appointment to years of Cyber Security Summit speaker bios, used the name Judy Hatchett. More recent Surescripts content, including her 2025 and 2026 articles on HITRUST certification and cyber resilience, credits her as Judy Molenaar. Industry event organizers have adapted to this transition by listing her under the combined form Judy (Hatchett) Molenaar, a naming convention used by both the CyberRisk Collaborative and JM Search in their 2025 coverage. Surescripts’ own author archive still routes through the URL path /authors/judy-hatchett even when the byline reads Judy Molenaar, which is why both names continue to surface together in search results and professional directories.
Judy Hatchett’s Role in Modern Healthcare Security
Her career arc mirrors a larger shift in what the CISO title has come to mean across the industry. Twenty years ago, information security in a company like Best Buy or SUPERVALU largely meant protecting transactional and customer data from theft. Today, in her role at Surescripts, it means safeguarding the infrastructure that clinicians rely on to make real-time treatment decisions for millions of patients.
By combining rigorous identity verification through partnerships like CLEAR, formal assurance through HITRUST r2 and EHNAC certification, and a resilience architecture built to absorb rather than merely prevent disruption, she has helped position Surescripts as one of the more security-mature organizations in American healthcare infrastructure. Her own numbers make the case better than any marketing language could: a network that stayed up 99.998% of the time in 2025, moving billions of clinical transactions a year, in a sector that the FBI itself now identifies as the most targeted in the country. That is the practical, unglamorous, and genuinely difficult work behind the title Chief Information Security Officer, and it is the work she has spent more than two decades building toward.