EDITOR’S NOTE: Edward Roche, in association with RACmonitor, is writing a series on the need for U.S. healthcare facilities to protect themselves from cybercriminals demanding ransoms for patient records. This is the fifth installment in that series and comes on the heels of a reported cyberattack Tuesday at Heritage Valley Health System, based in Sewickley, Pa.
The U.S. House of Representatives’ Committee on Energy and Commerce held a hearing last week on cybersecurity in healthcare. In addition, the U.S. Department of Homeland Security (DHS) Cybersecurity Task Force recently released a report suggesting that current guidelines are not adequate to meet the threat posed by cyberattacks.
Of particular concern is risk associated with medical devices, especially when they are connected to networks.
If your devices become infected with malware, then it may start to alter their data, leading to incorrect diagnoses. This could result in deadly consequences in many cases. Hackers could connect to a device, break in, then change its function – for example, something like a heartbeat monitor might be changed into an eavesdropping device.
In the same way that websites sometimes are obstructed and made unreachable by a firestorm of robot-generated inquiries – a “distributed denial of service,” or DDoS, attack – so too would it be possible for devices and the networks that support them to be shut down or made unusable by a sudden and uncontrolled flood of information or requests.
It also is possible that medical devices could be converted into a portal from, through which sensitive patient data could be exfiltrated out of a health provider’s information system. In this case, the login and security credentials of the device itself would be harnessed in order to gain entry into the back-end information system containing patient information.
Sale on the Dark Web
The prices for raw patient data are not terribly high. Reports from the Identity Theft Resource Center indicate that there were 355 breaches of patient information in 2016, constituting about 15 million records. Banner Health in Phoenix, Ariz. lost 3.7 million records; Newkirk Products in New York City lost 3.3 million; 21st Century Oncology in Fort Myers, Fla. lost data on 2.2 million individuals; and such examples go on and on.
The records have a fluctuating price on the dark web: a place where illegal transactions take place behind a wall of encryption and virtual IP addresses. On a per-record basis, patient medical records go for between 24 cents and $2 per patient.
There are relatively low prices because this information represents only preliminary raw material being used for fraud. After obtaining items such as birthdates, social security numbers, driver’s license information, insurance information, and other details, then the trained criminal can begin the process of impersonating the identity of patients.
New Audits on the Way
In 2017, we will see a wave of new audits of healthcare providers. These will not come from the Recovery Audit Contractors (RACs) but instead from the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Evidently, the Civil Rights Act has been broadened in its scope to allow the government to audit providers, because having one’s personal information kept securely is considered to be a “civil right.” The audits are not only targeting hospitals, but also business associates. What types of punishment are available? Both civil fines and criminal penalties are being leveraged by the government to encourage good practices.
We can expect much more audit risk from cyber in the future, and we will continue to discuss these new audits in future installments of this series in RACmonitor.
As a provider, a question worth asking yourself these days is this: what degree of risk is there that you might have something on your
What is a “smart” hospital, and what states have the most of them? Furthermore, what makes them smart? Well, it is difficult to define exactly
Please log in to your account to comment on this article.
Join Beth Wolf, MD, CPC, CCDS, for an in-depth webcast on the FY2025 spinal fusion MS-DRG updates. Discover key changes in DRG classification, understand impacts on documentation and CMI, and learn strategies to ensure compliance.
Join Angela Comfort, DBA, MBA, RHIA, CDIP, CCS, CCS-P, as she presents effective strategies to strengthen collaboration between CDI, coding, and quality departments in acute care hospitals. Angela will also share guidance on implementing cross-departmental meetings, using shared KPIs, and engaging leadership to foster a culture of collaboration. Attendees will gain actionable tools to optimize documentation accuracy, elevate quality metrics, and drive a unified approach to healthcare goals, ultimately enhancing both patient outcomes and organizational performance.
Optimize your outpatient clinical documentation and gain comprehensive knowledge from foundational practices to advanced technologies, ensuring improved patient care and organizational and financial success. This webcast bundle provides a holistic approach to outpatient CDI, empowering you to implement best practices from the ground up and leverage advanced strategies for superior results. You will gain actionable insights to improve documentation quality, patient care, compliance, and financial outcomes.
Enhancing outpatient clinical documentation is crucial for maintaining accuracy, compliance, and proper reimbursement in today’s complex healthcare environment. This webcast, presented by industry expert Angela Comfort, DBA, RHIA, CDIP, CCS, CCS-P, will provide you with actionable strategies to tackle complex challenges in outpatient documentation. You’ll learn how to craft detailed clinical narratives, utilize advanced EHR features, and implement accurate risk adjustment and HCC coding. The session also covers essential regulatory updates to keep your documentation practices compliant. Join us to gain the tools you need to improve documentation quality, support better patient care, and ensure financial integrity.
Dr. Ronald Hirsch provides critical details on the new Medicare Appeal Process for Status Changes for patients whose status changes during their hospital stay. He also delves into other scenarios of hospital patients receiving custodial care or medically unnecessary services where patient notifications may be needed along with the processes necessary to ensure compliance with state and federal guidance.
Healthcare organizations face complex regulatory requirements under the No Surprises Act and Price Transparency rules. These policies mandate extensive fee disclosures across settings, and confusion is widespread—many hospitals remain unaware they must post every contracted rate. Non-compliance could lead to costly penalties, financial loss, and legal risks. Join David M. Glaser Esq. as he shows you how to navigate these regulations effectively.
Protect your facility from unwanted audits! Join Becky Jacobsen, BSN, RN, MBS, CCS-P, CPC, CPEDC, CBCS, CEMC, and take a deep dive into both the CMS and AMA guidelines for reporting post operative pain blocks. You’ll learn how to determine if the nerve block is separately codable with real life examples for better understanding. Becky will also cover how to evaluate whether documentation supports medical necessity, offer recommendations for stronger documentation practices, and provide guidance on educating providers about documentation requirements. She’ll include a discussion of appropriate modifier and diagnosis coding assignment so that you can be confident that your billing of post operative pain blocks is fully supported and compliant.
During this RACmonitor webcast Dr. Ronald Hirsch spotlights the areas of the OIG’s Work Plan and the findings of their most recent audits that impact utilization review, case management, and audit staff. He also provides his common-sense interpretation of the prevailing regulations related to those target issues. You’ll walk away better equipped with strategies to put in place immediately to reduce your risk of paybacks, increased scrutiny, and criminal penalties.
Copyright © 2024 RACmonitor. Powered by MedLearn Media.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
