Last week, the U.S. House of Representatives Committee on Energy and Commerce held a hearing on cybersecurity in healthcare. The U.S. Department of Homeland Security (DHS) Cybersecurity Task Force also just released a report suggesting that current guidelines are not adequate to meet the current situation.
The hearing was prompted by the recent wave of ransomware infecting healthcare providers worldwide, one of the most significant such attacks in history.
A recent survey on Monitor Monday, revealed that 80 percent of respondents considered cybersecurity to be either a “red hot” or “hot” topic in healthcare. Hospitals are under attack, at risk of losing their electronic medical records (EMRs). Malware infects hospitals’ information systems, then encrypts their data. In order to get the electronic “key” to unlock the data, a ransom must be paid.
Here is a typical message:
“Your important files are encrypted. Many of your documents, photos, videos, databases, and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service. We guarantee that you can recover all your files safely and easily. You have only three days to submit the payment. After that, the price will be doubled. Also, if you don’t pay in seven days, you won’t be able to recover your files forever.”
Not only healthcare establishments are vulnerable. This week the University College London (UCL) was hit with the infamous WannaCry malware. The National Security Agency (NSA) has tied this malware to North Korea, a regime long known for nefarious activities. Ransomware from that country is said to have infected more than 300,000 systems in 150 countries. Entire web hosting companies have been infected, resulting in the complete collapse of hundreds of websites and all associated cloud services supplying enterprise software.
The heartland is vulnerable. The most recent reported attack on a hospital in the United States took place late last week at the Waverly Health Center, a hospital in Cedar Falls, Iowa. A few weeks ago, ransomware hit a senior living community in Dallas, Texas. It is impossible to keep track of this deluge of malware attacks against hospitals and other healthcare facilities.
Cybersecurity Framework for Healthcare Providers
Consideration is being given to modifying Section 405(d) of the Medicare law with a view toward developing a “cybersecurity framework.” Federal agencies would be asked to harmonize “existing and future laws and regulations” across the healthcare industry. Work would begin on identifying best practices that are “scalable” from the smallest to largest healthcare organizations.
The Cyber Security Task Force report calls for the U.S. Department of Health and Human Services (HHS) to create a “cybersecurity leader role” to help align efforts across the nation’s healthcare sector. It is not entirely clear what “align” means. This leadership nexus would serve as a “single point of entry for health care industry partners” needing to share information on cyber threats.
The Stark Law and the Anti-Kickback Statute also may be modified to make it possible for cybersecurity organizations to share information and recommend software to physicians.
Medical devices are a particular area of concern. A task force is being put together to study the cybersecurity of all forms of medical devices, including implants. This promises to be a complex and difficult job, but it is viewed as being imperative.
As it creates new products, the government may start to require medical device manufacturers to adopt a secure systems development lifecycle (SDLC). Eventually, we may see approval of medical devices becoming contingent upon certification that they have been developed according to these more rigorous standards.
The backbone information systems that run healthcare are of great concern as well. It is generally recognized that many of these older systems are not as up-to-date on cybersecurity as they should be. More effort will be put into study of how these legacy information systems can be made less vulnerable to malware and other forms of hacking.
In order to better coordinate a national response to cyberattacks, the government will create MedCERT: The Medical Computer Emergency Readiness Team.
There are many recommendations and observations in the just-released report. It should be mandatory reading for every employee of ICT in every single healthcare organization across the United States.
We can be reasonably sure that eventually, healthcare organizations will be audited to make sure that they are in compliance with government-approved and certified cybersecurity practices. This was attempted in the past, but this new wave of malware has revived the notion. Thus, an entire new industry of auditors could be created: The Cyber RACs (Recovery Audit Contractors).
RACmonitor will continue to keep an eye on these developments.
I have written several times about patient choice. We all know the rules: offer choice to patients for all post-acute services. They are part of
The integration of generative artificial intelligence (AI) into the area of clinical documentation, including clinical documentation integrity (CDI) programs and electronic health records (EHRs), represents
Please log in to your account to comment on this article.
Join Beth Wolf, MD, CPC, CCDS, for an in-depth webcast on the FY2025 spinal fusion MS-DRG updates. Discover key changes in DRG classification, understand impacts on documentation and CMI, and learn strategies to ensure compliance.
Join Angela Comfort, DBA, MBA, RHIA, CDIP, CCS, CCS-P, as she presents effective strategies to strengthen collaboration between CDI, coding, and quality departments in acute care hospitals. Angela will also share guidance on implementing cross-departmental meetings, using shared KPIs, and engaging leadership to foster a culture of collaboration. Attendees will gain actionable tools to optimize documentation accuracy, elevate quality metrics, and drive a unified approach to healthcare goals, ultimately enhancing both patient outcomes and organizational performance.
Optimize your outpatient clinical documentation and gain comprehensive knowledge from foundational practices to advanced technologies, ensuring improved patient care and organizational and financial success. This webcast bundle provides a holistic approach to outpatient CDI, empowering you to implement best practices from the ground up and leverage advanced strategies for superior results. You will gain actionable insights to improve documentation quality, patient care, compliance, and financial outcomes.
Enhancing outpatient clinical documentation is crucial for maintaining accuracy, compliance, and proper reimbursement in today’s complex healthcare environment. This webcast, presented by industry expert Angela Comfort, DBA, RHIA, CDIP, CCS, CCS-P, will provide you with actionable strategies to tackle complex challenges in outpatient documentation. You’ll learn how to craft detailed clinical narratives, utilize advanced EHR features, and implement accurate risk adjustment and HCC coding. The session also covers essential regulatory updates to keep your documentation practices compliant. Join us to gain the tools you need to improve documentation quality, support better patient care, and ensure financial integrity.
Dr. Ronald Hirsch provides critical details on the new Medicare Appeal Process for Status Changes for patients whose status changes during their hospital stay. He also delves into other scenarios of hospital patients receiving custodial care or medically unnecessary services where patient notifications may be needed along with the processes necessary to ensure compliance with state and federal guidance.
Healthcare organizations face complex regulatory requirements under the No Surprises Act and Price Transparency rules. These policies mandate extensive fee disclosures across settings, and confusion is widespread—many hospitals remain unaware they must post every contracted rate. Non-compliance could lead to costly penalties, financial loss, and legal risks. Join David M. Glaser Esq. as he shows you how to navigate these regulations effectively.
Protect your facility from unwanted audits! Join Becky Jacobsen, BSN, RN, MBS, CCS-P, CPC, CPEDC, CBCS, CEMC, and take a deep dive into both the CMS and AMA guidelines for reporting post operative pain blocks. You’ll learn how to determine if the nerve block is separately codable with real life examples for better understanding. Becky will also cover how to evaluate whether documentation supports medical necessity, offer recommendations for stronger documentation practices, and provide guidance on educating providers about documentation requirements. She’ll include a discussion of appropriate modifier and diagnosis coding assignment so that you can be confident that your billing of post operative pain blocks is fully supported and compliant.
During this RACmonitor webcast Dr. Ronald Hirsch spotlights the areas of the OIG’s Work Plan and the findings of their most recent audits that impact utilization review, case management, and audit staff. He also provides his common-sense interpretation of the prevailing regulations related to those target issues. You’ll walk away better equipped with strategies to put in place immediately to reduce your risk of paybacks, increased scrutiny, and criminal penalties.
Copyright © 2024 RACmonitor. Powered by MedLearn Media.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
