The ransomware crisis continues to impact hospitals and health systems with little sign of slowing down.
In 2017, IT security in healthcare was in the media spotlight. In May, the WannaCry ransomware hit thousands of information systems. It was followed by NotPetya, which took down Merck and Nuance. In June, the Health Care Industry Cybersecurity Task Force released a number of security frameworks, and the number of cybersecurity training programs increased.
Security frameworks are not the answer to this problem, but they are organizing schema that sometimes help an organization think through its requirements to protect its healthcare data. By August, professionals were worrying about the Internet-of-things (IoT), including malware infection of medical devices – to possibly even include pacemakers active within patients’ bodies.
In Stockholm, at the October ITechLaw conference, practicing attorneys expressed concerns that there was no legal standard that defined the level of due diligence necessary in the management of their information systems. Organizations were being held responsible by government regulators, but with no objective standard of security. CMS delayed requirements for using the 2015 certified electronic health record (EHR) standard. eClinicalWorks’ software company was brought into court because its software could not identify cancer. Medicare continued to deny reimbursement for many telemedicine procedures, thus remaining Luddite in its orientation. Without an accepted standard for reasonable cybersecurity, organizations will remain unable to protect themselves from litigation claiming negligence in their data management.
The end-of-year statistics said it all. Healthcare system security breaches rose 24 percent, but ransomware incidents rose 89 percent.
We can expect that in 2018, IT security in the healthcare sector will continue to be a challenge. Hackers, terrorists, non-state actors, even state actors all continue to be antagonists to the global cyber infrastructure. Information systems can be compromised in a number of ways:
The industry already is off to a good start in 2018. Last Thursday, two North Carolina-based data centers of the giant company Allscripts had its cloud platform disabled by a ransomware attack. All patient information became unavailable. The e-prescribing system and EHR platform went offline. The Electronic Prescribing of Controlled Substances (EPCS) functionality went down. Physicians had to go back to paper records.
The previous week, Hancock Health in Greenfield, Ind. was hit by ransomware. All of the patient names in its EHR were changed to “I’m sorry.” They paid out $55,000, which is much less than it would have cost to restore the system had the records remained locked. The “I’m sorry” attack had been visited on Indiana’s Adams Memorial Hospital prior to this. In early January, it was reported that more than one-half of all patient information in Norway had been compromised.
The creativity of criminals is limitless, and law enforcement sometimes is a step behind. Likewise, healthcare security professionals and the security countermeasures they are able to deploy can be insufficient.
And in many cases, they will remain behind, because IT security involves what professionals describe as “asymmetric warfare,” a fancy way of saying that the cost of the attack is many times less than the cost of defense.
In particular, the tsunami of ransomware will continue to do damage to thousands of enterprises, both public and private.
Some have placed blame for ransomware on the outlaw government in North Korea. After all, it is a money-making operation, and the use of crypto-currency makes it easy to get paid. Or it could be Russian organized crime, or other governments, or rogue hackers, or someone else. It really doesn’t matter. What’s important is that ransomware is what the U.S. intelligence community calls an “advanced persistent threat.”
Efforts are being made to set up mechanisms for sharing of cyber threat information between organizations. Theoretically, this should mitigate the damage, but we will have to wait for 2019 to see if it really works as planned – and my guess is that it will not.
Combat is often described as hours of boredom intermixed with moments of sheer terror. I fear that that metaphor is increasingly applicable to Medicare enrollment. Few
Let’s start with a recent (U.S. Department of Health and Human Services Office of Inspector General) OIG audit of a Medicare Advantage plan. Now these
Please log in to your account to comment on this article.
Gain clarity and confidence in OB‑GYN coding with this expert‑led webcast featuring Stacey Shillito, CDIP, CPMA, CCS, CCS‑P, CPEDC, COPC. You’ll learn how to apply global maternity package rules accurately, select the right CPT codes for procedures and visits, and identify documentation gaps that lead to denials. With practical guidance and real examples, this session helps you strengthen compliance, reduce audit risk, and ensure accurate reimbursement for women’s health services.
Uncover essential coding insights with nationally recognized coding authority Kay Piper, RHIA, CDIP, CCS. Through ICD10monitor’s interactive, on‑demand webcast series, Kay walks you through the AHA’s 2026 ICD‑10‑CM/PCS Quarterly Coding Clinics, translating each update into practical, easy‑to‑apply guidance designed to sharpen precision, ensure compliance, and strengthen day‑to‑day decision‑making. Available shortly after each official release.
Uncover critical guidance on the ICD-10-CM/PCS code updates. Kay Piper reviews and explains ICD-10-CM/PCS coding guidelines in the AHA’s fourth quarter 2026 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Uncover critical guidance on the ICD-10-CM/PCS code updates. Kay Piper reviews and explains ICD-10-CM/PCS coding guidelines in the AHA’s third quarter 2026 ICD-10-CM/PCS Coding Clinic in an easy to access on-demand webcast.
Federal auditors are intensifying their focus on inpatient psychiatric facilities, using advanced data analytics to spotlight outliers and pursue high‑dollar repayments. In this high‑impact webcast, Michael Calahan, PA, MBA, Compliance Officer and V.P., Hospital & Physician Compliance, breaks down what regulators are really targeting in IPF-PPS admissions, documentation, treatment and discharge planning. Attendees will learn practical steps to tighten processes, avoid common audit triggers and protect reimbursement and reduce the risk of multimillion-dollar repayment demands.
In this timely session, Stacey Shillito, CDIP, CPMA, CCS, CCS-P, CPEDC, COPC, breaks down the complexities of Medical Decision Making (MDM) documentation so providers can confidently capture the true complexity of their care. Attendees will learn practical, efficient strategies to ensure documentation aligns with current E/M guidelines, supports accurate coding, and reduces audit risk, all without adding to charting time.
Join Ronald Hirsch, MD, FACP, CHCQM for The PEPPER Returns – Risk and Opportunity at Your Fingertips, a practical webcast that demystifies the PEPPER and shows you how to turn complex claims data into actionable insights. Dr. Hirsch will explain how to interpret key measures, identify compliance risks, uncover missed revenue opportunities, and understand new updates in the PEPPER, all to help your organization stay ahead of audits and use this powerful data proactively.
Stay ahead of the 2026-2027 audit surge with “Top 10 Audit Targets for 2026-2027 for Hospitals & Physicians: Protect Your Revenue,” a high-impact webcast led by Michael Calahan, PA, MBA. This concise session gives hospitals and physicians clear insight into the most likely federal audit targets, such as E/M services, split/shared and critical care, observation and admissions, device credits, and Two-Midnight Rule changes, and shows how to tighten documentation, coding, and internal processes to reduce denials, recoupments, and penalties. Attendees walk away with practical best practices to protect revenue, strengthen compliance, and better prepare their teams for inevitable audits.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
BLOOM INTO SAVINGS! Get 25% OFF during our spring sale through March 27. Use code SPRING26 at checkout to claim this offer.
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 1 with code CYBER25
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
