What’s Ahead in Health Informatics for 2018? The Ransomware Crisis and Beyond

The ransomware crisis continues to impact hospitals and health systems with little sign of slowing down.

In 2017, IT security in healthcare was in the media spotlight. In May, the WannaCry ransomware hit thousands of information systems. It was followed by NotPetya, which took down Merck and Nuance. In June, the Health Care Industry Cybersecurity Task Force released a number of security frameworks, and the number of cybersecurity training programs increased.

Security frameworks are not the answer to this problem, but they are organizing schema that sometimes help an organization think through its requirements to protect its healthcare data. By August, professionals were worrying about the Internet-of-things (IoT), including malware infection of medical devices – to possibly even include pacemakers active within patients’ bodies.

In Stockholm, at the October ITechLaw conference, practicing attorneys expressed concerns that there was no legal standard that defined the level of due diligence necessary in the management of their information systems. Organizations were being held responsible by government regulators, but with no objective standard of security. CMS delayed requirements for using the 2015 certified electronic health record (EHR) standard. eClinicalWorks’ software company was brought into court because its software could not identify cancer. Medicare continued to deny reimbursement for many telemedicine procedures, thus remaining Luddite in its orientation. Without an accepted standard for reasonable cybersecurity, organizations will remain unable to protect themselves from litigation claiming negligence in their data management.

The end-of-year statistics said it all. Healthcare system security breaches rose 24 percent, but ransomware incidents rose 89 percent.

We can expect that in 2018, IT security in the healthcare sector will continue to be a challenge. Hackers, terrorists, non-state actors, even state actors all continue to be antagonists to the global cyber infrastructure. Information systems can be compromised in a number of ways:

  1. EHRs can be stolen so that personal information can be used for identity theft;
  2. Social Security numbers of newly born babies can be hijacked and sold on the dark web;
  3. Databases can be corrupted or destroyed so that they may not be used; and
  4. Personal information can be stolen and used for blackmail later on. 

The industry already is off to a good start in 2018. Last Thursday, two North Carolina-based data centers of the giant company Allscripts had its cloud platform disabled by a ransomware attack. All patient information became unavailable. The e-prescribing system and EHR platform went offline. The Electronic Prescribing of Controlled Substances (EPCS) functionality went down. Physicians had to go back to paper records. 

The previous week, Hancock Health in Greenfield, Ind. was hit by ransomware. All of the patient names in its EHR were changed to “I’m sorry.” They paid out $55,000, which is much less than it would have cost to restore the system had the records remained locked. The “I’m sorry” attack had been visited on Indiana’s Adams Memorial Hospital prior to this. In early January, it was reported that more than one-half of all patient information in Norway had been compromised.

The creativity of criminals is limitless, and law enforcement sometimes is a step behind. Likewise, healthcare security professionals and the security countermeasures they are able to deploy can be insufficient.

And in many cases, they will remain behind, because IT security involves what professionals describe as “asymmetric warfare,” a fancy way of saying that the cost of the attack is many times less than the cost of defense.

In particular, the tsunami of ransomware will continue to do damage to thousands of enterprises, both public and private.

Some have placed blame for ransomware on the outlaw government in North Korea. After all, it is a money-making operation, and the use of crypto-currency makes it easy to get paid. Or it could be Russian organized crime, or other governments, or rogue hackers, or someone else. It really doesn’t matter. What’s important is that ransomware is what the U.S. intelligence community calls an “advanced persistent threat.”

Efforts are being made to set up mechanisms for sharing of cyber threat information between organizations. Theoretically, this should mitigate the damage, but we will have to wait for 2019 to see if it really works as planned – and my guess is that it will not.

Print Friendly, PDF & Email
Facebook
Twitter
LinkedIn

Edward M. Roche, PhD, JD

Edward Roche is the director of scientific intelligence for Barraclough NY, LLC. Mr. Roche is also a member of the California Bar. Prior to his career in health law, he served as the chief research officer of the Gartner Group, a leading ICT advisory firm. He was chief scientist of the Concours Group, both leading IT consulting and research organizations. Mr. Roche is a member of the RACmonitor editorial board as an investigative reporter and is a popular panelist on Monitor Mondays.

Related Stories

Leave a Reply

Please log in to your account to comment on this article.

Featured Webcasts

The Inpatient Admission Order: Master the Who, When, and How

The Inpatient Admission Order: Master the Who, When, and How

During this webcast Dr. Ronald Hirsch delves into the inpatient admission order process including when to get it, when it becomes effective, its impact on billing and payment, who can write it, how to cancel it, the effects on the beneficiary, and more. You’ll leave with a clear understanding of inpatient orders and guidelines for handling improper orders that you can implement immediately.

June 20, 2024
Navigating AI in Healthcare Revenue Cycle: Maximizing Efficiency, Minimizing Risks

Navigating AI in Healthcare Revenue Cycle: Maximizing Efficiency, Minimizing Risks

Michelle Wieczorek explores challenges, strategies, and best practices to AI implementation and ongoing monitoring in the middle revenue cycle through real-world use cases. She addresses critical issues such as the validation of AI algorithms, the importance of human validation in machine learning, and the delineation of responsibilities between buyers and vendors.

May 21, 2024
Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Frank Cohen shows you how to leverage the Comprehensive Error Rate Testing Program (CERT) to create your own internal coding and billing risk assessment plan, including granular identification of risk areas and prioritizing audit tasks and functions resulting in decreased claim submission errors, reduced risk of audit-related damages, and a smoother, more efficient reimbursement process from Medicare.

April 9, 2024
2024 Observation Services Billing: How to Get It Right

2024 Observation Services Billing: How to Get It Right

Dr. Ronald Hirsch presents an essential “A to Z” review of Observation, including proper use for Medicare, Medicare Advantage, and commercial payers. He addresses the correct use of Observation in medical patients and surgical patients, and how to deal with the billing of unnecessary Observation services, professional fee billing, and more.

March 21, 2024
Comprehensive Inpatient Clinical Documentation Integrity: From Foundations to Advanced Strategies

Comprehensive Inpatient Clinical Documentation Integrity: From Foundations to Advanced Strategies

Optimize your inpatient clinical documentation and gain comprehensive knowledge from foundational practices to advanced technologies, ensuring improved patient care and organizational and financial success. This webcast bundle provides a holistic approach to CDI, empowering you to implement best practices from the ground up and leverage advanced strategies for superior results. Participants will gain actionable insights to improve documentation quality, patient care, compliance, and financial outcomes.

June 26, 2024
Advanced Inpatient Clinical Documentation Integrity: Harnessing Technology, Analytics, and Compliance

Advanced Inpatient Clinical Documentation Integrity: Harnessing Technology, Analytics, and Compliance

Join expert Angela Comfort, MBA, RHIA, CDIP, CCS, CCS-P., as she helps you navigate advanced inpatient CDI technologies, regulatory changes, and system interoperability. Angela will provide actionable strategies for integrating AI and predictive analytics into CDI practices, ensuring seamless system interoperability, and maintaining compliance with evolving regulations. Attendees will learn to select and implement advanced EHR systems and CDI software, leverage data analytics to enhance documentation accuracy, and stay audit-ready with the latest compliance updates. Real-world case studies and practical tools will empower you to drive continuous improvement in CDI, improve patient outcomes, and enhance organizational efficiency. Don’t miss this opportunity to advance your CDI practices and stay ahead in this dynamic field.

July 11, 2024
Foundations of Inpatient Clinical Documentation Integrity: Enhancing Accuracy and Compliance

Foundations of Inpatient Clinical Documentation Integrity: Enhancing Accuracy and Compliance

Join expert Angela Comfort, MBA, RHIA, CDIP, CCS, CCS-P, for an insightful webcast on improving inpatient clinical documentation integrity (CDI). Inaccurate documentation can lead to misdiagnosis, improper treatment, and compromised patient safety. High workloads, lack of standardized practices, and outdated EHR systems contribute to these issues, affecting care quality and financial outcomes. Angela will offer practical strategies and tools to enhance accuracy, consistency, and timeliness in documentation. Attendees will learn to use standardized templates, checklists, and advanced EHR systems, while staying compliant with regulations. Improve patient care, ensure accurate billing, and reduce audit risks with actionable insights from this essential webcast.

June 26, 2024
Mastering E/M Coding: Navigating the Evolving Landscape

Mastering E/M Coding: Navigating the Evolving Landscape

Join industry expert, Kathy Pride, RHIT, CPC, CPMA, CCS-P, for an in-depth exploration of Evaluation and Management (E/M) coding, tailored for healthcare professionals navigating recent guideline changes. Dive into advanced topics beyond mere code selection, including shared visits, criteria for selecting E/M levels, and documentation best practices. Gain clarity on complex guideline terminology and ensure compliance with regulatory standards. This comprehensive session is essential for coders, auditors, educators, and practitioners seeking to enhance their proficiency in E/M coding and maximize revenue capture.

June 19, 2024

Trending News

Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →

Honor Memorial Day with Savings! Get 20% off all items using code MEMORIAL24 at checkout. Shop today and save! Offer valid until May 31. Exclusions apply.

Happy World Health Day! Our exclusive webcast, ‘2024 SDoH Update: Navigating Coding and Screening Assessment,’  is just $99 for a limited time! Use code WorldHealth24 at checkout.