Specialty Providers and Third Party Billers: It’s no longer a question of whether a data breach will happen, but when.
In February, the healthcare sector, long a target for cybercriminals, faced a watershed moment with the unprecedented cybersecurity breach involving Change Healthcare. This event underscored the vulnerability of healthcare organizations and shed light on the escalating threats posed by sophisticated ransomware groups like ALPHV/Blackcat.
While the fallout from such attacks continues to disrupt operations and compromise patient care, healthcare organizations must proactively prepare for future cyber threats.
In this context, we examine crucial strategies to weaken the impact of data breaches while acknowledging the complexities inherent in navigating this evolving landscape.
The Change Healthcare Disruption
Change Healthcare’s confirmation of its role in the historic cybersecurity breach reverberated across the healthcare industry, underscoring the severity of the situation. The ransomware attack orchestrated by ALPHV/Blackcat wreaked havoc, causing significant operational challenges for thousands of providers and patients.
The repercussions were felt nationwide, with pharmacists unable to fulfill prescriptions and healthcare organizations grappling with the aftermath, struggling to restore their revenue cycles.
The healthcare sector’s susceptibility to cyberattacks is undeniable.
Since 2020, healthcare cybersecurity breaches have increased by 53% and carry staggering financial repercussions. Ransomware groups exploit system vulnerabilities and capitalize on the critical nature of patient care and provider payments.
United Health Group’s alleged substantial payment to retrieve Change Healthcare’s stolen data underscores the grim reality: organizations often find themselves at the mercy of cybercriminals.
Healthcare Provider Cyberattacks: Impacts and Moving Forward
Since February, many healthcare organizations have struggled to restore their revenue cycle despite the hospital sector’s favorable financial performance.
In March, market research firm Eliciting Insights and HFMA surveyed healthcare system executives to assess the impact of the Change Healthcare outage.
One of the market pulse surveys, conducted three weeks after the incident, found that only 1% of the respondents who used Change Healthcare as their primary clearinghouse were back to “business as usual.”
In the wake of the Change Healthcare breach, healthcare organizations must adopt a proactive stance to mitigate future cyber threats. While acknowledging the disruptive nature of such attacks, it’s crucial to focus on actionable steps to bolster cybersecurity defenses.
Strategies to Mitigate Health System Cyberattacks
1. Employee Training
On April 5th, the Department of Health and Human Services released an advisory listing of the top 10 ransomware groups targeting hospitals. These ransomware groups rely heavily on social engineering tactics, like phishing, which can wreak havoc on an entire organization with just one successful email.
Recognizing the pervasive threat of phishing attacks, organizations must prioritize ongoing, comprehensive training for employees.
Ensuring employees are well-educated about email risks is imperative, as more than annual training sessions are required to reduce these risks.
Advantum Health’s approach of weekly communication and phishing simulations helps establish a culture of vigilance among employees, reducing the risk of successful phishing attacks.
2. Investment in Prevention
Implementing robust patch management operations and adopting a multi-layered approach to IT security is imperative.
Advantum Health’s emphasis on daily patch routines and round-the-clock security monitoring exemplifies proactive investment in prevention. Engaging a reputable security monitoring provider can be valuable for organizations with limited resources.
3. Diversification
Despite inherent difficulties, adopting a diverse approach to revenue cycle solutions can reduce the risks of excessive dependence on a solitary system.
Eliciting Insights and HFMA’s survey findings highlight the importance of partnering with multiple clearinghouses to enhance resilience. 53% of survey respondents who had Change Healthcare as their primary clearinghouse are partnering with multiple clearinghouses, and 17% are submitting claims directly to payers.
Diversification allows healthcare providers to minimize reliance on a single system, making it harder for bad actors to exploit system vulnerabilities.
4. Collaboration
Within our industry, collaboration and networking offer immense benefits. Exchanging information and successful strategies inform organizations about emerging risks and vulnerabilities, facilitating better protection of systems and data.
Leveraging peer collaboration fosters a culture of sharing and transparency, which is essential for combating cyber threats. Organizations can bolster their defenses and enhance incident response capabilities by pooling resources and sharing insights.
Conclusion
The Change Healthcare cyberattack served as a stark reminder of the urgent need for healthcare organizations to fortify their cybersecurity posture.
By implementing proactive measures such as employee training, preventive investments, diversification, and collaboration, organizations can reduce vulnerability to cyber threats and safeguard patient data and healthcare services.
Advantum Health stands ready to assist in navigating these challenges and supporting the industry in adapting to the evolving cybersecurity landscape.
If you have questions, concerns, or thoughts about cybersecurity, please contact our Advantum Health team.