The Ransomware Crisis: Part I

EDITOR’S NOTE: Following last week’s global cyberattack that spread through approximately 150 nations, particularly impacting the U.K.’s National Health Service, Edward Roche, in association with RACmonitor, is producing a series on the need for healthcare facilities in the U.S. to protect themselves from cybercriminals, demanding ransom for patient records. This is the first in a series of stories on the ransomware crisis.

The world is now witnessing one of the largest ransomware attacks in history. Computers all over the world have been hit, particularly in the United Kingdom. Healthcare providers, including both large and small hospitals and medical practices, have been a significant focus of the attacks.

In the U.S., the Department of Homeland Security has mobilized a full task force. The President of the United States issued an executive order on “Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure.” It is rumored that some of the tools used were taken from the infamous “Vault 7” materials stolen from the Central Intelligence Agency’s Center for Cyber Intelligence. These tools – malware, viruses, trojans, weaponized “zero day” exploits, malware remote control systems amounting to several hundred million lines of computer code – spread quickly across the Internet. It is impossible to determine the identity of the attacker, or even if the attacker was a human or an artificial intelligence algorithm that is out of control.

When the information system of a healthcare provider is infected with ransomware, a special computer virus will encrypt most if not all of its electronic medical records (EMR) data. In order to get the electronic “key” to “unlock” the data, a ransom must be paid. Often, even when the ransom is paid, the decryption key does not work, and the data needs to be restored from backup or paper records. The costs to the attacked healthcare provider may go far beyond the financial outlay of the ransom, putting at risk its ability to provide patient care, its ability to collect revenue, its reputation in the community, and even exposing it to legal liability for putting highly confidential patient data in jeopardy.

The Illusion of Effective Security

We can be sure that every organization under attack believes it has in place a full panoply of safeguards, firewalls, consultants, defensive software, and possibly even cyber insurance, all aimed at keeping out of harm’s way should an incident occur. And it all may still fail. Whatever is in place, no matter how advanced, may be unable to withstand the onslaught of specially designed hacking tools paid for at great expense by the American taxpayer and intended originally to safeguard security, not obliterate it.

Where does that leave us today? At a minimum, healthcare organizations are and should be doing the following:

  • Reviewing their policies and procedures in place to see if they are up to date with the latest cyber threats;

  • Learning what financial resources are in place in case it is necessary to make a giant and unexpected cash payment;

  • Making sure their IT systems and applications are up to date and properly patched to guard against known ransomware exploits;

  • Maintaining off-site backups to allow replacement of corrupted or stolen operational data; and

  • Examining the role of law enforcement and even national security experts in helping solve the problem.

Yet even these relatively technical and defensive steps will not resolve the problem, because the reality is that in the United States, we have built a giant, loosely integrated Medicare and Medicaid billing system that has so many points of vulnerability, they could not be counted.

Clear and Present Danger

The United States operates the world’s most complex claims processing system. For Medicare alone, around 5 million claims are processed every day. But instead of having a single integrated information system, the U.S. government has fallen into the habit of outsourcing much of its critical information infrastructure to third-party private subcontractors.

So, how does it work?  Each healthcare provider – and there are more than 5,000 hospitals alone in the U.S. – operates an information system that keeps track of its service delivery and billing. When claims are ready for the government, they are filed not with the government, but with a subcontractor. These subcontractors in turn must process these billions of claims and then pass them along to the the next level of process, also paid subcontractors. Finally, once the claims are electronically organized, they are transmitted to the federal government.

The problem with this arrangement is that at every level there is potential vulnerability. There are over one million Medicare providers. There may be exceptions, but we can assume that every one of these providers is operating an information system. Consequently, if only one out of a million information systems becomes infected with ransomware, the whole system could be taken down.

This infection would then hitch a ride on the Medicare claims that are filed. They would travel up the system to the next level of claims processing, usually the giant claims clearinghouses. These also would become infected. Finally, the malware would be sent directly into the heart of the federal government’s claims processing system.

If this happened, the entire Medicare system could be held hostage in a massive, unprecedented ransomware attack. 

So ask yourself – out of the more than one million providers, what is the chance that at least one provider-operated computer will become infected?

The odds are good – for the extortionist – but this is not such great news for the rest of us.

Print Friendly, PDF & Email
Facebook
Twitter
LinkedIn

Edward M. Roche, PhD, JD

Edward Roche is the director of scientific intelligence for Barraclough NY, LLC. Mr. Roche is also a member of the California Bar. Prior to his career in health law, he served as the chief research officer of the Gartner Group, a leading ICT advisory firm. He was chief scientist of the Concours Group, both leading IT consulting and research organizations. Mr. Roche is a member of the RACmonitor editorial board as an investigative reporter and is a popular panelist on Monitor Mondays.

Related Stories

Leave a Reply

Please log in to your account to comment on this article.

Featured Webcasts

Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Leveraging the CERT: A New Coding and Billing Risk Assessment Plan

Frank Cohen shows you how to leverage the Comprehensive Error Rate Testing Program (CERT) to create your own internal coding and billing risk assessment plan, including granular identification of risk areas and prioritizing audit tasks and functions resulting in decreased claim submission errors, reduced risk of audit-related damages, and a smoother, more efficient reimbursement process from Medicare.

April 9, 2024
2024 Observation Services Billing: How to Get It Right

2024 Observation Services Billing: How to Get It Right

Dr. Ronald Hirsch presents an essential “A to Z” review of Observation, including proper use for Medicare, Medicare Advantage, and commercial payers. He addresses the correct use of Observation in medical patients and surgical patients, and how to deal with the billing of unnecessary Observation services, professional fee billing, and more.

March 21, 2024
Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets

Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets

Explore the top-10 federal audit targets for 2024 in our webcast, “Top-10 Compliance Risk Areas for Hospitals & Physicians in 2024: Get Ahead of Federal Audit Targets,” featuring Certified Compliance Officer Michael G. Calahan, PA, MBA. Gain insights and best practices to proactively address risks, enhance compliance, and ensure financial well-being for your healthcare facility or practice. Join us for a comprehensive guide to successfully navigating the federal audit landscape.

February 22, 2024
Mastering Healthcare Refunds: Navigating Compliance with Confidence

Mastering Healthcare Refunds: Navigating Compliance with Confidence

Join healthcare attorney David Glaser, as he debunks refund myths, clarifies compliance essentials, and empowers healthcare professionals to safeguard facility finances. Uncover the secrets behind when to refund and why it matters. Don’t miss this crucial insight into strategic refund management.

February 29, 2024
2024 ICD-10-CM/PCS Coding Clinic Update Webcast Series

2024 ICD-10-CM/PCS Coding Clinic Update Webcast Series

HIM coding expert, Kay Piper, RHIA, CDIP, CCS, reviews the guidance and updates coders and CDIs on important information in each of the AHA’s 2024 ICD-10-CM/PCS Quarterly Coding Clinics in easy-to-access on-demand webcasts, available shortly after each official publication.

April 15, 2024

Trending News

Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →

SPRING INTO SAVINGS! Get 21% OFF during our exclusive two-day sale starting 3/21/2024. Use SPRING24 at checkout to claim this offer. Click here to learn more →