"MGMA 2019: Ransomware, phishing scams a growing threat in healthcare"

October 17, 2019

News

Healthcare attorney Isabelle Bibet-Kalinyak, partner at McDonald Hopkins LLC, in Cleveland, Ohio, raised the alarm on cyber security for physician practices at the MGMA 2019 conference in New Orleans.

During her presentation on medical records and HIPAA, Bibet-Kalinyak said that 76 percent of types of medical records breaches are due to hacking and IT incidents.

The second most common type of breach is theft at 15 percent, loss at 10 percent, and unauthorized use at four percent.

Some of the most common forms these breaches take are due to ransomware and phishing of cloud computing service providers, Bibet-Kalinyak says. There has been an increase in these malicious cyber breaches rather than coincidental or accidental breaches.

Ransomware is when a bad actor gains access to your computer system and holds your files hostage until you pay a specific sum of money, usually through untraceable means such as gift cards or cryptocurrency. Phishing refers to the act of using fraudulent emails—which often mimic an email from a colleague or someone the victim knows—to attempt to gain access to a computer system by the victim simply giving their login and password away.

In the past, larger health systems have been the most popular targets of these kinds of scams, but Bibet-Kalinyak warns that the smaller practices aren’t safe.

“They’re targeting smaller practices,” she says. “The first attacks are against hospitals [and hackers] said, ‘we want $5 million or you can’t touch your chart. It’s a prisoner.’ Now they’re going after small practices and they say, ‘$10,000 [to] $50,000 and we’ll release your records.’

Click here to read the full article.

Over the past 24 months, the U.S. Department of Health and Human Services Office for Civil Rights has brought notable enforcement efforts against several non-profit covered entities and business associates, resulting in instances of six and seven-figure penalties against providers across the county for incidents involving breaches of protected health information.

A new amendment to New York state law, which would have required all healthcare providers to obtain separate consents from patients for treatment and payment is on hold until further guidance is released, according to the New York Department of Health.

On November 1, 2024, the Centers for Medicare & Medicaid Services issued the Medicare Physician Fee Schedule 2025 final rule, which establishes new advanced primary care management billing codes that will expand opportunities for physician practices, federally qualified health centers, rural health clinics and other health care providers to get paid for services provided by clinical staff under the direction of a physician, nurse practitioner or physician assistant beginning January 1, 2025.

"MGMA 2019: Ransomware, phishing scams a growing threat in healthcare"

Related Services

You may also be interested in