LAByrinth

Cyberattacks and their Negative Impacts on Patient Care

In referencing his song “Movin’ Out,” Billy Joel might’ve called it a “Cyber attack ack ack ack ack ack ack,” but that’s him and this is us.

According to a recent survey by Proofpoint and Ponemon, healthcare cyberattacks not only negatively impact patient care but also sometimes lead to increased mortality. From 677 US-based healthcare IT and cybersecurity respondents come the following excerpted items:

• Healthcare cyberattacks are becoming more frequent, with most respondents reporting that their organizations were the target of at least one cyberattack in the past year. However, the number of attacks per organization averaged at – are you ready? – 43.
• The financial burden of ransomware attacks on healthcare organizations is rising.
• Supply chain attacks were the most likely to negatively impact patient care, resulting in patient deaths for 36% of victim organizations.
• 96% of the surveyed organizations reported “at least two incidents of data loss or exfiltration involving sensitive and confidential healthcare data over the past two years,” with more than half reporting observing disruptions in patient care due to this.

The survey reveals that healthcare cyberattacks not only impact IT issues but also pose life-and-death risks. That’s because when care is delayed, disrupted, or compromised due to a cyberattack, patient outcomes are significantly impacted, putting lives at risk.  

You’ll want to take every possible step on your end to ensure that physical and technological security protocols are in place and that HIPAA guidelines are followed. You not only have patients’ data to protect, but your laboratory’s sensitive business/operational/financial data which can be compromised as well.

(ADS strictly adheres to HIPAA regulations, and our servers are hosted by Equinix®, a SOC 1 and SOC 2 certified global leader in cloud hosting. We’ve never experienced an intrusion or cyber event!)

Laboratory Fraud of the Month

Effective September 3, 2025, the Office of the Inspector General (OIG) excluded an IL-based laboratory from participating in all Federal health care programs for a period of 10 years.

The exclusions were imposed based on the laboratory’s submission of claims for: (1) mileage under HCPCS Code P9603 that were improperly inflated in excess of the actual mileage driven by phlebotomists, or not properly prorated, or both; (2) travel allowance when only a fingerstick blood draw was performed which is not payable collections under Medicare rules; and (3) claims for travel allowance and laboratory services (i.e., clotting tests, catheterizations, venipunctures and A1C tests) that were never rendered.

Exclusion is the most severe civil sanction that can be imposed by HHS-OIG and is most commonly due to conviction of a felony or misdemeanor related to a federally funded healthcare program, although individuals and entities can be added to the exclusion list for a variety of reasons. The duration of the exclusion depends on several factors and can range from a few months to permanent exclusion.

Click here for the OIG’s details of this case.

Benefits Investigations: Everyone is a Detective

It may not be a “Where were you on the night of August 4^th,” type of investigation, but it is the kind that can be irksome, especially when benefits investigations (BI) involve genetic testing, although it shouldn’t be surprising. It appears that increasingly, patients want to know in advance about their costs for expensive genetic testing.

In other words, they want to investigate their benefits. They don’t want surprises. This appears to be especially true for patients with high deductibles.

Staff doing BIs for patients can be time consuming and derailing unless you have access to a pre-test patient responsibility estimator. If you do, then providing at least very close estimates if not exact amounts (1) make BIs so much easier to perform, (2) help avoid surprises, (3) work to keep patient A/R manageable, and (4) empower you to invoke your laboratory’s financial policy on patient responsibility balances.

You’d no doubt agree that going into expensive genetic testing knowing in advance what patients will owe, even approximately, would help solve the BI/no-surprises issue.

(ADSRCM clients can access the MedicsPremier patient responsibility estimator; ADS clients can as well if MedicsPremier is preferred as an in-laboratory system.)