EDITOR’S NOTE: Edward Roche, in association with RACmonitor, is writing a series on the need for U.S. healthcare facilities to protect themselves from cybercriminals demanding ransoms for patient records. This is the fifth installment in that series and comes on the heels of a reported cyberattack Tuesday at Heritage Valley Health System, based in Sewickley, Pa.
The U.S. House of Representatives’ Committee on Energy and Commerce held a hearing last week on cybersecurity in healthcare. In addition, the U.S. Department of Homeland Security (DHS) Cybersecurity Task Force recently released a report suggesting that current guidelines are not adequate to meet the threat posed by cyberattacks.
Of particular concern is risk associated with medical devices, especially when they are connected to networks.
If your devices become infected with malware, then it may start to alter their data, leading to incorrect diagnoses. This could result in deadly consequences in many cases. Hackers could connect to a device, break in, then change its function – for example, something like a heartbeat monitor might be changed into an eavesdropping device.
In the same way that websites sometimes are obstructed and made unreachable by a firestorm of robot-generated inquiries – a “distributed denial of service,” or DDoS, attack – so too would it be possible for devices and the networks that support them to be shut down or made unusable by a sudden and uncontrolled flood of information or requests.
It also is possible that medical devices could be converted into a portal from, through which sensitive patient data could be exfiltrated out of a health provider’s information system. In this case, the login and security credentials of the device itself would be harnessed in order to gain entry into the back-end information system containing patient information.
Sale on the Dark Web
The prices for raw patient data are not terribly high. Reports from the Identity Theft Resource Center indicate that there were 355 breaches of patient information in 2016, constituting about 15 million records. Banner Health in Phoenix, Ariz. lost 3.7 million records; Newkirk Products in New York City lost 3.3 million; 21st Century Oncology in Fort Myers, Fla. lost data on 2.2 million individuals; and such examples go on and on.
The records have a fluctuating price on the dark web: a place where illegal transactions take place behind a wall of encryption and virtual IP addresses. On a per-record basis, patient medical records go for between 24 cents and $2 per patient.
There are relatively low prices because this information represents only preliminary raw material being used for fraud. After obtaining items such as birthdates, social security numbers, driver’s license information, insurance information, and other details, then the trained criminal can begin the process of impersonating the identity of patients.
New Audits on the Way
In 2017, we will see a wave of new audits of healthcare providers. These will not come from the Recovery Audit Contractors (RACs) but instead from the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Evidently, the Civil Rights Act has been broadened in its scope to allow the government to audit providers, because having one’s personal information kept securely is considered to be a “civil right.” The audits are not only targeting hospitals, but also business associates. What types of punishment are available? Both civil fines and criminal penalties are being leveraged by the government to encourage good practices.
We can expect much more audit risk from cyber in the future, and we will continue to discuss these new audits in future installments of this series in RACmonitor.
EDITOR’S NOTE: Matt Bridge continues his three-part series on how to achieve a high-performing revenue cycle for your facility. Bridge reports that you need an
EDITOR’S NOTE: Senior healthcare consultant, Rose Dunn, past president of AHIMA, reported this story today during her appearance on Talk Ten Tuesdays. The Electronic Health
Please log in to your account to comment on this article.
Accurately determining the principal diagnosis is critical for compliant billing, appropriate reimbursement, and valid quality reporting — yet it remains one of the most subjective and error-prone areas in inpatient coding. In this expert-led session, Cheryl Ericson, RN, MS, CCDS, CDIP, demystifies the complexities of principal diagnosis assignment, bridging the gap between coding rules and clinical reality. Learn how to strengthen your organization’s coding accuracy, reduce denials, and ensure your documentation supports true medical necessity.
Denials continue to delay reimbursement, increase administrative burden, and threaten financial stability across healthcare organizations. This essential webcast tackles the root causes—rising payer scrutiny, fragmented workflows, inconsistent documentation, and underused analytics—and offers proven, data-driven strategies to prevent and overturn denials. Attendees will gain practical tools to strengthen documentation and coding accuracy, engage clinicians effectively, and leverage predictive analytics and AI to identify risks before they impact revenue. Through real-world case examples and actionable guidance, this session empowers coding, CDI, and revenue cycle professionals to shift from reactive appeals to proactive denial prevention and revenue protection.
Sepsis remains one of the most frequently denied and contested diagnoses, creating costly revenue loss and compliance risks. In this webcast, Angela Comfort, DBA, MBA, RHIA, CDIP, CCS, CCS-P, provides practical, real-world strategies to align documentation with coding guidelines, reconcile Sepsis-2 and Sepsis-3 definitions, and apply compliant queries. You’ll learn how to identify and address documentation gaps, strengthen provider engagement, and defend diagnoses against payer scrutiny—equipping you to protect reimbursement, improve SOI/ROM capture, and reduce audit vulnerability in this high-risk area.
Only ICD10monitor delivers what you need: updates on must-know changes associated with the FY26 IPPS, including new ICD-10-CM/PCS codes, CCs/MCCs, and MS-DRGs, plus insights, analysis and answers to your questions from two of the country’s most respected subject matter experts.
As AI reshapes healthcare compliance, the risk of biased outputs and opaque decision-making grows. This webcast, led by Frank Cohen, delivers a practical Four-Pillar Governance Framework—Transparency, Accountability, Fairness, and Explainability—to help you govern AI-driven claim auditing with confidence. Learn how to identify and mitigate bias, implement robust human oversight, and document defensible AI review processes that regulators and auditors will accept. Discover concrete remedies, from rotation protocols to uncertainty scoring, and actionable steps to evaluate vendors before contracts are signed. In a regulatory landscape that moves faster than ever, gain the tools to stay compliant, defend your processes, and reduce liability while maintaining operational effectiveness.
Get clear, practical answers to Medicare’s most confusing regulations. Join Dr. Ronald Hirsch as he breaks down real-world compliance challenges and shares guidance your team can apply right away.
Federal auditors are zeroing in on Inpatient Rehabilitation Facility (IRF) and hospital rehab unit services, with OIG and CERT audits leading to millions in penalties—often due to documentation and administrative errors, not quality of care. Join compliance expert Michael Calahan, PA, MBA, to learn the five clinical “pillars” of IRF-PPS admissions, key documentation requirements, and real-life case lessons to help protect your revenue.
During this essential RACmonitor webcast Michael Calahan, PA, MBA Certified Compliance Officer, will clarify the rules, dispel common misconceptions, and equip you with practical strategies to code, document, and bill high-risk split/shared, incident-to & critical care E/M services with confidence. Don’t let audit risks or revenue losses catch your organization off guard — learn exactly what federal auditors are looking for and how to ensure your documentation and reporting stand up to scrutiny.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 1 with code CYBER25
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
