Facebook Fallout Becoming a Social Media Menace

Many healthcare professionals have unwittingly placed their facilities at risk for ransomware attacks.

Many of us watched Mark Zuckerberg testify before Congress last week, in the wake of the news that Facebook had released the data of 87 million users to a company named Cambridge Analytica, which in turn sold the data to political campaigns. 

Let’s briefly talk about what happened at Facebook. A researcher named Aleksandr Kogan developed a Facebook application, or “app.” It was one of those “take a quiz” apps, on the surface. Unfortunately, if you took the quiz, your Facebook information was sent to the app creator. No big foul yet. 

Now, this was a special app. It then pulled the information of all your friends and contacts on Facebook, without their permission. Here is how we get to 87 million users. The app then went on to gather data of the contacts of your contacts – the way a virus spreads.   

Facebook and government bodies are still figuring out how much information was gathered. Cambridge Analytica has confirmed it also harvested some private messages. Facebook told them to delete the data once they found out what happened. The folks at Cambridge Analytica said they did, then continued selling the data to political campaigns. 

Mr. Kogan, who began working for Cambridge Analytica after creating the app, insists that the app was modified to collect only user names, birth dates, and pages users liked. We only have the assurances of Mr. Kogan and Cambridge Analytica on what data they have, and we already know they have been less than forthcoming.

Why is this such a big concern for healthcare? If I know enough about you, I can breach your system accounts. If I know where you work, I can find out what systems are used by your healthcare company. I can get your company email address. If I just know where you work and your name, I can use it to send emails with hacking tools to you and your coworkers that look like they are coming from you. 

Let’s assume that we trust Cambridge Analytica, and someone knows your name, birth date, and the Facebook pages you liked. Lots of people like their employers’ Facebook pages. Now I have your name, employer’s name, and your birth date. I can Google your company domain by Googling your company.  Knowing your name and company domain, I can figure out your email address. 

With just this much, I can start sending emails to you and your fellow employees. I can include special programs that allow me to take over computers in your company to access information – or maybe just lock the computers and demand payments to unlock them. If I can get control of your computer, maybe I can also log in to software with patient information that I can sell to identity thieves. 

What can be done? First, a dose of reality: social media is here to stay. Platforms like Facebook are free to users, and Facebook makes huge profits from advertisements. Facebook users are the product. Facebook can’t allow users to block themselves off completely from advertisers – or potential hackers that want to use social media to break into systems. 

Here are some common-sense things that can be done, keeping all this in mind.

First, you can start by being wary of emails that seem odd, like Dunn & Bradstreet suddenly needing a response to an impending issue when you never deal with this kind of information. Without opening such emails, notify your IT department. If you open an email that seems odd, immediately call IT. 

Next, be careful what you share about your company on social media. You may think you know the members of a group of fellow employees on Facebook. You may not know them as well as you think. Consider staying away from these groups, or clearing memberships with your IT department.  Review your company’s social media rules and comply with them.

Follow Mark Zuckerberg’s advice and review the privacy agreements and settings for your social media applications. If you are not comfortable with the privacy rules of a social media company, maybe you don’t need to use their apps. If you are comfortable, ask yourself: what privacy settings do you want to use for your account?

Never use personal information to make up company passwords. Change your passwords regularly, even if it is not required by your IT department.  Consider adopting the same rules for your passwords for personal use. 

When you walk away from your computer, lock it. You should also change your computer settings on your company computer to lock it after a period of inactivity. Even if someone can get access to your computer, they may not be able to unlock it without your computer login password. 

All of these rules are like buying an alarm for your house or a getting a guard dog. You can’t guarantee you will stop any thief, but you can get them to pick the easier house down the block.

 

Comment on this article

Facebook
Twitter
LinkedIn

Timothy Powell, CPA, CHCP

Timothy Powell is a nationally recognized expert on regulatory matters, including the False Claims Act, Zone Program Integrity Contractor (ZPIC) audits, and U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) compliance. He is a member of the RACmonitor editorial board and a national correspondent for Monitor Mondays.

Related Stories

Leave a Reply

Please log in to your account to comment on this article.

Featured Webcasts

I050825

Mastering ICD-10-CM Coding for Diabetes and it’s Complications: Avoiding Denials & Ensuring Compliance

Struggling with ICD-10-CM coding for diabetes and complications? This expert-led webcast clarifies complex combination codes, documentation gaps, and sequencing rules to reduce denials and ensure compliance. Dr. Angela Comfort will provide actionable strategies to accurately link diabetes to complications, improve provider documentation, and optimize reimbursement—helping coders, CDI specialists, and HIM leaders minimize audit risks and strengthen revenue integrity. Don’t miss this chance to master diabetes coding with real-world case studies, key takeaways, and live Q&A!

May 8, 2025

Trending News

Featured Webcasts

Navigating the 3-Day & 1-Day Payment Window: Compliance, Billing, and Revenue Protection

Navigating the 3-Day & 1-Day Payment Window: Compliance, Billing, and Revenue Protection

Struggling with CMS’s 3-Day Payment Window? Join compliance expert Michael G. Calahan, PA, MBA, CCO, to master billing restrictions for pre-admission and inter-facility services. Learn how to avoid audit risks, optimize revenue cycle workflows, and ensure compliance across departments. Critical for C-suite leaders, providers, coders, revenue cycle teams, and compliance teams—this webcast delivers actionable strategies to protect reimbursements and meet federal regulations.

May 15, 2025
Audit-Proof Your Wound Care Procedures: Expert Insights on Compliance and Risk Mitigation

Audit-Proof Your Wound Care Procedures: Expert Insights on Compliance and Risk Mitigation

Providers face increasing Medicare audits when using skin substitute grafts, leaving many unprepared for claim denials and financial liabilities. Join veteran healthcare attorney Andrew B. Wachler, Esq., in this essential webcast and master the Medicare audit process, learn best practices for compliant billing and documentation, and mitigate fraud and abuse risks. With actionable insights and a live Q&A session, you’ll gain the tools to defend your practice and ensure compliance in this rapidly evolving landscape.

April 17, 2025
Utilization Review Essentials: What Every Professional Needs to Know About Medicare

Utilization Review Essentials: What Every Professional Needs to Know About Medicare

Dr. Ronald Hirsch dives into the basics of Medicare for clinicians to be successful as utilization review professionals. He’ll break down what Medicare does and doesn’t pay for, what services it provides and how hospitals get paid for providing those services – including both inpatient and outpatient. Learn how claims are prepared and how much patients must pay for their care. By attending our webcast, you will gain a new understanding of these issues and be better equipped to talk to patients, to their medical staff, and to their administrative team.

March 20, 2025

Rethinking Observation Metrics: Standardizing Data for Better Outcomes

Hospitals face growing challenges in measuring observation metrics due to inconsistencies in classification, payer policies, and benchmarking practices. Join Tiffany Ferguson, LMSW, CMAC, ACM, and Anuja Mohla, DO, FACP, MBA, ACPA-C, CHCQM-PHYADV as they provide critical insights into refining observation metrics. This webcast will address key issues affecting observation data integrity and offer strategies for improving consistency in reporting. You will learn how to define meaningful metrics, clarify commonly misinterpreted terms, and apply best practices for benchmarking, and gain actionable strategies to enhance observation data reliability, mitigate financial risk, and drive better decision-making.

February 25, 2025

Trending News

Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →

CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24