Last week, the U.S. House of Representatives Committee on Energy and Commerce held a hearing on cybersecurity in healthcare. The U.S. Department of Homeland Security (DHS) Cybersecurity Task Force also just released a report suggesting that current guidelines are not adequate to meet the current situation.
The hearing was prompted by the recent wave of ransomware infecting healthcare providers worldwide, one of the most significant such attacks in history.
A recent survey on Monitor Monday, revealed that 80 percent of respondents considered cybersecurity to be either a “red hot” or “hot” topic in healthcare. Hospitals are under attack, at risk of losing their electronic medical records (EMRs). Malware infects hospitals’ information systems, then encrypts their data. In order to get the electronic “key” to unlock the data, a ransom must be paid.
Here is a typical message:
“Your important files are encrypted. Many of your documents, photos, videos, databases, and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service. We guarantee that you can recover all your files safely and easily. You have only three days to submit the payment. After that, the price will be doubled. Also, if you don’t pay in seven days, you won’t be able to recover your files forever.”
Not only healthcare establishments are vulnerable. This week the University College London (UCL) was hit with the infamous WannaCry malware. The National Security Agency (NSA) has tied this malware to North Korea, a regime long known for nefarious activities. Ransomware from that country is said to have infected more than 300,000 systems in 150 countries. Entire web hosting companies have been infected, resulting in the complete collapse of hundreds of websites and all associated cloud services supplying enterprise software.
The heartland is vulnerable. The most recent reported attack on a hospital in the United States took place late last week at the Waverly Health Center, a hospital in Cedar Falls, Iowa. A few weeks ago, ransomware hit a senior living community in Dallas, Texas. It is impossible to keep track of this deluge of malware attacks against hospitals and other healthcare facilities.
Cybersecurity Framework for Healthcare Providers
Consideration is being given to modifying Section 405(d) of the Medicare law with a view toward developing a “cybersecurity framework.” Federal agencies would be asked to harmonize “existing and future laws and regulations” across the healthcare industry. Work would begin on identifying best practices that are “scalable” from the smallest to largest healthcare organizations.
The Cyber Security Task Force report calls for the U.S. Department of Health and Human Services (HHS) to create a “cybersecurity leader role” to help align efforts across the nation’s healthcare sector. It is not entirely clear what “align” means. This leadership nexus would serve as a “single point of entry for health care industry partners” needing to share information on cyber threats.
The Stark Law and the Anti-Kickback Statute also may be modified to make it possible for cybersecurity organizations to share information and recommend software to physicians.
Medical devices are a particular area of concern. A task force is being put together to study the cybersecurity of all forms of medical devices, including implants. This promises to be a complex and difficult job, but it is viewed as being imperative.
As it creates new products, the government may start to require medical device manufacturers to adopt a secure systems development lifecycle (SDLC). Eventually, we may see approval of medical devices becoming contingent upon certification that they have been developed according to these more rigorous standards.
The backbone information systems that run healthcare are of great concern as well. It is generally recognized that many of these older systems are not as up-to-date on cybersecurity as they should be. More effort will be put into study of how these legacy information systems can be made less vulnerable to malware and other forms of hacking.
In order to better coordinate a national response to cyberattacks, the government will create MedCERT: The Medical Computer Emergency Readiness Team.
There are many recommendations and observations in the just-released report. It should be mandatory reading for every employee of ICT in every single healthcare organization across the United States.
We can be reasonably sure that eventually, healthcare organizations will be audited to make sure that they are in compliance with government-approved and certified cybersecurity practices. This was attempted in the past, but this new wave of malware has revived the notion. Thus, an entire new industry of auditors could be created: The Cyber RACs (Recovery Audit Contractors).
RACmonitor will continue to keep an eye on these developments.
I had the pleasure of attending the annual California Health Information Conference in Long Beach, California, as an attendee and as a speaker, last week.
In the ever-evolving world of health information, few transitions generate as much anticipation and uncertainty as the adoption of a new international classification system. The
Please log in to your account to comment on this article.
Sepsis sequencing continues to challenge even experienced coding and CDI professionals, with evolving guidelines, documentation gaps, and payer scrutiny driving denials and data inconsistencies. In this webcast, Payal Sinha, MBA, RHIA, CCDS, CDIP, CCS, CCS-P, CCDS-O, CRC, CRCR, provides clear guideline-based strategies to accurately code sepsis, severe sepsis, and septic shock, assign POA indicators, clarify the relationship between infection and organ dysfunction, and align documentation across teams. Attendees will gain practical tools to strengthen audit defensibility, improve first-pass accuracy, support appeal success, reduce denials, and ensure accurate quality reporting, empowering organizations to achieve consistent, compliant sepsis coding outcomes.
Expert presenters Kathy Pride, RHIT, CPC, CCS-P, CPMA, and Brandi Russell, RHIA, CCS, COC, CPMA, break down complex fracture care coding rules, walk through correct modifier application (-25, -57, 54, 55), and clarify sequencing for initial and subsequent encounters. Attendees will gain the practical knowledge needed to submit clean claims, ensure compliance, and stay one step ahead of payer audits in 2026.
Accurately determining the principal diagnosis is critical for compliant billing, appropriate reimbursement, and valid quality reporting — yet it remains one of the most subjective and error-prone areas in inpatient coding. In this expert-led session, Cheryl Ericson, RN, MS, CCDS, CDIP, demystifies the complexities of principal diagnosis assignment, bridging the gap between coding rules and clinical reality. Learn how to strengthen your organization’s coding accuracy, reduce denials, and ensure your documentation supports true medical necessity.
Denials continue to delay reimbursement, increase administrative burden, and threaten financial stability across healthcare organizations. This essential webcast tackles the root causes—rising payer scrutiny, fragmented workflows, inconsistent documentation, and underused analytics—and offers proven, data-driven strategies to prevent and overturn denials. Attendees will gain practical tools to strengthen documentation and coding accuracy, engage clinicians effectively, and leverage predictive analytics and AI to identify risks before they impact revenue. Through real-world case examples and actionable guidance, this session empowers coding, CDI, and revenue cycle professionals to shift from reactive appeals to proactive denial prevention and revenue protection.
In this timely session, Stacey Shillito, CDIP, CPMA, CCS, CCS-P, CPEDC, COPC, breaks down the complexities of Medical Decision Making (MDM) documentation so providers can confidently capture the true complexity of their care. Attendees will learn practical, efficient strategies to ensure documentation aligns with current E/M guidelines, supports accurate coding, and reduces audit risk, all without adding to charting time.
Join Ronald Hirsch, MD, FACP, CHCQM for The PEPPER Returns – Risk and Opportunity at Your Fingertips, a practical webcast that demystifies the PEPPER and shows you how to turn complex claims data into actionable insights. Dr. Hirsch will explain how to interpret key measures, identify compliance risks, uncover missed revenue opportunities, and understand new updates in the PEPPER, all to help your organization stay ahead of audits and use this powerful data proactively.
Stay ahead of the 2026-2027 audit surge with “Top 10 Audit Targets for 2026-2027 for Hospitals & Physicians: Protect Your Revenue,” a high-impact webcast led by Michael Calahan, PA, MBA. This concise session gives hospitals and physicians clear insight into the most likely federal audit targets, such as E/M services, split/shared and critical care, observation and admissions, device credits, and Two-Midnight Rule changes, and shows how to tighten documentation, coding, and internal processes to reduce denials, recoupments, and penalties. Attendees walk away with practical best practices to protect revenue, strengthen compliance, and better prepare their teams for inevitable audits.
As AI reshapes healthcare compliance, the risk of biased outputs and opaque decision-making grows. This webcast, led by Frank Cohen, delivers a practical Four-Pillar Governance Framework—Transparency, Accountability, Fairness, and Explainability—to help you govern AI-driven claim auditing with confidence. Learn how to identify and mitigate bias, implement robust human oversight, and document defensible AI review processes that regulators and auditors will accept. Discover concrete remedies, from rotation protocols to uncertainty scoring, and actionable steps to evaluate vendors before contracts are signed. In a regulatory landscape that moves faster than ever, gain the tools to stay compliant, defend your processes, and reduce liability while maintaining operational effectiveness.
Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 1 with code CYBER25
CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24
