Cybersecurity Contingency Planning 101

Introduction

Welcome, everyone, to today's session, Cybersecurity Continuity Planning one hundred and one, Are You Prepared to Keep Cash Flowing? On behalf of Becker's Healthcare, thanks for joining us today. With that, I'm pleased to introduce today's speakers, Greg Surlak, Senior Vice President and Chief Information Security Officer at FinCRIBE and Jonathan Rick, vice president of health insights at Synthrive. Thank you, Greg and John, for being here today. I'll turn the floor over to you.

Great. Thank you, Mariah. And, thank you, Greg, for your preparation with this, and thank all of you that are on the phone for, taking some time out of your very busy days to talk about, I think, a a a very relevant topic. We had quite a few folks registered for this, and Greg and I are excited to tell you what's going on in the market and then, how to be best prepared.

Chapter

Statistics and Recent Cybersecurity Events

I don't think you know what you know. Right? And, there are unknowns that you don't know, and we'll walk through what that is. Some stats I'm gonna go over here for a minute and then talk specifically about some of the things that have happened with Change Healthcare and Ascension, you know, kinda two of the the larger events that have kinda sentinel events, I would call them, in the last, quarter or so.

This is alarming to me. I shared this with Greg, earlier, in the year, and and, him and I were kinda looking at it going, wow. And, it it doesn't seem to be getting any better.

What you hear mostly too, I think, when these cyberattacks happen is is, you know, how it happened and how much ransom was paid and all of that. There isn't a ton of dialogue out there about that orange line, which really is this personal health information. There was four terabytes at the change health care event, for example, that alpha black cat, managed to get at. And, you know, what's happening with that data?

What's the impact? What's the identity theft? The financial or or personal or privacy implications of that is something that I always wanna keep at at the ground as we're looking. So I I think that's very, very important.

We're gonna talk a lot about cyber resiliency and how that impacts specifically areas of revenue cycle and keeping cash flowing. But, this is not a good trend. It's projecting to be about a hundred and forty five ransomware attacks this year. We're already a little over half of that, going forward.

Chapter

Impact and Response to Data Breaches

And and, you know, we're gonna, breach that that, you know, hundred and twenty or or a hundred and forty five million, you know, PHI being exposed as well. So I I I will keep recording this information, understanding it where it's at. The sources are there below as you're looking. You don't wanna end up necessarily where where mister Witte has ended up here in congress.

I think, this was a a pretty, you know, deep and I would argue, rough day for for for the UnitedHealth Group CEO, in terms of defending what will probably go down in history, one of health care's largest breaches. He was answering some really, really tough questions from, the, the the senate finance committee, surrounding how did this happen, what was the the entry point of it. I've got some detailed slides on that.

He was very apologetic, and and has said that UnitedHealth Group and and change for that matter have, made significant strides and steps since this event, to, prevent it to the best they can going forward at Optum and others. I I think, we've only seen at least, you know, in the first quarter, my opinion is that there's more to come coming out of this in terms of just as we start peeling away the layers and understanding what's going on and and what happened.

Chapter

Understanding the Implications

We'll start to understand what that means. And I've got some slides too on what does that look like from the different kind of stakeholders in the market, whether you be, a a health information technology company like Finthrive. And Greg will get into some of the things that we're doing. Or maybe you're a provider, a health system, or or or a a multi specialty clinic, or maybe you're a payer, that's listening today or or or or an attorney or whoever.

Just what are all the different pieces, and what do we expect to see going forward? Well, let's talk about what happened with Change Healthcare a little bit. There's a lot going on in the slide. I'm not gonna read it to you.

You're you're listening to a Becker's webinar, so you're all wicked brilliant folks, that could see it. But, you know, this started back in September.

UnitedHealth Group put an announcement and unplugged, you know, the change, you know, software solutions that were impacted.

Most, business partners and others that were connected rapidly disconnected as well.

And and then you started seeing kinda inquiries come from the associations, MGMA.

And then, you know, typical with these ransomware attacks, there are folks that claims responsibility. There's payments going back and forth, and then a timetable was announced from United surrounding this CHOP program or the change health care, outage payment distribution is what that stands for, program.

Chapter

OCR Investigation and Government Involvement

OCR opened an investigation in March.

CMS issued some guidance for payment. I think everyone was really concerned about how we get claims and and to some extent, eligibility back online to where claims can get out the door, be it whatever model, paper, plastic, through the portal, or through other options, to get that going. And and that was a matter of weeks, but it it there's still, from what I understand, some level of things that are having to get reconciled for remittance and payment standpoint. Most of the stuff's over the wall from a claim standpoint, and then, you know, we just gotta figure out where we're at from the rest of this. The federal government's gotten involved. The bill proposed by, democrat out of out of Virginia, senator Warner, setting some requirements for companies such as Finthrive and others in terms of what's happening. There are six clash action lawsuits, pending with change, that number will probably go up.

Chapter

UnitedHealth Group CEO's Defense

United has announced in late March that the attestation was complete. They're gonna fire everything back up.

They they've shelled out about five billion as of April payments. I believe that number is closer to eight now. And, they are looking to to under to understand exactly what it looks like from a scope standpoint as they move forward. And they learned, I think, something that was very important is that MFA or multifactor authentication wasn't enabled in one of the legacy systems on the chain side, and that caused a a relatively easy door to open. And Greg's more of an expert in that area than I am, for a for a bad guy or girl to get in there and start tooling around. But I'll let you guys look at this stuff.

Chapter

Ascension Data Breach

Some of those green things up there absolutely are links too that you can go to, when you get a copy of these slides. Then, you know, short sixty days later, we saw Ascension, have the same thing happen. I saw something in the news. I think it was Monday of this week that they have restored their EHRs, but they were now for a little over a month.

This you know, there's we're learning more as we go. They've engaged many consulting firms.

I don't think anything's off base these days, and and Greg's gonna end this presentation with about six or seven slides about some best practices and what organizations, be it public, private, you know, on the provider side or the the the business partner side, what you can do or be aware of or mindful of as you're going, and you kinda have to put your best kind of foot forward. It's an investment, but I think there's always gonna be some level of risk in terms of these things. And it's it's, it's it's the crisis du jour too, I think, for the bad guys. They know folks are gonna pay the ransoms.

There's a big debate out there if you go look it up about whether or not that's the right thing to do too. We don't negotiate with terrorists. Right? You don't know if that's if that's something that we should be looking at going forward also. So the there there's some information here just on on what happened at Ascension, and and there's a there's a story there that you can look at.

Chapter

Survey Results and Financial Impact

Did a really nice survey, I thought, surrounding, you know, what was happening relatively quickly. And they got a hospitals that answered. Three quarters of them reported that this was directly impacting patient care on some level. They were having extraordinary reductions in cash flow.

There's some really interesting studies out there looking at the dollars and things that were stuck, during that time. The majority, ninety four percent, reported this is absolutely impacting them financially with significant or serious implications. One in three indicated the attack has just prompted more than half of their revenue. They've implemented workarounds.

Some had professional, clearing houses that they just cut over to. Some had portals and went there. Some went completely to paper. Some didn't do anything and just put everything in a can and unscrewed it thirty days later and dumped it back out and submitted.

It was kinda all over the place. And, I think the market and and and and ThinThrive and others have have learned what did work, what didn't work, what are the financial implications of that. We'll talk about the importance of having standby systems that you can maybe fail over to to ensure your your par level of your cash stays where it's at, those types of things.

Chapter

Response and Financial Implications

Somewhat effective response. I think we were all very surprised by by it happening.

Not the fact that that does happen, but the impact of it and that having, sole solutions or sole connections certainly does expose, the, operations financially, to to more implications than than what we've normally seen. This is a nice study by Strata Decisions. I I like this. They they talked about, you know, what was the actual kind of share of the claims inventory that was hit. And I like how they kinda put it in these four tranches of half a billion, half a billion to a billion, billion two and a half billion, and then greater than two and a half billion buckets of of size. And, the range was, you know, right in that seventeen percent range, in terms of of payments that were impacted in the first quarter of the year.

That's a lot, gang. If you think about your personal finances or even, your your business finances, you know, one in five of your dollars, are were stuck for a period of sixty to ninety days. That starts to, you know, impact things. And I heard, and and a lot of sources out there have talked about the CHOP program, that that outage program, the UnitedHealth Group, the calculations that were being used, some of the things that were being applied were not close to what the historical payments were, so that created a cash deficit and a day's cash on hand, issue.

Bond covenants in some cases were violated or certainly threatened, which, impacted a hospital's capital ability to borrow, in some areas. And, for the most part, I think this cash kind of, event has has ebbed back. It it certainly tied it up. It certainly tsunami ed in, but, you know, we're into June now.

Most of it is known, I would say, and then it has some quick path to mitigation, if not already mitigated. I e, the claims were already submitted. Some of the payments were already coming back, if not all. And and and that bubble in the hose, if you will, is starting to spray back out the other side, and and, cash is flowing in the way that it needed to again. But it certainly did disrupt, q one financials pretty significantly.

Chapter

Multifactor Authentication and Risk Assessments

On the MFA thing, I love this this article from from health care excellence and and, executive ex insights from, health care media. It it talks through diligence, risk assessments, and Greg's gonna get into some of these things and understanding that, you know, I'll talk about redundancy and how we have that in the clinical area, but do we have that in our financial areas to the level that we have them in some of our clinical areas in the hospital?

You're gonna see this MFA push, and I think that's pretty true. Most of us that are even consumers are used to sending that little text code to our phone, right, and and typing that in on a website. A lot of software today does not have that, and, they they're gonna look at that. I think health care is one of those areas that falls into that, and you'll start seeing some more legislation as we move forward.

Chapter

Short-term and Long-term Impact on Providers

I'm gonna spend a little bit of time on this. I know this is a super saturated slide. It's violating my own kind of covenants in in presentation presenting information to you. But I really liked, you know, you know, understanding what is happening in the short and long term and in what market.

Right? So providers absolutely in that upper left corner, were scrambling to get claims out the door. And now I think they're scrambling somewhat to get those ones that they submitted in a nontraditional way reconciled to the traditional way that they had, and that's pushes over to that long term. So what does that backlog look like?

What are those paper remittances look like? What's their ERA, EFTT, and their their their automated clearing house, you know, in terms of the checks coming back and out in and out? What does that look like for them? Long term, absolutely.

Chapter

Vendor Management and Litigation

And Greg's gonna expand on this, look at vendor management, understanding what that cybersecurity assessment is. Finthrive has absolutely been fielding, rightfully different assessments and and requirements and attestations from very large health systems in terms of our, ability to, fight off or defend cyber attacks, and and more importantly, I think address them when they occur, in in early identification understanding how well they can or can't do this in we're gonna we're gonna spend a little bit of time on that here in a minute just talking about that concept because I think it's relatively new in the market.

And, we'll talk through what it means to have a standby claims or standby eligibility system. You'll also see some litigation, and and you saw the OCRs involved. There's I I think you'll see class action lawsuits and those things from providers for, you know, their they they they may even be submitting some FEMA claims.

Certainly, you know, maybe an insurance claim for the MG and A, understanding where they're at. On the payer side, you know, they actually were more amiable than typical.

Chapter

Payer Response and Impact on eVolumes

It's a bit usually, the payers are like, that's awful. You know, good luck with that. But they they actually did some proactive research or or reach out and said, hey. How can we help?

You know, those outside of Optum as well, but they they said, you know, we'll extend the out of timely filing requirements. We realize that you're not getting, you know, active scrubbing on some of these paper things, so we'll understand where you're at. I'd be interested to hear as we get to the q and a at the end if you felt the pairs were better, worse, or same, as we went through that. If you're a provider or if you're a payer on the phone, we'd love to hear about some of the things that you did to help the providers kinda get through, this downtime of sorts as they went.

They all saw about a twenty percent reduction in eVolumes. That, you know, translates well to that cash deficit that we saw earlier from Strata.

And, you know, it was it was it was not comical, I guess, but it was interesting to me that, you you know, twenty years ago, we we were very familiar with, you know, submitting UBO fours via paper and having an OCR reader convert that to a PDF and then looking at it and then typing it in. This was like we hadn't ridden a bike before. It was very difficult for the industry to switch back from an electronic workflow to paper, and that was felt on both the provider and the payer side.

Chapter

Impact on Claims Workflow

This was amplified in in pharmacy, and it was also amplified in VA in the VA, plans. So there was a bolus of held claims and that, you know, of course, translates to held payments.

And we'll see that kinda kinda play itself out, I think, for the rest of this quarter. The regulators absolutely got involved early, that you saw the congressional hearing there with with many others.

You will see a lot of three letter and four letter words coming out of Washington in terms of people that are getting involved.

The FTC, the FDA, the OIG are all going to the DOJ are all gonna get involved and look at this from multiple levels in terms of violation of privacy, violation of business transactions, sustainability in the economy, those types of things. And the the companies that that do SOX and and and, interoperability requirements from the office of national coordinator, we'll all look at this very, very closely and and understand. I think you're gonna see quite a bit of regulation, that that that's like the one thing health care doesn't need. But I I think you're gonna see a large wave of administrative requirements coming to both the vendor and payer side, out of this, into next year. It'll obviously kinda take a little bit of a hiatus here in the fall as we get through a presidential election.

But I guarantee you, those agencies that are operating under whichever president and and and cabinet that we have will pick will be picking this back up again, if if if they don't continue the momentum through to look at it. UnitedHealthcare optimum change, certainly, you know, was was, you know, micro surgically focused on getting the claims clearing out back up as soon as possible.

It took them about two to three weeks, and, and did out of stations, and that's where they ended up.

You know, they're obviously looking at the vulnerabilities now per the per that testimony, to the set of finance committee, which I encourage you to go read. It's a fascinating transcript, to understand what's happened, what they're doing going forward, just the the the the size of optimism and and and UnitedHealth Group as a company, with the change operations, which is very, very interesting. I do think you'll see a Department of Justice investigation out of this since that started already.

Chapter

Department of Justice Investigation

We'll be interested to see what the findings of that look like. And then finally, business partners like Finthrive and ourselves, you know, our company was very I was very proud of how we, you know, threw as many life rings out into the ocean as we could as folks were sinking without a claims clearing house. We tried to help as many as we could to cut over to ours. I think many other companies did that as well just to try to help, you know, providers continue to keep cash flowing. And we'll talk about, how you can do that kind of in a preventative manner here in a minute.

We, as a as a company and lots of others, I think, are going through cyber, reviews and infrastructure, and and Greg's gonna get into that pretty deeply. That's he's a he's our CISO, and he's a a wealth of information as we're talking through what what what companies should and shouldn't do and and where we're at and and what we're doing. We're putting a form together as well, and, I I think that's it. Platform is something I do wanna talk about as well as as you have more nodes, more vendors out there. My hospital had twenty six. We've done surveys with Finthrive where there's twenty to thirty, typically, you know, in a in a