American Hospital Association Archives - gettectonic.com
Cyber Insurance

Cyber Insurance

Navigating Cyber Insurance in an Evolving Threat Landscape The rapidly shifting cyberthreat landscape presents unique challenges for healthcare organizations and underwriters navigating cyber insurance coverage decisions. Cyber liability insurance plays a crucial role in shielding healthcare providers from the mounting costs associated with data breaches and cyberattacks, which now average $9.77 million per incident in the healthcare sector, according to IBM. The Challenges of Retaining Cyber Insurance Healthcare, among other heavily targeted sectors, faces difficulties in securing and maintaining affordable cyber insurance. The constantly evolving threat landscape impacts risk profiles, which drives up premiums and complicates coverage retention. Although year-over-year premium growth plateaued in the U.S. in 2023, 79% of respondents in a Delinea survey still reported increased insurance costs, with 67% experiencing premium hikes between 50% and 100%. As high-profile healthcare cyberattacks and increasing cyber risks persist, navigating the insurance landscape remains a significant challenge. Additionally, the lag in processing claims makes it difficult to anticipate how underwriters will respond to these changing threats. How the Evolving Threat Landscape Impacts Cyber Insurance Obtaining adequate cyber insurance coverage can be challenging in today’s risk-heavy environment. Unlike traditional insurance, where risks remain static, cyber risks constantly evolve to counteract security controls. “Cyber insurance risk adjusters face a unique challenge; unlike fires, which aren’t actively trying to burn you in new ways, cyberthreats are constantly adapting to bypass existing protections,” said Christopher Henderson, senior director of threat operations at Huntress. This continuous adaptation often means that by the time underwriting is complete, a risk assessment may already be outdated. Shifts in the threat landscape are driving changes in cyber insurance questionnaires. While in 2023 insurers focused on remote access tools, vulnerability management, and administrative access controls, the focus in 2024 shifted to include multifactor authentication (MFA) and identity-based attack prevention. This shift highlights the need for organizations to adapt to new requirements in cyber insurance as cybercriminals add new tactics to their playbooks. Adapting Insurance to Emerging Threats As cyberthreat tactics evolve, insurers may adjust policy terms to keep pace with the latest risks. Henderson suggests that insurers could move toward shorter underwriting cycles, possibly even six-month periods, to better align with the rapidly shifting cyber landscape. Mitigating Risk and Controlling Cyber Costs Several factors influence cyber insurance premiums, including organizational size and security posture. For healthcare providers, adhering to industry standards like SOC 2 and ISO 27001 can demonstrate compliance with best practices, improving coverage terms and potentially lowering premiums. Healthcare organizations using the NIST Cybersecurity Framework (CSF) as their primary security standard reported lower premium increases compared to those without this framework, according to a 2024 report by KLAS Research, Censinet, and the American Hospital Association. Henderson emphasizes the importance of layering new strategies with proven, traditional ones: “While staying vigilant against newer tactics like social engineering and identity-based attacks, maintaining consistent, auditable identity verification and MFA protocols remains crucial.” Despite upfront costs, cyber insurance can significantly reduce financial impact during cybersecurity incidents. For example, a 2024 Sophos report found that organizations with cyber insurance saw an average ransomware recovery cost of $2.94 million compared to $3.48 million for those without coverage. Navigating cyber insurance can be complex for healthcare organizations, but careful attention to risks and proactive security measures can help them secure the right coverage at sustainable rates. Like Related Posts Salesforce OEM AppExchange Expanding its reach beyond CRM, Salesforce.com has launched a new service called AppExchange OEM Edition, aimed at non-CRM service providers. Read more Salesforce Jigsaw Salesforce.com, a prominent figure in cloud computing, has finalized a deal to acquire Jigsaw, a wiki-style business contact database, for Read more Health Cloud Brings Healthcare Transformation Following swiftly after last week’s successful launch of Financial Services Cloud, Salesforce has announced the second installment in its series Read more Top Ten Reasons Why Tectonic Loves the Cloud The Cloud is Good for Everyone – Why Tectonic loves the cloud You don’t need to worry about tracking licenses. Read more

Read More
Challenges for Rural Healthcare Providers

Challenges for Rural Healthcare Providers

Rural healthcare providers have long grappled with challenges due to their geographic isolation and limited financial resources. The advent of digital health transformation, however, has introduced a new set of IT-related obstacles for these providers. EHR Adoption and New IT Challenges While federal legislation has successfully promoted Electronic Health Record (EHR) adoption across both rural and urban healthcare organizations, implementing an EHR system is only one component of a comprehensive health IT strategy. Rural healthcare facilities encounter numerous IT barriers, including inadequate infrastructure, interoperability issues, constrained resources, workforce shortages, and data security concerns. Limited Broadband Access Broadband connectivity is essential for leveraging health IT effectively. However, there is a significant disparity in broadband access between rural and urban areas. According to a Federal Communications Commission (FCC) report, approximately 96% of the U.S. population had access to broadband at the FCC’s minimum speed benchmark in 2019, compared to just 73.6% of rural Americans. The lack of broadband infrastructure hampers rural organizations’ ability to utilize IT features that enhance care delivery, such as electronic health information exchange (HIE) and virtual care. Rural facilities, in particular, rely heavily on HIE and telehealth to bridge gaps in their services. For instance, HIE facilitates data sharing between smaller ambulatory centers and larger academic medical centers, while telehealth allows rural clinicians to consult with specialists in urban centers. Additionally, telehealth can help patients in rural areas avoid long travel distances for care. However, without adequate broadband access, these services remain impractical. Despite persistent disparities, the rural-urban broadband gap has narrowed in recent years. Data from the FCC indicates that since 2016, the number of people in rural areas without access to 25/3 Mbps service has decreased by more than 46%. Various programs, including the FCC’s Rural Health Care Program and USDA funding initiatives, aim to expand broadband access in rural regions. Interoperability Challenges While HIE adoption is rising nationally, rural healthcare organizations lag behind their urban counterparts in terms of interoperability capabilities, as noted in a 2023 GAO report. Data from a 2021 American Hospital Association survey revealed that rural hospitals are less likely to engage in national or regional HIE networks compared to medium and large hospitals. Rural providers often lack the economic and technological resources to participate in electronic HIE networks, leading them to rely on manual data exchange methods such as fax or mail. Additionally, rural providers are less likely to join EHR vendor networks for data exchange, partly due to the fact that they often use different systems from those in other local settings, complicating health data exchange. Federal initiatives like TEFCA aim to improve interoperability through a network of networks approach, allowing organizations to connect to multiple HIEs through a single connection. However, TEFCA’s voluntary participation model and persistent barriers such as IT staffing shortages and broadband gaps still pose challenges for rural providers. Financial Constraints Rural hospitals often operate with slim profit margins due to lower patient volumes and higher rates of uninsured or underinsured patients. The financial strain is exacerbated by declining Medicare and Medicaid reimbursements. According to KFF, the median operating margin for rural hospitals was 1.5% in 2019, compared to 5.2% for other hospitals. With limited budgets, rural healthcare organizations struggle to invest in advanced health IT systems and the necessary training and maintenance. Many small rural hospitals are turning to cloud-based EHR platforms as a cost-effective solution. Cloud-based EHRs reduce the need for substantial upfront hardware investments and offer monthly subscription fees, some as low as $100 per month. Workforce Challenges The healthcare sector is facing widespread staff shortages, including a lack of skilled health IT professionals. Rural areas are disproportionately affected by these shortages. An insufficient number of IT specialists can impede the adoption and effective use of health IT in these regions. To address workforce gaps, the ONC suggests strategies such as cross-training multiple staff members in health IT functions and offering additional training opportunities. Some networks, like OCHIN, have secured grants to develop workforce programs, but limited broadband access can hinder participation in virtual training programs, highlighting the need for expanded broadband infrastructure. Data Security Concerns Healthcare data breaches have surged, with a 256% increase in large breaches reported to the Office for Civil Rights (OCR) over the past five years. Rural healthcare organizations, often operating with constrained budgets, may lack the resources and staff to implement robust data security measures, leaving them vulnerable to cyber threats. A cyberattack on a rural healthcare organization can disrupt patient care, as patients may need to travel significant distances to reach alternative facilities. To address cybersecurity challenges, recent legislative efforts like the Rural Hospital Cybersecurity Enhancement Act aim to develop comprehensive strategies for rural hospital cybersecurity and provide educational resources for staff training. In the interim, rural healthcare organizations can use free resources such as the Health Industry Cybersecurity Practices (HICP) publication to guide their cybersecurity strategies, including recommendations for managing vulnerabilities and protecting email systems. Does your practice need help meeting these challenges? Contact Tectonic today. Like Related Posts Salesforce OEM AppExchange Expanding its reach beyond CRM, Salesforce.com has launched a new service called AppExchange OEM Edition, aimed at non-CRM service providers. Read more The Salesforce Story In Marc Benioff’s own words How did salesforce.com grow from a start up in a rented apartment into the world’s Read more Salesforce Jigsaw Salesforce.com, a prominent figure in cloud computing, has finalized a deal to acquire Jigsaw, a wiki-style business contact database, for Read more Health Cloud Brings Healthcare Transformation Following swiftly after last week’s successful launch of Financial Services Cloud, Salesforce has announced the second installment in its series Read more

Read More
Standards in Healthcare Cybersecurity

Standards in Healthcare Cybersecurity

The Change Healthcare cyberattack was a significant incident with widespread ramifications across the healthcare industry, with effects that are likely to persist for months or even longer. Standards in Healthcare Cybersecurity will change as a result. Since the ransomware attack on UnitedHealth Group’s (UHG) subsidiary, Change Healthcare, providers have faced financial and operational challenges due to disruptions in claims processing and other essential services. Change Healthcare, which processes 15 billion transactions annually and interacts with one in every three patient records in the U.S., is undergoing a complex and lengthy recovery process, with long-term implications for the industry. The attack was first reported on February 21st when Optum, another UHG subsidiary, alerted customers about the unavailability of some applications due to a cybersecurity issue. It was later confirmed that the BlackCat ransomware gang was responsible for the attack, which led to a $22 million ransom payment by UHG. The scale of the attack caused significant operational disruptions across the healthcare system, affecting entities ranging from large pharmacy chains to small, independently owned practices. In the weeks following the attack, UHG began restoring services, but the recovery process remains ongoing. UHG CEO Andrew Witty testified before Congress that the cybercriminals had gained access to Change Healthcare systems nine days before deploying the ransomware, using compromised credentials to access a Citrix portal without multi-factor authentication. The decision to pay the ransom was described as one of the hardest Witty has ever had to make. The incident has highlighted the vulnerabilities in healthcare cybersecurity, particularly for large organizations like UHG that handle vast amounts of sensitive data. It has also fueled the debate over whether ransomware payments should be made illegal, with arguments on both sides regarding the implications for victims and the broader cybersecurity landscape. The attack has prompted a strong response from industry groups and the federal government. The American Hospital Association (AHA) and the American Medical Association (AMA) have been vocal about the impact on providers, with the AHA calling it “the most significant and consequential cyberattack on the U.S. healthcare system in American history.” The federal government, through the Department of Health and Human Services (HHS), has provided guidance to Medicare providers and launched a formal investigation into the breach. As the healthcare industry continues to recover, the long-term impacts of the Change Healthcare cyberattack are expected to shape future cybersecurity strategies. The incident has underscored the importance of robust third-party risk management, the implementation of security measures like multi-factor authentication, and the potential need for more stringent regulatory standards in healthcare cybersecurity. The full extent of the breach, including the number of individuals affected, remains to be seen, but it is already clear that this event will have lasting repercussions for the industry. Like Related Posts Salesforce OEM AppExchange Expanding its reach beyond CRM, Salesforce.com has launched a new service called AppExchange OEM Edition, aimed at non-CRM service providers. Read more Salesforce Jigsaw Salesforce.com, a prominent figure in cloud computing, has finalized a deal to acquire Jigsaw, a wiki-style business contact database, for Read more Health Cloud Brings Healthcare Transformation Following swiftly after last week’s successful launch of Financial Services Cloud, Salesforce has announced the second installment in its series Read more Top Ten Reasons Why Tectonic Loves the Cloud The Cloud is Good for Everyone – Why Tectonic loves the cloud You don’t need to worry about tracking licenses. Read more

Read More
gettectonic.com