Jeanette Hurt

A new study reports that phishing remains the leading cause of data security incidents for the third straight year, and the healthcare industry is the number one target of scammers.

, issued by BakerHostetler, 34 percent the data security incidents they managed last year involved phishing, and more than a third-35 percent of their clients-were in the healthcare industry. “It definitely is a huge problem,” says Eric Packel, a partner in the firm who specializes in privacy, data security, and technology issues. “There’s not a week, not a day, that goes by that I don’t get another request on a phishing incident for a client. The healthcare industry may be more of a target because healthcare information stays with (people).”

A phishing attack is when someone is tricked by an email message into providing access credentials to an unauthorized party, visiting a phony website or clicking on a link that installs malware.

The cost is quite high: An average forensic investigation into a phishing attack costs more than $84,000, with the largest investigations costing nearly $437,000. The average time between the incident and discovery is 66 days, with three days from discovery to containment, and then another 36 days to complete the forensic investigation and notification process. All 50 states have a data breach notice law, which requires providers to notify patients and vendors whose information may have been compromised, as well as HIPAA rules.

Particularly, Packel says, phishing scammers use information like Social Security numbers and healthcare identification-private details about illnesses, conditions, etc.-to create false identities and fraudulently bill Medicare, Medicaid, and other payers.  Sometimes, they’ve even changed the direct deposit for employee compensation to out-of-the-country accounts.  “If the employee uses the same credentials in different applications (at work) and these credentials are given up in the phishing attack, then the attacker can go to the benefits system and redirect their paychecks,” Packel says.

According to the report, both sophisticated and unsophisticated hackers use phishing to obtain direct network access, convince employees to wire money, enable remote access with compromised credentials, or deploy malware and ransomware. “If you haven’t been targeted, you will be,” he says. “It’s not a matter of if, but when.”

One of the challenges for physicians and healthcare providers is that any employee, from the CEO down to temporary office workers, can be victimized. “As a matter of fact, when it comes to organizations, it’s the higher-level employees who are more likely to respond to these phishing emails because they’re so busy,” Packel says. “It’s not the lower level employees or the less sophisticated employees. We’ve seen many physicians respond to these emails simply because they’re so busy, and they just want to move stuff along.”

Often, it’s not just one physician within a practice responding to a hacker’s email. “I’ve had as many as 39 to 40 physicians respond to a phishing attack, and that single attack could mean tens of thousands, if not hundreds of thousands of emails to parse through to determine what’s in there,” Packel says.

And it’s not just the larger healthcare organizations, which are targeted. “Think about it this way,” Packel advises. “Smaller providers might not have as many sophisticated defenses, technically or otherwise, and smaller providers are sometimes easier targets.”

While some hackers are unsophisticated-think of the Nigerian prince emails-many are more sophisticated, and the emails they send and the websites they link to are nearly identical to real websites that might be portals for insurance companies, etc.

So, how can physicians and their staff protect their practices from being compromised? Packel offers the following tips:

1. Determine which employees are most at risk for clicking on a phishing email.

 “Some companies send out a fake phishing email to test their employees, and those who consistently respond to any phishing emails can get additional education,” Packel says. “You can target your training to the employees who need it the most.

2. Institute a multifactor authentication process.

 A multifactor authentication process means that not only do people have to enter in their usernames and passwords, after they click on those, they have to put in an additional code. This code could be sent as a text, to another email address, or it could be a keyfob. “It makes it much more difficult for the attacker to get into the system if you have multifactor authentication,” Packel says.

 Work with your informational technology staff or vendor to determine what kind of multifactor authentication process would work best for your practice, and then determine the logistics of installing a system and getting everyone on board.  “It’s becoming the de facto standard,” Packel says.  “Here at my law firm, we have multifactor authentication in place, and we’re certainly used to it.”

Expect pushback, especially from higher-level staff, who sometimes feel they don’t have enough time or energy to learn or implement the new system.

 There are also costs to installing new technology. “There’s political pushback and financial and technical issues to consider, particularly with larger, more complex organizations,” Packel says. “But certainly the cost of one data security incident could be more than the cost of putting multifactor authentication into place.”

Articles

Emails luring physicians and staff into installing malware on their computers continues to spread. Here’s how to protect yourself and your patients.

5 ways to avoid a phishing attack at your medical practice

 are sicker and more likely to skip treatment than senior patients in 10 other developed countries, according to an international survey by the Commonwealth Fund.

How do physicians care for the digitally isolated?

	The 2017 Commonwealth Fund International Health Policy Survey of Older Adults examined 

 issues of those 65 and older in the United States, Australia, Canada, France, Germany, the Netherlands, New Zealand, Norway, Sweden, Switzerland and the United Kingdom.

	What makes this survey unique is that it looked only the age group of people who all are covered by Medicare, says Robin Osborn, MBA, vice president and director of The Commonwealth Fund’s International Policy and Practice Innovations program and one of the authors of this study.  

	“We were surprised at how much more serious the shortfalls were for U.S. elderly than we thought,” Osborn says.  “In other surveys, the U.S. looks relatively poor on many measures, just because of access, but everyone age 65  has Medicare. Medicare is such a beloved program…yet in quite stark relief, we see some of  (its) real shortfalls.”

	Across all 11 countries, at least one in eight older adults reported having three or more chronic conditions. But in the United States, the rate was the highest, with 36 percent being considered high needs.  “That’s three times the rate of New Zealand (13 percent), and of this group, we are the sickest,” Osborn says.

	Americans, nearly a quarter at 23 percent, reported financial worries, saying that in the past year, they had not visited a doctor when they were sick, had skipped a recommended test or treatment, had not filled a prescription or had skipped medication doses because of the cost.  This compares to five percent or less in France, Norway, Sweden and the United Kingdom.  Additionally, 22 percent of American respondents in the survey reported spending $2,000 or more on medical care in the past year. Except for Switzerland, which reported 31 percent, less than 10 percent of older adults in the other countries spent that much.  

	Problems get even more exacerbated for the high-need older adults – those with three or more medical issues – in that 31 percent of them skip care because of costs.

Next:  “The two together are a really bad combination.”

	“We’re talking about a sicker problem that’s also more financially troubled,” Osborn says.  “The two together are a really bad combination.”

	Jordan Grumet, MD, an internal medicine practitioner in Evanston, IL who sees nursing home patients in multiple places and author of  

I Am Your Doctor: And This Is My Humble Opinion

says the thing that stood out the most to him in the survey was the fact that such a large percentage of older Americans can’t manage the cost of their medical care.

	“The wealth in this country is spread diametrically from the very, very rich to everyone else,” Grumet says.   “We have an incredibly expensive healthcare system.   In Canada and parts of Europe, profits are not the goal for the healthcare system, even if you have an economically diverse strata of classes.”

	The economic challenges in the survey point to the problems of out-of-cost sharing and co-pays of Medicare, even though Medicare is a universal benefit, Osborn says.  “That may not always be apparent to doctors who are caring for the elderly,” Osborn adds.

5 facts physicians should know about Ane Schuchat

	Grumet says that most primary care doctors are immensely overwhelmed.  “I think most primary care doctors feel like they’re drowning as it is,” Grumet says.  “I don’t think American physicians are trained worse, but the pressures on the American healthcare system are different.  I love to compare (the American healthcare system) to conducting an orchestra.  The way in our healthcare system is to make our conductor also the guy who is taking tickets at the front door.  You can’t do it all. Practicing medicine is hard enough, taking care of your patients, motivating them and monitoring their medicine and getting them to do things that are good for them is a momentous problem on its own.”

	Everything gets exacerbated by compliance requirements and paperwork, Grumet says.   “Twenty-five percent of our time is spent on patient care, 75 percent is paperwork,” he says. “Residents in hospitals spend 5 to 10 percent of their time seeing patients, the other time is charting. The cost of compliance is insufferable.”

Next: "We can look after our patients the best that we can."

	Another shortfall of the American system that the survey points to is follow-up calls and care: 22 percent of Americans surveyed reported that they don’t always get a call back the same day when they’ve called with a medical problem, and almost 20 percent waited six days or more for an appointment. After hours calls and problems were worse, Osborn says, with 40 percent saying that they could not receive care after hours on evenings or weekends without going to the emergency department of a hospital.

	“A lot of primary care doctors don't have the capacity or arrangements for after-hours care,” Osborn says.  “That’s a point worth stressing.”

Top 10 metros doctors get the biggest pay raises

	Osborn points out that in the Netherlands, primary care doctors are required by law to have an arrangement for after-hours care, and so there are after hours collectives, where they can go from 5 p.m. to 8 a.m. “They didn’t always see their own doctors, but the doctors they did see had access to their medical records, and they send notes to the patients’ doctors,” Osborn says.

	Grumet says that physicians, as a group, could become more politically active, and he believes that many physicians try to address these problems with their own population of patients.  “We can’t change the numbers of the overall population, but we can look after our patients the best that we can,” Grumet says. “But if you really want to compete with these other countries, we have to streamline our healthcare system and get the business interests out of medicine.  I don’t see that happening anytime soon. I think it is a systemic problem.”

Older adults in the United States are sicker and more likely to skip treatment than senior patients in 10 other developed countries, according to an international survey by the Commonwealth Fund. 

American older adults sicker and poorer than 10 other countries, survey says

	It has been a rough start to 2017 when it comes to politics and healthcare. While no formal studies have been completed, 

many physicians say political talk with patients is increasing. 

	So what can doctors do when these awkward situations come up? We asked several physicians their best advice. Read on to find out what they had to say.

	8.     Redirect, redirect, redirect.

	7.     Focus on courtesy and respect.

	5.     Remember that patients don’t always feel equal.

	4.     Treat the patient, not their politics.

	2.     Remember that patients can often be complex, even conflicted people.

	1.     Treat patients the way you would want to be treated.

It has been a rough start to 2017 when it comes to politics and healthcare. While no formal studies have been completed, many physicians say political talk with patients is increasing. 

8 ways to combat politics in the exam room

	Contentiousness. Rage. Hate. Political talk often becomes anything but a civil conversation, and these days, patients are 

bringing their politics with them into exam rooms.

Mr. President, physicians fight when things get tough

	Although no formal studies have been done, many physicians say political talk from patients is increasing. Vineet Arora, MD, MAPP, associate professor and hospitalist at the University of Chicago, says it’s not just her patients who are talking about politics and bringing it up to her. 

	“It came up just recently when I got into a cab,” she says, adding that patients and the public in general especially want to know what physicians are thinking about political issues that relate to healthcare. 

	Kevin Pho, MD, an internal medicine physician, physician speaker and coach says physicians are noting this trend both online and in person.

	“Unequivocally, yes, patients are bringing up politics more,” Pho says. “The current political situation is not to everyone’s preference, and political conversations are happening more frequently.”

	So, should physicians mix patient care with politics? Some physicians work and live in communities that align with their values and politics, but that’s not always the case.

How do physicians care for the digital isolated?

	Josephine Soliz, MD, a primary care physician at the Rose Avenue Family Medical Group in Oxnard, California, says sometimes politics are mentioned in offhand comments, and other times, patients want to engage her in a political discussion.

Next: Don't let the conversation get tense 

	“I redirect them mainly because I just want to be sure to cover all of their medical issues,” Soliz says. “I don’t want them to feel like the things they care about don’t matter, but I want to be thorough and not miss things like diabetes.”

	Soliz says many political issues matter to her greatly, but she doesn’t talk politics with patients unless they directly bring it up. 

	“Sometimes I’ll even say to someone, ‘We could have a great half hour conversation about this because I see it a little differently than you, but maybe we should use this time for your medical concerns,” Soliz says.

Everything doctors need to know about patient sexual orientation, gender identity

	Arora believes strongly that physicians should have their voices out in public discourse, and in fact, she often coaches them on how to best use social media to be active on political issues that affect them. But, she says, it’s important to keep politics out of the exam room. Physicians, she says, are trained to give the exact same care to patients, no matter what the circumstances or personal disagreements they might have with patients.

	“You treat the patient in front of you,” Arora says.

	If a physician sees a patient with differing political views as adversarial, it could be akin to military doctors who trained to treat enemy soldiers with the same care and respect as they do their comrades. 

Next:  "When you’re treating patients, it's not their political view...it's them"

	“We’re going to treat both people the same way,” Arora says.  “Doctors are trained to do that regardless.”

	When politics comes up, Pho recommends addressing it in a nonpartisan manner. “There are factual ways, for example, to talk about the Affordable Care Act,” he says. “You can talk about things in a factual way without injecting your opinion into it.”

How to keep your patients from switching physicians

	Soliz says she’s had very opinionated patients say things that could definitely be construed as hurtful or racist. Recently, she had an elderly woman complain about a phlebotomist hurting her, and she referred to the staff person, using her racial identity.

	“I addressed it in an indirect way by stating how frustrating it was for her to get a bruise,” Soliz says. “The real problem was a bruised and sore arm, not (the race) of her phlebotomist.”

	Soliz points out that in the exam room, physicians and patients are not on equal footing.

	“I am very aware of the difference in power in the doctor-patient relationship,” Soliz says. “I would not want a patient to feel they had to conform to my perspective to feel welcome and valued and to receive good care.”

	Politics not only is being brought up to physicians, but it’s sometimes being brought up in conversations patients have with other medical staff. Soliz says her medical staff are trained to be courteous, even when dealing with rude patients, and that’s the same way to deal with opposing political views.

	“I try not to put down rules for my staff,” Soliz says. “By and large, we leave it to a staff person’s judgment.”

	Politics shouldn’t ever be an issue when patients see physicians, Arora says. “Really, the issue at hand, when you’re treating patients, is not their political view,” she says.  “It’s them.”

Contentiousness. Rage. Hate. Political talk often becomes anything but a civil conversation, and these days, patients are bringing their politics with them into exam rooms.

Author | Jeanette Hurt

Articles

5 ways to avoid a phishing attack at your medical practice

American older adults sicker and poorer than 10 other countries, survey says

8 ways to combat politics in the exam room

Don't let patients bringing politics into the exam room give you a migraine