DHA 715 Week 7 Information Technology Risk and Claims Administration Example

When the Screens Go Dark: Cyber Risk, Downtime Readiness and Claims Administration for Four Rural Hospitals

[Student Name]

University of Phoenix

DHA/715: Risk Management in Complex Health Organizations

Week 7 Assignment

[Instructor Name]

[Date]

The rural hospitals, the neighboring attack, downtime drills, insurance program, claims data and plans are composites written for a model paper; research findings come from the sources cited.

On a Sunday night, an independent hospital thirty miles from the region's largest rural hospital lost access to its electronic health record, laboratory systems and imaging after a ransomware attack. For three weeks it diverted ambulances, and patients drove to the region's emergency departments instead. The region's hospital saw its emergency visits rise by a third and its waiting times double. The regional vice president asked two questions: could the same thing happen here, and were the region's processes ready for the claims that would follow any attack? This paper answers both.

How Common Attacks Have Become

Ransomware attacks on health care are rising. Drawing on a national database that tracks ransomware against American care providers, Neprash and colleagues found 374 attacks from 2016 to 2021 that together exposed records belonging to nearly 42 million patients; the yearly count rose to 91 from 43, and 44.4% disrupted care, most commonly through electronic system downtime, with some causing cancellations of scheduled care or ambulance diversion (Neprash et al., 2022). Rural hospitals appear in the data too, and a small hospital with a thin information technology staff may take longer to recover than a large system with its own security team.

Why Attacks Are Getting Worse

The same study found that over time attacks more often struck big multi-facility organizations, exposed more patients' information, were less often restored from backups and more often exceeded mandatory reporting deadlines (Neprash et al., 2022). The findings matter for a network: an attack on the academic center's systems could reach all eleven hospitals, including the four rural ones.

Effects on Hospitals Next Door

An attack on a neighbor is a regional event. When a health system with four hospitals in San Diego was attacked in 2021, Dameff and colleagues found that a nearby academic emergency department saw its daily census rise from about 218 to 251, ambulance arrivals increase, patients leaving without being seen more than double, median waiting times rise from 21 to 31 minutes and stroke code activations grow from 59 to 102 (Dameff et al., 2023). A hospital that is never attacked can still be overwhelmed by its neighbor's attack.

Effects on Quality After a Breach

Effects can last well beyond the attack. Choi and colleagues linked federal breach data with hospital quality measures across 3,025 hospitals and found that in the three years following a breach, hospitals took up to 2.7 minutes longer to obtain an electrocardiogram after a patient arrived, and heart attack deaths within 30 days rose by up to 0.36 percentage points, which they attributed to remediation efforts such as new security procedures that slowed clinicians (Choi et al., 2019).

Designing Security That Does Not Slow Care

The breach evidence suggests caution in how security is added. Log-in steps that take clinicians away from patients, especially in emergencies, can carry their own risk. The region will involve clinicians in designing controls and use tap badges and single sign-on to keep security strong without adding minutes. Emergency department and intensive care workstations will be tested with clinicians before any new log-in step goes live, and the time to complete common tasks will be measured before and after.

Testing the Region's Readiness

Rather than assume readiness, the region held a four-hour downtime drill at its largest rural hospital. The drill exposed gaps: paper order forms were outdated, laboratory results could not be sent to the emergency department except by telephone, medication administration records for current patients were not printed in advance and staff under thirty had never used paper charting. The pharmacy could not verify orders for almost an hour, and a simulated patient with chest pain waited twenty-two minutes for a paper electrocardiogram reading to reach the physician. Staff said the drill was the first time they understood how dependent every step of care had become on the record system.

Third-Party Risk

Vendors add risk. The region counted 41 vendors with remote access to its systems, including device makers, billing services and a transcription company. Several lacked clear security requirements in their contracts, linking this week's analysis to the contract standards adopted earlier. Two vendors still used shared passwords for remote support, and one former vendor's account had never been disabled. Attackers often enter through such accounts, since a vendor's access can bypass controls placed on staff.

Surge Planning for a Neighbor's Attack

The neighbor's attack showed a gap in surge planning. The region will treat an attack on a nearby hospital as a regional disaster, with triggers to open overflow space, call in staff, coordinate with emergency medical services and arrange transfers to the academic center.

How Incidents Become Claims

Claims administration begins with an incident report. The regional risk manager reviews every report for potential liability, investigates significant events, notifies the network's captive insurance company within the required time and sets a reserve, the estimated cost of resolving the claim. Claims are then managed through negotiation, the communication-and-resolution program or defense, and closed claims are reviewed for lessons.

Weaknesses in the Current Process

A review of the past three years found problems. Seven potential claims were reported to the insurer late, risking coverage. Reserves were set inconsistently across hospitals. And lessons from closed claims rarely reached the safety program. Two claims involving delayed reading of imaging, three years apart, arose from the same gap in how after-hours results were communicated, a gap that would have been closed if the first claim's review had been shared.

Cyber Insurance

The network's cyber policy covers forensic investigation, notification of affected patients, legal defense, regulatory fines where insurable and business interruption after a waiting period of twelve hours. It excludes losses from unpatched systems known to be vulnerable, making patching a coverage issue as well as a security issue. Premiums have risen sharply, and insurers now require multifactor authentication and tested backups.

Plan Element One: Cyber Defenses

The region will complete multifactor authentication for all remote access, patch critical systems within fourteen days, keep offline backups tested quarterly and run phishing training with monthly simulations.

Plan Element Two: Downtime Readiness

Each hospital will update paper forms, print current medication records every shift, hold two downtime drills a year and train newer staff in paper workflows.

Plan Element Three: Vendor Risk

Every vendor with system access will meet security requirements in its contract, including breach notification within 72 hours and access limited to what the vendor needs.

Plan Element Four: Claims Administration

The region will adopt a standard reporting timeline, a reserving guide and a monthly claims review that sends lessons to the safety and risk committees.

Measures

Measures include the share of accounts with multifactor authentication, phishing click rates, patch compliance, backup restoration tests, drill performance, vendor contracts meeting standards, timely claim notification and consistency of reserves.

Conclusion

A neighbor's ransomware attack showed that technology risk is regional and clinical. Evidence documents rising attacks that disrupt care, spillover to nearby hospitals and quality effects after breaches. A tested downtime plan, vendor controls, surge planning and a disciplined claims process prepare the rural region for the event it hopes never comes.

References

Choi, S. J., Johnson, M. E., & Lehmann, C. U. (2019). Data breach remediation efforts and their implications for hospital quality. Health Services Research, 54(5), 971-980. https://doi.org/10.1111/1475-6773.13203

Dameff, C., Tully, J., Chan, T. C., Castillo, E. M., Savage, S., Maysent, P., Hemmen, T. M., Clay, B. J., & Longhurst, C. A. (2023). Ransomware attack associated with disruptions at adjacent emergency departments in the US. JAMA Network Open, 6(5), Article e2312270. https://doi.org/10.1001/jamanetworkopen.2023.12270

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), Article e224873. https://doi.org/10.1001/jamahealthforum.2022.4873