Becker's Hospital Review

67 CIO / HEALTH IT Finger Lakes Health pays hackers' demand, recovers from ransomware attack By Julie Spitzer E mail, internet, the majority of phone lines and several other electronic systems at Geneva, N.Y.-based Finger Lakes Health were restored after a ransomware attack shut them down March 18, a FLH spokesper- son told Becker's Hospital Review. FLH lost access to its computer system around midnight March 18 when a third party encrypted the health system's files and demanded a payment to unlock them. FLH reverted to its downtime procedures, including paper charting, while its infor- mations services team worked around the clock to bring systems back online. The health system eventually decided to pay the attacker's ransom demand. As of March 23, security experts con- firmed to FLH there was no patient, res- ident or employee data compromised, and no protected health information was acquired by the unauthorized third party. FLH attributes the recovery to its prompt response upon discovering incident. "Our immediate action to reduce con- nectivity and bring our own systems offline to protect them and patient, resi- dent [and] employee care and informa- tion was effective and served an import- ant purpose … Our experts have shared that this was a sophisticated attack that was only directed at extortion of money and not to access information," a FLH statement provided to Becker's Hospital Review reads. Via its insurance carrier, the health sys- tem opted to pay the ransom to accel- erate its recovery process. FLH has not released how much money the hackers demanded. "We made this decision in the interest of patient and resident care to minimize patient inconvenience and to move past this incident as quickly as possible," the statement reads. n MDLive nabs former Cerner exec for leadership role: 4 points By Anuja Vaidya M DLive selected Michael Farrell to serve as senior vice president and general manager of its hospitals and health systems business. Here are four points: 1. Most recently, Mr. Farrell served as vice president of Community Works at Cerner Corp. 2. He helped develop Cerner CommunityWorks, a cloud-based IT platform that integrates clinical and financial data into one comprehensive patient health record. 3. He also held other leadership positions at Cerner, including director of sales and senior director in business development. 4. In his new role, Mr. Farrell will oversee virtual health management at MDLive's hospital and health system clients. n OIG: Practitioners billed $3.7M for telehealth services that did not meet Medicare requirements By Julie Spitzer A report from HHS' Office of Inspector General found nearly 31 percent of claims submitted between 2014 and 2015 did not meet the Medicare conditions for pay ment for telehealth services, which resulted in $3.7 million in excess payments. Medicare paid a total of $17.6 million in telehealth payments in 2015, compared to $61,302 in 2001, according to the report. Because of this spike, OIG sought to determine whether CMS paid practitioners for telehealth services that met Medicare requirements. e government watchdog group reviewed 191,118 Medicare-paid distant-site tele- health claims that totaled $13.8 million and did not have corresponding originat- ing-site claims. en, OIG reviewed a random sample of 100 claims, of which "24 claims were unallowable because the beneficiaries received services at nonrural origi- nating sites, seven claims were billed by ineligible institutional providers, three claims were for services provided to beneficiaries at unauthorized originating sites, two claims were for services provided by an unallowable means of communication, one claim was for a noncovered service and one claim was for services provided by a physician located outside the U.S.," the report states. OIG said the errors it found were the result of a lack of CMS oversight to ensure pay- ments were not allowed for errors where telehealth claim edits could not be implement- ed, a failure to ensure all contractor claim edits were in place, and low awareness among practitioners of Medicare telehealth requirements. "We recommend that CMS (1) conduct periodic postpayment reviews to disallow payments for errors for which telehealth claim edits cannot be implemented; (2) work with Medicare contractors to implement all telehealth claim edits listed in the Medicare Claims Processing Manual; and (3) offer education and training sessions to practitioners on Medicare telehealth requirements and related resources," the report reads. n

• Cover