Medical Review Audits Suspended

Reliant has worked closely with the National Association for the Support of Long Term Care (NASL) to raise awareness of the activity associated with Medicare’s medical review process during this pandemic, including pre-pay targeted probe and educate (TPE) activity and post-pay recovery audit contractor (RAC) reviews. At this time, Novitas, First Coast and CGS have suspended TPE activity until further notice. Our contacts indicate current pre-pay TPEs will be released and paid in the coming weeks.

According to an FAQ released on 3/30/2020, CMS indicates suspension of most Medicare Fee-For-Service (FFS) medical reviews during the emergency period due to the COVID-19 pandemic. The FAQ states that both pre-payment medical reviews such as the reviews for TPE and post-payment reviews conducted by the MACs, Supplemental Medical Review Contractors (SMRCs) and Recovery Audit Contractors (RACs) are suspended for the duration of the Public Health Emergency (PHE).

The FAQ also notes that “no additional documentation requests will be issued for the duration of the PHE for the COVID-19 pandemic.” Current post-payment review by the MACs, SMRCs, and RACs will be suspended and released from review as well. CMS is suspending these medical review activities for the duration of the PHE, but could conduct medical reviews “during or after the PHE if there is an indication of potential fraud.”

Medicare Advantage Plans Prior Authorization Suspended

In response to the COVID-19 pandemic, Medicare Advantage plans are issuing temporary suspensions in prior authorization requirements for post-acute settings and revising policies to improve patient access to care.

UnitedHealthcare (UHC) is suspending prior authorization requirements for post-acute settings through May 31, 2020, with the waiver applying to skilled nursing facilities (SNFs), long-term care facilities (LTCFs), and acute inpatient rehabilitation (AIR).  In addition, UHC will reimburse physical, occupational and speech therapy telehealth services provided by qualified health care professionals when rendered using interactive audio/video technology, emphasizing state laws and regulations apply.

Cigna has indicated a similar suspension for commercial and Medicare Advantage plans, noting it will make it easier for hospitals to transfer patients to long-term acute-care hospitals (LTACHs) and other sub-acute facilities to help manage the demands of increasingly high volumes of COVID-19 patients

Medicare Accelerated and Advanced Payments Now Available

On March 28, 2020, the Centers for Medicare & Medicaid Services (CMS) expanded the current Accelerated and Advance Payment Program to a broader group of Medicare Part A providers and Part B suppliers. This program expansion, which includes changes from the recently enacted Coronavirus Aid, Relief and the Economic Security (CARES) Act, is one way CMS is working to lessen the financial hardships of providers facing extraordinary challenges related to the COVID-19 pandemic and ensures the nation’s providers can focus on patient care.

Eligibility qualifications state the provider/supplier must:

  • Have billed Medicare for claims within 180 days immediately prior to the date of signature on the provider’s/supplier’s request form
  • Not be in bankruptcy
  • Not be under active medical review or program integrity investigation
  • Not have any outstanding delinquent Medicare overpayments

Medicare will start accepting and processing the Accelerated/Advance Payment Requests immediately. CMS anticipates that the payments will be issued within seven days of the provider’s request.   

Access CMS’ step by step guide for eligibility and processes here.

COVID-19 Medicare Waivers

CMS is empowered to take proactive steps through 1135 waivers and rapidly expand the Administration’s aggressive efforts against COVID-19. As a result, the following blanket waivers are available: 

  • Three-Day Stay Waiver: CMS is waiving the requirement at Section 1812(f) of the Social Security Act for a 3-day prior hospitalization for coverage of a skilled nursing facility (SNF) stay, providing temporary emergency coverage of SNF services without a qualifying hospital stay for those who need to be transferred as a result of the effect of a disaster or emergency.
  • SNF Part A 100-Day Benefit Waiver: For certain beneficiaries who recently exhausted their SNF benefits, it authorizes renewed SNF coverage without first having to start a new benefit period.
  • MDS Completion and Submission Waiver: CMS is waiving 42 CFR 483.20 to provide relief to SNFs on the timeframe requirements for Minimum Data Set assessments and transmission.

Read the Coronavirus 1812(f) waiver.

New Targeted Plan for Healthcare Facility Inspections

On March 23, 2020 CMS released guidance to state survey agencies further prioritizing and suspending most federal and state surveys and delaying revisit surveys for the next three weeks beginning March 20.

CMS has released this survey tool to review infection prevention and control practices. Providers are encouraged to perform a self-assessment utilizing this same tool. Surveyors will review for:

  • Overall effectiveness of the Infection Prevention and Control Program (IPCP) including policies and procedures
  • Standard and transmission-based precautions (with the understanding that certain essential supplies are scarce, and facilities should not be penalized for not having certain supplies if they are unable to obtain them)
  • Quality of resident care practices, including those with COVID-19 (laboratory-positive cases), if applicable
  • Surveillance plan
  • Visitor entry and facility screening practices
  • Education, monitoring and screening practices of staff
  • Facility policies and procedures to address staffing issues during emergencies, such as transmission of COVID-19

Click here for the Survey Prioritization Fact Sheet.

PPE Guidance from CDC and CMS

The CDC issued guidance for optimizing the PPE supply, specifically facemasks, gowns and eye protection, including suggestions on what to do in case of shortages.

CMS recommends reaching out to a health care coalition (HCC) in your area for emergency response assistance. Click here for an interactive map with contact information.

Additionally, AHCA has warned providers to beware of COVID-19 scams selling PPE or other supplies. To aid in differentiation between legitimate businesses and scams, the Federal Trade Commission (FTC) has provided general guidance on COVID-19-related scams.

March Clinical Appeals

Denial Reason Code W7020- NCCI Edit Update

In February, CMS rescinded the National Correct Coding Initiative (NCCI) Edits which restricted the billing of CPT codes 97530 and 97150 on the same day as billing of PT/OT evaluation codes (97161, 97162, 97163, 97164, 97165, 97166) retroactively to January 1, 2020. Nonetheless, many providers have experienced line item denials due to the edit enacted for the short duration. These line item denials are reflected by reason code W7020. To resolve, CMS will be correcting the NCCI edit, beginning April 6, 2020. Medicare Administrative Contractors (MACs) will automatically reprocess claims, without provider action.  When reconciling payments,

  • Review Part B line items for denial of HCPCs 97530 and 97150, in the presence of evaluation codes 97161, 97162, 97163, 97164, 97165, 97166.
  • If line item denials are identified, determine if reason code W7070 is appended.
  • If confirmed, flag impacted claims for review for automatic reprocessing following CMS correction of the edit, beginning April 6, 2020.
  • CMS has indicated provider action is not required.
  • Follow up with your MAC should reprocessing not occur or occur with errors.

SNF Claims Incorrectly Cancelled

From January 26 through February 16, 2020, a software issue caused SNF claims to be incorrectly cancelled with a message that there was no three-day qualifying hospital stay. This issue has been corrected. If your claims were incorrectly cancelled, re-bill them in sequential order to receive payment.

  • Claims need to process in date of service order for each stay for the Variable Per Diem (VPD) to calculate correctly.
  • Submit claims in sequence and wait at least 2 weeks before billing subsequent claims.
  • Some of the affected claims with older dates of service will require a timely filing exception; enter “Resubmission due to non-qualifying stay” in the remarks field.

Click here for more information.

HIPAA Privacy & COVID-19

In this unprecedented time with worldwide infection of COVID-19, there are provisions within the HIPAA Privacy Rule to address use and disclosure of patient information in a public health emergency to aid in prevention and control of the spread of disease. While this provision addresses use and disclosure to authorized public health authorities, Covered Entities and Business Associates must continue to safeguard patient information from impermissible uses and disclosures.

Refer to the bulletin released by the Office of Civil Rights (OCR) in February 2020 at this link OCR HIPAA Privacy and COVID-19 for more information regarding HIPAA Privacy Rule relating to infectious disease control.

Enhancing the Quality of Life of Individuals with Lung Disease

Individuals with respiratory illnesses often take shallow breaths causing chest muscle weakness, reduced oxygen circulation, shortness of breath and fatigue. Effective pulmonary programs can increase quality of life and reduce unnecessary hospitalizations.

Three types of breathing exercises

  1. Pursed Lip Breathing: Helps to increase the length of expiration

a.         Relax neck and shoulders

b.         Breathe in for two counts through nose

c.         Breathe out for three to four counts through pursed lips.

d.         “Smell the roses, blow out the candles!

2. Deep Breathing: Helps to calm nerves and exercise the diaphragm

a.         Inhale for 4 seconds

b.         Hold for 4 seconds

c.         Exhale for 4 seconds

d.         Hold for 4 seconds

3. Diaphragmatic Breathing: Helps train the abdominal muscles to aid during exhalation to fully empty the lungs

a.         Place one hand on your upper chest and the other just below the ribcage.

b.         Breathe in slowly through your nose, so your stomach moves out against your hand. The hand on your chest should remain as still as possible.

c.         Tighten your stomach muscles, letting them fall inward as you exhale through pursed lips.

Key Benefits of Breathing Properly: 

•          Endorphins, the body’s natural painkiller, are released

•          Improved blood flow

•          Improves posture

•          Reduces inflammation

•          Detoxifies the body by releasing toxic carbon dioxide

•          Stimulates lymphatic system

•          Improves digestion

•          Relaxes the mind and body

The Amplifying Quality of Group Therapy

Although the concept of group therapy is not new to long-term care, the implementation of the Patient Driven Payment Model (PDPM) has ignited renewed interest in its utilization during a skilled stay. From the resource availability to expand restorative nursing programs that allow up to four skilled residents in a group, to the revised group definition under Section O of the RAI manual, it is highly likely the clinician, staff, and patient interaction throughout a stay will reflect an exciting environment of peer motivation and social engagement.  

Prior to PDPM, if a therapy clinician executed a group with skilled residents participating, the group had to be planned for no more nor less than four individuals. Now, when a skilled resident is included in a group, the clinician has the autonomy to mold the size of the group to include anywhere from two to six participants, as appropriate. The psycho-social benefits and opportunity to apply functional carryover techniques within a quality, patient-centered group have not changed.

As noted by CMS and in multiple research studies, the psycho-social benefits of group are varied and include enhanced learning, increased sense of support, decreased depression, and improved motivation. Consider the story of a skilled patient who planned to return home alone. Prior to the event that led to the skilled stay, she participated in social outings once a week and depended heavily on loved ones to drop by for social interaction. Her family and friends encouraged her to “get out more”, but due to a self-perceived burden and a touch of embarrassment over her functional changes, she frequently declined the invitations. Eventually, this unintentional social isolation led to depression, sadness, and declining functional health. In her weakened functional state, she fell and although no fractures or breaks resulted, she did admit to the hospital due to altered mental status, dehydration, and mild malnutrition. Once stabilized, she admitted to a skilled nursing facility with the hope her weakened state could be reasonably reversed for a safe return home. During her stay, she participated in a physical therapy group once a week in addition to her daily individual therapy. Knowing her history, the clinician formulated a peer group identifying patients with similar goals targeting gait and balance, with the knowledge that this patient needed the peer motivation and example for attaining and maintaining her functional gains once she discharged home. During those sessions, the patient was encouraged by the evidence that her story was not unique and allowed her to self-identify the functional and emotional effects of isolation all while achieving her physical therapy goals.

Group therapy presents the unique opportunity for the therapy practitioner or restorative nursing staff to engage the patient during their care journey in novel ways. As a result, success is often amplified due to the underlying qualities inherent within group formats that simply cannot be mirrored in individual treatment sessions.  Whether delivered by restorative aides as part of a nursing program or by therapy clinicians as part of a rehabilitation stay, there is magic in the makeup of a group that is created with patient-centered intention and guided by staff who recognize the benefits of community and teamwork.

HIPAA Privacy Rule Refresher

Refresh your memory with some of the Privacy Rule points below:

  • HIPAA’s Privacy Rule goal is to protect the confidentiality of patient/resident healthcare information.
  • Protected Health Information (PHI) is individually identifiable health information collected from an individual and created or received by a health care provider, health plan, or health care clearing house relating to past, present, or future physical or mental health conditions of an individual.
  • Information is “individually identifiable” when any of the 18 types of identifiers can be used to identify an individual (e.g. name, address, dates such as birth date, account number etc.).
  • The HIPAA Privacy Rule applies to healthcare organizations, healthcare plans, healthcare clearinghouses, and business associates with access to PHI.
  • PHI can be in paper or electronic form, as well as in verbal communications. 
  • Photos and videos of patients/residents are PHI and require documented authorization to take and use.
  • Access to PHI must be restricted to the minimum access needed to accomplish the intended objective.
  • PHI cannot be used or disclosed without documented patient authorization unless it is for any of the following purposes or situations:
    • Use or disclosure to the patient
    • Use or disclosure for treatment, payment, or general healthcare operations
    • Use or disclosure if the individual can agree or object to a disclosure such as a patient bringing a family with them when discussing care with a physician
  • Covered Entities (CE) are required to provide residents/patients with a Notice of Privacy Practices (NPP) to tell how the CE may use and share their health information.
  • Disposal of documents containing PHI must be rendered unreadable.  Shredding is the most common method of disposal.  Before disposal, be sure to follow your organization’s data retention policies.

For more information regarding HIPAA Privacy, visit www.hhs.gov.

Appeals Demonstration and How it Continues to Evolve

Effective May 1, 2019, CMS expanded C2C Innovative Solution’s QIC Telephone Discussion and Reopening Process Demonstration to include providers/suppliers within certain MAC jurisdictions. Under the Demonstration, providers have the opportunity to participate in a recorded telephone discussion that will be included and considered as part of the appeals case file, prior to C2C’s reconsideration decision. In addition, the QIC has the authority to conduct reopenings on previously adjudicated unfavorable claims that are currently pending Administrative Law Judge (ALJ) assignment and/or unfavorable reconsiderations that have been decided by the QIC, but not yet appealed to OMHA.  Participation in the Telephone Discussion Demonstration is voluntary.

C2C will issue a form letter notifying the appellant that the claim has been selected to participate in the Telephone Discussion Demonstration. Participants will be allowed 14 calendar days from the date of the notification letter to respond by returning the forms with the enclosed letter and indicate a desire whether or not participate in this voluntary Telephone Discussion Demonstration.

If the provider concurs with the request to participate in the Telephone Discussion Demonstration, C2C will conduct the telephone discussions and shall be specific in clarifying Medicare policies and requirements, educating the provider/supplier, and identifying any materials, evidence, and/or documentation that would yield a favorable outcome as part of the reconsideration process. Following the telephone discussion, a reconsideration professional at the QIC will conduct the medical or technical review, considering and applying any additional information or supporting documentation that was provided as a result of the telephone discussion. After reviewing all documentation available, the reconsideration professional will issue a decision on the case.

Click here to read on for more information from C2C.

8 Sweet Ways to Love Your Heart

February is Heart Health Month. Here are some of the top ways to keep the heart healthy and happy.

  1. Sleep. Getting at least seven hours of sleep each night has been shown to reduce the amount of calcium build up in our hearts. Get to bed at a reasonable time or let yourself sleep in when you can.
  2. Be less salty. Adults should consume less than six grams of salt per day or about one teaspoon. Check food labels and cut down on added salt to foods and enjoy the natural flavors instead.
  3. Get fruity! (and veggie). Increase your intake of fruits and vegetables as much as possible throughout the day. Giving your body the nutrients it needs can be healing and give you and natural energy boost.
  4. Keep your hands busy. Knitting, quilting, woodworking, scrap-booking and other activities we do with our hands keeps our minds active and also can help reduce our stress levels.
  5. Dance. Saying to “exercise more” sounds like a chore but telling you to “dance” three or four times a week is a cardiovascular activity that will help to improve your strength and stamina as well.
  6. Laugh. When we laugh, stress hormones are reduced, endorphins and T-cells are boosted, and we can get a good ab workout when we have a good belly laugh. Considering all this, laughter actually might be nature’s best medicine.
  7. Stretch it out. Stretching can help improve your balance, strength and flexibility. It also helps reduce stress and can help improve heart health by helping you relax. Do some simple stretches throughout the day to stay nimble and loose.
  8. Eat breakfast. Eating a nutritious breakfast every morning can help maintain a healthy weight and get your metabolism awake for the day. Food is fuel, so eating a heart-healthy meal at the beginning of the day can help kick start a great day!

Credit: A Year of Wellness™, www.ayow.com

HIPAA Concerns with Personal Computers

Many clinical systems can be accessed via the internet making it convenient to work from your personal computer.  However, there is growing concern regarding HIPAA privacy and security issues with using personal computers.

Reasons for the concerns are:

  1. Malware, such as viruses and ransomware, are tools bad actors use to gain access to ePHI and other sensitive information.  Security and compliance minded companies implement anti-malware software and continually update it to detect and eliminate malware. With personal computers there is no guarantee this defense is in place and kept current.
  2. Computer devices require an operating system (OS) to manage the various functionalities of the computer.  Windows 10 is an example of an OS.  Bad actors are continually looking for vulnerabilities within the various versions of these systems to attack and access them for ill-gotten gain.  Vendors provide routine updates as vulnerabilities are discovered to remove them and prevent bad actors from accessing.  This requires a vigilant process of routinely updating the OS to eliminate vulnerabilities.  This process is not guaranteed or consistent with personal computers.
  3. Encryption of devices is a security feature by which information is encoded such that only authorized individuals can access.  Encryption is a HIPAA-endorsed safe harbor, meaning lost or stolen devices containing ePHI that are encrypted do not constitute a breach.  Configuration of encryption is not guaranteed on personal computers.
  4. Remote wipe is a security feature that allows an administrator to issue a command to delete data on a computer.  This is used as a safeguard when equipment is lost or stolen to avoid unencrypted data falling into the hands of a bad actor.  Proper configuration and/or additional software is required to provide this capability, and this is not guaranteed to be implemented on personal computers.
  5. Consider, ePHI can be stored on a personal computer such as reports produced by the clinical system containing PHI.  This means individuals, such as others within the household, who have no need to view or access the ePHI have that capability.  This can result in a HIPAA reportable breach.  To heighten the risk, once an employee leaves their current employer, they are no longer authorized to access the ePHI; however, there is no capability for the employer to remove the ePHI from the employee’s personal computer to eliminate access.

Reliant employees are not allowed to use personal computers to access Reliant systems and may refer to Policy 3.14 – IT Equipment Protection & Physical Access Controls. 

A Glimpse into Medical Review Under the PDPM

While many providers are anxiously anticipating the receipt of their first additional development request (ADR) or denial under the Patient-Driven Payment Model (PDPM), other providers are gradually starting to receive requests. These requests are largely coming from managed care companies (primarily Humana) that also chose to adopt the new payment model on October 1, 2019.  While the documentation requests may look the same, the information being reviewed will differ.  Previously, the requests being received were solely focused on RUG reviews. With RUG levels no longer being the driver of payment, the reviews will shift to elements of support for qualifying hospital stays, medical necessity, and the strength of the skilled documentation supporting the services provided.

Qualifying factors for skilled services have not changed with the PDPM. It is our responsibility to document why skilled therapy is needed. Be mindful that not only does strong documentation affirm medical necessity for skilled therapy, but it also becomes part of the patient’s medical record and will be referred to for validation purposes if needed. Use of discipline specific clinical terminology and documentation of techniques, which can only be performed by a skilled clinician, are paramount to ensuring success.

 The most advantageous thing we can do to prepare for documentation review is to continue to ensure our documentation and coding is held to the highest standard.  By providing thorough documentation, a collaborative team approach, and the best care possible to all beneficiaries, we possess all the tools needed to produce the outcomes that will be necessary to succeed with these audits.

Remaining Constant Through Change

The Greek philosopher, Heraclitus, mused “the only thing that is constant is change.”  In life, change often comes in waves that may be sudden and unexpected, altering our individual existence drastically.  Changes within the post-acute care industry are often cumbersome and occur gradually, but once enacted, the ripple effect is far reaching.  Such is the case with our recent industry shift to the Patient-Driven Payment Model (PDPM) and the annual, regulatory updates of healthcare. Although change is inevitable, the consistency of our mission, vision, and values, which is patient-centered, quality care that reflects successful outcomes, do not change. With this in mind, advocacy becomes paramount to ensuring our patients’ access to quality care.

The industry entered 2020 alert and aware of the need to remain abreast of regulatory updates and to affect change through advocacy. One excellent example includes the NCCI edits that CMS announced on January 1st that precluded clinicians from providing therapeutic activities or group intervention on the same day the patient was evaluated. The immediate effect included lack of patient access to potential treatment approaches at the onset of intervention, preventing the evaluating therapist from assessing patient response in order to develop the most effective, individualized plan of care. Reliant provided education on workable solutions to ensure our patients continued to receive the most individualized and appropriate treatment approaches within this regulatory limitation.  At the same time, we encouraged every avenue of advocacy, and ultimately, the industry prevailed in repeal of these edits imposed on rehabilitation codes.

Current advocacy efforts surround proposed payment reductions impacting rehabilitation directly. Beginning January 1st, modifiers must be present to denote outpatient therapy services furnished in whole or in part by a PTA or an OTA. This data will be utilized to reflect a payment reduction beginning in 2022. These services will be reimbursed at 85% of the physician fee schedule.  The proposed reimbursement decrease is of significant concern. Daily interventions provided by a licensed PTA or an OTA are of a skill, quality, and caliber that should continue to receive value recognition through reimbursement.  As a result, advocacy should be a priority for all!

An additional area of advocacy opportunity surrounds CMS’ proposed 8% cut to outpatient therapy service reimbursement starting in 2021.  This is in addition to the changes to reimbursement for services provided by a PTA/OTA as noted above. Many details are still needed to better understand why these rehabilitation codes were selected as a pay-for to a physician outpatient evaluation code increase.  Advocacy efforts seek transparency surrounding this selection process, the data used, and continue to point out how this reduction runs counter to CMS’ mandate for patients to have access to accurate and appropriate quality of care. 

Let’s not wait until the next round of regulations are implemented before making our voices heard. Who better to anticipate how regulations may impact our patients’ access to services than the professionals of the industry who provide patient care and have a vested interest in ensuring their outcomes are positive?  May our care for the patients and their needs embolden us to action, to become agents of change. 

Reducing Pain Naturally

Both acute and chronic pain can be debilitating and severely impact quality of life. What’s more, the number of people who have died from an opioid overdose has quadrupled from 1999 to 2015. Opting for non-drug pain management alternatives is preferable for both patients and physicians.

Acute Pain:

  • Acute pain is a warning sign that tissue damage has occurred or may occur.
  • Acute pain is a type of pain that is directly related to soft tissue damage such as a sprained ankle or a paper cut.
  • An acute pain signal is the body’s way of providing protection from injury or further injury.
  • Acute pain lasts for a short time (up to 12 weeks).

Chronic Pain:

  • Chronic pain occurs when the brain determines there is a threat to one’s wellbeing based on the many signals it receives from the body.
  • It can occur independently of any actual damage due to injury or illness, and may extend beyond the normal tissue healing time.
  • With chronic pain, the nervous system creates pain even after the physical injury/illness has healed.

Non-drug Pain Treatments:

  • Posture and balance training
  • Manual therapies including myofascial release and soft tissue mobilizations
  • Modalities including diathermy, electrical stimulation, or ultrasound (limited duration)
  • Flexibility exercises
  • Energy conservation techniques
  • Adaptive techniques for completing common activities
  • Relaxation techniques such as Thai Chi, Yoga, distraction activities, deep breathing, meditation, socialization activities, hobbies, etc.

Celebrating the Successes of 2019

The past year ushered in a new era for the long-term care industry. With implementation of the Patient Driven Payment Model (PDPM), as well as full implementation of the Requirements of Participation (RoP), evolving became a part of our daily lives.

Through preparation, collaboration and continued evaluation of processes we have celebrated many successes. Together over the past year, we have explored all aspects of the PDPM, as well as the regulatory impact of the RoP and rehabilitation’s role in partnering with facilities for collaborative communication and success, all while never losing focus on patient outcomes.

We celebrated patients’ successes as they met their goals and returned to prior levels of independence, many returning to the community. In 2019, Reliant therapists climbed our Clinical Advancement Ladder and teams continuously practiced at the top of their licenses all while commemorating holidays with themed parties, fabulous costumes and fun activities for the patients.

Because our dominant focus was on our care for the patient, we maneuvered through these uncharted regulatory waters successfully. As we continue to fine tune processes, our focus remains on patient satisfaction and positive patient outcomes for that is at the heart of all we do. Their successes are our successes!

A year from now when we are reviewing our successes, we will have learned, adjusted, grown and flourished. We look forward to our continued partnerships allowing us to do what we do best because, together, our Care Matters.

Ransomware Impacts Over 100 Nursing Homes


Imagine how hard it would be to do your job if you could no longer login to the systems you use every day! What would you do if you couldn’t access your patients’ information? How would you properly care for your patients? That’s what happens when hackers conduct a successful ransomware attack. Data is held hostage until the ransom demand is paid.

In a recent ransomware attack impacting over 100 nursing homes, the ransom demand was $14 million in bitcoin. Very few businesses can afford that large of a ransom and the FBI does not recommend paying ransoms as it only encourages this bad behavior. In this instance, a third party IT vendor called Virtual Care Provider Inc. (VCPI) providing data storage and other IT services for the nursing homes was the target of the attack. 1In an interview with KrebsOnSecurity today, VCPI Chief Executive and Owner Karen Christianson, said the attack had affected virtually all their core offerings, including internet service and email, access to patient records, client billing and phone systems, and even VCPI’s own payroll operations that serve nearly 150 company employees.

Phishing emails are the most common mechanism for the delivery of ransomware. Clicking on a link or opening an attachment within a ransomware phishing email triggers the infection resulting in encryption of data. This is the reason it is so important for anyone using email to be cautious and heed the red flags such as below.

  • Be suspicious of unsolicited or unexpected email messages from individuals asking for sensitive information like User IDs and passwords.  Contact the individual by means other than email to confirm the validity of the request.
  • Never click on links or open attachments in suspicious emails. (Tip: Hovering your mouse over a link will reveal the destination of where the link would take you.  If that destination is different than what’s shown in the email, do not click it.)
  • Never enter your User ID or password on a web page unless you are 100% sure the page is legitimate.
  • Pay attention to the URL of a website.  Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net).

1 https://blog.knowbe4.com/110-nursing-homes-cut-off-from-health-records-in-ransomware-attack?utm_source=hs_email&utm_medium=email&utm_content=79860342&_hsenc=p2ANqtz-9jWBaMNzZIKqlb8s2ojaqDpKROxTRgP_fcyCUVCI_VOBLpEOiAhl4q6y2ljzvEzYK4oBWCk1JSZXl4Yiij6pCZ_BhiVA&_hsmi=79860342