Counteracting Healthcare Industry Cybersecurity Threats: Security Awareness for Everyone (SAFE)

healthcare cybersecurity threat awareness | HealthEdge

Here at HealthEdge, our cybersecurity strategy relies on a defense-in-depth approach, which means we rely on people, processes, and technology to ensure our security controls remain viable and constantly evolve. Of these three, the HealthEdge team, is the most formidable layer of cybersecurity. We count on our global workforce to stay informed, identify and report suspicious messages, and to understand and comply with our IT Security Policies. Our Chief Information Security Officer, Jerry Sto. Tomas says, “I am often asked how big our security team is. I respond with, ‘around 2,000 people.’ Each of us has a responsibility in security because the HealthEdge team is the first line of defense.”

The SAFE program aims to empower our team with:

  • Regular newsletters providing education on healthcare cybersecurity threat awareness and trends.
  • Cybersecurity alerts on real-time threats and how the workforce can help.
  • Comprehensive IT security policies.
  • Mechanisms to report suspicious messages.
  • Monthly internal phishing simulation tests and just-in-time training.
  • Annual training, role-based training, and continuous micro-training.
  • Cybersecurity best practice tips to implement in the workplace and at home.

Preparing the Team

With regular information newsletters and real-time security alerts, our team is always kept up-to-date on cybersecurity, regardless of their role at HealthEdge. Newsletters are sent out bi-weekly with cybersecurity news, tips, trends and communications about new security practices. Newsletter content is tailored to our organization with the objective of improving overall healthcare cybersecurity threat awareness both at work and home.

Identifying and Reporting

The goal of SAFE is to ensure everyone is able to identify and quickly report suspicious messages or activities. The Security Operations team analyzes every message that is reported as suspicious and sends the results back to the reporter. Sending the analysis results back to the reporter provides the reporter with confirmation of their ability to identify malicious messages or spam. On a monthly basis, phishing tests are sent out that simulate current phishing campaigns used by threat actors. Campaign attack techniques include domain and popular brand spoofs, QR codes, and suspicious links with requests for information, oftentimes with topics based on global security trends, cultural events or “the events of the day”. In addition to maintaining a low fail rate, the objective is to increase identification and reporting of suspicious messages. Those who fail are provided subsequent training to increase future awareness.

Administrative and Technical Controls

In addition to IT security policies, HealthEdge implements technical controls that monitor and enforce password policies and multifactor authentication. Network access is controlled, and principles of least privilege are enforced. This means that even trusted users with authorized network access are limited to only the access required to do their job. When access is granted, logs are collected from across the environment, which gives us the ability to monitor changes that could impact preservation of confidentiality, integrity, or availability. Our team’s cybersecurity habits, and best practices strengthen our administrative and technical controls; each component is critical for cybersecurity maturity.

A Holistic Approach

Our team prides itself on keeping up with the latest cybersecurity news and updates. We follow industry best practices, monitor third-party intelligence, implement technical and administrative controls, and most importantly we keep the cybersecurity discussion going. Our holistic approach allows our team to be prepared to protect the HealthEdge workforce network as the first line of defense, and also empowers them to practice good cyber hygiene at home. Security awareness for everyone, every day, everywhere.

 

HealthRules Payer Named ‘Best in KLAS’ for Second Consecutive Year

HealthEdge’s Core Administrative Processing Platform Earns #1 Ranking

 

HealthEdge Software, provider of the industry’s leading next-gen integrated solution suite for health insurers, is proud to share that HealthRules Payer® earned the 2023 “Best in KLAS” title for Claims & Administration Platforms for the second year in a row. Healthcare IT data and insights company KLAS Research awards the annual recognition to companies ranking #1 in their category. Rankings are based on the opinions of healthcare professionals and clinicians in 23,000 evaluations across more than 4,500 organizations.

Powering plans across all lines of business, HealthRules Payer is solving some of today’s biggest payer challenges. An advanced core administrative processing system (CAPS) with capabilities far beyond legacy systems of the past, HealthRules Payer provides a transformational, digital foundation for health plans of all types and sizes. The next-gen application gives plans the agility, flexibility and insights to grow their business, embrace change, and swiftly address new regulations and market opportunities. In addition, the user-friendly platform reduces manual processing, empowering payers to improve operational efficiency through automation.

“We’re honored by the growing number of health plans that trust HealthRules Payer as the foundation for their digital transformation journey,” said Sagnik Bhattacharya, Executive Vice President and General Manager of HealthRules Payer. “We look forward to further accelerating health plan digital automation, flexibility and agility as today’s healthcare economy demands.”

What do HealthEdge customers say?

KLAS evaluations give a glimpse into what users are saying about HealthEdge & HealthRules Payer:

“HealthRules Payer is a great product. The system is very configurable, and we experience a high automatic adjudication rate for our claims, and those are really positive things. There are very few things that we haven’t been able to do in the system. I would buy HealthRules Payer again because it is a solid product. HealthEdge has done a lot of work and implementations, and they have created the best practices to move from one system to the next.” – Health plan COO, September 22, 2022

“HealthEdge stands out as the one vendor we would want to expand the business relationship with. When their CEO ascended, there was a shift in the philosophy of the company, and it became much more customer-centric. There is a whole chain of really talented people on their team, they have never hesitated to reach out, and our technical teams meet regularly. It is definitely a relationship we value quite a bit, even despite some bumps.” – Health plan CIO, September 22, 2022

“HealthEdge is at the forefront of things when it comes to staying current with the direction that healthcare is moving in the United States. Some examples of that are the ways that the vendor does value-based payments and makes sure that the system is aligned with the work that it needs to be. The vendor also keeps up the trend of moving toward a digital world. HealthEdge is very good at partnering with and acquiring other vendors.” – Health plan VP, September 22, 2022

Good Relationships + Good Technology = Customer Success

“Our company vision is to innovate a world where healthcare can focus on people,” highlights Steve Krupa, chief executive officer at HealthEdge “We’re thrilled to receive the “Best in KLAS” award for the second year in a row, and more importantly, help our payer customers write the next chapter of their story.”

Our healthcare SaaS software provides payers with a digital foundation that enables them to deliver a transparent and consumer-centric experience at lower cost while offering higher quality and higher service levels to their members, providers and partners.

HealthEdge’s Source Shines Bright in KLAS ‘Emerging Solutions Spotlight’

Alongside the “Best in KLAS” title honoring HealthRules Payer, KLAS Research surfaced high scores for prospective payment integrity platform Source, an integral part of the HealthEdge ecosystem. In a 2023 “Emerging Solutions Spotlight” examining product performance, KLAS details Source’s strong customer satisfaction scores, with A grades for all key performance indicators and success in achieving customers’ expectations. The report references high points called out by customers, including the tool’s biweekly updates around pricing guidelines and real-time claims processing that gets prices right on the first pass. Payers in the report credit Source for increased savings, reduced agreement volumes and workflow automation. KLAS Research highlights customer comments commending the company for listening to customer needs, providing frequent updates to reflect changes in fee schedules, and enabling visibility into Medicare rates and pricing. “What sets HealthEdge apart from other vendors is the capability to look up the Medicare rates in the system,” said a health plan director. “If we have, for example, a provider that says that we didn’t price a claim correctly, we love the way that the audit tool can go in and look at the claim.”

“As an interoperable, cloud-based platform built from the ground up, Source enables health plans to identify and fix issues at the root cause,” said Ryan Mooney, Source’s executive vice president and general manager. “With true transparency and control over their payment integrity operations, healthcare payers can finally unlock the ability to pay claims accurately, quickly and comprehensively the first time.”

Learn more about HealthRules Payer and Source.

Supporting the Complexities of State Medicaid Reimbursement: New York

New York represents one of the country’s largest populations of Medicaid beneficiaries, according to Medicaid.gov. Keeping up with the payment and policy updates that the New York State Department of Health (NYSDOH) sets for Medicaid providers is no easy task for payers trying to successfully serve this growing population. In fact, in a 2022 survey of more than 400 payers offering Medicaid as a line of business, the three most popular challenges payers faced were all tied to staying compliant with all of the changes:

  • 74% = staying compliant with changing reimbursement policies
  • 62% = installing updates to the fee schedule in a timely manner
  • 52% = keeping up with changing fee schedules

That same study revealed how manual-intensive it is for payers to keep their Medicaid program fee schedules and policies up-to-date, with 84% claiming that they do it “mostly manually.”

Due to the complex nature of Medicaid, payers have historically relied on a patchwork of disparate workflows and vendor solutions to provide pricing for their Medicaid lines of business. Today, Source is taking its expertise developed over decades of supporting Medicare reimbursement and applying that same depth and breadth of content to Medicaid. New York is the latest state supported by HealthEdge Source.

The uniqueness of state Medicaid programs is what makes it so challenging for many solutions to keep up. One size does not fit all, and change is constant. Each state has its own set of rules that payers must play by so there are very few common rules that can be applied. For example, in New York, the state doesn’t post nursing facility rates by NPI or Medicaid ID, but by operating certificate. Many states are still using grossly outdated Medicare guidelines and prices. And when you combine these unique complexities with those of the multiple Managed Care Organizations (MCOs), it can quickly become overwhelming to manage, resulting in non-compliance and inaccurate payments.

HealthEdge Source: How it Works

When it comes to payment integrity for Medicaid programs, the Source experts have payers covered with two dedicated teams – one for data research and new developments and a second for maintaining the Medicaid edits currently available. Armed with advanced web monitoring tools and seasoned research analysts, Source delivers updates to customers every two weeks. And because it is a cloud-based solution, those updates are automatically applied. That means IT teams are free to focus on strategic initiatives instead of trying to maintain complex pricing.

Many industry experts believe that state Medicaid programs will continue to become increasingly complex as the necessity of finding more cost-effective ways to deliver high quality care becomes more urgent due to rising costs. To learn more about how Source can help your organization stay on top of the ever-evolving New York Medicaid program requirements, visit Source Medicaid Reimbursement.

The Importance of Effective Customer Communications for Health Insurers

Health insurers increasingly understand that delivering a delightful customer experience to members is critical for success. In a survey of health insurance executives conducted by market research firm Survata and commissioned by HealthEdge, when asked about the most important organizational priority, the number one response was “member satisfaction.” This surpassed lowering costs, investments in innovation and the shift to new business models, and represents a heightened awareness that members are actually customers, and act as consumers of a health insurers’ services. Effective communications are a critical component of creating a satisfying customer experience. Expectations from consumers reflect their experiences with services provided by virtually every other industry, enabling real time transactions and access to relevant and up-to-date information on demand.

Top Challenges of Effective Customer Communications

Health insurers must continually provide timely and accurate communications to tens of thousands of their customers throughout the year. Challenges, particularly with legacy communications solutions include:

  • Maintaining a large library of templates to tailor communications to specific requirements
  • Significant IT resources along with costly services engagements to maintain and upgrade communications solutions
  • The inability to scale with speed to market for competitive advantage
  • Resource intensive requirements to maintain and update complex documents

3 Musts of Effective Customer Communications

As you develop and enhance your communication protocols, or partner with a service provider, there are 3 communication musts:

  • Easy complex logic – templates must be easy to use, feature drag and drop functionality, and enable your team to easily incorporate videos, charts, multiple attachments, and more
  • Flexible & streamlined communication management – templates must be able to support multiple brands, languages, and communication channels
  • Security & compliance – all communication must be PCI, HIPAA, SSAE 16, ISAE 3402, and ISO compliant

HealthRules Payer® & Smart CommunicationsTM – Enhancing Customer Communications

HealthEdge’s next generation core administrative processing system, HealthRules Payer, has partnered with Smart Communications to empower HealthRules Payer customers to improve the member experience with more customized communications across more channels. Smart Communications is the leading cloud-based platform for enterprise customer communications. As the only cloud solution ranked as a Leader in Gartner’s Magic Quadrant for Customer Communications Management, more than 350 global brands — many in the world’s most highly regulated industries — rely on Smart Communications to make multi-channel customer communications more meaningful, while also helping them simplify their processes and operate more efficiently.

Learn more here about how HealthRules Payer and Smart Communications are paving the way to more impactful communication.

New CMS Proposed Rule: Interoperability & Electronic Prior Authorization

Prior authorization is a challenge for both providers and patients. The new CMS proposed rule on interoperability and electronic prior authorization aims to decrease provider abrasion and enhance the member experience – and ultimately improve both member and population health.

Today’s prior authorization challenges

Prior authorization hinges on accurate data and easy access to that data.  Today, the exchange of information between providers and insurance is often challenging and convoluted, and the processes for prior authorizations are no different.  Determining which services and procedures require prior authorization and what supporting documentation is needed to reach a decision often delays the delivery of care.

Many providers still rely on fax to get the prior authorization information to and from the insurance company. Providers send the information, wait for a response from the health insurance plan, send the requested information, wait for a response, and so on.

In a world, where nearly anything can be instantaneously ordered and delivered overnight, from your mobile phone or laptop, it seems inconceivable that prior authorizations, something so critical to member and population health, is managed by such a slow, tedious, and antiquated system.

Interoperability in healthcare data is poised to close the gap.


Making provider abrasion less painful through interoperability in healthcare

Interoperability offers the possibility of streamlining the prior authorization process with the seamless interchange of data via APIs, in real time. The new CMS rule proposes requiring implementation of a Health Level 7® (HL7®) Fast Healthcare Interoperability Resources® (FHIR®) standard Application Programming Interface (API) to support electronic prior authorization. With this:

  • Providers can easily find out if a prior authorization is required for a patient/procedure
  • If yes, providers can then see the documentation requirements for that prior authorization

For example, if a member needs an endoscopy, the API pulls the information and tells the provider what information is required for the prior authorization.

Furthermore, since the early 2010s, most provider offices have electronic health records. This API would facilitate linking the electronic records to the prior authorizations and exchanging the information that needs to be shared between the provider and insurance.

This seamless exchange of data will reduce provider abrasion, improve the member experience and potentially their health outcome, and ultimately decrease the cost of care – as the manual effort and time linked to prior authorizations markedly decreases.

Patient Access API

The CMS Interoperability final rule which has been in effect since January 1, 2021, and CMS began enforcing as of July 1, 2021 included the Patient Access API and the proposed rule looks to expand the scope.

The Patient Access API enables a Medicare Advantage (MA), Medicaid, Children’s Health Insurance Program (CHIP), and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges (FFEs) member to access their healthcare information using smart apps of their choice.

The proposed rule adds prior authorizations and decisions to the information available via the Patient Access API along with annual metrics of prior authorization requests and decisions on the plan or issuer’s website.

Member health information is a mountain of data – a lifetime of different doctors, procedures, and experiences. You move or change doctors – sometimes you collect your health records and sometimes they’re lost to the shuffle of life. All this data, in so many different places, makes it challenging for members and their providers to understand and analyze it all.

Extending the interoperability API to members puts all their health data at their fingertips – across doctors, geography, and time – empowering members and populations to improve their health.

Provider Access API

For providers, there’s the possibility of sharing patient data within a network of providers. Members can grant providers access to share their data – empowering the providers to better collaborate and see the full picture of a member’s health and medical experience. This could ultimately improve patient outcomes.

The Proposed Rule also looks to return focus on the Payer to Payer Data Exchange rules which CMS deferred enforcement to allow for creation of supporting structure and standards. The Payer to Payer Data Exchange required a plan or issuer to share up to 5 years of membership and claims information for a member when the member moved to a new plan or issuer, upon the members request. CMS is proposing to also allow a member with concurrent coverages to request the plans or issuers to exchange the data quarterly. The addition of prior authorization requests and decisions to the data exchanged is also proposed.

HealthEdge: On the Forefront of Interoperability

The HealthEdge suite of products are built on solid processes that produce accurate, real-time data. With this data, providers and plans can easily access data and improve population health, increase customer satisfaction, and decrease provider challenges. Learn more here.

Transitioning Out of a Public Health Emergency

The good news: COVID-19 numbers across the country have gotten low enough (daily reported cases are down 92%[1]) that the Federal government feels the Public Health Emergency status issued in March 2020 that enabled the government to weather the worst of the virus, is no longer needed. The bad news for the American healthcare system: Estimates show up to 18 million Americans will lose their health insurance coverage through Medicaid within 14 months[2].

The Medicaid line of business grew more than 17% from February 2020 to September 2022 from an increase in the unemployment rate as well as the Continuous Enrollment Provision as part of the Public Health Emergency. That growth may now tumble downward as states begin to comply with CMS and State guidelines for Medicaid eligibility.

Medicaid chip enrollment, february 2020 september 2022 [3]

While the current Federal guidelines give states up to 14 months to resume normal income eligibility for Medicaid enrollees, many states can choose to do so more rapidly. What this all means for health insurers is a renewed need for outreach to potential Medicaid members who are in danger of being disenrolled to communicate options for Marketplace coverage. This can become increasingly complex for states with federally facilitated Marketplaces that can oftentimes operate in siloes.  Others losing Medicaid may become eligible for Medicaid Premium Assistance in the Employer Sponsored Insurance (ESI), but while employment levels nationally have returned to pre-pandemic levels, it can vary widely from state to state.

But amidst this looming unrest lies an opportunity for an often-broken healthcare system to work as it should. States are encouraged to partner with health plans, MCOs, community health centers, ancillary care providers, and other health care partners to reach out to enrollees to conduct their annual Medicaid renewal application. Each entity plays a role in ensuring the fewest number of Americans become uninsured. With HealthEdge’s family of products, modern health plans can operate Medicaid lines of business with maximum efficiency while staying compliant with state-specific frequently changing regulations. To learn more visit: https://healthedge.com/lines-of-business/government/medicaid/

 

[1] https://www.hhs.gov/about/news/2023/02/09/fact-sheet-covid-19-public-health-emergency-transition-roadmap.html

[2] https://www.urban.org/sites/default/files/2022-12/The%20Impact%20of%20the%20COVID-19%20Public%20Health%20Emergency%20Expiration%20on%20All%20Types%20of%20Health%20Coverage_0.pdf

[3] https://www.kff.org/medicaid/issue-brief/10-things-to-know-about-the-unwinding-of-the-medicaid-continuous-enrollment-provision/