MHA CEO Report — Time to Focus on Cybersecurity

MHA Rounds Report - Brian Peters, MHA CEO

MHA Rounds Report - Brian Peters, MHA CEOThe world-altering powers that technology has delivered into our hands now require a degree of consideration and foresight that has never before been asked of us.” ― Carl Sagan

A long-held practice utilized by businesses of all stripes is the ubiquitous SWOT (strengths, weaknesses, opportunities and threats) analysis. For a hospital or health system in 2022, there is no shortage of candidates to fully stock the “threat” category. In this column, I want to draw attention to one that deserves increased attention because of its potential to cripple an organization in an instant: cybersecurity.

The wonders of technology have dramatically improved healthcare in Michigan and beyond. Advancements include imaging technology that identifies serious disease at a much earlier stage, robotic devices that permit surgical interventions that were previously considered too risky to attempt, remote patient monitoring and telehealth, and electronic medical records that facilitate better tracking and coordination for patients across various sites of care — the list is impressively long.  And amid our current workforce shortage crisis, we often describe technology in healthcare as a “force multiplier” that can supplement and extend our limited staffing resources to help ensure adequate access to care.

Make no mistake, healthcare still has one foot on the proverbial dock and one foot in the proverbial boat. That is, many of our communications and services remain in the “analog” world, while a growing share have become electronic, digitized and inter-connected. This phenomenon — coupled with the fact that the personal health information we collect and store has more value on the black market than any other data — has painted a neon target on our back for a growing cadre of cybercriminals and adversarial nation states. It is no accident the FBI has identified healthcare as the number one target of these bad actors. And simply put, a cyberattack on a hospital is a “threat to life” crime. We must act accordingly.

The statistics on healthcare attacks are enough to keep any executive up at night. An attack on a midsize hospital creates an average shutdown time of 10 hours and costs on average $45,700 per hour, according to an Ipsos report. In the same report, 49% of the respondents said their annual compliance budget for cybersecurity wasn’t enough. According to IBM, a data breach at a healthcare organization costs more than any other sector at $10.1 million. And the threat continues to grow, as healthcare cyberattacks have increased by 84% from 2018 to 2021, according to Critical Insight. Michigan hospitals, health insurance companies, physician offices and others have been the victims of ransomware attacks and related cybercrime in recent years.

If this wasn’t bad enough, a spotlight was shone on cybersecurity this past spring during Russia’s invasion of Ukraine, when cyberattacks on the Ukrainian government and critical infrastructure organizations had the potential to ripple across multi-national organizations and infect U.S.-based operations, including healthcare. Experts believe this scenario will be part of every future global conflict. And unfortunately, for many hospitals and health systems who welcome patients from multiple foreign countries, and who have business partners outside the United States, the practice of “geo-fencing,” or blocking all incoming email traffic from outside the country, is not always a viable approach.

So where can hospitals and health systems turn for help? At the national level, the American Hospital Association anticipated this trend several years ago and employs John Riggi as the national advisor for cybersecurity and risk. John has been a resource for the MHA in the past and as a former leader within the FBI’s cybercrime division, he maintains close ties with all the relevant government agencies.

And here at the MHA, we are also very committed to strengthening our own cyber defenses, while doing the same for our members. We have appointed Mike Nowak to serve as our own Chief Information Security Officer. Several years ago, Mike and his team helped to launch, and have subsequently helped to operate, the Michigan Health Security Operations Center (Mi|HSOC) for hospitals and health systems. Created for healthcare providers by healthcare providers, this first of its kind entity has the proven ability to prevent, detect, analyze and respond to cybersecurity events. Operating 24/7/365, the Mi|HSOC has developed strong relationships and communication with law enforcement at various levels, including the Michigan State Police Cyber Division, FBI and Secret Service.

An organization that helped form the Mi|HSOC is CyberForce|Q, which is now an MHA Service Corporation Endorsed Business Partner. In addition to sharing tactical information on emerging threats with the members of the security operations center, CyberForce|Q offers a variety of additional cybersecurity services to our members and other healthcare clients.

The bottom line — the MHA and our partners have helped Michigan become a leader in this space. By mitigating potential risk, physicians, nurses and staff of our member hospitals have the best opportunity to provide exceptional patient care without any external interruptions. While the advocacy, policy and safety and quality areas of the association often receive public attention, our cybersecurity efforts are constantly at work, often without much notice, to protect healthcare in Michigan.

But we need your help. I am the farthest thing from an expert in this field, but one thing I have learned is that the “human factor” is the most critical element of our defenses — and therefore the most vulnerable. Think twice before opening a suspicious email or text message, safeguard your electronic devices and passwords and take the time to educate yourself on all of the best practices to follow in the midst of this new, online world. The health of your patients and communities may depend on it.

As always, I welcome your thoughts.

Member Feedback Requested on Proposed Telemedicine Policy

The Michigan Department of Health and Human Services (MDHHS) recently released a proposed policy to update Medicaid coverage of telemedicine services after the conclusion of the federal COVID-19 public health emergency (PHE). The policy outlines several updates, including:

  • Making permanent policies established during the PHE through bulletins MSA 20-09 (General Telemedicine Policy Changes) and MSA 21-24 (Asynchronous telemedicine services). MSA 20-09 requires either direct or indirect patient consent for all telemedicine services and defines originating and distant sites. MSA 21-24 clarifies Medicaid coverage for asynchronous telemedicine services, including store and forward services, remote patient monitoring and interprofessional consultations.
  • Not requiring prior authorization unless the equivalent in-person service requires prior authorization. Authorization requirements for Medicaid health plans may vary.
  • Establishing payment rates for allowable telemedicine services at the same level as in-person services. To effectuate this policy, the provider must report the place of service as they would if they were providing the service in-person, along with modifier 95 – Synchronous Telemedicine Service. *MDHHS varies from Medicare telehealth billing by not using place of service 02 or 10 but aligns in the use of modifier 95.
  • Allowing audio-only telemedicine services only for select situations where the beneficiary does not have access to audio/visual capabilities. These codes are currently represented as CPT codes 99441-99443 and 98966-98968.

Members are encouraged to submit comments to the MDHHS by Sept. 20. Questions should be directed to Renée Smiddy at the MHA.

U.S. House Passes Advancing Telehealth Beyond COVID-19 Act

The U.S. House of Representatives passed July 27 the Advancing Telehealth Beyond COVID–19 Act to expand telehealth services by extending several telehealth flexibilities under Medicare that were initially authorized during the public health emergency relating to the COVID-19 pandemic.

Specifically, the bill allows federally qualified health centers and rural health clinics to serve as the distant site (i.e., the location of the healthcare practitioner); allows beneficiaries to receive telehealth services at any site, regardless of type or location; allows any type of practitioner to furnish telehealth services, subject to approval by the Centers for Medicare & Medicaid Services; and allows audio-only evaluation and management, and behavioral health services.

The legislation passed the House in a 416-12 vote. The entire Michigan delegation to the U.S. House voted in favor of the bill. The bill now moves to the U.S. Senate, where it likely has adequate support for passage.

For more information about the Advancing Telehealth Beyond COVID-19 Act, contact Lauren LaPine at the MHA.

Physician Fee Schedule Final Rule Affects Telehealth, Vaccines, More

The Centers for Medicare & Medicaid Services recently released the Medicare Physician Fee Schedule final rule for calendar year 2022, which includes updates to Medicare payments under the schedule and other Medicare Part B issues effective Jan. 1. Provisions of the rule will:

  • Reduce the conversion factor by $1.31, from $34.89 to $33.58, to accommodate budget neutrality with changes in relative value units and the expiration of the 3.75% payment increase provided in the 2021 Consolidated Appropriations Act.
  • Extend eligible telehealth services that were added to the Medicare telehealth services list during the COVID-19 public health emergency (PHE) through Dec. 31, 2023. This will allow for more time for stakeholders to gather data and submit support for requesting that services be permanently added to the Medicare telehealth services list.
  • Implement an in-person visit requirement at least every 12 months to qualify for telehealth service payment.
  • Include audio-only communications technology when used for telehealth services for the diagnosis, evaluation or treatment of mental health disorders furnished to established patients in their homes under certain circumstances.
  • Delay the start date for compliance actions related to electronic prescribing of controlled substances to Jan. 1, 2023, and delay the compliance start date for Part D prescriptions written for beneficiaries in long-term care facilities to Jan. 1, 2025.
  • Delay the penalty phase of the appropriate use criteria program to Jan. 1, 2023, or the Jan. 1 that follows the declared end of the COVID-19 PHE, whichever comes later.
  • Pay $30 per dose for the administration of the influenza, pneumococcal and hepatitis B virus vaccines, and maintain the current payment rate of $40 per dose for the administration of the COVID-19 vaccines. In addition, make the additional payment of $35.50 for COVID-19 vaccine administration in the home through the end of the calendar year in which the ongoing PHE ends.
  • Define and clarify policies for split (or shared) evaluation and management visits, which can be billed by the physician or practitioner who provides the substantive portion of the visit.
  • Allow physician assistants (PAs) to bill Medicare directly for their professional services, reassign payment for their professional services, and incorporate with other PAs and bill Medicare for PA services.
  • Delay the increase in the quality performance standard Accountable Core Organizations must meet to be eligible to share in savings until program year 2024.

Members with questions should contact Renée Smiddy at the MHA.

CMS Releases Proposed Rule on Physician Fee Schedule

The Centers for Medicare & Medicaid Services (CMS) recently released the calendar year 2022 Medicare Physician Fee Schedule proposed rule. The rule proposes a conversion factor of $33.58, a decrease of $1.31 from the calendar year 2021 conversion factor of $34.89. The updated conversion factor is budget neutral to account for changes in relative value units and the expiration of the 3.75% payment increase provided in the 2021 Consolidated Appropriations Act. The proposed rule also includes provisions to expand telehealth for mental health services and include coverage for audio-only services in certain instances. Highlights for the proposed rule include the following:

  • Telehealth Services: The CMS continues to evaluate the temporary expansion of telehealth services that were added to the telehealth list during the COVID-19 public health emergency. The CMS proposes certain telehealth services remain on the list until Dec. 31, 2023, so there is a glide path to evaluate whether the services should be permanently added to the telehealth list. The agency is proposing including audio-only communication when used for telehealth services for the diagnosis, evaluation or treatment of mental health disorders furnished to established patients in their homes. It is also proposing to require use of a new modifier for services furnished using audio-only communications.
  • Medicare Shared Savings Program: The CMS is proposing to freeze the quality performance standard for program year 2023 and revise the methodology for calculating repayment mechanism amounts for risk-based accountable care organizations. The Quality Payment Program Fact Sheet provides additional details.
  • Vaccine Administration Services: The proposed rule includes a comment solicitation to obtain information on the costs involved in furnishing preventive vaccines, with the goal to inform the development of more accurate rates for these services.
  • Opioid Treatment Program (OTP) Payment Policy: The CMS is proposing to allow OTPs to furnish counseling and therapy services via audio-only interaction after the conclusion of the COVID-19 public health emergency in cases where audio/video communication is not available to the beneficiary.
  • Electronic Prescribing of Controlled Substances (EPCS): The CMS is proposing certain exceptions to the EPCS, which requires electronic prescribing of controlled substances for schedule II, III, IV and V controlled substances covered through Medicare Part D.
  • Requiring Certain Manufacturers to Report Drug Pricing Information for Part B: The CMS is proposing to make regulatory changes to implement the new reporting requirements for drug manufacturers with Medicaid Drug Rebate Agreements.
  • Clinical Laboratory Fee Schedule: The CMS is seeking comments on policies for specimen collection fees and the travel allowances for homebound patients and inpatients (not in a hospital).

Comments on the proposal are due Sept. 13. Members with questions should contact Renée Smiddy at the MHA.

Federal COVID-19 Telehealth Program Application Deadline Announced

The Federal Communications Commission announced that Round 2 of the COVID-19 Telehealth Program application portal will be open from April 29 to May 6. Applications for the program may be filed through a dedicated application portal on the COVID-19 Telehealth Program webpage. Applications will be accepted once the application filing window opens, and all applications will be reviewed after the application filing window has closed. The COVID-19 Telehealth Program supports the efforts of healthcare providers to continue serving their patients by providing reimbursement for telecommunications services, information services and connected devices necessary to enable telehealth during the COVID-19 pandemic. There will be an additional $249.95 million available for Round 2 funding. Members with questions can contact the Universal Service Administrative Company.

FCC to Relaunch COVID-19 Telehealth Program

The Federal Communications Commission (FCC) announced that it voted March 30 to reopen the COVID-19 Telehealth Program, a $249.95 million federal initiative that builds on the $200 million program established as part of the CARES Act enacted in March 2020. The COVID-19 Telehealth Program is a reimbursement program that allows healthcare providers to receive compensation for telehealth-related expenses with appropriate invoices and documentation. The new application window for the second round of funding is expected to open within 30 days of the order, and the FCC will provide advance notification of that date.

The COVID-19 Telehealth Program was created to help healthcare providers provide connected care services to patients at their homes or mobile locations in response to the COVID-19 pandemic. With the relaunch of the program, the FCC announced that telehealth technology is a vital component of curbing inequities in access to healthcare services and that applications will be evaluated equitably to better ensure each state and territory can be approved for funding. Round 2 funding will prioritize low-income communities, tribal communities, areas with provider shortages and projects that were not approved during the Round 1 application. The second application process will differ from the first by having an application deadline meant to ensure all applications are reviewed, rather than applications being reviewed as submitted. The first round of funding for the program was depleted in July 2020 after issuing awards to 539 applicants. Members with questions should contact Renée Smiddy at the MHA.

Combating the Novel Coronavirus (COVID-19): Week of Nov. 16

MHA Covid-19 update

MHA COVID-19 UpdateAs the Thanksgiving holiday approaches, the number of hospitalizations due to COVID-19 continues to rise. The MHA keeps members apprised of pandemic-related developments affecting hospitals through email updates and the MHA Coronavirus webpage. Important updates are outlined below.

Vaccine Studies Show 95% Effectiveness

Moderna announced Nov. 16 that the latest trials and studies of its COVID-19 vaccine show 95% effectiveness, and Pfizer updated its findings Nov. 18, announcing its vaccine also shows 95% effectiveness. Moderna’s results stem from its Phase 3 clinical trial of 30,000 individuals, and Pfizer’s efficacy rate resulted from a final analysis of its trial with more than 41,000 volunteers. Both vaccines use messenger RNA (mRNA) technology to cause the effective immune response. A key difference between the vaccines is that Moderna’s vaccine can be safely stored in freezers at about 25 degrees Fahrenheit (minus 4 degrees Celsius), a temperature easily reached by a normal freezer. The Pfizer vaccine requires ultracold storage only achieved by specialized freezers or dry ice.

Pfizer applied with the Food and Drug Administration for emergency use authorization of its vaccine Nov. 20, and Moderna expects to soon apply for the authorization. Although distribution dates are not yet certain, the Michigan Department of Health and Human Services (MDHHS) has advised that providers should be prepared to accept vaccine by early December to ensure expedient distribution and administration when shipments begin. Members with questions may contact Ruthanne Sudderth at the MHA.

Provider Relief Fund Further Clarified

The U.S. Department of Health and Human Services (HHS) has issued two important clarifications related to Provider Relief Fund (PRF) reporting.

The HHS had previously stated that providers could claim only the value of depreciation for COVID-19-related capital purchases with useful lives of more than 12 months. However, after urging from the American Hospital Association and the MHA, the agency stated that expenses for capital equipment, facilities projects and inventory may be fully expensed in cases where the purchase was directly related to the prevention, preparation for and response to COVID-19. Examples of such purchases include:

  • Upgrading heating, ventilation and air conditioning systems to support negative pressure units.
  • Retrofitting COVID-19 units.
  • Enhancing or reconfiguring intensive care unit capabilities.
  • Leasing or purchasing temporary structures to screen and/or treat patients.
  • Leasing permanent facilities to increase hospital capacity.

The HHS also clarified that providers’ reporting of net patient revenue should NOT include payments received from or made to third parties that relate to care not provided in 2019 or 2020.

For more information on the PRF, contact Jason Jorkasky at the MHA.

COVID-19 ICU Best Practices Follow-Up Webinar Offered Nov. 24

A Nov. 11 COVID-19 webinar titled “ICU Management & Treatment of COVID-19 Patients” was hosted under the MI-COVID19 registry continuous quality improvement initiative and provided meaningful discussion for participants. As a result, a follow-up webinar has been scheduled for noon to 1 p.m. EST Nov. 24. Objectives include:

  • Summarizing the latest COVID-19 intensive care unit (ICU) guidelines and recommendations.
  • Discussing best practices for management of critically ill COVID-19 patients.
  • Identifying resources and creating a network for ICU leaders in Michigan to advance the care of critically ill COVID-19 patients.

Members may register online, and questions should be emailed to

CDC Offers Education on Telehealth and Health Equity Dec. 8

The Centers for Disease Control and Prevention (CDC), through its Clinician Outreach and Communication Activity division, will host an educational event via Zoom from 2 to 3 p.m. EST Dec. 8 that will focus on telehealth and health equity. Details and access information for the event are available online. Presenters from Kaiser Permanente and the Veterans Health Administration will discuss how telehealth has affected health equity in their patient populations before and during the COVID-19 pandemic.

Topics will also include challenges and opportunities related to telehealth implementation. Presenters will share strategies to expand access that can reduce disparities and improve culturally responsive care to help achieve health equity within each organization. In addition, presenters from the CDC will share telehealth strategies that incorporate the CDC’s frameworks for Addressing Health Equity in Public Health Practice.

In associated news, the MHA recently released its Pledge to Address Racism and Health Inequities that was approved by the MHA Board of Trustees at its Nov. 4 meeting (see related article).

COVID-19 Relief Facility Application Now Open

The state has released the application for being designated a COVID-19 Relief (CR) Facility, which are designed to allow eligible Nursing Facilities to retain COVID-19-positive residents. These facilities will meet criteria established in Senate Bill 1094 to care for COVID-19-positive residents who become ill and do not require hospital-level care. The purpose of the CR Facilities is to provide care in place with enhanced infection control measures for individuals with confirmed COVID-19 who have not met the criteria for discontinuation of Transmission-Based Precautions and have limited access to the state’s Care and Recovery Centers. All approved CR Facilities may retain, or readmit after acute care, their own COVID-19-positive residents.

Facilities must meet certain criteria to qualify for CR Facility designation or admission of new COVID-19-positive residents, as detailed in Bulletin Number MSA 20-73 from the Medical Services Administration. The bulletin also provides a list of documents and details applicants should have prepared before applying.

Completed applications should be submitted by 5 p.m. Dec. 1. The MDHHS, in partnership with the Michigan Department of Licensing and Regulatory Affairs, will review applications as they are received. Notification of application status will be contingent upon the volume of applications received. However, it is estimated that facilities seeking CR Facility designation may expect to be notified about the determination within one to two weeks of application submission. Questions about CR Facilities may be submitted to the MDHHS via email.

Additional information on the COVID-19 pandemic is available to members on the MHA Community Site and the MHA COVID-19 webpage. Questions on COVID-19 and infectious disease response strategies may be directed to the MDHHS Community Health Emergency Coordination Center (CHECC). Members with MHA-specific questions should contact the following MHA staff members: