By NextBestFitMandatory security standards and backup payment systems
Minimum security rules, and backup payment for providers during outages.
Lesson of the Change Healthcare attack.
Review ledgerHow this path connects
This path
Mandatory security standards and backup payment systems
Concrete changes if chosen
What would actually have to change in law, agencies, payment rules, or systems.
- Set minimum security standards
- Create backup payment systems
Effects
Each effect has its own page: the evidence, the case that it is or isn't a real cost, and whom it affects.
What it fixes
- Cyberattacks can halt payments and care
Minimum security rules improve resilience against attacks, while backup payments keep providers paid during outages.
What it creates or worsens
- Adds paperwork, coordination, or complexity
Complying with minimum security rules adds costs for providers.
- Directs benefits or burdens imperfectly
Minimum security requirements are hardest for small providers to meet.
Who's affected
Who gains
- Hospitals, clinics, and care organizations
- Cyberattacks can halt payments and care: Cyberattacks disrupt claims and leave providers unpaid.
- People with employer coverage
- Cyberattacks can halt payments and care: Cyberattacks expose personal health data.
- Uninsured people
- Cyberattacks can halt payments and care: Cyberattacks expose personal health data.
- People with unaffordable deductibles or coinsurance
- Cyberattacks can halt payments and care: Cyberattacks expose personal health data.
- People with ongoing or specialist care needs
- Cyberattacks can halt payments and care: Minimum security rules improve resilience against attacks, while backup payments keep providers paid during outages.
Who loses
- Fraudulent operators and cybercriminals
- Cyberattacks can halt payments and care: Attackers profit from ransomware attacks on health systems.
- Hospitals, clinics, and care organizations
- Adds paperwork, coordination, or complexity: Complying with minimum security rules adds costs for providers.
Other ways to soften the losses
- Grants for small and rural providers
Where it has been tried
- Change Healthcare attack (2024): CMS reported more than $3.26 billion in Change Healthcare emergency payments in June 2024, comprising over $2.55 billion to more than 4,200 Part A providers and over $717.18 million through 4,722 Part B advance payments.