News, Analysis, Trends, Management Innovations for
Clinical Laboratories and Pathology Groups

Hosted by Robert Michel

News, Analysis, Trends, Management Innovations for
Clinical Laboratories and Pathology Groups

Hosted by Robert Michel
Sign In

Hospital, Health System Mergers and Acquisitions Impact Clinical Laboratories

Post-merger, a first goal is often to achieve cost savings by consolidating hospital laboratory testing into fewer medical laboratory sites

Major integrated delivery network (IDN) healthcare systems continue to acquire other hospitals. These deals are getting larger in scope and confirm that the trend of hospital consolidation is robust and ongoing. They also present a challenge for clinical laboratories that service the IDN’s physicians from both inside and outside the networked systems.

One most recent example is the announced mega-merger of non-profit BJC HealthCare (BJC) in St. Louis and faith-based non-profit Saint Luke’s Health System (St. Luke’s) in Kansas City, both in Missouri. St. Louis Post-Dispatch described the deal as “one of the biggest local hospital mergers in recent memory.”

And for good reason. According to Healthcare Dive, the partnership that will create a 28-hospital, $10 billion dollar health system with more than 100 specialty and primary care offices serving patients in Illinois, Kansas, and Missouri. Fiscally, BJC showed $6.3 billion in revenue last year and Saint Luke’s $2.4 billion.

Mega mergers are a big deal (pun intended). They can give the new healthcare organization unrivaled competitive authority in the marketplace potentially passing along lower healthcare prices to patients. But they come at cost to embedded clinical staff, including medical laboratories.

The health system merger gives BJC/St. Luke’s “huge leverage in terms of negotiating power with the insurers,” Ryan Barker, an independent healthcare policy consultant, told the St. Louis Post-Dispatch. Clinical laboratories are also impacted in these mergers when hospital systems consolidate their testing capabilities and locations. (Photo copyright: Missouri Foundation for Health.)

Impact of the BJC/St. Luke’s Merger

BJC and St. Luke’s signed a non-binding agreement to merge on May 31 and plan to reach a final agreement before the year’s end barring regulatory interference. The duo’s combined 28-hospital system will operate out of two headquarters: One in St. Louis managing southern Illinois and eastern Missouri, and another in Kansas City to serve parts of Kansas as well as western Missouri, Healthcare Dive reported.

The merger of BJC and St. Luke’s means the formation of a “clear market leader in Missouri,” St. Louis Post-Dispatch reported, adding that BJC has 40% of the market’s patient discharges and St. Luke’s holds 20% of the market share in the “state’s second largest metropolitan area.”

This will likely manifest itself in leverage during negotiations with healthcare payers that service that area.

“It continues to be the case that the hospitals are trying to gain the upper hand on the insurers,” John Romley, PhD, Associate Professor in the University of Southern California (USC) Price School of Public Policy and USC Mann School of Pharmacy and Pharmaceutical Sciences, told the St. Louis Post-Dispatch. Romley is also an economist at the USC Schaeffer Center for Health Policy and Economics, and adjunct economist at the Rand Corporation. “That was true 10 years ago. That’s true today,” he added.

“That’s what I always worry about with consolidation is the impact on [healthcare] pricing,” Ryan Barker, an independent healthcare policy consultant in St. Louis and former Vice President of Health Policy at Missouri Foundation for Health, told the Post-Dispatch.

Other Large Health System Mergers and Acquisitions

There have been a growing number of large-scale mergers and acquisitions of IDNs in the last few months. Dark Daily’s sister publication The Dark Report has covered these deals in multiple intelligence briefings.

Most recently, in “Kaiser Acquires Geisinger Health in Value-Based Deal,” The Dark Report outlined Kaiser Foundation Hospitals’ (KFH) acquisition of Pennsylvania-based Geisinger Health. Based in Oakland, California, KFH is part of the Kaiser Permanente integrated delivery network.

Healthcare policy makers were surprised by the merger, as Kaiser and Geisinger were often cited as two of the best IDNs in the nation.

Now under single ownership there will be implications that take years to play out, especially for clinical laboratories that now must service a significantly larger physician base. Conversely, if the new combined healthcare system decides to combine multiple medical laboratories to save on costs it will have a huge impact on lab staff.

Another deal recently announced involves UPMC’s (University of Pittsburgh Medical Center) announcement to merge with multihospital Washington Health System (WHS) in Washington, Pennsylvania, a WHS news release noted. But the move has drawn pushback from elected officials and organized labor, the Pittsburgh Post-Gazette reported.

UPMC has recorded rapid growth over the year acquiring smaller hospitals, but hospital mergers are getting closer inspections from federal regulators, the Pittsburgh Post-Gazette noted.

SEIU Healthcare Pennsylvania—part of the Service Employees International Union—was first to request an investigation by the US Department of Justice for what it called a “long and egregious history of labor law violations.” It also claimed that UPMC merged with 27 hospitals from 1996 to 2019, adding 10 between 2016 and 2018, the Pittsburgh Post-Gazette reported.

And in “Sanford/Fairview Merger Has Implications for Clinical Labs,” The Dark Report explored the merger between IDNs Sanford Health of Sioux Falls, South Dakota, and Fairview Health Services in Minneapolis. The mega merger creates a 58 hospital/79,000 employee multi-hospital system.

Concentrated ownership of diagnostic services impacts clinical laboratories in many ways. The Dark Report noted that combined IDNs often review clinical laboratory services across the entire healthcare network. Opportunities for third-party commercial labs to step in and run the hospitals’ local laboratory services may also present themselves.

Impact IDN Mergers Have on Clinical Laboratories

Mergers occur for many reasons. Monetary stress has a wide-reaching impact, and some healthcare researchers suggest that financial pressures may cause hospitals formerly hopeful about their medical laboratory outreach businesses to consider selling their programs, as The Dark Report noted.

One significant impact that health system mergers and acquisitions can have on clinical laboratories is to reduce their number, particularly by consolidating testing from multiple sites into a core laboratory.

“There is a growing body of empirical research about the potential for competitive harm to labor markets from consolidation and concentration,” Federal Trade Commissioner Rebecca Kelly Slaughter, JD and FTC Chair Lina M. Khan, JD, wrote in a joint 2022 statement about the merger of the first and second biggest healthcare providers in Rhode Island. “The loss of competition from mergers may be especially pernicious in the healthcare sector where skilled medical professionals are uniquely limited in employer options within their local geographic area,” the Pittsburgh Post-Gazette reported.

In this case, the plans to merge were ended after the FTC sued to block the partnership.

More IDN Mergers on the Way

But increased FTC scrutiny does not seem to have slowed the trend toward larger merger and acquisition deals. Kaufman Hall’s 2023 National Hospital Flash Report states that both mergers and acquisitions are trending toward cross-regional partnerships and predicts a “new wave of transaction activity,” Healthcare Dive reported. The report looks at actual and budget data collected over the past three years that was sampled from more than 900 hospitals on a recurring monthly basis.

And so, moving into the future, clinical laboratories can expect to see more mergers and acquisitions of IDNs, with consolidation, regionalization, and standardization occurring in the combined IDN’s clinical laboratory once the merger is completed and leadership begins to look for ways to save costs. Labs are generally first to be consolidated because it is easier to move lab specimens than it is to move patients.

—Kristin Althea O’Connor 

Related Information:

BJC Healthcare, Saint Luke’s Health System Plan to Merge, Forming $10B System

BJC Saint Luke’s Hospital Merger Would be One of the Area’s Largest, It May Not be the Last

Merger of BJC and St. Luke’s Will Likely Raise Hospital Prices in Missouri, Analysts Say

BJC HealthCare and Saint Luke’s Health System Sign Letter of Intent to Form Integrated Missouri-based Health System

UPMC Plans to Acquire Washington Health System

UPMC, Washington Health System Sign Letter of Intent to Affiliate

Washington Health System to Merge with UPMC

UPMC Seeks to Add 2-Hospital Washington Health System

Stiff Headwinds Await UPMC in Its Bid to acquire Washington Health System

National Hospital Flash Report: April 2023

Kaufman Hall’s 2023 National Hospital Flash Report

Larger Hospital Mergers Expected in Post Pandemic Market, Kaufman Hall Says

13 Healthcare Mergers and Acquisitions Making Headlines in May

Clinical Laboratory Trends Kaiser Acquires Geisinger Health in Value-Based Deal

Major Data Breaches at Hospitals, Clinical Laboratories, and Health Plans Continue to Put Patient Data at Risk

Lapses in security measure testing can give healthcare employees a false sense of protection against data breaches, says cybersecurity expert

Cyberattacks on our nation’s hospitals, clinical laboratories, other healthcare organizations, and health plans, continue to plague the healthcare industry. As of July 7, 2023, 324 data breaches have occurred and are currently under investigation, according to the US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) data breach portal.

This has affected more than 39 million people, HealthITSecurity reported.

When cybercriminals attack hospitals, clinical laboratories, and other medical organizations, healthcare consumers’ protected health information (PHI) may be stolen.

Dark Daily has covered such cyberattacks extensively.

In “Healthcare Cyberattacks at Two Hospitals Prompt Tough Decisions as Their Clinical Laboratories Are Forced to Switch to Paper Documentation,” we reported how in response to cyberattacks on two hospitals, medical laboratories in Florida and Maryland were forced to switch from digital to paper documentation and, in at least one case, the organization reportedly had difficulty accessing electronic laboratory test results.

And in, “Nearly One Million Patient Records of Hospitals, Health Clinics, Medical Laboratories, and other Providers Stolen in Ransomware Attack on Medical Records Company,” we covered how a single ransomware attack on a medical records company netted nearly a million PHI records from 28 healthcare providers in New York. This include names, home addresses, treatment dates, health plan numbers, and internal account numbers of 934,138 patients.

Below is a list of the data breaches this year that affected the most people.

“The way that computer network environments work today, users are acknowledged as the weakest link and offer the most potential for access to a hacker,” Ben Denkers (above), former Chief Innovation Officer at CynergisTek, told Dark Daily’s sister publication The Dark Report. He added that data breaches at clinical laboratories can start with “missteps” by lab employees who have a false sense of protection caused by lapses in testing a lab’s security measures. CynergisTek merged with Clearwater in 2022. (Photo copyright: CynergisTek.)

Top Data Breaches in First Six Months of 2023

Here are healthcare’s top 10 data breaches for the first half of 2023, listed by organizations with the most people affected, according to HHS:

  • Managed Care of North America, dental benefits organization, Atlanta, Georgia, 8.8 million individuals affected.
  • PharMerica Corporation, pharmacy services for skilled nursing, Louisville, Kentucky, 5.8 million individuals affected.
  • Regal Medical Group, Reseda, California, 3.3 million individuals affected.
  • Cerebral, mental health services, Claymont, Delaware, 3.1 million individuals affected.
  • NationsBenefits Holdings, supplemental benefits company, Plantation, Florida, three million individuals affected.
  • Harvard Pilgrim Health Care, health plan, Canton, Massachusetts, 2.5 million individuals affected.
  • Enzo Clinical Labs, clinical reference laboratory, Farmingdale, New York, 2.4 million individuals affected.
  • ZOLL Services, medical equipment, Pittsburgh, Pennsylvania, 997,097 individuals affected.
  • Community Health Systems, healthcare provider with 15,000 licensed beds at 89 acute care hospitals in 16 states, Brentwood, Tennessee, 962,884 individuals affected.
  • CentraState Healthcare System, healthcare provider with a 284-bed acute care medical center, an ambulatory campus, and an urgent care clinic, Freehold, New Jersey, 617,901 individuals affected.

Clinical Laboratory Brings in Cybersecurity Experts

Following a ransomware incident in April on its computer network, Enzo Clinical Labs in Farmingdale, New York, “immediately took steps to secure our systems and began an investigation with the assistance of a cybersecurity firm,” the lab’s Notice of Data Security Incident explains.

“The investigation determined an unauthorized party accessed files on our systems,” the notice continues. “The files contained patient names, dates of service, clinical test information, and, in some instances, Social Security numbers.”

Enzo “has incurred, and may continue to incur, certain expenses related to this attack, including expenses to respond to, remediate and investigate this matter,” according to the lab’s Securities and Exchange Commission (SEC) filing.

Multiple Large Health Systems Suffer Data Breaches

At Community Health Systems (CHS) it was a security incident at Fortra, a cybersecurity firm engaged by CHS, that resulted in “unauthorized disclosure of patient information,” according to CHS’s Notice of Third Party Security Incident.

The extent of data theft from the breach of Fortra’s GoAnywhere MFT secure managed file transfer software was not immediately clear, HIPAA Journal reported.

“The personal information may have included full name, address, medical billing and insurance information, certain medical information such as diagnoses and medication, and demographic information such as date of birth and Social Security number,” the CHS notice explained.

At CentraState Healthcare System, “an unauthorized person obtained a copy of an archived database that stored certain patient information,” the healthcare provider’s Notice of Security Incident states. 

“There was no financial account and/or payment card information involved in this incident,” CentraState noted.

Financial Impact of Data Breaches

One of the effects on healthcare providers is costly settlement of lawsuits following data breaches that allege failure to secure patients’ PHI. For example, according to Becker’s Health IT:

  •  UMass Memorial Medical Center in Worcester, Massachusetts, paid $1.2 million “to settle a March 2022 lawsuit regarding a data breach of its payroll management system Kronos.”  
  • Advent Health in Altamonte Springs, Florida, paid $500,000 “to settle a data breach lawsuit alleging that the health system failed to protect patients’ confidential information after a September 2021 data breach.”
  • CommonSpirit Health in Chicago spent $150 million recovering from a ransomware attack in October 2022 that also sparked lawsuits over stolen PHI.

Tips for Clinical Laboratories on Securing Patient Data

In “Labs Must Audit Their Cybersecurity Measures,” Ben Denkers, former Chief Innovation Officer at CynergisTek, an Austin-based cybersecurity company which has since merged with healthcare cybersecurity and compliance company Clearwater, told Dark Daily’s sister publication The Dark Report, “The way that computer network environments work today, users are acknowledged as the weakest link and offer the most potential for access to a hacker.”

Denkers advises that while training employees is important for cybersecurity because it aims at changing human behavior, laboratories and other healthcare organizations also need to audit the technological measures they have in place to protect data.

“What we find is that organizations have security technology or processes in place that are either not effective or not working as designed,” he said, adding that when data breaches do occur “it’s a complete blindside for a lot of organizations that think they have protections in place because they bought a product, or they developed a policy.

“Testing, validating, and auditing whether measures are working as designed is a change of mentality for a lot of organizations. I would recommend taking those steps,” he added.

Clinical laboratories hold vast amounts of patient data and cannot afford disruptions to testing and results reporting. Vigilance can help labs avoid catastrophic cyberattacks, secure their patients’ protected health information from being stolen, and prevent the subsequent lawsuits that ensue following a data breach.

—Donna Marie Pocius

Related Information:

US Department of Health and Human Services Office for Civil Rights Breach Portal

2023 Largest Health Data Breach So Far Brings Legal Flurry

Biggest Healthcare Data Breaches Reported This Year, So Far

Notice of Data Security Incident: Enzo Clinical Laboratories

Securities and Exchange Commission (SEC) Filing: Enzo

Third Party Security Incident Impacting Community Health Systems

Up to One Million Community Health Systems Patients Affected by GoAnywhere MFT Hack

CentraState Healthcare System Notice of Security Incident

How Much Three Health Systems are Paying to Resolve Cyberattacks

Sophisticated Cyberattacks Target Healthcare

Labs Must Audit Their Cybersecurity Measures

Healthcare Cyberattacks at Two Hospitals Prompt Tough Decisions as Their Clinical Laboratories Are Forced to Switch to Paper Documentation

Nearly One Million Patient Records of Hospitals, Health Clinics, Medical Laboratories, and other Providers Stolen in Ransomware Attack on Medical Records Company

Clinical Laboratory Owner Receives 15-Year Federal Prison Sentence, Hefty Fine as DOJ Hits Hard on Healthcare Fraud Cases

US Department of Justice sends a strong message that it will continue to root out fraud involving clinical laboratory owners and operators

Arkansas clinical laboratory owner/operator Billy Joe Taylor has been sentenced to 15 years in federal prison and ordered to pay nearly $30 million in restitution, according to a June 8 press release from the US Attorney’s Office for the Western District of Arkansas.

Taylor pleaded guilty in October of 2022 to conspiracy to commit fraud and money laundering. He and his accomplices submitted $134 million in false or fraudulent claims to Medicare before and during the COVID-19 pandemic.

The claims came from five laboratory companies owned and operated by Taylor and his co-conspirators. All claims centered around respiratory illness tests or urine drug tests that were either not medically necessary or not ordered by medical providers, the DOJ’s press release states.

Taylor’s 15-year sentence in federal prison and huge restitution reinforces the fact that the federal Department of Justice (DOJ) will indict—and convict—owners and managers of clinical laboratory companies accused of healthcare fraud.

Billy Joe Taylor, owner/operator of five clinical laboratories in four states, was sentenced in June to 15 years in prison and ordered to repay nearly $30 million in fraudulent test claims made to Medicare prior to and during the COVID-19 pandemic. This conviction is part of an ongoing campaign against healthcare fraud being conducted by the US Department of Justice. (Photo copyright: Arkansas Democrat-Gazette.)

Details of Taylor Fraud Case

Taylor allegedly obtained private personal and medical data from Medicare beneficiaries and then used that information to submit and resubmit claims to Medicare for diagnostic tests. More than $38 million was received from Medicare on those fraudulent claims, the DOJ noted.

According to an October 2022 DOJ press release, the labs involved in the case included:

In 2021, Taylor claimed innocence and told Arkansas Business that the accusations were “sensationalism-type claims from the government that were completely erroneous and false.”

As a young man, Taylor planned to go into the clinical laboratory field when he was still in high school. He got started by volunteering at his hometown hospital in Stigler, Oklahoma, the Free Library reported. Eventually hired by the hospital to draw blood, run tests, and keep quality control and inspection data, Taylor later moved to other hospitals before partnering in 2009 to start Advanced Laboratory Services (ALS) of Oklahoma City, Oklahoma.

A pulmonary embolism and stroke forced Taylor to sell his share in ALS, and not long after returning as a consultant, his business partner sold the lab company. Taylor joined two people from a Tulsa laboratory to start a new company, acquiring Medtest Laboratories LLC of Hurricane, West Virginia, and Vitas laboratory LLC in 2017. He hoped to compete with national laboratories, earning up to $2 million per month, the Free Library reported.  

Other Clinical Laboratory Testing Fraud Schemes

The DOJ’s aggressive efforts to crack down on healthcare fraud over the past years have produced multiple court cases against clinical laboratory owners, managers, and the doctors who conspire with them. Dark Daily has covered such fraud cases in numerous ebriefings over the years.

In “Southern California Physician and Clinical Laboratory Owners Charged in Federal Crackdown on Pandemic-Related Billing Fraud,” we reported on federal charges that had been brought against a number of physicians and clinical laboratory owners in what the DOJ described as the “largest ever” coordinated nationwide law enforcement effort against COVID-19 pandemic-related healthcare fraud.

Also, in “California Clinical Laboratory Owners among 21 Defendants Indicted or Criminally Charged for COVID-19 Test Fraud and Other Schemes Totaling $214 Million,” we covered how the DOJ had charged the owners of a California clinical laboratory—as well as 19 other defendants—for their roles in fraudulent billing, kickbacks, and money laundering schemes to defraud Medicare of more than $214 million.

And in “Department of Justice Recovers $1.8B from Medical Laboratory Owners and Others Accused of Alleged Healthcare Fraud During COVID-19 Pandemic,” we reported that DOJ had recovered billions of dollars as a result of federal investigations into alleged healthcare fraud by clinical laboratories and other organizations during fiscal year 2020.

DOJ’s Healthcare Fraud Unit

In 2021, the DOJ’s Healthcare Fraud Unit brought “criminal charges against 14 defendants, including 11 newly-charged defendants and three who were charged in superseding indictments, in seven federal districts across the United States for their alleged participation in various healthcare fraud schemes that exploited the COVID-19 pandemic and resulted in over $143 million in false billings,” a DOJ press release announced.

In a statement to the press, Deputy Attorney General Lisa O. Monaco said, “The multiple healthcare fraud schemes charged today describe theft from American taxpayers through the exploitation of the national emergency … These medical professionals, corporate executives, and others allegedly took advantage of the COVID-19 pandemic to line their own pockets instead of providing needed healthcare services during this unprecedented time in our country.

“We are committed to protecting the American people and the critical healthcare benefits programs created to assist them during this national emergency, and we are determined to hold those who exploit such programs accountable to the fullest extent of the law,” she added.

Monaco’s statement emphasizes the DOJ’s expanding focus on healthcare fraud. The DOJ formed the Health Care Fraud Strike Force in 2007 to handle cases like Taylor’s. The program is composed of 15 teams operating out of 25 federal districts. During the 15 plus years the Strike Force has been active, the DOJ has charged more than 5,000 defendants who collectively billed over $24 billion to both private insurers and federal healthcare programs.

Therefore, it behooves clinical laboratory managers to ensure all lab operations are well-within the bounds of legality. The DOJ is taking its hunt for healthcare fraudsters quite seriously.

—Kristin Althea O’Connor

Related Information:

Lavaca Man Sentenced in $134 Million COVID-19 Health Care Fraud and Money Laundering Scheme

Lavaca Man Sentenced to 15 Years in Prison, Ordered to Pay More than $29.8 Million in Medicare Fraud Case

Lavaca Man Gets July 19 Sentencing Date in Federal Healthcare Fraud, Money Laundering Case

Lab Owner Fights His Insurer, and Now a Federal Fraud Case: Lavaca Man Denies Fraud in Health System, Accusing US of ‘Sensationalism’

Lavaca Man Pleads Guilty of Conspiracy to Commit Healthcare Fraud and Money Laundering

Lavaca Man Pleads Guilty to Stealing Millions in Medicare Fraud

DOJ Announces Coordinated Law Enforcement Action to Combat Healthcare Fraud Related to COVID-19

Federal Trial for Lavaca Man Facing Healthcare Fraud Charges Moved to Next Year

Southern California Physician and Clinical Laboratory Owners Charged in Federal Crackdown on Pandemic-Related Billing Fraud

California Clinical Laboratory Owners among 21 Defendants Indicted or Criminally Charged for COVID-19 Test Fraud and Other Schemes Totaling $214 Million

Department of Justice Recovers $1.8B from Medical Laboratory Owners and Others Accused of Alleged Healthcare Fraud During COVID-19 Pandemic

Continued Cyberattacks on Hospitals, Clinical Laboratories, and Other Providers Cause Closures as Hackers Grow in Sophistication

Cybersecurity experts recommend clinical laboratories have in place a plan for performing tests and distributing results prior to a cyberattack

Hospitals of all sizes continue to be prime targets for sophisticated cyberattacks, where hackers remotely disable a healthcare network’s computer systems—including its laboratory information system—and extort ransomware payments. Similar attacks are happening to clinical laboratories and other providers, although not with the same frequency.

Recently, hospitals in Illinois, Idaho, Vermont, Indiana, and other states had their ability to treat patients severely reduced and, in some cases, completely shut down by cybercriminals, endangering lives and costing millions of dollars in damages.

Today’s hospitals rely on information technology (IT) for patient care workflow, internal/external communication, billing, and medical laboratory testing. It’s this reliance on computer/internet technology combined with the vast quantities of protected health information (PHI), that makes hospitals such ripe targets for attack.  

In June, a US cancer center had to take its digital services offline which “significantly reduced patient treatment capability” following a ransomware attack by a group of hackers known as the TimisoaraHackerTeam (THT), MedCity News reported.

“Patients don’t stop getting sick just because a hospital is hit by a ransomware attack,” Christian Dameff, MD, emergency physician at UC San Diego Health and lead author of a study that looked into how cyberattacks affect other hospitals in the area, told ABC News. “They have to go somewhere. So, what this research shows is that those patients go to neighboring hospitals that can be overwhelmed.” Clinical laboratories can also become overwhelmed with test orders when nearby hospitals lose their ability to distribute the results of critical lab tests. (Photo copyright: UC San Diego Health.)

In its “Healthcare and Public Health Sector Cybersecurity Notification” on the event, the federal Division of Critical Infrastructure Protection (CIP) wrote, “Little is known about the obscure group of hackers, but when its ransomware is deployed, their rarely used and very effective technique of encrypting data in a target environment has paralyzed the health and public health (HPH) sector.”

The CIP operates within the US Department of Health and Human Services’ (HHS) Office of the Administration for Strategic Preparedness and Response (ASPR) and Health Sector Cybersecurity Coordination Center (HC3).

Here is a list of other cyberattacks on healthcare providers and the consequences of these crimes.

Recent Cyberattacks Close Hospitals, Disrupt Clinical Laboratory Testing

The 44-bed St. Margaret’s Hospital in Spring Valley, Illinois, was forced to close its doors in June due in part to a 2021 ransomware attack, NBC News reported. 

“The attack halted the hospital’s ability to submit claims to insurers, Medicare or Medicaid for months, sending it into a financial spiral,” Linda Burt, RN, Vice President of Quality and Community Services at St. Margaret’s, told NBC News. “We were down a minimum of 14 weeks. And then you’re trying to recover. Nothing went out. No claims. Nothing got entered. So, it took months and months and months.”

Meabwhile, 88-bed Idaho Falls Community Hospital experienced a cyberattack in May that required it to divert ambulances to other hospitals for 24 hours, CNN reported. The provider’s sister healthcare facility, MountainView Hospital in Las Vegas, which shares the same computer system, was also affected.

The Idaho Falls attack “forced nurses and doctors … to use pen and paper rather than computers for patient charts,” a hospital spokesperson told CNN.

At the University of Vermont Medical Center (UVM), Burlington, Vermont, a ransomware attack affected healthcare services for 28 days, costing the provider $50 million to recover, and preventing healthcare workers from accessing critical treatment plans for cancer patients, ABC News reported.

UVM’s President and Chief Operating Officer, Stephen Leffler, MD, an emergency medicine physician, told ABC News that the 2020 cyberattack significantly disrupted clinical laboratory operations at UVM.

“When the laboratory had a critical lab result on someone, they couldn’t put it in the electronic medical record,” he explained. “They couldn’t call the floor. And so, we literally had our administrators start going in the lab, standing there and running a paper result to the floors.

“Everything that we do and rely on was down,” he added. “We actually sent some staff to Best Buy to buy Walkie Talkies!

“It can happen to you—even when you think it’s impossible,” Leffler warned.

And at Johnson Memorial Health, Franklin, Indiana, clinical laboratory tests took two hours to perform instead of 30 minutes, NPR said in its report on cyberattacks affecting Indiana providers. The lab had to use “runners” to share handwritten test results with caregivers and patients, NPR explained. 

“You ask many CEOs across the country, ‘What keeps you up at night?’ Of course, they talk about workforce, financial pressures, and they say, ‘the possibility of a cyberattack,” John Riggi, National Advisor for Cybersecurity and Risk at the American Hospital Association (AHA), told NPR.

Cyberattacks Affect Surrounding Hospitals

To make matters worse, cyberattacks have a “blast radius” that impacts the healthcare community around an attacked provider, Christian Dameff, MD, Assistant Professor, Emergency Medical Services, University of California, San Diego, told ABC News. Dameff was lead author in a study that looked at how healthcare providers nearby to an attacked provider are affected.

“Hospitals adjacent to healthcare delivery organizations affected by ransomware attacks may see increases in patient census and may experience resource constraints affecting time-sensitive care for conditions such as acute stroke,” Dameff and co-authors wrote in a JAMA Open Network article titled, “Ransomware Attack Associated with Disruptions at Adjacent Emergency Departments in the US.”

“Healthcare cyberattacks such as ransomware are associated with greater disruptions to regional hospitals and should be treated as disasters,” they wrote.

Vigilance Is Required as Cyberattacks Increase

Ransomware attacks on hospitals climbed from 43 to 91 annually during the years 2016 to 2021, a separate study in JAMA Health Forum reported, adding that large organizations with multiple facilities were increasingly targeted.

The US experienced a 57% increase in cyberattacks in 2022 compared to 2021, according to a Check Point Research (CPR) report. Healthcare ranked second on the list of attacked industries due, according to Check Point, to the quantity and availability of personal and sensitive information, such as social security numbers and medical data.

“We expect the increase in cyber activity to only increase. With AI [artificial intelligence] technologies such as ChatGPT readily available, it is possible for hackers to generate malicious code and emails at a faster, more automated pace,” the CPR report noted.

For its part, the AHA said in a statement it plans to:

  • Make available cybersecurity services to members.
  • Work with federal agencies to mitigate cyber threats.
  • Advocate for increased government cybersecurity assistance.

Hospital clinical laboratory leaders need to be vigilant and work with colleagues to prevent cyberattacks. Check Point’s report advises, for example, avoiding malicious links and unexpected electronic attachments as well as verifying software is legitimate before downloading it. These are standard warnings, but they only work if staff members actually heed these actions.

Also important for diagnostics professionals is having a plan for performing clinical laboratory and anatomic pathology tests and distributing the results in the event of an attack.    

—Donna Marie Pocius

Related Information:

An Illinois Hospital Is the First Health Care Facility to Link Its Closing to a Ransomware Attack

Feds Warn Healthcare Providers about “Obscure” Ransomware Gang

Healthcare and Public Health Sector Cybersecurity Notification

TimisoaraHackerTeam Ransomware Attacks US Cancer Center

St. Margaret’s Health—Spring Valley Breached by Cyber Security Attack

Cyberattack Forces Idaho Hospital to Send Ambulances Elsewhere

Cyberattacks Are Growing Threats to Patient Safety, Experts Say

Cyberattacks on Healthcare Are Increasing: Inside One Hospital’s Fight to Recover

Ransomware Attack Associated with Disruptions at Adjacent Emergency Departments in the US

Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Healthcare Delivery Organizations, 2016-2021

Check Point Research Reports a 38% Increase in 2022 Global Cyberattacks

Keeping Hospitals and Patients Safe against Cyberattacks

CDC Study: Rate of Nosocomial Infections in Nation’s Hospitals Increased During the COVID-19 Pandemic

CDC’s findings are a setback for the national effort to encourage hospitals and their clinical laboratories to reduce the number of nosocomial infections and practice better antimicrobial stewardship

Nosocomial infections—also known as hospital-acquired infections—increased during the COVID-19 pandemic. That’s according to a Centers for Disease Control and Prevention (CDC) report that showed increases in several HAIs, including a 14% jump in Methicillin-resistant Staphylococcus aureus (MRSA) from 2020 to 2021.

The CDC’s 2021 National and State Healthcare-Associated Infections Progress Report suggests that “the pandemic may have permanently damaged the ability of hospitals to prevent their patients from contracting infections while in the hospital,” according to healthcare columnist David Burda in an article he penned for 4Sight Health titled, “Hospital Infection Regression.”

Clinical laboratory testing is part of a concerted effort in the US to reduce HAIs in acute care hospitals. Additionally, diagnostic testing is vital to antimicrobial stewardship, which is designed to help physicians prescribe to patients only those antibiotics that are appropriate and reduce the chance for antimicrobial resistance (AMR).

So, it’s disturbing to see a setback in both HAIs and antimicrobial stewardship in the wake of the COVID-19 pandemic. Burda called the CDC’s findings a “regression” that “gives new meaning to the term long COVID.”

“I think, without any proof, doctors, nurses, medical technicians, and other clinicians who provide direct patient care regressed in terms of infection control best practices,” wrote healthcare journalist David Burda in his column for 4Sight Health. Clinical laboratories that processed COVID-19 tests during the pandemic can attest to the burnout. (Photo copyright: 4Sight Health.)

CDC Report Reveals Increase in Hospital Acquired Infections

The CDC used standardized infection ratios (SIRs) in its report to detail changes in nosocomial infections. CDC calculates SIRs by dividing the number of observed infections by the number of predicted infections.

“In 2021, the nation and the world continued to experience unprecedented challenges due to the COVID-19 pandemic, which impacted surveillance for and incidence of HAIs,” the CDC explained in its report.

“Compared to pre-pandemic years, hospitals across the nation experienced higher than usual hospitalizations and shortages in healthcare personnel and equipment, which may have resulted in deterioration in multiple patient safety metrics since the beginning of the pandemic,” the CDC added.

In his 4Sight Health article, Burda noted that physicians and other care providers may have “regressed” in their infection control practices due to severe pressures during the COVID-19 pandemic. “I also think the traveling nurse and temporary staff situation had something to do with it. Who has time to learn or follow the infection control policies and protocols at every hospital when you’re moving from one hospital to the next every few weeks?” he added.

The CDC explored HAIs in acute care hospitals, critical access hospitals, inpatient rehabilitation facilities, and long-term acute care hospitals. According to the federal agency’s report, at acute care hospitals, increases in nosocomial infections from 2020 to 2021 include the following:

On a positive note, the report noted these findings as well:

  • 3% decline in hospital onset Clostridioides difficile (C. diff) infections.
  • No significant change in colon surgery SSIs.

In its review of state-level data, CDC noted:

  • 27 states performed better on at least two types of infection.
  • 30 states performed worse on at least two infection types. 

In response to the CDC’s report, the American Hospital Association (AHA) wrote, “In acute care hospitals, the increases seen in some HAIs in 2021 contrast with the success in reducing these infections prior to the pandemic. Despite the challenges of the COVID-19 pandemic, acute care hospitals performed significantly better than the 2015 national baseline in preventing CLABSI, CAUTI, SSIs following colon surgeries, and C. difficile infections.”

The AHA recommended that hospitals “continue to reinforce prevention practices and review HAI surveillance data to identify areas for improvement.”

Dangers of Antimicrobial Resistance

According to CDC data, in the US there are 2.8 million antimicrobial infections each year, and more than 35,000 people die as a result. Dark Daily has reported extensively on the growing danger of antibiotic resistance and outlined the importance of clinical laboratory involvement in hospital antimicrobial stewardship programs.

In “During Pandemic, Clinical Laboratories Should Be Alert for Drug Resistant Infections That Pose High Risk to COVID-19 Patients,” we covered a study conducted at the University of Minnesota which highlighted the continuing need for microbiologists and clinical laboratories to stay alert for COVID-19 patients with drug-resistant infections following a CDC report on 941 confirmed and probable Candida auris cases that had been reported in 13 states, with an additional 1,830 patients that had been found to be colonized with the multidrug-resistant fungus.

And in “Leapfrog Group Report Shows Hospitals Failing to Eliminate Hospital-Acquired Infections; Medical Laboratories Can Help Providers’ Antimicrobial Stewardship Programs,” we wrote about how healthcare leaders were concerned about a Leapfrog Group report that indicated hospitals are finding it increasingly difficult to completely remove infections. The report states that the number of hospitals reporting zero infections has declined significantly since 2015.

New Joint Commission Antibiotic Standards

The Joint Commission’s expansion of antibiotic stewardship standards, which went into effect on January 1, 2023, could help hospitals reduce nosocomial infections and fight antimicrobial resistance. 

“The updated standards come at a vital time. Data shows that the COVID-19 pandemic has resulted in increased antibiotic use and a backslide in stewardship efforts,” wrote David Hyun, MD, Antibiotic Resistance Project Director of the Pew Charitable Trusts, in an article he penned for PEW titled, “Expanded Antibiotic Stewardship Standards for Hospitals Will Help Combat Superbugs.”

Pew conducted research related to the requirements and found “significant room for improvement in adoption and implementation of stewardship practices” in acute care hospitals, Hyun wrote. 

The Joint Commission’s new and revised requirements for antibiotic stewardship for hospitals include:

  • Allocate financial resources for staffing and IT to support the antimicrobial stewardship program.
  • Implement evidence-based guidelines to improve antibiotic use for infections such as urinary tract c. diff. community-acquired pneumonia.
  • Evaluate the program using evidenced-based criteria.

“New antibiotic stewardship standards should help limit the emergence and spread of new drug-resistant superbugs,” Hyun noted.

Clinical Laboratories Need to Deepen Involvement

By testing patients and quickly reporting results to physicians, hospital-based and independent medical laboratories play an important role in appropriate antibiotic use and elimination of HAIs.

Heightened involvement by microbiologists and other medical laboratory professionals is key to success in light of recent setbacks in elimination of HAIs and antimicrobial resistance due to the SARS-CoV-2 outbreak.       

—Donna Marie Pocius

Related Information:

2021 National and State Healthcare-Associated Infections Progress Report

Hospital Infection Regression

CDC Reports Increase in Certain Healthcare Associated Infections in 2021

Expanded Antibiotic Stewardship Standards for Hospitals Will Help Combat Superbugs; Updated Requirements for Accredited Healthcare Facilities Take Effect

Drug Resistance National Estimates

R3 Report: Requirement, Rationale, Reference—New and Revised Requirements for Antibiotic Stewardship

Australian Researchers Discover New Form of Antimicrobial Resistance in Findings That Have Implications for Microbiology Laboratories

During Pandemic, Clinical Laboratories Should Be Alert for Drug Resistant Infections That Pose High Risk to COVID-19 Patients

Leapfrog Group Report Shows Hospitals Failing to Eliminate Hospital-Acquired Infections; Medical Laboratories Can Help Providers’ Antimicrobial Stewardship Programs

Two International Surveys Show Doctors and Consumers See Increasing Value in Genetic Testing

As demand for genetic tests increases, so does the call for clinical laboratories to process and analyze the data, and work with ordering physicians to explain test results to patients

According to a 23andMe press release announcing the results of two national surveys, “most people and doctors agree that genetic testing offers promise for more personalized healthcare.” This is positive for clinical laboratories that provide genetic testing. These two surveys indicate a growing understanding among physicians and healthcare consumers of genetic testing’s value to effective precision medicine.

The surveys were conducted by Medscape, an online resource of medical information owned by WebMD, and Material, an international firm that partners with companies to provide strategy, insights, design, and technology, according to its website. Direct-to-consumer (DTC) genetic testing company 23andMe commissioned the surveys.

The researchers found that 75% of patients in the US said, “they’d be more likely to follow a doctor’s advice if they knew their genetic profile was used to personalize their care.”

The survey also revealed that:

  • 92% of doctors in the US say genetics is an important part of a patient’s complete health picture.
  • 66% of doctors say genetic testing could help lead to better outcomes for patients.

“I am excited about a future where genetic information becomes the foundation of personalized health,” said Anne Wojcicki, 23andMe co-founder and CEO, in a press release. “And that future may help alleviate some issues already affecting the population.” Recent surveys commissioned by 23andMe that indicate both physicians and patients are becoming more accepting of genetic tests are good news for clinical laboratories that perform genetic testing. (Photo copyright: TechCrunch/Wikimedia Commons.)

Filling a Need for Personalized Healthcare

Elective genetic testing is not only becoming more popular with doctors and patients, it may also fill a key precision medicine need in the population. According to the researchers, “more than half of people surveyed (55%) said they don’t feel healthy today, and 63% said they don’t feel in control of their health. And while most people surveyed (62%) said they wanted advice from their doctors that was tailored to them personally, few, only about 36%, said that’s what they were getting,” the press release noted.

Clearly, demand for a pathway to more personalized healthcare exists in the market. Thus, companies that offer elective genetic testing are looking to fill that need.

Genetic testing kits from companies such as 23andMe and Ancestry have become increasingly popular over the past few years. People often turn to these DTC companies to learn about their heritage, but they also allow healthcare consumers to take part in elective genetic testing without needing a referral from a doctor.

Before the popularity of these DTC tests, most genetic testing only took place when ordered by a healthcare provider. But that may be changing. According to a study conducted by Global Markets Insights (GMI), the size of the DTC genetic testing market “surpassed USD $3 billion in 2022 and is predicted to expand at over 11.5% CAGR [compound annual growth rate] from 2023-2032.”

GMI also predicted that “rising prevalence of genetic disorders will accelerate [genetic testing] industry growth.”

Problems and Opportunities in Genetic Testing

As consumer demand for elective genetic testing has increased, certain issues and opportunities have arisen as well.

In an article she penned for STAT titled, “Why the Rise of DNA Testing Is Creating Challenges—and An Opportunity,” physician/scientist Noura Abul-Husn MD, PhD, Vice President of Genomic Health at 23andMe, wrote, “This rapid growth has created what some might see as a big problem and others might see as an opportunity.” Abul-Husn is also Associate Professor of Medicine and Genetics, and Clinical Director of the Institute for Genomic Health, at the Icahn School of Medicine at Mount Sinai.

“The problem? There hasn’t been a corresponding increase in genetics education and training healthcare providers about it, meaning that many people are reaching out to healthcare providers who are ill-prepared to incorporate genetic test results into clinical practice,” she wrote.

“The opportunity? Results from genetic testing can help healthcare providers engage with their patients on a deeper level about personal health risks, promoting health, and preventing disease,” she added.

Growing Need for Processing and Analyzing Genomic Tests

A YouGov survey of 1,000 adults between February 9 and February 12, 2022, showed that two of every 10 Americans have taken a DTC genetic test. But it seems healthcare professionals currently lack the training to incorporate genetic test results into their patients’ care. This may present an opportunity for the genetic testing industry to meet the demand of its consumers.

The growing popularity of elective genetic testing will also increase demand for clinical laboratories to process and analyze these types of tests. And that will drive increased revenue and job opportunities in those labs.

Another factor that is positive about the increased acceptance and interest in genetic testing by doctors and consumers is that this creates a demand by employees for their company health plan to cover genetic tests. Each year, going forward, employers will recognize that their employees want genetic tests and so will take steps to make such tests a covered benefit within the health plan. That is also a positive market factor for those medical laboratories offering genetic testing.  

It seems clear that elective genetic testing offers individuals the opportunity to work with their physicians to design personalized treatments based on their unique conditions. And it gives the healthcare industry—including clinical laboratories—the opportunity to expand services and branch out. The future of precision medicine may lie within our genes.  

—Ashley Croce

Related Information:

New 23andMe Surveys Find Most People and Doctors Agree That Genetic Testing Offers Promise for More Personalized Healthcare

Genetics: The Bridge to More Personalized Healthcare

Why the Rise of DNA Testing Is Creating Challenges—And An Opportunity

Genetic Testing Coverage and Reimbursement

FDA Authorizes 23andMe to Report Results of Direct-to-Consumer Pharmacogenetics Test to Customers without a Prescription, Bypassing Doctors and Clinical Laboratories

International Team of Scientists Use Genetic Testing to Solve Centuries-Old Mystery of Black Death’s Origin

;