◆ The second largest nonprofit hospital chain in the U.S. has been grappling with an Oct. 3 cybersecurity incident that affected facilities across the country, forcing ambulance diversions, system shutdowns and patient appointment rescheduling.^[1] CommonSpirit Health has acknowledged a cyberattack involving ransomware “that has impacted some of our facilities” and said that “upon discovering the ransomware attack, we took immediate steps to protect our systems, contain the incident, begin an investigation, and ensure continuity of care.”^[2] CommonSpirit has 140 hospitals and more than 1,000 care sites in 21 states, and facilities in Iowa, Nebraska, Tennessee and Washington were among those enduring disruptions. MercyOne Central Iowa said the ransomware attack impacted its information systems.^[3] Hospital-based systems came back online first, MercyOne Central Iowa said. However, as of late October, access had not yet been restored for patient electronic health records and electronic prescription tools, and patients were unable to schedule appointments online, the hospital system said. “It will take some time before we can restore full functionality, and we continue work to bring our systems up as quickly and safely as we can,” MercyOne Central Iowa said.

◆ A former pharmaceutical sales representative from Berkeley, New Jersey and a Delray Beach, Florida physician have pleaded guilty in a scheme that involved defrauding New Jersey state health benefits programs and other insurers out of more than $2.5 million,

U.S. Attorney Vikas Khanna said.^[4] Keith Ritson and Frank Alario, MD, had been charged in 2020 in a 16-count indictment. Ritson pleaded guilty to one count of conspiracy to commit health care fraud and one count of conspiring to wrongfully disclose health information in violation of HIPAA. Alario pleaded guilty to conspiring to wrongfully disclose patients’ individually identifiable health information. According to the original indictment,^[5] Ritson and Alario recruited individuals to obtain very expensive and medically unnecessary compounded medications from a Louisiana pharmacy, Central Rexall Drugs Inc. Ritson and Alario learned that certain compound medication prescriptions—including pain, scar, antifungal and libido creams, and vitamin combinations—would be reimbursed by insurance providers in amounts in the thousands of dollars for a one-month supply, the indictment said. The two men also learned that some New Jersey state and local government and education employees had insurance coverage for these compounded medications, according to the indictment. “As a sales representative not affiliated with Alario’s medical practices, Ritson should not have had access to patients’ confidential information. However, since only certain insurances covered the compound medications promoted by Ritson, the defendants accessed patient files and other identifying information to ascertain patients’ insurance coverage,” the U.S. Attorney’s Office said. “On at least one occasion, Ritson and Alario jointly accessed patient information on an office computer for the purpose of determining insurance coverage for the medications. Ritson also had access to parts of Alario’s office where patient information was stored or could be heard and observed, including employee-restricted areas with medical files, fax machines, and computers. Ritson was also frequently present in exam rooms during patient appointments with Alario for the purpose of promoting the compound medications.”