CrowdStrike Disruption Member Update

AHCA/NCAL Updates; Security
 

As you likely know, on Friday, July 19, a routine but defective automated cybersecurity software update deployed to certain Windows-based computer systems created worldwide infrastructure disruptions to airlines, mass transit, emergency response, financial, healthcare, and other systems. 

Impacted users experienced the 'blue screen of death' due to the defective “Falcon" cybersecurity defense software. This required rebooting operating systems with a corrected update. 

Detailed instructions have been posted by CrowdStrike and Microsoft for impacted users about various approaches IT administrators need to take to get their systems back online. More information can be found at the National Cybersecurity and Infrastructure Security Agency (CISA) website

This issue only impacted a portion of Windows users and not Mac or Linux hosts. Both CrowdStrike and Microsoft estimate that 8.5 million devices were affected – about 1% of all Windows devices worldwide. 

We want to assure you that this does not appear to be a cybersecurity incident like the Change Healthcare incident in February. The CrowdStrike outage appears to have disrupted some electronic health records (EHRs) and claims processing operations, but only for a short period of time. Additionally, no personal health information was compromised. 

For the most part, we understand this CrowdStrike disruption has been resolved for those impacted. However, for some AHCA/NCAL members who were affected, there may be a few residual impacts to pay attention to: 

  1. Some Medicare administrative contractors and other payers that were impacted may require providers to resubmit claims if they were submitted during the disruption period. We highly recommend providers check in with their payers to see if their claims were impacted and if there are any actions the provider needs to take. 

  2. Some EHR vendor systems may have been affected. We highly recommend providers that experienced disruptions check their EHR vendor support webpages to see if further actions may be needed. 

NOTE: Providers should be cautious about potential scammers attempting to take advantage of this situation.