In healthcare, technology has the ability to increase operational efficiency, improve access, and impact outcomes. For some people, technological innovation in the industry is a daunting concept. But not for Premise Health’s vice president of clinical applications, Laurel Cipriani, MSc, MSN. She thrives on technology-enabled transformation.  

Laurel specializes in systems improvement, information technology, and IT leadership. At Premise, she is an expert at helping her teams navigate the only constant in life: change. Adding to her impact, in 2025 Laurel joined the Executive Fellowship at The Digital Economist. We sat down with Laurel to discuss her experience in healthcare, her passion for technology, and her ability to lead teams in clinical excellence and technological innovation.  

What inspired you to initially pursue nursing, and how has your background influenced your interest in healthcare technology and technology-enabled transformation? 

My nursing background set the stage for everything that came after. When I was a teenager, I was in and out of the hospital with a serious autoimmune condition. It was during this time I realized what a difference a nurse can make in the experience – and the life – of a patient. That’s what made me realize I wanted to go into nursing.  

While working as a floor nurse during graduate school, I helped deploy the first ‘smart’ IV infusion pumps across the hospital. As opposed to their predecessors, which required nurses to manually calculate rate and volume, smart pumps contained software to ensure the correct dosage of medicine was given to each patient, with guardrails to prevent over or under dosing.  That was my first time being part of a technological advancement in healthcare, which was exciting. I was also working in nursing when we transferred from paper charts to electronic health records.  

One thing I noticed right away was a stark difference in how those two major technological changes were received by my fellow healthcare workers. I get really excited when there’s new technology. I love change. I know a lot of people don’t thrive when things change, so I find it rewarding to get to be a person that helps show people all they can gain from technological advancements.  

How has your diverse career prepared you to lead in healthcare technology, and what impact are you making in your current role? 

I got so much great experience in being an advocate for change on the frontlines of nursing. In my career I always tried to be an early adopter of technology, so that I could help lead the way and show others how to use it. I always want to do more.  I’m always looking for ways I can evolve; ways I can make an even bigger positive impact for people. My goal in life is to help make people’s lives better – and the right technologies can help do that.  

Every role I have had positioned me to be a well-rounded leader in healthcare technology. This included working as a bedside nurse, as a nurse researcher, and in population health, where I designed a clinical application, wrote clinical algorithms and taught nurses around the world how to use the system.  

In my current role at Premise, I’m responsible for all our specialty clinical applications, our occupational health platform, clinical application governance, and our instructional design and clinical application training teams. The people on our application training team travel to our wellness centers and train all our care team members how to use the technologies they rely on, such as Epic and our occupational health software. That’s really rewarding to see.  

You’re in the Executive Fellowship at the Digital Economist, a premier program for forward-thinking leaders, dedicated to advancing transformative change and focused on human-centered, systems-level change. What does your involvement as a Senior Fellow look like?  

I’m a full supporter of using AI to revolutionize healthcare, improve quality of life, and reduce suffering – but it has to be implemented in a thoughtful way. AI can actually make certain people sicker, if there aren’t safeguards in place. Unfortunately, right now AI training and education are not widely deployed and are inconsistent in their content. There are few large-scale studies on its risks. I’m trying to change that.  

In my role at the Digital Economist, I’m acting as a human-first technologist, partnering with those who are driving the innovations by bringing the call for responsible governance and keeping an eye on ethics. Together with these innovators, we’re seeking to implement AI in a way that keeps humans first, emphasizing AI’s benefits while minimizing risk – that’s where that “human-centered change” piece comes into play.  

AI and mental health is an emerging and complex space. Where do you see the greatest opportunities for AI to improve mental health outcomes — and the most urgent safeguards that need to be in place? 

One of my biggest concerns with the current state of AI is its echo chamber effect, like what we see on social media. Most AI models reflect what they think you want to hear, encouraging you to keep using it. Just like on social media, if people don’t agree with something, they disengage or unfollow, ensuring they only see content that confirms their views. We can’t allow AI to continue to be designed that way, especially when we think about how it can impact someone who may already be struggling with mental health. 

But with safeguards and thoughtful implementation, everyday AI can actually help our mental health, rather than harm it. But I think to be thoughtfully designed, we have to engage psychologists, philosophers, economists, educators, and policy makers – all these thought leaders must be involved in determining what the regulations are and ensuring the data the AI is trained on is inherently safe. Having the right types of advisors participate in the design of large language models will shape how AI affects our mental health.  

How do you envision your Digital Economist fellowship experience influencing technological innovation at Premise? 

In my fellowship, I am learning a great deal and leaning into the most advanced technologies, including the latest developments in AI and digital health solutions. Beyond gaining technical knowledge, I’m also exploring how these tools can be applied in real-world healthcare settings to improve efficiency, access, and outcomes.  

A unique aspect of the Digital Economist fellowship is the opportunity to attend exciting international events. For example, I recently attended the United Nations 80th General Assembly and NYC Climate Week, where thought leaders, scientists, academists, and politicians from around the world convened to discuss the latest breakthroughs. I attended a session on the emerging importance of considering meteorology in healthcare. We discussed ways that AI could translate weather-related factors, such as heat waves, draught, and smoke from wildfires, into an actionable format to providers at the point of care.   

This experience is sharpening my ability to evaluate emerging technologies not only for their potential but also for their risks, with a strong focus on ethics, equity, and responsible innovation. I look forward to bringing these insights back to Premise to help us drive forward-thinking solutions that keep our members at the center while ensuring we innovate with integrity. 

What excites you most about the intersection of technology and healthcare delivery in the years ahead? 

Combined with modern medicine, I think technology is going to help us cure diseases that have been considered incurable until now. We’ll be able to eliminate suffering in ways we’ve never been able to before. We’ll have diagnostics that are so much sharper and, combined with a clinician’s expertise and experience, can detect things so much earlier. I believe AI stands poised to usher healthcare into an era of unprecedented innovation and human-centered precision.  

At Premise, it’s not just about what we do today. We’re always looking ahead to implement new and improved technological innovation. Join us on the journey to reimagine what healthcare can be – contact us today.  

AI and machine learning is dominating healthcare news headlines, boardroom agendas, and watercooler conversations — but how do benefits leaders really feel about it? At Premise Health’s 2025 Client Forum, we asked some of the country’s most innovative HR leaders to share their thoughts on the promise of AI in healthcare. The results were mixed. While excitement is growing about how it can impact their benefits offerings, so are concerns and misconceptions. In fact, 53% of poll respondents shared that when they hear the term “AI,” they feel “cautiously optimistic.”  

While artificial intelligence is certainly a buzzword, with careful and diligent evaluation, it’s not something to fear. Let’s break down the top four myths we uncovered at Client Forum and hear what organizations must consider as they look to bring AI and machine learning into the fold, straight from our Premise and Epic experts. 

Myth 1: “Everyone is using AI.” 

Reality: 38% of Client Forum attendees use AI “very little or not at all.” 

While AI headlines suggest a gold rush, most organizations are still cautiously exploring early use cases. That means you’re not behind — you’re in good company. The necessity of AI in your organization comes back to the question of innovation, according to Sriram Narayan, executive vice president of data and analytics at Premise. In the Client Forum session, “Innovation: The Premise Roadmap,” Narayan shared, “Different organizations have different priorities. The key for us when we consider implementing AI technologies is to always tie that to business imperatives – where you’re trying to grow. I’ve seen a lot of companies spend a lot of money on the question of innovation and get very little value out of it.”  

If your organization is still on the fence about your need for innovative technologies, Narayan recommended considering the following questions:  

• Is this technology desirable? 

• Is this technology creating value? 

• Is this technology usable?  

For AI and machine learning technologies related to healthcare delivery, Narayan urged leaders to focus on innovation that ties to improving member experiences, creating value, and boosting provider efficiency.  

Myth 2: “AI is only useful for automation or customer service.” 

Reality: 54% believe AI’s greatest value is in predictive models. 

It’s true that some companies use AI purely to automate tasks or handle high-volume customer service inquiries — but that’s just the tip of the iceberg. In fact, only 8% of leaders who attended Client Forum said they’re currently using AI for automation, and just 5% cited customer service as a top use case. It appears these leaders believe AI’s real power lies in predictive models.  

Epic, the developer of the nation’s leading electronic health record, has been creating innovative models and technologies to help clinicians provide smarter, more proactive care by identifying at-risk members, flagging care gaps, and reducing clinician burnout.  

Spooner X, who leads technical and product development teams at Epic, shared some of the highlights of the innovations they’re rolling out, which are made more powerful by integrating directly into their EHR:  

• Enhancing, not replacing, human care teams 

• Personalizing member communication 

• Saving healthcare costs through administrative efficiency 

• Prioritizing features with clinical impact for patients 

“We know there’s a shortage of clinicians right now, so anything we can do to make a provider’s workday as efficient as possible is a top priority for us right now at Epic,” Spooner X said.  

Myth 3: “People are so excited about AI; they’re not digging deep enough into the security concerns.” 

Reality: 59% cite data privacy and security as top concerns. 

Many organizations have concerns when it comes to the data privacy and security of AI technologies, and those concerns are valid. However, instead of viewing those concerns as roadblocks, view them as important criteria for vetting the right innovative technologies and partners for your organization. “The journey to implementing AI across industries is bright, but it takes careful governance,” shared Narayan. 

Premise has found a trusted partner in Epic based on their patient-centered approach to keeping data safe and secure. “We’ve been in this business for 40 years,” explained Spooner X. “We approach software development in a very intentional way. Whenever we think about a healthcare problem, we start from the center – with the patient at the heart. Everything we do links back toward the patient at the center of the software design. That same approach extends to our business practices. Patient medical information is used for clinical care and is never sold, used for model training, or utilized for other goals that aren’t in the patient’s interests.” 

Myth 4: “We need a big strategy before we act.” 

Reality: Most leaders are still exploring AI use cases, and that’s normal. 

The majority of HR leaders are still early in their AI journeys. They’re testing small use cases, building internal understanding, and figuring out how this technology fits within their broader health and benefits strategies. 

“Out of all the industries, healthcare is the most intentional with AI adoption – and for right reasons,” said Narayan. “Because what we do is personal, what we do is intimate. This is about changing the lives of patients. So, adoption might be slow.”  

Moving from pilot to implementation won’t happen overnight: Narayan predicts that in five years, many companies will move from a proof-of-concept phase to a model-based phase. “Premise itself has done a nice job in terms of building pilots, and we are well positioned to scale in the future with good partnership from Epic and some of the other players we currently work with,” explained Narayan. 

As your organization looks to fully implement AI and machine learning technologies, start by having open, honest conversations with your benefits vendors about your needs and concerns, and focus on what innovations make sense for your unique population.  

Learn more about how our organization is using data to improve access, outcomes, and experiences for organizations.  

Imagine giving your care teams the ability to see the full picture of a member’s behavioral health journey — from past diagnoses and missed prescriptions, to ER visits and everything in between. By leveraging claims data, you can uncover deeper insights that empower you to make strategic decisions about how care is delivered to your employees with behavioral health concerns. These kinds of insights can be the difference between a last-minute counseling appointment and an inpatient hospitalization.

But first, what are population health insights?

“Data” is more than a buzzword — it’s a strategic business imperative and public health interest. Population health insights refers to the information that can be found in your medical and pharmacy claims data and your enrollment data, including member demographics, healthcare utilization, risk scores, preventive care, chronic disease prevalence, and pharmacy costs. This data can reveal trends among your employee population, offering a unique lens into how you can improve healthcare outcomes. When combining population health insights with a focus on behavioral health, it can provide transformative benefits.

Here are four key benefits of incorporating population health insights into your behavioral healthcare strategy.

1. Optimized Behavioral Healthcare: The Right Care at the Right Time

Behavioral health challenges are complex, often requiring tailored, and timely, interventions. A typical office visit with a provider is often not enough time for a member to share their full health history and relevant details, especially when it comes to behavioral health concerns. One of the greatest advantages of population health insights is the ability to empower care teams with data, at the right time. By analyzing claims data and integrating it into member outreach efforts, healthcare providers are proactively equipped with comprehensive information on an individual’s health journey, allowing them to provide support for a member before it’s an emergency.

For instance, by looking at the data and identifying gaps in care — like unfilled prescriptions for mental health medications or lack of follow-up on previous diagnoses — Premise providers can address these issues head-on. They can offer personalized guidance to the member at their next appointment and make necessary referrals to behavioral health specialists, if necessary.

2. Strategic Insights: Aligning Care with Business Goals 

Going beyond individual care, population health insights enable you to identify trends and develop long-term strategies that align with your organization’s healthcare goals and benefits. For example, if your data reveals high behavioral health spend in the community, an onsite, nearsite, or virtual behavioral health solution could help meet that need in a more cost-effective manner.  

We found this to be true for one employer, whose mental health spend was 22% higher than its peers. This large expense was mainly due to outpatient visits, costing the employer over $4 million per year. This client also spent another $2 million a year on mental health inpatient and outpatient care, some of which could have been avoided through preventive care. To help resolve this challenge, we helped them implement an onsite behavioral health program to make care more accessible — resulting in better care and lower costs. 

3. Engaged Members: Reaching those Who Need Care the Most  

Sometimes it can be a challenge to get your people to go to the doctor, which can leave behavioral health conditions unnoticed or unmanaged. Those with unmanaged behavioral health diagnoses are more at risk for other chronic health issues and expensive emergency care.  

With access to claims data, Premise providers can go beyond traditional population health approaches to proactively identify and work with individuals who are high-cost year after year, as well as those who are high-risk and have unmanaged conditions like depression or anxiety. While it’s important to serve everyone with high-quality care, it’s critical to specifically focus on serving those who need it most. 

Take, for example, an employee who frequently visits the emergency room for anxiety attacks. They may not be aware preventive care, such as routine mental health check-ins or medication management, can help prevent these episodes, or that they have helpful resources available through their EAP. By using claims data, care teams can proactively remind the individual about available services and educate them on the benefits of using their onsite, nearsite, or virtual health center for their needs. These interventions not only help improve health outcomes, but also significantly reduce healthcare costs for your organization by addressing issues before they require emergency or inpatient care.

4. Behavioral Health Equity: Breaking Down Barriers to Care 

Not all members access healthcare equally. For some employees, managing a behavioral health diagnosis isn’t as simple as making an appointment. Barriers such as past negative experiences, financial concerns, social stigma, cultural differences, or a lack of understanding about available resources can prevent them from seeking care. With a combination of claims data, electronic health records, and survey insights, we can help identify the people who need additional support.  

For instance, data may show an individual has missed several scheduled doctor’s appointments. These care gaps can cue their provider to have a conversation with them, either through outreach over the phone or secure messaging via their portal, about their hesitancy to go to the doctor. Let’s say through this conversation, the provider finds out the member hasn’t been taking care of their health because they are worried about costs. Their provider can then direct them to a resource such as Find Help, which offers a list of free community resources and assistance programs for things like food, transportation, and bills. The provider may also make sure the member knows about the low-cost or no-cost health services available to them at their health center, ensuring they feel supported and comfortable seeking care. These efforts not only reduce disparities in access to care but also promote an environment where members feel empowered to take control of their health without fear of financial strain. 

From insights to impact, you can take a more proactive approach in improving your population’s mental health. When you can anticipate the needs of your people, you improve health outcomes and reduce downstream care costs. And it all starts with data. See the types of results you can achieve by allowing Premise to manage population health. 

Interested to learn more about how population health insights can empower organizations like yours? Contact us today.  

Healthcare technology should answer a single question: how does this make things easier for the people who use it? That’s the question we answered with My Premise Health, our secure online member portal and mobile app. Let’s take a tour to see what members can do with it. 

Interacting with their care team

In the My Premise Health app, members have easy ways to interact with their care teams. Secure messaging allows them to ask questions and confirm next steps. Members also can see their care team with virtual visits during regular hours for their wellness center, right in the app. Through video or phone, they can engage with healthcare that works for them. Members with access to the Digital Wellness Center through their organization can take virtual visits anytime, anywhere.

In addition, Premise clinical team members can help members stay on track through proactive follow-up and outreach to members via the app, including post-appointment check-ins or reminders when it’s time to be seen again. By making it as easy as possible for members to interact with their healthcare, we help build the kind of trusted relationships with their care team that leads to better health.

Convenient appointment scheduling

Making appointment scheduling as easy as possible removes a common barrier between patients and their healthcare. Our members can schedule same-day and next day appointments through the My Premise Health app, selecting from any care team member or type of care available to them. Once they set the appointment, they’re ready to go — there’s no need to confirm over the phone.

Ahead of the appointment, members can complete all their check-in forms and provide updates on their medical information, like current prescriptions, when it’s convenient for them, instead of having to arrive 15 minutes early to fill out a stack of papers. This helps keep wait times to a minimum and makes appointments less disruptive to their schedules.

Staying on top of their health

It’s easy for members to stay up to date with their care plans and health information through the My Premise Health app. Taking ownership and being equipped to act on it can help members succeed in their health and wellness goals.

Lab and test results can be viewed by members on-demand from the moment they are loaded into their health record. The results are clear and easy to read, including if the results are high, low, or optimal. Providers can message alongside the results being uploaded and provide directions, context, and next steps, while answering any questions.

Members can then review any existing care plans, follow-up instructions, or educational materials provided by their care team to empower them to the best health possible. For prescribed medications, members can request refills, check the status, and more.

The My Premise Health app was designed to empower our members on their healthcare journey, make the journey as easy as can be, and ultimately to put access to their care team in their pockets. It provides a seamless, on-demand experience tailored to member’s needs.

Get in touch today to learn more about how we leverage technology to make healthcare easy for our members!

Connected devices: A quick refresher

By now, you’ve no doubt heard about connected devices. These devices have been implemented and improved over the years to help people better monitor their health in various ways. The most common devices are smart watches, but the list continues to grow with the evolution of devices like more discrete bio-wearable rings, glucose monitors, in-ear devices, blood pressure monitors, and chest straps for running.

Whether you’ve been along for the ride since the introduction of connected devices, or you need a crash course on what they’re capable of, here are three areas of your health that connected devices can help you keep tabs on.

Heart

Now more than ever, heart health is top of mind for many Americans. A report by the American Heart Association found that the prevalence of hypertension among adults 20 years or older from 2017 to 2020 was roughly 46%. The good news is that it’s never been easier for heart conscious people to keep track of this foundational organ’s performance.

Many smart watches, bio-wearable rings, and widely available in-home blood pressure monitors and cuffs provide daily heart rate monitoring and blood pressure readings. More recently, users have been empowered by these devices to take an electrocardiogram (ECG) test at will.  This extremely important test can help those with a family history of heart disease continually monitor for any markers of disease. It should be noted that this type of ECG, though convenient, shouldn’t be thought of as a diagnostic tool and users should consult their healthcare provider if they are experiencing any irregular cardiac symptoms. Heart disease can be a costly and debilitating condition to manage, so take advantage of connected devices to avoid complications down the road.”

Sleep

An emergent trend that many health professionals are concerned about is the rising prevalence of sleep deficiency. Recently, sleep has been included in conversations about health management as it’s been found to aid in memory formation, support consistent physical performance, and even prevent chronic illnesses. That’s why connected devices can be a useful tool to ensure that you get the recommended amount of sleep every night to maintain a productive and healthy life.

Connected devices can be used to tune in to your circadian rhythm, the body’s natural clock that dictates when you wake up and go to bed. During sleep, they’re able to catalogue your heart and breathing rates during the night, which sleep cycles you’re in and when, and present that data to you over a period of months or even years if you’re consistent enough. This type of information can be extremely useful in gamifying sleep to see how well you can manage getting to bed on time, sleeping the full night, and waking up feeling refreshed, ensuring that you’ll have plenty of energy to get through your busy week.

Physical Activity

At this point, fitness tracking may be the first thing that comes to mind when you hear about connected devices. It goes without saying, these devices are synonymous with step tracking, calories burned, stairs climbed, workout regiments followed, miles walked or run, the list goes on and on. What’s important to remember is that you don’t have to do it alone. Connected devices are still offering more ways than ever to get your daily 30 minutes of exercise in and have fun while doing it.

Wellbeing and engagement platforms like Sonic Boom Wellness can be used in conjunction with connected devices to host fun challenges and provide bonus incentives to get people moving. These types of platforms make it simple for people to sync up a connected device to an app for access to daily reminders, contest sign-ups, and updating their steps. These apps make it easier than ever to engage in wellness activities like standing throughout the day, hitting movement goals, and even starting friendly competition with family and friends to support an active lifestyle.

Monitoring your health has never been easier or more accessible

Not too long ago, it may have been unheard of for health management to exist anywhere outside of the primary care office, but we’ve reached a point where healthcare in your pocket is well within reach. Thanks to advancements in the technology of connected devices and the popular adoption of these devices commercially, it’s now more affordable and easier than ever to get started on your journey to better health.

At Premise Health, our members can sync their connected devices to the My Premise Health app for convenient, on-the-go health management. The app allows them to schedule appointments, manage their medications, message their provider, upload real-time health data, and more, wherever they may be.

If you’re interested in talking more about how your organization can get started on using connected devices for their health management goals, get in touch with us today.

After two years of change, what’s ahead for healthcare in 2022?

The pandemic has served as a forcing function for the rapid adoption of technology. Now, many of the technologies that were launched or improved during COVID-19 are being more fully integrated into existing care models.

As we look ahead, three of the top technology trends for employers to keep an eye on will be virtual health, remote patient monitoring, and care navigation. All expanded in response to COVID-19, and now are becoming part of the new standard of care.

Virtual Health

For many employers, the COVID-19 pandemic created a more dispersed population, as the flexibility to work remotely became a new reality for many workers. This shift led companies to reevaluate their benefits, recognizing that employees need the ability to access care when, where, and how it’s most convenient for them. In order to continue providing employees with easy access to high-quality care, many companies have turned to virtual health.

However, what many organizations have since learned is that standalone virtual solutions often don’t meet people’s needs. In 2022, expect to see increased interest in integrated digital and physical access models. Not only are multiple access points more convenient, but the integration of in-person and virtual health leads to higher utilization and better outcomes.

Additionally, people still value in-person connections with their trusted providers. Premise data shows that there is a lot of variability in how patients choose to access care virtually. As of August 2021, virtual utilization of behavioral health continued to be quite high at 73% of appointments while physical therapy had returned to post-COVID levels with 92% of visits being in-person.

In 2022, organizations are taking healthcare into their own hands by investing in integrated digital and in-person healthcare. By focusing on virtual health technology that interacts seamlessly with in-person offerings, employers can offer their people healthcare that guides them through every step of their care journey.

Remote Patient Monitoring

As patients have grown more comfortable seeking care virtually, the importance of remote patient monitoring (RPM) has also grown. RPM is a set of patient tools that makes it easier to for providers to monitor their health outside of the clinical setting, whether at home or on the go. During virtual primary care visits, RPM helps providers facilitate many of the check-ups that they would traditionally do in a doctor’s office, like blood pressure readings and weight measurements.

Throughout the pandemic, these tools helped many providers continue delivering care without requiring their patients to leave home. Now, as employers adopt more hybrid care models, a combination of virtual health and RPM is poised to help close the access gap by eliminating the need for employees to take time off work, find transportation, or travel a long way for an appointment.

In 2022, benefits leaders should expect RPM to continue expanding beyond chronic condition management and integrating into virtual primary care delivery models. When investing in connected devices, organizations should focus on those that offer flexible and scalable solutions rather than single-use models to avoid point-solution fatigue.

Care Navigation

As mentioned above, the growing focus on virtual primary care delivery does not replace the need for in-person care. When patients need to seek care in person, it is important that their virtual care integrates with local providers who can guide them to downstream care. On top of that, navigating care within the community can be complex and people may not have time to make their health a priority given busy schedules.

Care navigators provide a guided experience through the healthcare ecosystem, helping members seamlessly manage their care, whether that is at their onsite clinic, virtually, or in the community. This simplicity increases employee engagement by offering them one point of entry to all their care needs. Throughout the COVID-19 pandemic, care navigation has also been critical for patients with confirmed or suspected cases of the virus. Care navigators provide daily check-ins, monitor symptoms, and help members return to work when ready.

Looking ahead to 2022, we expect more employers to invest in virtual health solutions that provide their population with tools to navigate the entire healthcare ecosystem.

Regardless of an employees’ physical location – whether in the office or in a remote environment – providing both in-person and digital access points ensures they can get the care they need in a way that’s most convenient for them. Offering a combination of both removes barriers to care, keeps employees engaged in their health journey, and leads to better outcomes for happier, healthier members. With the right partner and benefits strategy, a tailored direct healthcare solution can create a positive impact for your population.

Ready to get started? Contact us today.

It’s no surprise to any employer that ransomware attacks are on the rise, making these destructive breaches a serious cause for concern. Attacks rose 158% from 2019 to 2020 in North America alone. Unfortunately, cybercriminals can easily access company data if proper measures aren’t in place. Read on for tips employers can use to mitigate the risk.

What makes a ransomware attack so destructive?

Ransomware is a type of malicious software that threatens to publish or block access to data or a computer system. An attack occurs when a cybercriminal encrypts an organization’s data and demands a ransom fee to decrypt the data. Employers are faced with a difficult decision because the data involved is crucial to the business and highly confidential. Attacks are not only costly but also harmful to productivity. The average impact of a ransomware attack on an organization’s ability to do business is, on average, a little over two weeks.

Why are ransomware attacks on the rise?

There are a few reasons ransomware attacks have grown.

1. Accessibility of cloud infrastructure, anywhere, anytime. Access to data from anywhere around the globe makes it easy for attackers to get into systems in the U.S. without being tracked and ultimately accused.
2. A growing number of criminal organizations promoting ransomware-as-a-service (RaaS). This service acts more like a business with individual groups performing different parts of a ransomware attack. Each group ends up with a cut of the ransom.
3. Vulnerable industries attract attackers. There are certain industries that cannot afford a disruption, such as food, transportation, and healthcare, which increases the likelihood of organizations paying the ransom.

How can employers prevent ransomware attacks?

While IT security teams play a large role in reducing incidents involving company data, we all play a significant part in helping to protect our organization’s data assets. Employers can take several steps to help reduce risk, starting with educating on the importance of following security protocols. Here are four tips employers can share with their employee populations to protect data.

• Always be mindful of what is being clicked on. Educate your employees on the harm an unknown, unsafe URL could cause. Employees should avoid clicking on URLs or opening attachments from unfamiliar entities. If you are ever unsure about an email, it’s better to be safe than sorry and share it with your security team for guidance.
• Avoid reusing or creating weak passwords. Reusing passwords between personal and work accounts can significantly increase the risk of a ransomware attack. Password manager applications can create complex passwords eliminating the hassle of remembering. It’s highly recommended to include special characters between words and numbers to strengthen them.
• Follow company protocols and be an active participant. It’s not unusual for your organization to have restrictions on certain things, such as blocking access to install software or certain websites, as these tactics provide protection from ransomware and many other types of attacks. Although updating software can be an inconvenience, it’s an important part of any organization’s defense and severely limits what attackers can do in an environment.
• See something, say something. If something doesn’t seem right, report it immediately to your security team. Early detection significantly reduces the impact a security breach has on an entire organization.

Premise Health’s security posture

Premise Health upholds a strong security posture given the nature of our business. Being HITRUST certified demonstrates our strong adherence to information security standards, which is a certification we don’t take lightly. As a healthcare organization, we are the keepers of a significant amount of sensitive information, making it critical that we hold ourselves to the highest security measures. To mitigate our risk against ransomware attacks, it starts with strong support from the top down. Leadership buy in allows our IT security team to implement defense-in-depth strategies, including:

• Strict web filtering policies to block traffic from regions known to distribute malware
• Endpoint protection to limit what an attacker can do in a system
• Email gateway filter which blocks and helps mitigate phishing emails
• Strong incident response team that responds to incidents that get past our controls
• Internal phishing program that leverages current trends and sends practice phishing emails to everyone in the company
• Continuing to look for ways we can further improve our security posture

Ransomware attacks are on the rise, impacting employers daily. From the compromise of the Colonial Pipeline to the attack of Kaseya to the global WannaCry incident, it’s not uncommon for employers to find themselves in the middle of a ransomware situation. These types of attacks quickly become destructive and have a costly impact on organizations, so it’s important to understand the basics to help mitigate your risk. Continue reading to learn more about the evolution of ransomware attacks and potential consequences.

What is a ransomware attack?

First, let’s start by defining this security term. Ransomware is a type of malicious software, also known as malware, that threatens to publish or blocks access to data or a computer system. Typically, this is done by encrypting the data until the target pays a ransom fee to the attacker. When encryption is complete, attackers commonly leave notes on the organization’s computers demanding a form of payment to unencrypt the data and not leak what’s been stolen. To recover the data, victims will be asked to pay in cryptocurrency because it allows for anonymity, making transactions difficult to track.

How do ransomware attackers get into organizations?

There are several ways a ransomware attack can initiate. Here are the top three ways attackers use to get access to an organization’s data:

• Brute-force. This is essentially password guessing. Brute force is likely to occur when members have easy-to-guess passwords or passwords discovered in other unrelated breaches.
• Exploit a vulnerability in the technology’s software. When administrators fall behind on patching, a potential entry point is created. Attackers will exploit these entry points to gain a foothold in the employer’s network.
• Phishing. Unfortunately, this is probably the easiest way to get a foothold into an organization. Scammers will use communication methods, such as email or text messages, posing as a reputable source to trick individuals into giving them sensitive information, such as passwords and credit card information. Phishing occurs when a link or attachment is opened or acted upon.

The time of day an attack happens is also intentional. Attackers often choose times where activity is least likely to be monitored, such as the middle of the night or weekend. Once in the system, attackers map out the network and begin to fully understand the lay of the land. Sensitive information and system backups are the main targets. This is what is used to recover a machine when it breaks down. A company is more likely to pay the ransom if it doesn’t have adequate backups or these become encrypted by the attackers.

What is a ransom and is it effective?

Attackers can demand payment because organizations want to protect their valuable and confidential data. When an employer’s data is at risk of being shared, the company is forced to make a difficult decision because the chance of leaking confidential information could be highly destructive. On average, a ransomware attack will impact an organization’s ability to do business for two weeks or more.

Unfortunately, it is difficult for companies to distinguish if the attacker can be trusted when determining whether to pay the ransom. At times, even a payment doesn’t result in decryption. Attackers are known to disappear after a payment is made or provide a faulty decryption key. In addition, decryption can often be too slow to recover the stolen data in a reasonable time.

Premise Health’s Security Posture

Premise Health upholds a strong security posture given the nature of our business. As a healthcare organization, we are the keepers of a significant amount of sensitive information, which makes it critical that we hold ourselves to the highest security measures. To mitigate our risk against ransomware attacks, it starts with strong support from the top down. Leadership buy in allows our IT security team to implement defense-in-depth strategies including:

• Strict web filtering policies to block traffic from regions known to distribute malware
• Endpoint protection to limit what an attacker can do in a system
• Email gateway filter which blocks and helps mitigate phishing emails
• Strong incident response team that responds to incidents that get past our controls
• Internal phishing program that leverages current trends and sends practice phishing emails to everyone in the company

In addition, Premise makes a priority to have strong backups that are regularly tested to put us in a good position to recover from an attack.

In part two of our ransomware series, you’ll learn more about why ransomware attacks are so destructive and tips employers can use to prevent them.