All Episodes

September 29, 2025 11 mins

In this episode of the MGMA Podcast, we sit down with Rana McSpadden, FACMPE, CHPC, CPC, a consultant with the Medical Practice Services department of SVMIC, to explore the growing risks of ransomware and cybersecurity threats in medical practices. With more than 25 years of healthcare experience, Rana brings expertise in compliance, cybersecurity, patient experience, and practice operations to the discussion.


What You’ll Learn:

  • Why ransomware attacks on medical practices are becoming more frequent
  • Common gaps in healthcare security risk analysis that leave practices vulnerable
  • The dangers of incomplete malware removal and repeat ransomware attacks
  • How AI tools like ChatGPT can create cybersecurity risks in healthcare
  • What PHI you should never put into public AI systems
  • Real OCR settlement case studies from practices that experienced breaches

Key Takeaway: Many practices have not completed thorough, enterprise-wide security risk analyses—making them prime targets for threat actors. Leadership from the top is essential for building effective cybersecurity programs.

📍 Recorded live at the MGMA Leaders Conference 2025 in Orlando, FL

🎯 Perfect for: Healthcare administrators, practice managers, medical group leaders, compliance officers, and IT professionals in healthcare settings

Email us at dwilliams@mgma.com if you would like to appear on an episode. If you have a question about your practice that you would like us to answer, send an email to advisor@mgma.com. Don't forget to subscribe to our network wherever you get your podcasts.

Mark as Played
Transcript

Episode Transcript

Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Daniel Williams (00:03):
Well, hi, everyone. I'm Daniel Williams,
Senior Editor at MGMA, and weare at the twenty twenty five
MGMA Leaders Conference inOrlando at the Convention
Center. It's day one on Sunday,and we're so excited here. And I
am here with my first guest ofthe week, and that's Rayna

(00:24):
McSpadden. She's with SVMIC.
And I kid you not, she lives inDifficult Tennessee. She is in
Difficult Tennessee. She's goingto tell us all about this. And
Rayna has been on the podcastbefore. So Rayna, I want to just
welcome you back to the MGMApodcast.

Rana McSpadden (00:41):
Thank you so much. I enjoy this so much.

Daniel Williams (00:44):
That is wonderful. Natellis, I wasn't
joking. You live

Rana McSpadden (00:48):
in I difficult live in Difficult Tennessee.

Daniel Williams (00:50):
And it's near

Rana McSpadden (00:50):
Defeated Creek, Tennessee.

Daniel Williams (00:52):
Defeated Creek. It sounds sad.

Rana McSpadden (00:54):
So But it's a beautiful area.

Daniel Williams (00:56):
It is beautiful. You said, you were
telling me earlier, you havebald eagles that you can see

Rana McSpadden (01:02):
in your No, necessarily my area. It's more
towards Eastern Tennessee.

Daniel Williams (01:07):
That's Eastern Tennessee? Okay. Okay. So what
would we find in DefeatedTennessee?

Rana McSpadden (01:13):
Lots of deer.

Daniel Williams (01:14):
Okay.

Rana McSpadden (01:15):
Coyotes. Occasional bear.

Daniel Williams (01:20):
Okay.

Rana McSpadden (01:20):
Yeah. I've been told that there's been a bear
sighted around where my farm is.

Daniel Williams (01:24):
So. So, you and I were having such a great time
catching up. One thing that's sointeresting, because we get to
know people in thistechnological age through a
video screen. So when you wentand stood next to me, I looked
right past you because you'retaller than I thought. You're

(01:44):
five'seven or so.
And I went, I just saw you asthis person in this little box,
and then there you are. And wewere looking eye to eye.
Absolutely. I was going, okay.

Rana McSpadden (01:54):
Back in COVID, we hired somebody into our
department, and our firstmeetings were through Zoom.
Right. And the first time I mether, I was like, like, oh wow,
you are so tall.

Daniel Williams (02:08):
Well, it's just, we get to know each other
digitally. Exactly. And thenwhen we get to meet, that's one
of the wonderful things about alive face to face event.

Rana McSpadden (02:16):
Absolutely. And that's one of the things I enjoy
so much about the live MGMAevents such as the Leadership
Conference is that I get tonetwork with people. I get to
see them face to face andactually meet them.

Daniel Williams (02:26):
Right.

Rana McSpadden (02:27):
And become more than just friends.

Daniel Williams (02:29):
Exactly. And so you are one of our speakers as
well. You're an attendee. Yes.You're a speaker.
So first of all, Jill, let'sjust reeducate our audience if
they did see that earlierpodcast or people are new to it.
What are you gonna be speakingon this week?

Rana McSpadden (02:44):
I will be talking about cybersecurity and
how the importance of leadershipfrom the top when it comes to
your cybersecurity program.

Daniel Williams (02:52):
Okay. And you were talking to me earlier that
you had real case studies aboutpractices that just they need to
up the game as far as thosecyber terrorists. Talk about
that. Talk about what's goingon. Don't have to get into too
much We can whet the appetite,but talk about what some of the

(03:13):
common themes are, wherepractices do.
I think you've used the verbransomed. Had not heard it used
quite like that, practices doget ransomed, So so to tell us
about that.

Rana McSpadden (03:26):
So in my presentation, will be using
real, you know, OCR settlementsof various breaches that were
caused by cybersecurity eventsbeing ransomed by threat actors.

Daniel Williams (03:38):
Okay.

Rana McSpadden (03:39):
Where the threat actors, they put software into
the computer systems that thenlock it up to where the user
can't gain access to it anymoreunless they pay the ransom.

Daniel Williams (03:50):
Okay.

Rana McSpadden (03:51):
I'll be, you know, ransomware has become so
rampant in healthcare andthere's so many different types
of ransomware that is out there.And I'll be talking just a
little bit about the differenttypes too. Okay. But the biggest
thing is, is one, making surethat you have a thorough
security risk analysis. We'refinding a lot of practices that
have not either completed one,or it's not as thorough as it

(04:14):
needs to be.
It's not enterprise wide. Itdoesn't take into account all
the different satellite officesor various things like that. And
then also looking to see whatkind of malicious software we
have on our systems to keep thatmalicious software out of our
systems, or that can detect itand zap it and get rid of it out
of your systems, either beforeit can do something bad, or at

(04:38):
least once they're in yoursystem and they've done
something, you install somethingthat can remove it from your
systems. One of the examplesthat I'm gonna be giving in my
presentation is talking about apractice that was ransomed many
times because that coding in thecomputer systems was not
removed, and so the threatactors still had access to those

(04:59):
Oh, computer wow.

Daniel Williams (05:00):
Okay. That is going to be so helpful. Now,
this is what's so interestingabout a face to face event like
this. You're a speaker, butyou're also getting to interact
and attend sessions yourself.What's something here that
you're looking forward to,whether you looked at the
schedule or you're meeting upwith people that you've met
before or meeting new people?

Rana McSpadden (05:21):
Mainly it's the networking again for me. I'm
only here for a short period oftime. So unfortunately I'm not
going to be able to see a wholelot. I saw that there was an AI
in the morning and I was like,oh dang, I really wanted to see
the AI because AI is getting sorampant in healthcare. And with
it coming into our computersystems, I will also be talking
about the AI risks incybersecurity too.

(05:45):
Coders are using AI to writecode and they're not necessarily
considering all the securityrisks behind it. So it is
causing a risk to cybersecurityas well.

Daniel Williams (05:55):
Okay, you brought a topic up that I am
very interested in. As someonewho has made a new best friend,
and Millennial Mike, I'll callhim, he's my AI friend, and we
have wonderful chats. Are therethings we shouldn't be saying or
telling or prompting into theAI?

Rana McSpadden (06:14):
Oh, absolutely.

Daniel Williams (06:16):
Gosh. Let me turn my phone off right now.

Rana McSpadden (06:19):
Well, mainly when it comes to health care, no
patient information, no PHI cango into an AI system unless that
it's a system that's closed thatis not public facing. ChatGPT,
don't put any privateinformation. Don't even put your
own private information intoChatGPT because it's open to
anybody.

Daniel Williams (06:38):
Oh my goodness. So this changes everything,
Reyna. I'm so glad you're Don'thyperventilate on me. I'm so
glad and terrified right nowthat you're telling me all of
this. Okay, so that's somethingfor everybody to put down right
now.
Because I have to say, I'm inColorado, you know, MGMA, we're

(06:59):
headquartered in Denver, rightdown the street. The cartoon
South Park is originated there.They just had this hilarious
episode I watched where peoplewere coming up with their
business plan based on someinteraction they have with their
AI. And it was absolutelyhilarious. You know.

Rana McSpadden (07:20):
Well, AI can be absolutely helpful because I use
it myself. I mean, I use it forwriting prompts or I will write
up a little article orsomething. I'll put it in there
just to see, clean it up alittle bit for me. Okay. But you
still have to be careful aboutwhat you pull from AI too.
Okay. Definitely make sure thatyou're reviewing whatever
information you get from it tomake sure it's true. Tends to

(07:43):
hallucinate some.

Daniel Williams (07:44):
Boy, I'll say. And

Rana McSpadden (07:49):
look at the sources that it came from,
because there's sometimes thatI'll Google something, because I
still Google, I don't use AI asmy first line of defense. And
it'll pop up an AIinterpretation of various
articles that it read. Well,based off of what you read on
the AI, and then when you gointo the article, it's polar
opposite of what it's Sosupposed to be always, you know,

(08:12):
trust but verify.

Daniel Williams (08:13):
Right. Well, I'm a big film buff, and so I'll
ask it about movies in the '70sjust to get kind of the themes
or the plots down, and thenit'll list the year. And I'll
know that's not right. I'll say,No, that wasn't in 'seventy
four, it was in 'seventy two.Right.
And they'll go, Oh, you werecorrect. I was wrong about that.
So you really, I think that's soimportant that it can help us do

(08:37):
things more efficiently. It canhelp us correct some grammar,
style, different things in ourwriting. But you do have to fact
check it.
You can't just say, sure, andthen just

Rana McSpadden (08:47):
Exactly.

Daniel Williams (08:48):
Send it out. It's just not gonna be there. So
when are you turning around?We're on Sunday right now. When
are you heading back out then?

Rana McSpadden (08:56):
I head out first thing Tuesday morning. So I'll
be here all day tomorrow onMonday.

Daniel Williams (09:00):
Okay. What else, you are gonna speak
tomorrow, but what else are you,is there anything else you've
set up? Are you kind of goingwith the flow?

Rana McSpadden (09:07):
I'm just going with the flow. I'm just kind of
one of those go with the flowtype people. So it's one of
those, I do have a sessiontomorrow afternoon I want to sit
in on young careerists that I'llattending. So I'm excited to see
that one. But unfortunately withMGMA is I always see there's

(09:30):
multiple sessions all at thesame time that I wanna attend.
And there's one on creating anMA program. Yeah,

Daniel Williams (09:38):
heard multiple people

Rana McSpadden (09:39):
Since I'm a consultant, that's one of the
things that we were working on.So I'd love to see that one too,
it's at the exact same time. Ohgosh. I'm having to juggle which
one do I really wanna go see. SoI'll probably go pull the slides
from the one I don't get tosell, go see, at least so that I
still have that information.

Daniel Williams (09:54):
Right. Now I bumped into you. We just had a
session for first timeattendees. Are you a first time
attendee?

Rana McSpadden (10:02):
Absolutely not. No.

Daniel Williams (10:03):
See, we're just hanging out there meeting

Rana McSpadden (10:05):
new was first time helping out.

Daniel Williams (10:08):
Oh, that's wonderful. Okay. Any last words
then, since you have been toMGMA events before? Any advice
you'd give to people who may behere for their first time or
they're still just kind ofgetting their feet wet at what
to get, what's, how do they getthe most out of that event? What
would you give somebody's, whatadvice would you give someone?

Rana McSpadden (10:29):
Wear comfortable shoes for one. We don't care,
tennis shoes are fine. Butabsorb as much as you can.
You're not gonna be able to doit all. Do as much as you can,
but definitely network.
Find somebody in your field,find somebody in your system, in
your state, somebody that you'venever spoken with, worked with

(10:50):
before. Gain those friendships,gain that networking, because
those are people that you'regonna be able to go back to when
you have questions, when youhave help. There's days that I
have questions that, you know,I'm a consultant and there's
still things I don't know.

Daniel Williams (11:03):
Right.

Rana McSpadden (11:03):
And where I'm not in a practice every single
day and I have friends all overthe nation that are, I can reach
out to them and say, Hey, howare you handling this?

Daniel Williams (11:11):
Yeah.

Rana McSpadden (11:13):
And I think that's the most beneficial thing
for

Daniel Williams (11:15):
me. Okay.

Rana McSpadden (11:16):
I mean, the education is great, but it's the
networking for me that is themost important.

Daniel Williams (11:21):
Okay, well, Rayna McSpadden from SVMIC and
from Difficult Tennessee. Just ahoot and a holler from Defeated
Creek, It's been a pleasure tocatch up with you.

Rana McSpadden (11:35):
I have so enjoyed this.

Daniel Williams (11:36):
All right. Well, everybody, this is
Danielle Williams, senior editorat MGMA, signing off. Thank you
so much for listening to theMGMA podcast.
Advertise With Us

Popular Podcasts

My Favorite Murder with Karen Kilgariff and Georgia Hardstark

My Favorite Murder with Karen Kilgariff and Georgia Hardstark

My Favorite Murder is a true crime comedy podcast hosted by Karen Kilgariff and Georgia Hardstark. Each week, Karen and Georgia share compelling true crimes and hometown stories from friends and listeners. Since MFM launched in January of 2016, Karen and Georgia have shared their lifelong interest in true crime and have covered stories of infamous serial killers like the Night Stalker, mysterious cold cases, captivating cults, incredible survivor stories and important events from history like the Tulsa race massacre of 1921. My Favorite Murder is part of the Exactly Right podcast network that provides a platform for bold, creative voices to bring to life provocative, entertaining and relatable stories for audiences everywhere. The Exactly Right roster of podcasts covers a variety of topics including historic true crime, comedic interviews and news, science, pop culture and more. Podcasts on the network include Buried Bones with Kate Winkler Dawson and Paul Holes, That's Messed Up: An SVU Podcast, This Podcast Will Kill You, Bananas and more.

24/7 News: The Latest

24/7 News: The Latest

The latest news in 4 minutes updated every hour, every day.

Dateline NBC

Dateline NBC

Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com

Music, radio and podcasts, all free. Listen online or download the iHeart App.

Connect

© 2025 iHeartMedia, Inc.