MGMA Week in Review: Cybersecurity Updates, Patient Loyalty, and Shifts in Incentive Pay

In this episode of MGMA Week in Review, hosts Daniel Williams and Colleen Luckett explore pressing issues impacting healthcare practices today. The episode opens with insights from the Colorado HIMSS Advocacy Day Breakfast, where Colleen shares the latest updates on healthcare cybersecurity and the growing need for vigilance against data breaches and cyber threats. Daniel dives into a recent study showing that patients are willing to wait for their preferred doctors, particularly for complex or personal care, highlighting the ongoing importance of continuity of care.

The conversation then shifts to incentive-based pay trends for advanced practice providers, where Colleen and Daniel analyze a modest but notable shift away from heavily incentivized compensation models. Rounding out the discussion, they examine predictions for hospital overcrowding and its downstream impact on outpatient care, stressing the importance of collaboration between hospitals and ambulatory practices to manage patient flow effectively.

00:47 Introduction and Hosts' Welcome

01:17 Colorado HIMSS Advocacy Day Recap (MGMA.com)

01:52 Cybersecurity in Healthcare: Key Insights (MGMA.com)

05:35 Patient Loyalty and Continuity of Care (Medical Economics)

09:19 Incentive-Based Pay for Advanced Practice Providers (MGMA Stat)

11:43 Dismissing Patients: Best Practices (Physicians Practice)

14:46 Hospital Overcrowding and Outpatient Care Implications (Health Journalism)

17:03 Conclusion and Resources

Additional Resources:

• Connect with the hosts at [e-mail] and [e-mail] to share your practice challenges, news to know, or to be featured on an upcoming episode. 
• Join Us at the 2025 MGMA Financial Conference (April 13-15, Washington, DC) - Register Here

Episode Transcript

Daniel Williams (00:06):
Well, hi, everyone. Daniel Williams here,
senior editor at MGMA and hostof the MGMA Podcast Network.
We're back with another MGMAweek in review podcast along
with cohost Colleen Luckett, aneditor and writer at MGMA. And
we've been chatting offline,having a little fun catching up,
so we're gonna share some ofthat with y'all. Colleen, what

(00:28):
do you have first to share withus?

Colleen Luckett (00:30):
Yeah. Well, I may have mentioned this last
week, Daniel, but in in anycase, I attended the Colorado
HIMSS advocacy day breakfastlast week. It was held in our
own swanky historic Brown PalaceHotel in Downtown Denver. And if
you're not already familiar, HIMstands for the Healthcare
Information and ManagementSystem Society. They just had

(00:51):
their big annual conference inVegas.
Chris Herritt, my boss,attended, and this was a little
Colorado breakfast. And it washeld on March 17. Yes. That was
Saint Patrick's Day. And let'sjust say, if you were hoping for
a feel good parade oncybersecurity updates, this is
not going to be that.
Now while there were festivegreen outfits, including a

(01:13):
speaker from local government ina truly unforgettable shamrock
blazer, the mood was anythingbut celebratory for the
Guardians of Healthcarestrengthening cybersecurity in
an evolving Threat Landscapepanel that took place later in
the morning. So I wrote a recapof the panel in my latest, in
this latest MGMA Insightsarticle I did. It's titled

(01:34):
Cybersecurity in Healthcare. Noluck required, just relentless
vigilance. And friends, I don'tscare easily psychological
horror and crime drama to myfavorite genres for books and
movies, but this one got undermy skin.
I just wanted to give you all afew important insights from the
panel. So moderated by StephanieBroderick from clinical

(01:54):
architecture, the panel broughttogether some true cyber
sentinels. Howard Hale, VP andCTO, Intermountain Health
Richard Stainings, chief chiefsecurity strategist from Silera,
and Rick Baum, chief informationsecurity officer at Point
Solution Security, and a selfproclaimed professional hacker.

(02:16):
They were not pulling anypunches on that morning from
ransom ransomware attacks,paralyzing entire revenue
cycles, to AI generated deepfakes of your CEO calling the
help desk for a password reset.The message was clear.
Cybersecurity isn't just an ITproblem anymore. It is a
leadership problem. A patientsafety problem. A we could lose

(02:39):
everything problem. One of thekey takeaways, health care is a
massive target because it'sessential, and our systems,
particularly third partyvendors, are deeply
interconnected and underdefended.
That was the really scary part.The Change Healthcare breach
wasn't just a fluke. It was awarning. And as Rick Baum
bluntly put it, the next changehealthcare is coming is coming.

(03:03):
So what does this mean for you,our members, in outpatient and
medical group practice settings?
Well, even if you're not part ofa hospital system, you're likely
working with these third partyvendors. Do you know how secure
they are? Do you havecontingency plans if they go
down? Something to really thinkabout. Also, the panel
emphasized that availability isnow the top concern, not

(03:26):
confidentiality.
So if your EMR is encrypted byransomware, if your e
prescribing system is offline,or if your devices stop working,
patient care halts. And that isbad, as you know. Finally, and
this one's personal forpractices. Your staff,
especially at the front desk orcall center, are the new

(03:46):
frontline. Social engineeringattacks powered by AI are
designed to sound like yourboss.
So penetration testing, yourhelp desk isn't a luxury
anymore. It is a necessity. Thegood news, you, our MGMA
members, don't have to figurethis out alone. We have a
cybersecurity and medicalpractices playbook we just put

(04:08):
out. We have podcast episodesfrom Daniel's team.
We've got courses and insightarticles all designed to help
you secure your systems, trainyour staff, and stay a step
ahead of those bad guys. And Irounded up a strong collection
of them for your convenience.You can find them at the bottom
of my recap article. Again, it'scalled cybersecurity and health
care. No luck required.

(04:28):
Just relentless vigilance, andit's live now on mgma.com. We'll
also link it in the show notesbelow, of course, but don't read
it before bed unless you wannalose sleep like I did after
listening to that panel. Okay.Over to you, Daniel.

Daniel Williams (04:44):
Alright. Thanks for sharing that. What a great
panel discussion. So our nextstory, it comes from medical
economics. It's written byAustin Lattrell.
It was published on March 26,and this is something that
really caught my attention. It'sa new study published in the
Annals of Family Medicine, andit suggests something that I did

(05:08):
not know. Patients are, in fact,willing to wait a little bit
longer to see their own doctor.As long as it's their own doctor
who they trust, they're willingto see them. So there are some
caveats here.
It's special, especially whenthe visit involves something
more personal or complex. We'retalking chronic condition

(05:29):
management, mental health care,or anything that requires a
sensitive exam. The surveyincluded more than 2,300 primary
care patients, and it does makeone thing very clear: continuity
of care still matters. In fact,ninety four percent of those

(05:49):
surveyed said they have apersonal primary care physician,
and seventy one percent said itwas extremely important to them
that that was so. Now, that's apowerful reminder in an era
filled with urgent care clinics,minute clinics, and same day
telehealth appointments.
For a lot of people, trust beatsconvenience. Now, when it comes

(06:14):
to things like follow-up visitsfor mental health or chronic
illness, more than half apatient said they only wanted to
see their doctor. But thatloyalty starts to shift when
symptoms are more acute. Forexample, only about seven
percent said they'd wait fortheir own doc when dealing with
something urgent. Makes sense?

(06:36):
When you're sick sick, you won'thelp fast fast, so that's
something to keep in mind. Thesurvey even laid out
hypothetical scenarios. Wouldyou rather see your own primary
care physician in three to fourweeks or someone else within
twenty four to forty eighthours? If the issue was
sensitive, something like apelvic or prostate exam, sixty

(06:59):
eight percent said they'd holdout for their physician. For
mental health concerns, fiftynine percent said the same.
That trust and relationship,especially in vulnerable
situations, was worth the wait.And there was there were some
interesting demographic detailsin the mix too. Patients with
less education were actuallymore likely to want to wait to

(07:23):
see their own doctor, even fornew symptoms. Women were also
more likely to prefer continuitywhen it came to annual checkups.
And for chronic healthconditions, folks with higher
self reported health riskmeasured by the What Matters
Index were more likely to wantto stick with their personal
provider.

(07:44):
So what's this mean forpractices? It's merely a
reminder that while improvingaccess and quick scheduling is
important, practices shouldn'tlose sight of the value patients
place on long term relationshipswith their providers. Building
that trust isn't just good foroutcomes. It's something that
patients are actually willing towait for. So Colleen, turn it

(08:06):
over to you.

Colleen Luckett (08:07):
I can totally relate to that. I actually saw
my primary care physicianyesterday, and I had waited for
a little while. But I wasthinking that, like, at our age,
at my age, like, symptoms couldbe any number, like a hundred
thousand different things. Andso having that continuity of
care and someone who reallyknows you, that is very

(08:27):
important. Cool article.
Thanks. So let's move on to thenext segment here. So is the
momentum behind incentive basedpay for advanced practice
providers starting to losesteam? In our March 25 poll, we
asked medical group leaders howthey currently compensate their
APPs, and the results show apretty even split. 44% said they

(08:49):
use salary plus incentives, butanother 44% said they stick to
straight salary or hourly pay.
Just 6% reported using an RVUmodel, and 3% used volume based
compensation, and another 3%said other, the mystery people.
That's a bit of a shift from ourAugust poll when more than half,

(09:10):
51%, of respondents were usingsalary plus incentives. So we're
seeing a modest retreat fromincentive laden models. Now,
before we jump to conclusions,it's worth noting that a number
of leaders using salary onlyapproaches said they're still
considering adding incentives inthe future, especially tied to
productivity or value basedcare. But others were clear.

(09:31):
They're sticking with simplesalary models for now. And
honestly, with risingoperational costs and constant
pressure on margins, thatpredictability can be a big win.
It's also worth noting, fixedsalary models may actually help
with recruitment. In our Junepoll, 63% of practices said they
were planning to add new APProles. And with the ongoing

(09:52):
hiring boom, less administrativecomplexity and quicker
onboarding can be realadvantages, especially for
smaller groups with limitedresources.
Hey. If you've got a successstory or best practice to share
around APP compensation, wewould love to hear from you. We
would actually love to publishyou in our next issue of
Connection magazine or on theWeek in Review podcast right

(10:15):
here. You can reach out to me atc luckett, c l u c k e t t at m
g m a dot org or Daniel at dwilliams, d w I l l I a m s at
mgma dot org. And if you're notalready part of the MGMA stat
community, you should be.
You can join by texting stat, st a t, to 33550 or by accessing

(10:38):
our sign up form online atMGMA.com/MGMA-stat. It's quick,
easy, and your insights reallyhelp shape the future of health
care leadership. Daniel, back toyou.

Daniel Williams (10:50):
All right. Thanks for that story, Colleen.
Now we talked about continuityof care a moment ago. Let's talk
about the flip side,discontinuity of care and when
that comes from the practice. Sowhat am I getting at?
Well, this is a story that comesfrom Physicians' Practice
written by Keith A. Reynolds,published on March 25. And let's

(11:15):
be honest here, discontinuity ordismissing a patient from your
practice is one of those thingsthat no one wants to deal with,
but sometimes it just has tohappen. Maybe it's chronic no
shows, maybe it's verbal abuse,or a complete breakdown. In that
word again, trust.
Whatever the reason, the articlelays it out clearly. If you're

(11:38):
going to do it, you've got to doit the right way, legally,
ethically, and professionally.Reynolds walks through the
situation where dismissal isappropriate, and there are more
than you'd think. We're talkingthings like noncompliance,
threatening behavior, repeatedviolations of office policies,

(11:59):
or even refusal to pay forservices. But here's the key.
It's not just about why you'reletting a patient go. It's how
you do it that really matters.Step one: document everything.
You need a paper trail showingyou gave the patient clear
communication and reasonablechances to correct the issue.

(12:21):
This isn't just about coveringyourself.
It's also about showing thatyou've acted in good faith
throughout. Then comes theformal written notice. That's
your official breakup letter. Itneeds to explain without
inflammatory language that thepatient provider relationship is
ending, and it should include athirty day window during which

(12:43):
you'll still provide emergencycare, giving that patient time
to find a new provider. Andhere's something that might

surprise some folks (12:51):
You don't have to give a specific reason
for dismissal in the letter,especially if it's a high
conflict situation.
The goal is to stay neutral,professional, and most
importantly, avoid escalatingthings. The article also
emphasizes avoidingdiscriminatory language or
actions. You've got to beespecially cautious when dealing

(13:14):
with patients in protectedclasses. Think disability, race,
gender, age, or a mental healthstatus. A poorly handled
dismissal can lead to legalblowback and damage your
practice's reputation.
And finally, offer referrals.Even if the relationship has
gone south, helping the patienttransition out shows

(13:36):
professionalism and keeps thefocus where it should be on
patient care, even as you'reparting ways. So, yeah, it's not
easy, but it's necessary. Andwhen handled well, dismissing a
patient can protect your team,your other patients, and the
overall healthier practice.Colleen, I'm gonna turn it over

(13:57):
to you.

Colleen Luckett (13:58):
Sure. We're gonna finish this episode off
with some hospital overcrowdingissues. So if you thought
hospital overcrowding peakedduring COVID, think again. A new
forecast says we may just begetting warmed up. So while your
clinic might not have patientsparked in the hallway yet, this
story has major implications foroutpatient care.

(14:20):
The Association of HealthcareJournalists published a piece on
March 17 by Mary Chris Jaklavikentitled it's titled More
Hospitals Will Get DangerouslyOvercrowded, Researchers
Project. The article breaks downfindings from a new research
letter in JAMA Network Openshowing that national hospital
occupancy has climbed to a postpandemic average of seventy five

(14:43):
percent compared to about sixtyfour percent before COVID hit.
The big takeaway, this increaseisn't due to a massive surge in
hospitalizations. It's largelybecause we now have fewer
staffed hospital beds. In fact,researchers found a 16% drop in
bed supply nationwide.
And if current trends hold, wecould hit a critical 85%

(15:06):
occupancy rate by 02/1932. Now,why does this matter to
outpatient leaders like you allat NGMA? Well, first, hospital
capacity often leads systems todouble down on ambulatory
services. That could mean moremergers, partnerships, or even
acquisitions involving localpractices. If hospitals can't
keep patients in beds, they'lltry to keep them out of beds,

(15:28):
and that's where outpatient caresteps in.
Second, staffing. If hospitalsstart throwing around big sign
on bonuses to solve theirbottlenecks, physician practices
could find themselves in an eventougher talent war. Recruiting
and retaining staff could getmore competitive than ever,
especially in markets with majorhealth systems. And finally,
collaboration. This is a momentfor outpatient practices to lean

(15:51):
into preventive care, carecoordination, and discharge
planning.
By working more closely withlocal hospitals, you can play a
key role in reducingreadmissions and helping manage
complex patients outside thefour walls of the hospital.
Again, this article is by MaryChris Jaklavik for the
Association of HealthcareJournalists. It was published on
March 17, and we've got the linkfor you in the show notes. And

(16:14):
that does it for me today,Daniel.

Daniel Williams (16:16):
Alright. And that's gonna do it for this
episode. Again, as Colleen wassaying, we'll have all of these
links for you in the episodeshow notes, and we'll provide
other resources for you as well.So I'll just say thank you all
for being MGMA podcastlisteners.

Colleen Luckett (16:33):
Thanks, everyone. See you next time.