Cybersecurity in the Patient Contact Center: 4 Essential Tips for Leaders

It’s not a matter of if a cybersecurity attack will occur within your health system — it’s a matter of when.

That’s what Yuriy Kotlyar, CEO of American Health Connection, tells his contact center clients. And he wants them to be prepared.

“You need to assume that you will get hacked,” Kotlyar says. “Even if you have the best security in the world, you can and probably will get hacked.”

Kotlyar shares four tips on how to prepare:

1. Develop a Comprehensive Disaster Recovery Plan

   When cyberattacks occur, time matters. Contact centers must have a well-rehearsed plan to maintain operations and minimize disruption. Key elements of a disaster recovery plan include:

   • Offsite and offline backups
   • Redundancy across multiple cloud providers
   • Regular drills to test system restoration
   • Clear communication protocols

2. Get Extra Help

   When a cyberattack strikes, employees are often left in the lurch, grappling with questions about payroll, benefits and job security. In the wake of the Kronos payroll attack at a large central Florida healthcare provider, American Health Connection stepped in and provided external support to answer employee HR-related questions.

   “We started a 24/7 hotline the next day and began answering questions,” Kotlyar says. “With our hotline, we answered thousands of calls from concerned employees.”

   Similarly, when Crozer Health faced a ransomware attack in August 2023, rapid response was essential. American Health Connection was able to pitch in.

   “We took over operator responsibilities and departmental calls. Basically, every call coming to the facility,” Kotlyar says. “Because they lost their EMR, their computer systems, email and phone system, we had to manually communicate with staff through cell phones and texts to take care of patients.”

3. Train Agents for Crisis Communication

   During a cyberattack, contact center agents become the organization’s voice. Proper training and preparedness are essential to managing customer concerns effectively.

   “First, agents need to be empathetic, but they also have to be able to prioritize the calls,” Kotlyar says. “With so many calls coming in, you have to have an escalation protocol system to help your call center agents distinguish true emergencies.”

4. Foster Strong Relationships with IT and Leadership

   Cybersecurity is a team effort. Contact center leaders must build strong relationships with IT departments and C-suite executives to ensure seamless coordination during crises.

   “When a cyberattack happens, the contact center is at the front end receiving calls,” Kotlyar says. “Contact center leaders need to show C-suite executives that their team can handle these types of emergency calls.”

   Proactive engagement with IT can lead to collaborative initiatives. For example, contact center leaders can work with IT to develop training programs that help agents identify potential phishing attempts or other security risks.

   Cybersecurity is not just the responsibility of IT departments. All employees, especially those in customer-facing roles, play a role in maintaining a secure environment.

   “A lot of these hacks happen through people, like an employee receiving an email that looks like it comes from the boss or the HR department, asking you to update your bank account,” Kotlyar says. “Staff needs to be trained to spot them and not click on anything suspicious.”