What are the key risks for private healthcare organisations?

12 June 2024

Private healthcare providers face a range of risks. As they transition towards digitisation and user-centricity, their business and operational risks are also evolving. Key risk areas include cyber threats, business disruption, workforce challenges, business continuity and contingency planning, new technologies, quality and safety, and supply chain disruptions. We explore some these risks below.

Workforce challenges

Healthcare organisations are increasingly facing challenges in recruiting, hiring, and retaining staff. The current shortage of clinical staff is projected to intensify, leading to increased risk within healthcare organisations due to a lack of experienced staff and stronger competition for workers.

Addressing near-term workforce challenges arising from the pandemic—in particular, safeguarding the safety and well-being of frontline staff—while also building future workforce adaptability and resilience will require data-driven, human-centric solutions. These solutions should then enable organisations to respond swiftly to evolving employee needs.

Additionally, workforce shortages and the pandemic have highlighted the enormous strain under which staff often work. Staff also want the option to work flexibly, prompting health systems to customise both the patient experience for each patient and the work experience for each employee. A talented workforce is essential to the delivery of high-quality care.

Cybersecurity

As the use of technology in care and patient communication grows, cybersecurity continues to be a top concern for healthcare executives, audit committees, and boards. Cyber criminals have become relentless in the pursuit of data and sensitive information, leading to record levels of attacks and disruptions. Criminals have been quick to exploit vulnerabilities, unleashing a variety of attacks ranging from malware and viruses to targeted social engineering and phishing attacks across industries.

Cybersecurity programmes should focus on identifying information assets and related cyber risks, applying protective controls, detecting and responding to security threats, and recovering from incidents.

Patient safety

Patient care continues to be the top risk on healthcare organisations’ risk registers. The impact of the pandemic, both on patient demand and the healthcare workforce, is putting huge pressure on services, which in turn is impacting patient care. Failures in patient safety can result in preventable death, high litigation costs, increased liability, and reputational damage to facilities and health systems.

The occurrence of adverse events due to unsafe care is likely one of the top 10 causes of death and disability worldwide. According to the , it is estimated that one in every 10 patients in high-income countries is harmed while receiving hospital care. This harm can be caused by a range of adverse events, nearly 50% of which are preventable. Investing in reducing patient harm can lead to significant financial savings and, more importantly, better patient outcomes.

Business continuity and disaster recovery

Healthcare institutions have to operate in an increasingly dynamic and uncertain environment, where their reputational value is closely aligned to how they respond to disruption. Whether it be cyber threats, political and regulatory change or disruptive innovation, healthcare institutions need to navigate shocks, high-impact events, and change. Experience shows that over 50% of organisations without an effective business continuity plan will ultimately fail in the event of an incident. To avoid this, healthcare institutions need to plan and prepare for a diverse set of strategic, operational and technology risks.

Supply chain disruption

Healthcare organisations rely on third parties to deliver critical services, which can increase business exposures. Third-party vendors often have access to critical systems, including patient data, and even direct access to patients. As a result, compliance, patient safety, and regulatory risks can be greatly magnified. Failure by third parties to comply with relevant laws and regulations can have lasting and damaging negative financial, legal, and reputational impacts.

Advanced technologies

Healthcare organisations are increasingly using AI, blockchain, robotic process automation, machine learning, and other technologies to help diagnose illnesses, provide value-based patient care and improve the revenue cycle. This trend is expected to accelerate, with diagnoses and treatment being increasingly based on technological and scientific advancements, including digital therapeutics, epigenetics and the metaverse. The implementation of AI, nanotechnology, quantum computing and fifth-generation technologies will enable faster, customised diagnostics and more personalised patient care pathways. However, risks introduced by new technologies are often overlooked in favour of focusing on the rewards they promise. New technologies, when not sufficiently tested or understood, can pose risks to data quality, data security, user access, confidence in results, return on investment, and human oversight, among others.

Interoperability and future technologies

Radical data interoperability is a required foundational capability to enable healthcare providers and other stakeholders to deliver patient-centric programs, solutions and associated technologies. If implemented efficiently, it can help elevate care delivery, co-production and patient empowerment, while providing a return on investment. However, many technologies and applications still do not (and cannot) broadly exchange data across various organisations and technology platforms, making healthcare records easily available to patients and providers. This can lead to poor patient outcomes.

The need for proper governance and control

Changes to the UK Corporate Governance Code, while directly impacting premium-listed businesses and those voluntarily applying the code, provide a good opportunity for all organisations to assess their internal control systems and processes, and implement best practice to manage and mitigate the significant risks impacting the sector. The Code requires those organisations to assess their material controls and confirm they have robust processes in place. It is best practice for all organisations to assess their material controls and ensure they have robust assurance of their operability in a time of significant change, challenge, and risk.