How healthcare leaders can mitigate concentration risk

Depending on a single system or process to complete a critical task or keep operations running smoothly can lead healthcare organizations to have high levels of concentration risk, Forrester researchers warned in a trends report. When that system or process no longer functions, healthcare organizations could be left scrambling to regain control of critical systems or adjust to changes in market conditions.

The report highlighted several common dependencies throughout the healthcare ecosystem that can lead organizations to have single points of failure and offered mitigation strategies for each, ranging from workforce shortages to AI risks.

"Healthcare organizations are increasingly operating under a perpetual heightened state of alert due to a nonstop barrage of risk events, seemingly from every direction," the report stated.

"A leading cause of the mayhem is concentration risk -- one of the top systemic risks -- the equivalent to putting all of your eggs in one basket. Consequences occur when extreme dependencies within a business, operating, or commercial model create a single point of failure that cascades throughout an organization, sector, or region -- or on a global scale."

For example, Forrester researchers suggested that the consolidation of assets that results from healthcare mergers and acquisitions could limit a patient's access to care, as well as the organization's ability to handle a crisis.

Additionally, the report highlighted "dangerous" levels of dependence on outsourcing, which increases third-party risk and can result in inconsistencies when it comes to standards of care and patient and employee satisfaction.

The report identified five specific areas in which healthcare organizations should look for concentration risk now to avoid single points of failure in the event of a crisis.

First, researchers pointed to labor concentration and skilled staff shortages as a potential concentration risk area. An imbalance in supply and demand of skills can create disruptions, especially as more physicians retire, taking essential skills and knowledge with them.

To mitigate this risk, the report suggested prioritizing workplace flexibility and knowledge transfer to remain adaptable amid staffing shortages.

"This includes developing an adaptive workforce capable of scaling and shifting based on need, utilizing float pools, leveraging per diem workers and staffing partnerships, and expanding telehealth services for more flexible working conditions," the report said.

Second, researchers identified the concentration of technology as a barrier to resilience. The report noted that reliance on just one or two key technology vendors can create a single point of failure that can ripple through the healthcare ecosystem. The sector saw this scenario play out in February 2024, when the Change Healthcare cyberattack left providers unable to file claims for multiple weeks.

Forrester researchers recommended focusing on resilience, rather than compliance, to mitigate concentration risk in this area. Organizations should consider taking inventory of all third parties and contracts and maintaining awareness of vendor mergers and acquisitions among technology vendors.

Third, the report pointed out concentration in AI-based decision-making, citing litigation against major healthcare companies that are facing scrutiny for using faulty AI algorithms to process prior authorizations. Mitigating this risk requires organizations to balance the speed and innovation of AI with risk management.

Next, the report highlighted the ongoing challenge of algorithmic bias in medicine and clinical research, which can have negative effects on diagnoses and care. Ensuring that datasets are diverse is crucial to mitigate racial bias in clinical trials, researchers suggested. Specifically, the report recommended engaging in implicit bias training, engaging with underrepresented communities and using real-world data.

Lastly, the report emphasized the concentration risk that naturally comes with monopolies and oligopolies in healthcare. For example, just three vendors own more than 95% of the global market share for blood glucose monitoring, the report noted. The primary mitigation for this risk area is to identify dependencies and single points of failure tied to these monopolies.

Overall, identifying areas of concentration risk and evaluating the potential effects of these risks is a crucial step in reducing them.

"Don't stop looking for concentration risk after tracking the common sources," the report stated. "Only by understanding your organization's mission, identifying existing single points of failure, and thoroughly assessing their impact on the business will you uncover all of your latent sources of concentration risk."

Jill McKeon has covered healthcare cybersecurity and privacy news since 2021.