Advancing IT at Nonprofit Hospitals Despite Budget Constraints

Nobody doubts that nonprofit hospitals play a crucial role in the healthcare system and provide numerous benefits to the communities they serve. Guided by a mission to serve the community rather than generate profits, these hospitals frequently provide free or reduced-cost care to underserved populations, ensuring that even those without insurance or the ability to pay receive necessary medical services.

This is a worthy, important, and critical mission—but one that nonprofit hospitals struggle to enact due to many external pressures. They are simply asked to do so much, with so few resources, that it brings many to the breaking point. There are about 2.5 nonprofit hospitals for every for-profit hospital in the United States, and so nonprofit hospitals provide a disproportionate amount of patient care while also often asked to do more for their communities than for-profit hospitals.

Some major economic factors impacting nonprofit hospitals include:

Expenses exceeding revenue: Healthcare expenses continue to increase for goods and services (such as pharmaceuticals and medical supplies)—especially during the last few years of high inflation. Uncertainty in the economy and with health insurance means more patients use Medicaid and public insurance options while often not paying bills on time. Patient care for nonprofit hospitals has consistently struggled to remain profitable.
Hospitals still reeling from the pandemic: The pandemic hit nonprofit hospitals hard on multiple levels. It strained staff and drove many workers out of the industry, flooded hospitals with patients from underserved communities who are slower to reimburse, and delayed more profitable patient care and procedures. Hospitals are still catching up.
Competition from for-profit hospitals and non-traditional players: For-profit hospitals are good at marketing and selling more profitable services while other non-traditional players such as Walmart, Walgreens, CVS, and Amazon continually innovate and gain customers for healthcare services that nonprofit hospitals previously provided. There has also been a massive shift in the ratio of patient care to outpatient and ambulatory care—with less demand for patient care services hurting nonprofit hospitals.

What's Inside this Critical IT Strategies Guide?

1

Why Budget Constraints Disproportionally Affect Nonprofit Hospitals

View
2

How Nonprofit Hospital Budget Constraints Impact IT

View
3

How Nonprofit Hospitals Can Put Effective IT and Cybersecurity Strategies into Place

View

Short on Time? Download the PDF ⬇️

You have likely historically underinvested in IT.

Budget constraints often force nonprofit hospitals to rely on outdated or legacy IT systems that are less efficient, harder to maintain, and more vulnerable to security risks. Limited funds mean that essential upgrades to hardware, software, and network infrastructure are often postponed, leading to performance issues and potential compatibility problems with newer technologies.

This is a significant problem because, despite a lack of budget to modernize hardware, you introduce greater risks such as systems crashing, dying, or malfunctioning in ways that affect patient care.

You likely have significant cybersecurity and compliance risks.

Healthcare organizations are frequently targeted by cyberattackers, as they are seen as good ransomware targets and keepers of protected health information (PHI) that can be sold for a high price on the dark web. If a hospital is hit by a cyberattack, lives are on the line, patient care is jeopardized, and reputation can be seriously damaged.

According to a BMC Medical Informatics and Decision Making article:

“Cyberattacks can threaten a wide variety of services within a hospital, from surgeries to drug delivery, by targeting advanced equipment such as blood-product refrigerators, imaging equipment, automated drug dispensers and electronic health records, as well as by targeting supporting critical systems such as heating, ventilation, and air conditioning (HVAC). When EHR integrity is compromised, or they are suddenly encrypted in an attack, such as ransomware, providers lose access to critical information (e.g., patient allergies, current medications, and comorbidities).”

Tight budgets can result in insufficient investment in cybersecurity tools and personnel, making nonprofit hospitals more vulnerable to cyberattacks, data breaches, and other security incidents. Maintaining compliance with regulations like HIPAA also requires ongoing investment in security and privacy measures. Budget constraints can make it difficult to meet these standards, increasing the risk of penalties and reputational damage.

Technology is often the source of patient care disruptions and operational bottlenecks.

Inefficient IT systems can lead to delays in patient care, errors in medical records, and overall reduced quality of service, directly impacting patient outcomes and satisfaction. Slow, outdated IT systems can create operational inefficiencies, leading to longer wait times, increased administrative burdens, and higher operational costs.

You likely have an understaffed IT department.

Nonprofit hospitals often struggle to afford competitive salaries, leading to understaffed IT departments. This can result in overworked staff, slower response times, and a “keeping afloat” mentality where your team is only mostly able to put out fires rather than proactively manage and support IT systems.

As a result, routine maintenance tasks such as patch management, system updates, and hardware replacement may be neglected, leading to increased downtime and higher long-term costs due to system failures. Limited budgets can also restrict the ability to hire specialized IT staff or invest in ongoing training and development, leaving your hospital without the expertise needed to handle complex IT challenges.

You do not plan for long-term technology and cybersecurity needs.

Budget constraints can make it difficult for nonprofit hospitals to develop and implement comprehensive strategic IT plans, leading to short-term, reactive decision-making rather than proactive, strategic investments. This short-term planning approach may result in using break/fix vendors, investing only when a major disruption occurs, and failing to make a sound business case to decision makers during the budgeting process.

---
Budget constraints can have far-reaching effects on the IT capabilities of nonprofit hospitals, impacting everything from system performance and security to patient care and operational efficiency. To mitigate these challenges, nonprofit hospitals need to prioritize their IT investments carefully.

How Nonprofit Hospitals Can Work Around Budget Constraints To Put Effective IT and Cybersecurity Strategies Into Place

So, understanding the issues you face, how do you tackle these serious IT and cybersecurity problems?

Not all at once. And not with expensive hardware, application, and tool purchases that you can’t afford and that make decision makers skeptical.

Certain high-impact areas require a low investment of money and time. We’ve prioritized several strategies to implement or improve that can help you work around budget constraints and ensure that effective IT and cybersecurity measures are in place.

1. Improve your proactive maintenance and monitoring.

Leverage network monitoring tools to proactively detect and respond to potential security threats. Activities should include:

Continuously checking the status of network components such as routers, switches, firewalls, servers, and other devices.
Measuring metrics like bandwidth usage, latency, packet loss, and error rates.
Setting up alerts to notify you about potential issues or anomalies in the network.
Logging network activity and performance data for analysis and troubleshooting.
Identifying and diagnosing network problems to minimize downtime and improve performance.

Proactive maintenance and monitoring helps reduce the likelihood of ongoing fires and alerts you to problems before they become disruptions.

2. Regularly patch your software.

It’s very important to ensure that all systems and software are regularly updated and patched to protect against vulnerabilities. The overwhelming majority of cyberattacks exploit known vulnerabilities for which patches have existed for many months. Don’t make it easy for cyberattackers to breach your systems.

3. Use Endpoint Detection and Response (EDR).

EDR should be deployed at your hospital. Period. This tool not only prevents most incoming attacks from succeeding but also detects anomalous behavior that may be a sign of a cyberattacker who has breached your systems. Once the cyberattacker is detected, you can then take action to remediate the breach—long before the bad actor deploys ransomware or steals data.

4. Implement multi-factor authentication (MFA), comprehensive access controls, and strong password policies.

This is one of those areas that will drastically improve your cybersecurity for a very minimal cost. In most cases, you are just configuring settings, establishing policies, and enforcing best practices.

MFA has become a standard requirement because it can stop so many cyberattacks. For example, 99.9% of account compromise attacks can be blocked by MFA. There is no excuse not to implement it across your systems and applications.
Implement controls to restrict employee access to information based on job responsibilities. This includes using strong authentication methods, maintaining user account logs, and regularly reviewing and updating access permissions.
Enforce strong password policies, including the use of complex and unique passwords, regular password rotation, and the prohibition of password sharing.

5. Proactively protect your email.

95% of successful cybersecurity attacks start in an email, so it’s important to use enhanced tools that help protect email users from themselves. Your email security strategy should include advanced email filtering, anti-malware scanning, phishing protection, link/attachment sandboxing, and advanced encryption.

6. Enable strong web content filtering.

Many nefarious websites can easily fool employees. Before they know it, they’ve downloaded malware or given up user credentials. Web filtering capabilities block access to malicious or inappropriate websites, preventing users from accessing harmful content and helping to enforce acceptable use policies.

7. Inventory and consolidate systems.

While this takes some upfront work, especially if you haven’t performed an IT inventory in a while, the payoff for your budget can be immense. Consolidating redundant systems and applications will help you streamline operations and reduce maintenance costs.

When performing the inventory, record the details of each asset including its current location, status, user, and history of maintenance and repairs. Then, review the inventory to see if you have redundant servers, systems, and applications. Especially note where departments might waste money using separate assets that could be consolidated.

8. Leverage cloud services.

Purchasing and maintaining hardware often results in a high cost for nonprofit hospitals. Where you can, transition to cloud-based services in areas such as data storage, backup, and software applications. The cloud will help you reduce the costs of maintaining on-premises infrastructure.

9. Create incident response, disaster recovery, and business continuity plans.

A catastrophe can threaten the safety of patients, severely disrupt operations, and lead to financially ruinous costs as you recover from a major incident.

Hospitals with well-defined incident response plans are more likely to detect and respond to data breaches faster. A strong response plan includes predefined actions for data loss scenarios.
A comprehensive disaster recovery plan is essential for ensuring that your hospital can quickly and effectively respond to and recover from unexpected disruptions. It should include a risk assessment, operational impact analysis, recovery objectives, and the types of backups needed (such as local, remote, cloud, hybrid).
A comprehensive business continuity plan integrates the disaster recovery plan with additional plans for maintaining essential functions and services during a disaster. Ensure that all departments are involved in continuity planning and understand their roles in maintaining operations during a crisis.

10. Engage in strategic planning and prioritization.

Develop a comprehensive strategic IT plan that aligns with your hospital’s goals and prioritizes critical IT and cybersecurity investments. As part of this strategic planning, it’s important to centralize IT budgeting. Without centralized oversight, different departments may duplicate efforts by purchasing similar software or hardware solutions. This redundancy can result in higher costs and inefficient resource allocation.

You can also implement IT and cybersecurity improvements in phases to spread costs over time and align with budget cycles. In some cases, consider starting with pilot programs to test new technologies and approaches on a smaller scale before full-scale implementation.

Ongoing, you want to regularly review IT strategies and performance to identify areas for improvement and ensure alignment with your hospital’s changing needs and budget constraints. Establish feedback mechanisms to gather input from staff and stakeholders on IT effectiveness and areas for enhancement.

11. Invest in staff training and awareness.

Regularly train staff on cybersecurity best practices and awareness to reduce the risk of human error and improve overall security posture. Security awareness training is rather low-cost nowadays—with flexible online video training, phishing simulations, and reporting. Also encourage IT staff to obtain certifications in cybersecurity and IT management to enhance their skills and knowledge.

12. Partner with a managed service provider (MSP).

MSPs offer comprehensive IT and cybersecurity services, allowing your hospital to benefit from expert support without the expense of a full in-house team. Or, you can use a co-managed model where internal IT staff work alongside MSPs to maximize resources and expertise.

---

By leveraging these strategies, nonprofit hospitals can enhance their IT and cybersecurity capabilities despite budget constraints, ensuring they can protect patient data, maintain operational efficiency, and deliver high-quality care.

🔎 Related: Co-Managed IT Buyer's Guide

Running the operations of a nonprofit hospital can sometimes feel like a thankless task. You’re asked to do so much with so little resources. Economic factors weigh against you. The pandemic left you stunned. And more competitive healthcare options exist than ever before.

Such challenges mean budget restraints from strained resources, slow reimbursement, and understaffing—especially post-pandemic. Relying on donations and grants isn’t a sure bet. And since many nonprofit hospitals are located in areas with population stagnation or exodus, you’re just not getting that revenue.

So, you struggle with outdated and legacy IT systems. You hope a cybersecurity vulnerability doesn’t lead to a data breach or compliance fine. You ride out yet another operational disruption caused by technology. And planning? You’re just trying to get through the day.

Despite significant challenges, we hope that our distilled suggestions help you stabilize and turn around your IT—step by step. In many cases, these suggestions are a reminder of what you already know—but it’s good to reinforce how essential these items are, even when you’re facing budget restraints.

Your checklist to effective IT & cybersecurity:

Improve your proactive maintenance and monitoring.

Regularly patch your software.

Use Endpoint Detection and Response (EDR).

Implement multi-factor authentication (MFA), comprehensive access controls, and strong password policies.

Proactively protect your email.

Enable strong web content filtering.

Inventory and consolidate systems.

Leverage cloud services.

Create incident response, disaster recovery, and business continuity plans.

Engage in strategic planning and prioritization.

Invest in staff training and awareness.

Partner with a managed service provider (MSP).

We Make IT Easy

Municipal Disaster Recovery Checklist

Municipal League Partnerships

2024 Managed IT Services Cost & Pricing Guide

A Guide to Advancing IT at Nonprofit Hospitals Despite Budget Constraints