Telehealth Nurse Roles

There’s been a lot of discussion this week about the value of RPM programs that manage chronic disease using CPT codes. I’ve been surprised to see deep skepticism from digital health entrepreneurs I respect like TJ Parker, Christopher McGhee, Grant Hesser, Nikhil Krishnan and others. At Cadence, we partner with leading health systems to deliver high-quality RPM for both fee-for-service and at-risk populations. As one of the largest platforms in the US, supporting over 70,000 patients, we’ve learned what drives real outcomes: + 24/7 dedicated clinical team (MDs, NPs, RNs, etc.) able to prescribe medications, order labs, and triage urgent issues + Deep EMR integration enabling seamless coordination between virtual teams, PCPs, and specialists + AI-assisted proactive care model that continuously compares medications, labs, vitals, and health records to clinical guidelines These fundamentals have produced dramatically better outcomes: 27% reduction in hospitalizations, 13% reduction in total cost of care, and improved primary care capacity across many of the country’s largest health systems. Our results are peer-reviewed in leading journals, which detail exactly how our model works, from medication titration to AI design to team structure: – JACC: https://lnkd.in/gJtg8ptD – NEJM Catalyst: https://lnkd.in/g9amrHab – AHA: https://lnkd.in/gwN_6f6c (presentation of pre-published data) In my view, the key question isn’t whether RPM can work, it’s how we set the right policies to reward high-quality RPM and eliminate bad actors. If we’re serious about bending the cost curve today, the solutions must also deliver on value in a fee-for-service model. We have proven this at scale.

𝗦𝗣𝗔𝗡, 𝗥𝗦𝗣𝗔𝗡 𝗮𝗻𝗱 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝘁𝗮𝗽𝘀 All three can feed traffic to a monitoring tool. They do not provide the same level of visibility confidence. ▪️ 𝗦𝗣𝗔𝗡 𝗽𝗼𝗿𝘁 SPAN creates a switch-based copy of selected local traffic. It is convenient and inexpensive, but the mirrored copy depends on: ✓ Switch resources ✓ Destination-port bandwidth ✓ Correct SPAN configuration ✓ Traffic volume and oversubscription Under load, mirrored packets may be dropped. The monitoring tool may also observe altered timing or packet order. ▪️ 𝗥𝗦𝗣𝗔𝗡 RSPAN—Cisco’s term for Remote SPAN—transports mirrored traffic across an RSPAN VLAN to another switch. It extends monitoring reach, but also adds dependence on: ✓ The transit switching path ✓ VLAN configuration ✓ Available bandwidth ✓ Every intermediate device RSPAN inherits the limitations of SPAN and introduces more configuration complexity. ▪️ 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 𝘁𝗮𝗽 A network tap creates a dedicated hardware copy of traffic independently of the switch’s SPAN configuration. It generally provides more faithful passive visibility and is often preferred at critical OT monitoring points. Some tap designs are fail-open, but this depends on the specific device and architecture. 𝗖𝗼𝗿𝗲 𝗰𝗼𝗻𝗰𝗲𝗽𝘁 𝗦𝗣𝗔𝗡 mirrors locally through switch resources. 𝗥𝗦𝗣𝗔𝗡 transports that mirrored traffic across a switching path. 𝗔 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝘁𝗮𝗽 creates a dedicated hardware copy. For convenient monitoring, SPAN may be sufficient. For high-confidence OT detection and incident investigation, a correctly designed tap architecture is usually the stronger choice. #OTSecurity #NetworkMonitoring #NetworkTap #SPAN #RSPAN #IndustrialCybersecurity

Key Insights from Michigan’s Remote Patient Monitoring (RPM) Pilot Program An 18-month RPM pilot program in Michigan has published ways to improve healthcare access and outcomes for rural communities, particularly residents aged 65 and older. A key factor in the program's success was the pivotal role of primary care providers in identifying eligible patients and ensuring their adherence to the RPM program. Highlights: Role of Primary Care: Primary care providers identified eligible patients, ensuring consistent engagement with RPM tools. Their guidance resulted in an 85% adherence rate among participants, showing the power of trusted relationships in technology adoption. Improved Health Outcomes: Chronic condition management for over 300 patients with hypertension, diabetes, and congestive heart failure showed significant improvements. Patients were monitored remotely, reducing ER visits and hospitalizations. Increased Accessibility: With RPM, patients saved an average of 4 hours per visit and reduced travel costs by up to $150 per month, addressing barriers to frequent in-person care for rural residents. This pilot demonstrates how RPM, supported by proactive primary care, can create more equitable and effective healthcare systems in underserved areas. Full article in comments.

𝐑𝐞𝐯𝐨𝐥𝐮𝐭𝐢𝐨𝐧𝐢𝐳𝐢𝐧𝐠 𝐇𝐞𝐚𝐫𝐭 𝐅𝐚𝐢𝐥𝐮𝐫𝐞 𝐂𝐚𝐫𝐞: 𝐓𝐡𝐞 𝐈𝐦𝐩𝐚𝐜𝐭 𝐨𝐟 𝐑𝐞𝐦𝐨𝐭𝐞 𝐌𝐨𝐧𝐢𝐭𝐨𝐫𝐢𝐧𝐠 🏥❤️📊 As we continually strive to enhance patient outcomes and operational efficiency, remote monitoring for heart failure patients has emerged as a game-changer. Let's explore how this technology is transforming care delivery and improving lives. 𝐊𝐞𝐲 𝐁𝐞𝐧𝐞𝐟𝐢𝐭𝐬 𝐨𝐟 𝐑𝐞𝐦𝐨𝐭𝐞 𝐌𝐨𝐧𝐢𝐭𝐨𝐫𝐢𝐧𝐠 𝐢𝐧 𝐇𝐞𝐚𝐫𝐭 𝐅𝐚𝐢𝐥𝐮𝐫𝐞 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭: 𝟏. 𝐑𝐞𝐝𝐮𝐜𝐞𝐝 𝐑𝐞𝐚𝐝𝐦𝐢𝐬𝐬𝐢𝐨𝐧𝐬 📉 Early detection of deterioration allows for timely interventions, significantly reducing unnecessary hospitalizations. 𝟐. 𝐎𝐩𝐭𝐢𝐦𝐢𝐳𝐞𝐝 𝐑𝐞𝐬𝐨𝐮𝐫𝐜𝐞 𝐀𝐥𝐥𝐨𝐜𝐚𝐭𝐢𝐨𝐧 📊 By prioritizing patients based on real-time data, we can better manage our time and resources. 𝟑. 𝐈𝐦𝐩𝐫𝐨𝐯𝐞𝐝 𝐌𝐞𝐝𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 💊 Remote data enables more precise titration of medications, enhancing treatment efficacy. 𝟒. 𝐄𝐧𝐡𝐚𝐧𝐜𝐞𝐝 𝐏𝐚𝐭𝐢𝐞𝐧𝐭 𝐄𝐧𝐠𝐚𝐠𝐞𝐦𝐞𝐧𝐭 🤝 Patients become active participants in their care, leading to better adherence and outcomes. 𝟓. 𝐃𝐚𝐭𝐚-𝐃𝐫𝐢𝐯𝐞𝐧 𝐃𝐞𝐜𝐢𝐬𝐢𝐨𝐧 𝐌𝐚𝐤𝐢𝐧𝐠 📈 Continuous monitoring provides a wealth of data for more informed clinical decisions. 𝟔. 𝐒𝐭𝐫𝐞𝐚𝐦𝐥𝐢𝐧𝐞𝐝 𝐖𝐨𝐫𝐤𝐟𝐥𝐨𝐰 🔄 Automated alerts and data integration can significantly reduce administrative burden. 𝟕. 𝐄𝐱𝐭𝐞𝐧𝐝𝐞𝐝 𝐑𝐞𝐚𝐜𝐡 𝐨𝐟 𝐂𝐚𝐫𝐞 🌍 Particularly beneficial for rural or mobility-impaired patients, expanding our care beyond physical boundaries. Implementing remote monitoring isn't just about technology; it's about reimagining care delivery. It allows us to shift from reactive to proactive care models, potentially reducing costs while improving patient outcomes. 𝐓𝐡𝐞 𝐅𝐮𝐭𝐮𝐫𝐞 𝐨𝐟 𝐂𝐚𝐫𝐝𝐢𝐨𝐥𝐨𝐠𝐲: As we move towards value-based care, remote monitoring will play a crucial role in managing chronic conditions like heart failure more effectively and efficiently. 𝐐𝐮𝐞𝐬𝐭𝐢𝐨𝐧𝐬 𝐟𝐨𝐫 𝐂𝐨𝐧𝐬𝐢𝐝𝐞𝐫𝐚𝐭𝐢𝐨𝐧: - How has your organization implemented remote monitoring? - What challenges have you faced in adoption? - What outcomes have you observed? Let's discuss how we can leverage this technology to elevate our standard of care. Share your experiences and insights below. #HeartFailureManagement #RemotePatientMonitoring #HealthcareInnovation #CardiacCare #TeleHealth #ValueBasedCare #HealthTech #DigitalTransformation Interested in implementing or optimizing remote monitoring in your practice? Let's connect and explore strategies tailored to your organization's needs.

Day 48: Hunting Lateral Movement via SMB & Remote Services 🚀 🔍 Adversaries use lateral movement techniques to spread across networks, escalate privileges, and exfiltrate data. SMB, WMI, and RDP are commonly abused protocols for this purpose. Today, let's explore detection strategies! --- 🛠️ Why Is Lateral Movement Dangerous? ✅ Expands attacker access – Enables adversaries to compromise multiple systems. ✅ Blends with normal traffic – Hard to distinguish from legitimate administrative activity. ✅ Privilege escalation – Attackers often seek high-privileged accounts. ✅ Can lead to ransomware deployment – Many attacks use lateral movement before execution. --- 🚨 Common Tactics & Techniques (MITRE ATT&CK - T1021, T1077, T1569.002) 1️⃣ SMB Lateral Movement (PsExec, C$ Drive Access) psexec \\target_system -u Admin -p password cmd.exe 📌 Attackers use SMB (Server Message Block) to execute commands remotely. 2️⃣ WMI-Based Execution (Remote Command Execution via WMI) wmic /node:"target_host" process call create "malicious.exe" 📌 Adversaries use WMI for stealthy, fileless execution. 3️⃣ RDP Hijacking (Remote Desktop Abuse) mstsc /v:target_host /restrictedadmin 📌 Attackers leverage RDP to move laterally while evading detection. --- 🔎 Threat Hunting Queries for Lateral Movement 1️⃣ Detecting Suspicious SMB Traffic (Lateral Movement via PsExec & C$ Drive) | where EventID == 5140 // Windows Security Log for SMB file access | where ShareName contains "C$" or "ADMIN$" | where AccountName != "Expected_Admin_Accounts" ✅ Response: Investigate unauthorized file shares accessed remotely. 2️⃣ Detecting WMI-Based Lateral Movement Sysmon | where EventID == 1 | where ProcessName == "wmic.exe" | where CommandLine contains "process call create" ✅ Response: Flag remote process execution attempts via WMI. 3️⃣ Monitoring RDP Connections from Unusual Hosts | where EventID == 4624 | where LogonType == 10 or LogonType == 7 | where SourceIP not in ("whitelisted_admin_IPs") ✅ Response: Investigate unexpected RDP logins, especially from external IPs. 4️⃣ Detecting Lateral Movement via Service Creation Sysmon | where EventID == 7045 | where ServiceName contains "MaliciousPattern" ✅ Response: Identify suspicious services created remotely. --- 🛡️ Best Practices for Defending Against Lateral Movement ✔ Restrict administrative privileges & limit SMB access. ✔ Monitor event logs & Sysmon for remote execution activity. ✔ Enforce network segmentation to prevent unnecessary lateral movement. ✔ Enable RDP logging and use MFA for remote access. --- 🎯 Key Takeaways for SOC Analysts 🔹 Lateral movement is a key phase in targeted attacks & ransomware campaigns. 🔹 Monitoring SMB, WMI, and RDP activity helps detect stealthy adversaries. 🔹 Threat hunting & proactive defense strategies reduce the attack surface. #CyberSecurity #ThreatHunting #LateralMovement #SOC #WindowsSecurity

ICH GCP E6(R3) Has Arrived - 7 Changes That Will Redefine Trial Oversight. E6(R3) is here in Europe and it's not just a regulatory update, it's reshaping how we handle clinical trials. It's a shift in how we design, run, and oversee trials. Risk-based quality management is no longer optional, it's mandatory. Here's what it really means for Clinops and Quality Managers in practice: 1. Quality by Design (QbD) Regulators expect quality to be built in from the protocol stage. Example: Instead of collecting 20 secondary endpoints "just in case," focus on what truly matters for patient safety and primary efficacy. This is supposed to avoid overcomplicated protocols. 2. Risk-Based Quality Management (RBQM) Risk logs aren't a paper exercise anymore, they're central to trial conduct. Risk identification is systematic. Critical process monitoring is continuous. Issue management is proactive Example: If data entry delays are identified as a risk, you don't wait. You set up dashboards, review KPIs weekly, and escalate if sites fall behind. 3. Investigator Responsibilities No more "PI signed but never saw." E6(R3) makes PI oversight non-negotiable. Under R3, sponsors must prove Pls are truly engaged. 4. Technology &Decentralization Remote monitoring, eConsent, eSource, all welcome, but quality must be equivalent. - Electronic systems must be validated. Data integrity requirements are stricter. Remote monitoring is officially recognized Example: If you use eConsent, regulators will expect audit trails of patient questions, re-consent versions, and proof the process was validated. 5. Sponsor Oversight of CROs/Vendors Delegation abdication. Sponsors remain accountable. Example: You'll need minutes of governance meetings, KPI reports, and proof you challenged underperformance, not just accepted it. 6. Data Governance Data integrity is now end-to-end. It's not enough to lock the DB on time. 7. Lifecycle Documentation (TMF/eTMF) "Final TMF cleanup" is over. Inspectors expect the TMF to be inspection-ready at any time. R3 requires evidence you actively monitored completeness during the study. The Big Picture: E6(R3) isn't about more paperwork. It's about living oversight: proactivenot reactive, risk-driven, and documented in real time. Our role just became more strategic: We're not "checking compliance", we're designing trials that deliver real-world quality. Will you embrace these changes as opportunities for improvement, or see them as regulatory burden? #ICHGCP #E6R3 #ClinicalTrials #ClinOps #QualityManagement #RBQM #Clinicalresearch #InspectionReadiness #ClinicalOperations

We built healthcare around acute care - and then tried to make it work for chronic disease. It doesn't. If we were starting over, we'd build it like this: - Remote patient care as the default model for chronic conditions - Office visits reserved for when you can't manage things at home - A community of health wrapped around every patient: coaching, education, behavior change, care coordination, caregiver engagement That's exactly what we're building at Cadence. Health systems are purpose built for in-person care in their brick-and-mortar assets. Cadence is purpose-built for what happens in between. When we partner and deeply integrate our capabilities, we become something neither of us could be alone: a care delivery system without walls. I talked about this with Zeev Neuwirth, MD this week on his podcast, Creating a New Healthcare, including what that kind of partnership actually looks like in practice and why it's the model that scales. Worth a listen if you're thinking about where care delivery is headed. → https://lnkd.in/gyQi6Jqa #DigitalHealth #ChronicDisease #RemotePatientMonitoring #Cadence

𝐇𝐨𝐰 𝐰𝐨𝐮𝐥𝐝 𝐲𝐨𝐮 𝐭𝐚𝐜𝐤𝐥𝐞 𝐭𝐡𝐞 𝐬𝐢𝐭𝐮𝐚𝐭𝐢𝐨𝐧 𝐚𝐬 𝐚 𝐒𝐎𝐂 𝐚𝐧𝐚𝐥𝐲𝐬𝐭 𝐢𝐟 𝐲𝐨𝐮 𝐝𝐞𝐭𝐞𝐜𝐭𝐞𝐝 𝐑𝐃𝐏 𝐍𝐞𝐬𝐭𝐢𝐧𝐠? RDP Nesting is a common technique that attackers use, where they hop from one system to another through Remote Desktop Protocol (RDP) within a short time span. 𝐒𝐭𝐞𝐩 1: 𝐂𝐨𝐧𝐟𝐢𝐫𝐦 𝐓𝐫𝐮𝐞 𝐏𝐨𝐬𝐢𝐭𝐢𝐯𝐞 𝐨𝐫 𝐅𝐚𝐥𝐬𝐞 𝐏𝐨𝐬𝐢𝐭𝐢𝐯𝐞 >> Check Frequency: How common is this alert in your setup? IT teams often use RDP to manage systems in quick succession. >> Create a whitelist of known admin accounts and their typical RDP usage patterns. >> Maintenance and Scripts: Sometimes, automated scripts use RDP to update or configure multiple systems. >> Third-Party Vendors: External support might trigger these alerts as they access various systems for troubleshooting. >> Load Balancers: RDP sessions might be redirected, giving the appearance of nesting. >> Scanners and Assessments: Regular scans or assessments can mimic RDP nesting. Consider excluding authorized tools to reduce noise. 𝐒𝐭𝐞𝐩 2: 𝐂𝐨𝐧𝐟𝐢𝐫𝐦𝐞𝐝 𝐓𝐡𝐫𝐞𝐚𝐭? 𝐇𝐞𝐫𝐞’𝐬 𝐘𝐨𝐮𝐫 𝐏𝐥𝐚𝐧 >> Check for Data Exfiltration: Is there any sign of sensitive data being transferred or an unusual Command and Control (C2) connection? >> Understand the conditions that led to the offense being generated. >> Review SIEM Alerts: Look into alert details like source IP, destination IP, country of origin, and connection timing. >> Look for additional context, such as the typical behavior of the user account and the systems involved. >> Contact the users involved to see if the connections were legitimate or administrative. >> Check for any odd processes or file changes on the devices involved. >> Look for strange data transfers or unexpected connections. This could signal data exfiltration. Look for similar alerts it might show that this is part of a larger campaign. >> Compare the current alert/scenario with historical data to identify any anomalies. 𝐄𝐬𝐬𝐞𝐧𝐭𝐢𝐚𝐥 𝐋𝐨𝐠𝐬 𝐟𝐨𝐫 𝐑𝐃𝐏 𝐈𝐧𝐜𝐢𝐝𝐞𝐧𝐭 𝐈𝐧𝐯𝐞𝐬𝐭𝐢𝐠𝐚𝐭𝐢𝐨𝐧: >> Windows Event Logs: Look for specific event IDs like: 4624 - Successful logon 4625 - Failed logon 4648 - Logon with explicit credentials 4778 - Session reconnected >> Firewall Logs: Detect unusual RDP traffic patterns, especially over port 3389. >> IDS/IPS Logs: Keep an eye out for brute-force attempts or connections from suspicious IPs. >> EDR Logs: Endpoint Detection and Response logs provide detailed insights, including process creation and file changes. >> Authentication Logs: Multiple login attempts, especially from different locations or odd hours, can indicate compromised accounts. Feel free to share your thoughts—I’d love to hear them! #CyberSecurity #IncidentResponse #SOC #RDPNesting

Healthcare doesn’t fail because of a lack of treatment — it fails because problems are identified too late. Most healthcare systems are still built around episodic care: A visit. A complaint. A prescription. Repeat. But chronic conditions, senior care, post-acute recovery, and even preventive care don’t work that way. 👉 Early triage and continuous symptom reporting are where real impact happens. Modern healthcare software must enable: Proactive triage based on reported symptoms and risk signals Continuous symptom tracking instead of one-time snapshots Real-time reporting shared across care teams Seamless care coordination between providers, caregivers, and patients When symptoms are captured early and triaged intelligently: Care teams can intervene before escalation Hospitalizations can be avoided Outcomes improve Costs drop — without compromising quality This is how we move from reactive care to preventive, coordinated care — where the system works around the patient, not just the appointment. Healthcare software isn’t just about digitizing workflows. It’s about seeing the problem earlier than the crisis. #HealthcareIT #DigitalHealth #CareCoordination #Triage #RemoteMonitoring #ValueBasedCare #HealthTech #PreventiveCare

𝐇𝐨𝐰 𝐰𝐞 𝐟𝐢𝐱𝐞𝐝 𝐄𝐇𝐑 𝐝𝐚𝐭𝐚 𝐬𝐢𝐥𝐨𝐬 𝐟𝐨𝐫 𝐚 𝐑𝐞𝐦𝐨𝐭𝐞 𝐏𝐚𝐭𝐢𝐞𝐧𝐭 𝐌𝐨𝐧𝐢𝐭𝐨𝐫𝐢𝐧𝐠 𝐜𝐨𝐦𝐩𝐚𝐧𝐲 — 𝟑 𝐤𝐞𝐲 𝐥𝐞𝐬𝐬𝐨𝐧𝐬 Most healthcare teams don’t have a data problem. They have a fragmentation problem disguised as workflow inefficiency. We worked with a Remote Patient Monitoring (RPM) and Chronic Care Management (CCM) company managing multiple practices where: Nurses were spending 1–2 hours per patient just gathering data Care plans were manually built across spreadsheets + disconnected EMRs RPM billing was inconsistent, leaving revenue on the table No unified audit layer across practices Care decisions were delayed, not because data didn’t exist, but because it wasn’t operationally accessible across systems. 𝐖𝐡𝐚𝐭 𝐰𝐞 𝐚𝐜𝐭𝐮𝐚𝐥𝐥𝐲 𝐜𝐡𝐚𝐧𝐠𝐞𝐝 (𝐭𝐡𝐢𝐬 𝐢𝐬 𝐰𝐡𝐞𝐫𝐞 𝐦𝐨𝐬𝐭 𝐭𝐞𝐚𝐦𝐬 𝐟𝐚𝐢𝐥) We didn't just add AI. We rebuilt the clinical data infrastructure layer across practices. Unified fragmented systems (multiple EMRs, labs, RPM devices) via FHIR pipelines + unstructured ingestion Built a multi-tenant, centralized data layer to support multiple practices securely Designed scalable ETL pipelines for continuous patient data synchronization Layered RAG + Knowledge Graph augmentation for contextual reasoning across notes, labs, vitals 𝐈𝐧𝐭𝐫𝐨𝐝𝐮𝐜𝐞𝐝 𝐚𝐠𝐞𝐧𝐭𝐢𝐜 𝐰𝐨𝐫𝐤𝐟𝐥𝐨𝐰𝐬: Automated onboarding (doctor notes → structured patient profiles) AI care plan generation grounded in full patient context Real-time RPM alerts + health summaries CMS-compliant RPM/CCM billing automation This turned AI into an active operational system across clinics, not just a feature. 𝐎𝐮𝐭𝐜𝐨𝐦𝐞𝐬 20+ hours/week saved per care manager Scaled from 6,000 → 10,000+ patients in ~90 days Significant improvement in RPM/CCM billing accuracy Real-time monitoring → faster interventions → higher patient satisfaction Full HIPAA compliance + audit-ready multi-practice infrastructure This aligns with a consistent pattern in healthcare systems, real leverage comes from data orchestration, not just AI models 𝐋𝐞𝐬𝐬𝐨𝐧𝐬 𝐟𝐨𝐫 𝐇𝐞𝐚𝐥𝐭𝐡𝐜𝐚𝐫𝐞 𝐋𝐞𝐚𝐝𝐞𝐫𝐬 1. Multi-practice systems fail without tenant-aware data architecture. If each practice operates in isolation, your AI layer breaks instantly. 2. AI must operate on longitudinal patient data and not snapshots Care plans and alerts only work when models see the entire patient timeline. 3. Billing accuracy is a systems problem, not a staffing problem Tight coupling between patient data, workflows, and CMS logic is where revenue is recovered. We’re seeing this repeatedly: Healthcare companies that fix data + workflow orchestration across practices scale aggressively. Those that don’t stay stuck in operational chaos. If you’re running care programs across multiple practices and hitting data fragmentation, I’m open to a technical strategy discussion on how to fix this at the infrastructure level. #healthcare #ai #healthtech