Gabrielle Russon
AdventHealth got caught up in another company’s hack that cost the Altamonte Springs-headquartered hospital system about $430,000, according to a new federal lawsuit.
RxCrossroads is a Texas-based company that determines patient copay prescription reimbursements from drug manufacturers and then sends the money to pharmacies, like AdventHealth. And in turn, RxCrossroads uses Payspan to help process those payments.
The problem began, AdventHealth contends in the lawsuit, when the hospital system realized $429,319 in patient copay reimbursements had been missing since January 2021.
“In June 2021, Payspan notified AdventHealth of suspicious activity associated with the patient copay reimbursements owed to AdventHealth under RxCrossroads’s Programs. Specifically, a fraudulent third party accessed Payspan’s system, created a new AdventHealth account using a generic email address, and then electronically signed a Payspan contract associated with AdventHealth’s payment processing,” the lawsuit said.
Whoever committed the scheme set up a fake account in the name of AdventHealth Chief Financial Officer Paul Rathbun so the real AdventHealth never got the money, court documents said.
AdventHealth called the fraud “amateur in nature and easily detectable. Neither RxCrossroads nor Payspan detected or prevented it.”
AdventHealth contacted RxCrossroads and Payspan to demand the missing payments, according to a November 2021 letter written by AdventHealth Executive Vice President and Chief Law Officer Jeffrey Bromme that was filed with the lawsuit.
AdventHealth and RxCrossroads did not respond to requests for comment Monday.
Similar fraud schemes have popped up over the years, according to lawsuits and law-enforcement records.
Precision Turf, a Georgia business that installs turf fields, was hired by Orlando City Soccer Club to do some work in 2019. Orlando Soccer’s Training Facility Operations Manager received emails from a hacker, so he wired Precision’s $191,012 payment to a different bank account as requested. Precision didn’t get the money, Precision said in a federal lawsuit filed in 2020 that was ultimately dismissed.
At Disney World’s government, a Reedy Creek Improvement District employee mistakenly thought she was receiving emails from a real landscaping company and paid out nearly $722,000 in 2018. Reedy Creek recovered all the money except for about $94,000, according to the Orlando Sentinel.
“Business email compromise — also known as email account compromise — is one of the most financially damaging online crimes,” according to the FBI. “It exploits the fact that so many of us rely on email to conduct business — both personal and professional.”
