Nonprofit hospitals are focused on risk management as a crucial variable in financial analyses and an increasingly important credit strength, Moody’s Investors Service says in a new report.

The report, “Not-for-Profit and Public Healthcare — U.S.: Risk Management Crucial to Success Amid Changing Healthcare Landscape,” says key areas of risk management include new IT and cybersecurity systems, clinical quality and brand protection, balance sheet health, and reimbursement.

Moody’s gives the industry a poor grade overall in preventing and adequately responding to cyberattacks. Hospitals aren’t spending enough of their budget on IT security but are beginning to dedicate more resources, the report says.

Accounting for roughly 25-35% of a hospital’s overall capital budget, IT systems provide benefits in customer service and patient outcomes as well as potential hazards with cost overruns. Risk can arise during installation, optimization, and maintenance, while the launch might result in a temporary spike in expenses, the report notes. Guarding against cyberattacks is another area of concern.

Moody’s says a hospital’s ability to improve quality of care and the patient experience will increasingly affect its financial performance. Strategies to maintain high clinical quality involve recruiting and retaining top physician and nursing staff as well as investing in clinical technology and IT integration, Moody’s Vice President Brad Spielman said in a statement announcing the report.

“The relationship between quality of care and operating margins is increasingly linked. The perception of poor quality or management can have a lasting negative impact on an organization’s brand and patient demand, and adversely affect profitability,” he said.

A healthy balance sheet provides a hospital with a buffer against unexpected liquidity demands and is a strong measure to credit quality, the report says, and there has been a general strengthening of balance sheets in recent years, with median days cash on hand for Moody’s-rated portfolio increasing to 212 in 2015 from 164 days in 2010. In 2015, median days cash on hand for Aa-rated credits was 277, while the median for Baa-rated credits was 161.

Hospitals also face financial risk with the Affordable Care Act’s shift toward pay-for-performance reimbursement models associated with patient outcomes. Hospitals will have to take on more risks by building in-house capabilities to manage them, the report says. The risks are inherent with both traditional insurers and the growing number of plans owned by hospitals, it says.

The report is available online at: