Cybersecurity Saturday

David Ermer

I am an attorney who practices law in Washington DC. My practice has involved the Federal Employees Health Benefits Program since 1983.

Cybersecurity Saturday

David Ermer–Cybersecurity, Uncategorized–

From the ransomware front, Cybersecurity Dive reports

The prevalence and scope of ransomware exploded in 2021, as two-thirds of mid-sized organizations worldwide were targets and average ransom payouts saw a five-fold increase, according to the State of Ransomware 2022 report from Sophos released Wednesday. 

Ransomware hit 66% of mid-sized organizations last year, up from 37% in 2020. Average ransom payments reached $812,000 during 2021, compared with $170,000 the prior year.  

Among organizations with encrypted data, 46% paid a ransom to adversaries. In addition, 26% of organizations who were able to restore data from backups, still decided to pay a ransom.

To make matters even worse, Security Week informs us

As part of a recent cyberattack, threat actors deployed ransomware less than four hours after compromising the victim’s environment, according to researchers with The DFIR Report.

The attack started with an IcedID payload being deployed on a user endpoint and led to the execution of Quantum ransomware only three hours and 44 minutes later. DFIR Report researchers described it as one of the fastest ransomware attacks they have observed to date.

In a Ryuk ransomware attack in October 2020, the threat actors started encrypting the victim’s data only 29 hours after the initial breach, but the median global dwell time for ransomware is roughly 5 days, according to Mandiant’s M-Trends 2022 report.

Once the ransomware has been executed, however, the victim’s data may be encrypted within minutes. A recent report from Splunk shows that ransomware needs an average of 43 minutes to encrypt data, while the fastest encryption time is less than 6 minutes.

ZDNet describes how a single failure to patch a vulnerability opened the door to ransomware hackers. The article emphasizes the importantance of basic cybersecurity hygiene advice:

“The biggest lesson here is patch the network infrastructure – whatever is facing the internet, it’s always important for it to be fully patched,” said Daniel dos Santos, head of security research at Forescout. 

It’s also recommended that organisations monitor their networks for external access from known IP addresses or unusual patterns of behavior. In addition, businesses should backup their servers regularly. Then, if something happens, the network can be restored to a recent point without needing to pay a ransom. 

Perhaps then it is not surprising that a Security Week expert advises “it is important to increase an organization’s ransomware preparedness and assure that the tools needed for remediation, eradication, and recovery are not just in place but also functioning as expected. This is especially true for the recovery of endpoints, which represent an essential tool for remote workers to conduct their assigned business tasks in today’s work-from-anywhere environment.” 

As always and it may be every other week now, here is a link to Bleeping Computer’s The Week in Ransomware.

From the vulnerabilities front, HHS Cybersecurity Program released

  • a report on 2021’s top exploited vulnerabilities
  • a warning about BlackCat/ALPHV Ransomware Indicators of Compromise, and
  • an international joint cybersecurity advisory on Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure.

CISA added “seven new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.”

Health IT Security notes

Mandiant Threat Intelligence observed a record number of zero-day exploits in 2021, its latest report revealed. The firm identified 80 exploited zero-days in 2021, compared to just 30 in 2020. Threat actors favored zero-days in Google, Microsoft, and Apple products most frequently, largely exhibiting the popularity of those vendors.

The term “zero-day” indicates that there is no time between when a vulnerability is discovered by developers and when it is exploited by bad actors.

From the cyberdefenses front —

  • Healthcare Dive discusses what cyber insurance companies expect from their policyholders.
  • Federal News Network provides insights into achieving zero trust requirements.
  • ISACA explains what you need to know about malicious cybertrends.

Friday Stats and More

David Ermer–ACA, CDC, COVID-19, COVID-19 vaccine, HSA, Medicare, Rx coverage, U.S. Healthcare–

Based on the Centers for Disease Control’s Covid Data Tracker and using Thursday as the first day of the week, here are the FEHBlog’s weekly charts of new Covid cases and deaths from the 27th week of 2021 through the 17th week of 2022:

In addition, here’s the CDC’s Chart of Daily Trends in the Number of New COVID-19 Hospital Admissions in the United States:

Can you say endemic?

Below you will find the FEHBlog’s weekly chart of Covid vaccinations distributed and administered from the beginning of the Covid vaccination era in December 2020 to the current week 17.

The CDC’s Covid Data Tracker Weekly Review points out, “This week, the U.S. COVID-19 Vaccination Program marks two milestones: 500 days since the first COVID-19 vaccine was approved for use in the United States, and 100 million first booster doses administered.”

In the New York Times, David Leonhardt reports that the FDA is waiting to receive additional data from Pfizer and Modera [likely next month] to support their emergency use authorizations for Covid vaccines for children between six months and five years. Although the FDA’s preference is to give EUAs to both vaccines simultaneously to provide parents a choice, the agency will not delay a EUA decision on one or the other unnecessarily.

The CDC’s weekly review adds,

Currently, there are 54 (1.68%) counties, districts, or territories with a high COVID-19 Community Level, 256 (7.95%) counties with a medium Community Level, and 2,910 (90.37%) counties with a low Community Level. This represents a slight (0.59%) increase in the number of high-level counties, a small (+1.43%) increase in the number of medium-level counties, and a corresponding (−2.02%) decrease in the number of low-level counties. Seventeen (30.36%) of 56 jurisdictions had no high- or medium-level counties this week.

To check your COVID-19 community level, visit COVID Data Tracker.

From the health savings account front, the Society for Human Resource Management reports

Health savings account (HSA) contribution limits for 2023 are going up significantly in response to the recent inflation surge, the IRS announced April 29, giving employers that sponsor high-deductible health plans (HDHPs) plenty of time to prepare for open enrollment season later this year.

The annual inflation-adjusted limit on HSA contributions for self-only coverage will be $3,850, up from $3,650 in 2022. The HSA contribution limit for family coverage will be $7,750, up from $7,300. The adjustments represent approximately a 5.5 percent increase over 2022 contribution limits, whereas these limits rose by about 1.4 percent between 2021 and 2022.

In Revenue Procedure 2022-24, the IRS confirmed HSA contribution limits effective for calendar year 2023, along with minimum deductible and maximum out-of-pocket expenses for the HDHPs with which HSAs are paired.

Here is that 2023 deductible and OOP max information:

For calendar year 2023, a “high deductible health plan” is defined under § 223(c)(2)(A) as a health plan with an annual deductible that is not less than $1,500 for self-only coverage or $3,000 for family coverage [Self-only: +$100 Family: +200 from 2022], and for which the annual out-of-pocket expenses (deductibles, co-payments, and other amounts, but not premiums) do not exceed $7,500 for self-only coverage or $15,000 for family coverage [Self-only: +$450 Family: +$900 from 2022].

From the Medicare Part D front, Fierce Healthcare reports

CMS is giving Part D plans a little extra time to prepare to funnel price concessions to the member at the point of sale.

The Centers for Medicare & Medicaid Services on Friday finalized a rule with the price concession changes as well as a slew of updates for Medicare Advantage plans.

The agency said in a fact sheet on the regulation that beginning Jan. 1, 2024, it will define the negotiated price for a drug in Part D as the baseline, or lowest possible, payment to a pharmacy to ensure that price concessions are felt at the point of sale by beneficiaries.

“This policy reduces beneficiary out-of-pocket costs and improves price transparency and market competition in the Part D program,” CMS said.

The bell for prescription drug rebates is beginning to toll.

From the healthcare business front, Healthcare Dive tells us

Molina Healthcare in the first quarter recorded its highest COVID-19 costs since the start of the pandemic, CEO Joe Zubretsky said Thursday.

However, those costs were almost entirely offset by members cutting back on healthcare visits, a common trend throughout the pandemic, he said on a call with investors.

After costs peaked in January, they quickly declined in the subsequent months. “When I say [COVID-19 costs] subsided during the quarter, it did so dramatically,” Zubretsky added.   

HR Morning discusses a recent Willis Towers Watson survey on how employers are dealing with rising health care costs. To make healthcare more affordable for employees.

Fifty-five percent said their plan is to improve quality and outcomes to lower overall cost. Adding or enhancing low- or no-cost coverage for specific benefits is the plan for 41%. And 32% will be making changes to employees’ out-of-pocket costs, while 21% said they’ll alter their health plan payroll contributions.

From the preventive services front, the U.S. Preventive Services Task Force made a final grade D recommendation against initiating low-dose aspirin use for the primary prevention of CVD in adults 60 years or older. “For adults aged 40 to 59 years with an estimated 10% or greater 10-year cardiovascular disease (CVD) risk:  The decision to initiate low-dose aspirin use for the primary prevention of CVD in this group should be an individual one.” This is a Grade C recommendation.

Thursday Miscellany

David Ermer–ACA, COVID-19, COVID-19 vaccine, Federal employment benefits, Rx coverage, U.S. Healthcare–
Photo by Josh Mills on Unsplash

From the Omicron and siblings front —

MedPage Today brings us up to date on the whereabouts of Omicron BA 2.12.1.

“What we’re seeing right now is a version of the virus that is much more transmissible than previous versions of the virus, perhaps, but also less likely to cause severe disease,” Perry Halkitis, PhD, MPH, dean of the Rutgers School of Public Health, told MedPage Today.

The FEHBlog heard a fascinating talk about the Long Covid or PASC on the second and final day of the 2022 OPM AHIP Carrier Conference. Dr. Micheal Brode explained that PASC usually is evidenced by fatigue, brain fog, or exertional fatigue more than 12 weeks after the first symptoms of Covid. People afflicted by PASC typically, but not always, were hospitalized when Covid was in its acute opening phase. Covid vaccinations reduce the risk of contracting PASC by at least 50%, but they don’t prevent PASC. Although it’s premature for evidenced-based treatment guidelines to exist, Dr. Brode complimented the work of the PASC Collaborative to get to that point expeditiously. Most PASC patients recover slowly with medical care, although some PASC patients have permanent disabilities. Dr. Brode reminded the audience that Covid is a multi-system disease, not only a lung disease. PASC’s recently added ICD-10 code is U09.9.

The American Hospital Association adds, “Moderna today asked the Food and Drug Administration to authorize for emergency use its COVID-19 vaccine in children aged six months through 5 years, citing previously released data estimating the vaccine’s efficacy against the omicron variant in this age group was similar to that in adults, with a favorable safety profile.”

From the Affordable Care Act front, the ACA regulators released the final 2023 notice of benefit and payment parameters and the Final 2023 Actuarial Value Calculator and Methodology. Fierce Healthcare highlights the significant changes facing ACA qualified health plans in 2023.

From the healthcare business front —

Humana has released its 1st Quarter 2022 earnings. Fierce Healthcare provides background on the favorable report.

Fierce Healthcare informs us, “Walmart’s telehealth provider, MeMD, is rolling out the virtual diabetes program as a standalone service or as part of a comprehensive medical and behavioral telehealth program for enterprise customers and health plans. The retail giant collaborated with the American Diabetes Association on the virtual program, which was developed to help employees and members close gaps in diabetes management through early intervention, Walmart Health executives said.”

From the drug research front, BioPharma Dive tells us

Eli Lilly’s experimental diabetes shot tirzepatide helped obese people who have an underlying medical condition lose more than 15% of their body weight in a late-stage clinical trial. At the highest dose tested, patients receiving the weekly injection lost, on average, 21% of their body weight, Lilly said in a press release Thursday.

The data suggests tirzepatide could challenge similar drugs marketed by Danish drugmaker Novo Nordisk, which earned about $1.2 billion when prescribed for obesity in 2021. Novo’s weekly weight-loss shot Wegovy helped patients with medical complications lose an average of 15% of their body weight in clinical testing.

Wall Street analysts forecast swift growth for obesity drugs in coming years as patients, doctors and insurers acknowledge the effectiveness of newer agents like Wegovy and tirzepatide. Wegovy sales alone are expected to reach $5.5 billion in 2026, according to consensus estimates highlighted by Cantor Fitzgerald analyst Louise Chen in January.

From the federal employment front —

The U.S. Office of Personnel Management (OPM) released government-wide results of the 2021 OPM Federal Employee Viewpoint Survey (OPM FEVS). Federal News Network summarizes the results as follows:

Change is the biggest constant for the federal workforce after two years in a pandemic that capsized government operations. Despite the upheaval, employee engagement remained relatively steady over the last year, dropping just one point between 2020 and 2021, from 72% down to 71%.

But other factors, like employees’ job and pay satisfaction, declined in 2021 compared to 2020. The overall index points for global satisfaction dropped as well, from 69% down to 64%.

Govexec notes

As part of his fiscal 2023 budget proposal, [President] Biden proposed an average pay increase of 4.6% for civilian federal workers and members of the military, which, if implemented, would mark the biggest raise the federal workforce has seen in 20 years. Although it is unclear how that raise would be broken up between across-the-board increases to basic pay and an average boost to locality pay, traditionally, 0.5% of the pay raise has been set aside for locality pay increases.

In a letter, [62] House Democrats led by Rep. Gerry Connolly, D-Va., pressed the leadership of the House Appropriations Committee to go further than the president and endorse a 5.1% average pay increase for feds, reflecting legislation introduced by Connolly and Sen. Brian Schatz, D-Hawaii, that would grant federal employees a 4.1% across-the-board boost to basic pay and a 1.0% average increase in locality pay.

And don’t forget that this Saturday, April 30, is National Prescription Drug Take-Back Day.

Midweek update

David Ermer–COVID-19, Mental health care, OPM, SDOH, Telehealth, U.S. Healthcare–
Thanks to Alexandr Hovhannisyan for sharing their work on Unsplash.

Today, the FEHBlog attended day one of the virtual OPM AHIP FEHB Carrier Conference. OPM informed carriers to expect a carrier letter on the No Surprises Act. OPM also presented panels delving into Biden administration initiatives described in the 2023 call letter. The second and final day is tomorrow.

The FEHBlog suggests that OPM resume the practice of including health plan and PBM representatives on its conference panels to provide more relevant perspectives on these initiatives.

From the Omicron front, the Wall Street Journal informs us

There’s a good chance you’ll get Covid more than once.

Covid-19 reinfections are more common and can happen within a shorter window of time than doctors previously thought possible, recent research suggests. More than half of people in the U.S. showed signs of having been infected at least once as of February, according to a report Tuesday from the Centers for Disease Control and Prevention. * * *

“On average at a population level, the people who get reinfected have milder symptoms,” says Francois Balloux, an infectious disease epidemiologist and director of the UCL Genetics Institute in London. “That doesn’t mean that some people might not have a worse infection the second or even third time.” 

From the SDOH front, Health Payer Intelligence tells us

The Blue Cross and Blue Shield Association (BCBSA) and the Blue Cross and Blue Shield companies have urged the healthcare industry to adopt national health equity data collection standards.

The companies released a paper that defines health equity and submits a proposed model for data collection standardization.

That is a valuable resource.

From the telehealth front, Healthcare Dive reports

Whether or not telehealth visits result in duplicative care — a hot topic on the Hill as Congress debates future telemedicine regulation — could depend on whether users have acute or chronic conditions, a new study suggests.

Researchers analyzed data from almost 41 million commercially insured adults, and found patients with acute conditions that had an initial telehealth visit were slightly more likely to have a follow-up encounter, emergency room visit or inpatient admission, compared to those who had an in-person visit.

However, patients with chronic conditions that had an initial telehealth visit were as or less likely to need follow-up care, than those with an initial in-person visit.

That’s practical information for you.

Healthcare Dive adds

Teladoc Health recorded a $6.6 billion impairment charge in the first quarter, reflecting the waning market value of its acquisition of chronic care company Livongo inked two years ago.

Teladoc, the largest virtual care company in the U.S., bought Livongo for $18.5 billion in cash and stock late 2020 in the biggest digital health deal to date. However, the merger has struggled, resulting in the large goodwill impairment charge for the Purchase, New York-based vendor.

The charge drove Teladoc’s net loss up to $6.7 billion in the quarter, a record for the company. That’s more than 33 times bigger than its loss of about $200 million during the same time last year; and about 16 times its full year 2021 net loss of $429 million.

Ouch.

The Wall Street Journal reports

Some of the nation’s largest pharmacies have blocked or delayed prescriptions over the last year from clinicians working for telehealth startups that have sprung up to treat attention-deficit hyperactivity disorder, according to pharmacies and people familiar with the issue.

The pharmacies in certain cases have expressed concerns that clinicians at Done Health and Cerebral Inc. are writing too many prescriptions for Adderall and other stimulants, the people said. The federal government considers the drugs controlled substances because of their potential for abuse and places them in the same category as cocaine.

From the mental health and substance use disorder front —

Fierce Healthcare calls attention to the fact

Mental and behavioral health conditions account for a growing segment of healthcare costs, and insurers have a significant opportunity to address these expenses and drive costs down overall, according to a new report [which is behind a Moody’s paywall].

Mental health conditions accounted for just 5.2% of healthcare spending in 2019, but the number of people with these conditions is expanding, particularly in the pandemic environment, according to a report from analysts at Moody’s Investors Service.

A recent study suggests that healthcare costs for people with behavioral health conditions are 3.5 times higher than for those without such conditions, according to the report. Annual healthcare costs for patients with behavioral health needs are $12,272, with just 7.9% of that specifically for the behavioral conditions.

The National Institutes of Health offers a Q&A with Dr. Rena D’Souza, the Director of the National Institute of Dental and Craniofacial Research.

RB: Thanks for joining me, Rena. Many people might not recognize the relevance of oral health in opioid use and pain. Can you give us some examples of NIDCR HEAL projects and recent findings?

RD: Rebecca, thanks for the opportunity to have this conversation. Managing and treating dental, oral, and craniofacial pain is central to NIDCR’s vision to improve oral health and well-being for all people. So there’s an obvious connection. NIDCR HEAL projects include research to discover new, non-addictive ways to prevent and treat orofacial pain disorders such as temporomandibular disorders, inflammatory and neuropathic pain, and oral cancer-associated pain. NIDCR HEAL researchers are also in the early stages of developing a material that can seal surgical wounds and deliver pain medicine on-site to help reduce the need for opioids after oral surgery. In addition, our institute is interested in how socioeconomic status, race, ethnicity, and other social determinants of health play a role in chronic pain, pain management, and patient outcomes.

This work is necessary to tackle our opioid epidemic.

The Department of Health and Human Services announced the availability of “new, free informational resources that inform Americans of their rights under law on coverage for mental health benefits.”

“The following resources have been posted on SAMHSA’s website:

  1. “Know Your Rights: Parity for Mental Health and Substance Use Disorder Benefits,” an updated trifold pamphlet explaining mental health parity, detailing what it means to the consumer, and listing the protections the parity law provides.
  2. “Understanding Parity: A Guide to Resources for Families and Caregivers,” which provides an overview of parity geared toward parents, family members or caregivers with information and tools to help them obtain behavioral health services for children or family members in their care.
  3. “The Essential Aspects of Parity: A Training Tool for Policymakers,” which provides state regulators and behavioral health staff an overview of mental health and substance use disorder parity and how to implement and comply with the federal parity law regarding employer-sponsored health plans and group and individual health insurance.”

Tuesday’s Tidbits

David Ermer–CDC, COVID treatment, COVID-19, COVID-19 vaccine, Medicare, Mental health care, U.S. Healthcare, Uncategorized–
Photo by Patrick Fore on Unsplash

From the Omicron and siblings front —

The American Hospital Association informs us

The share of the U.S. population with antibodies to the SARS-CoV-2 virus in their bloodstream increased from 34% in December 2021 to 58% in February 2022, including 75% of children, according to a study released today by the Centers for Disease Control and Prevention. The study tested blood samples during the COVID-19 omicron period for antibodies produced in response to infection but not in response to COVID-19 vaccines. Children had the highest rates of infection-induced antibodies and adults 65 and older the lowest, with the greatest increases over the period in age groups with the lowest COVID-19 vaccination coverage. 

“Vaccination remains the safest strategy for preventing complications from SARS-CoV-2 infection, including hospitalization among children and adults,” the authors said. 

and

Starting this week, the Administration will allow all pharmacies in the federal pharmacy program to order free oral antiviral treatments directly from the federal government, the White House announced today. The Administration hopes to double the number of participating pharmacies to 40,000 in the coming weeks, and to launch new Test-to-Treat locations that offer the Pfizer and Merck pills, which the Food and Drug Administration authorized in December to treat COVID-19 in patients at risk of progressing to severe disease. Pharmacies also can continue to receive the pills through their state or territorial health department. The Administration said it is working to improve the Test-to-Treat patient experience, including through telehealth options; and to provide more guidance on COVID-19 treatments to prescribers and clinicians.

The New York Times adds more details to this AHA blurb. In short, “experts say that efforts to reach at-risk Americans remain complex and inefficient.”

Medscape adds “Contrary to popular belief, no association appeared between the number of intensive care unit beds and COVID-19 deaths, based on a review of data from all 50 states between March 1, 2020, and June 30, 2021.”

The Wall Street Journal further reports

Pfizer Inc. and partner BioNTech SE asked U.S. health regulators to authorize a booster dose of its Covid-19 vaccine for children 5 to 11 years old.

The request Tuesday to the Food and Drug Administration comes after the companies said earlier this month that a third shot safely generated a strong immune response in the youngsters, including significantly increased antibody levels against the Omicron variant. 

A thumbs-up from the FDA would expand eligibility of boosters to the roughly 28 million children in the U.S. Booster doses are now available for people as young as 12 years old in the U.S., and regulators recently greenlighted second boosters for people who are 50 years old and up or who have weakened immune systems. 

In FEHB news, OPM issued a paper describing the 2021 highlights of OPM’s FEHB Plan Performance Assessment system. In the FEHBlog’s view, OPM’s PPA system could be improved by (1) seeking plan input on all PPA changes, including, for example, the benchmark change to ALOB and (2) implementing changes for the first measurement year following the change, not the year in which the change is made. Both of these changes are consistent with federal administrative law, in the FEHBlog’s opinion. Also, OPM should use the carrot incentive more than the stick.

In healthcare business news,

Healthcare Dive tells us

Hospitals are experiencing a “massive surge” in expenses for items such as labor, drugs and supplies amid rising inflation, the American Hospital Association said in a report on Monday.

Labor is a particular stressor, making up more than half of hospitals’ total expenses. Overall, hospital labor expenses per patient increased almost 20% from 2019 to 2021, the AHA said. 

The powerful hospital lobby urged Congress to help address these headwinds by adding money to the provider relief fund and creating flexibility on advanced Medicare repayments, among other items.

Medpage Today informs us

Nearly three-fourths of U.S. physicians opted for employment with hospitals, health systems, or other corporate entities, such as private equity firms and health insurers in the pandemic era, according to a new report.

In 2021, 73.9% of physicians were hospital- or corporate-employed, up from 69.3% at the start of 2021, 64.5% at the start of 2020, and 62.2% at the start of 2019, according to the nonprofit Physicians Advocacy Institute (PAI) and consulting firm Avalere. That equates to 484,100 employed physicians, up from 423,800, 391,000, and 375,400 at the start of 2021, 2020, and 2019, respectively.

Perhaps these two trends are related? On the one hand, more physician employees create more hospital expenses. On the other, a hospital receives additional health plan payments for services provided by physician employees. In all likelihood, the revenue exceeds the expense in this case.

From tidbits department,

  • AHRQ reports on “Geographic Variation in Inpatient Stays for Five Leading Mental Disorders, 2016–2018.”

CAQH CORE, the author of national operating rules for the HIPAA-covered administrative transactions, recently released new operating rules to enhance information exchange and healthcare operations related to benefits coverage and supplemental documentation. * * *

The new CAQH CORE Attachments Operating Rule aims to improve the exchange of attachments, a long-standing industry issue. The guidelines will establish key infrastructure and data content requirements, helping providers send electronic health plans documentation to support a claim or prior authorization in a uniform format, the press release stated.

Reassociation or linking the attachment with the original prior authorization request or claim submission is one of the most significant pain points in the attachment workflow, CAQH CORE added.

The new guidelines also offer updates to enhance the exchange of critical eligibility and benefit information related to telemedicine, prior authorization, remaining coverage benefits, procedure-level information, and tiered benefits between health plans and providers.

The second newly released rule, the CAQH CORE Eligibility & Benefits Data Content Rule, intends to enhance provider knowledge regarding their patients’ coverage, leading to more timely care and accurate billing.

Finally, CAQH CORE revised its rules for infrastructure, which now calls for greater health plan system availability and less frequent periods of downtime.

  • Health Payer Intelligence notes “Applying an out-of-pocket spending cap to Medicare Part D could be a tool for promoting health equity, according to an insight from Avalere.”

Monday Roundup

David Ermer–COVID treatment, COVID-19, COVID-19 vaccine, No Surprises Act, Rx coverage, SDOH, U.S. Healthcare–
Photo by Sven Read on Unsplash

From the No Surprises Act front, the FEHBlog nearly fell off his chair when he noticed this Healthcare Dive article:

The Department of Justice intends to appeal a federal judge’s ruling that sided with providers over a challenge to the surprise billing rule, according to a Friday filing from the DOJ in the Eastern District of Texas.  

The Texas Medical Association sued the federal government over its interpretation of the No Surprises Act, arguing the rule leans too heavily on one factor arbiters are supposed to consider when resolving payment disputes between payers and providers.      

Federal Judge Jeremy Kernodle’s February ruling said nothing in the bill passed by Congress instructs arbiters to “weigh any one factor … more heavily than the others,” indicating the rule conflicts with the bill.

The Justice Department noticed an appeal to the Fifth Circuit in the referenced Friday, April 22, filing with the District Court. That notice effectuates the appeal. The FEHBlog will keep an eye on the dockets to learn whether the Justice Department will seek a stay of the February ruling while the case is on appeal.

From the Omicron and siblings front —

  • Bloomberg’s Prognosis reviews progress being made in the development of Covid vaccines administered nasally. Nasal vaccines have a better shot at preventing COVID than injected vaccines.
  • The American Hospital Association reports “The Food and Drug Administration today expanded its approval for remdesivir (Veklury) to include pediatric patients under age 12 who test positive for SARS-CoV-2 and are hospitalized or at high risk of progressing to severe COVID-19. The patient must be at least 28 days old and weigh at least 3 kilograms (about 7 pounds). FDA said the approval is supported by a clinical study of 53 pediatric patients as well as trials in adults, given the similar course of disease in adult and pediatric patients.”
  • Medical Dialogues informs us the World Health Organization has recommended Pfizer’s Paxlovid Covid pill over remdesvir, Merck’s pill and monoclonal antibodies for patients with milder forms of Covid and nevertheless at high risk of hospitalization from the disease, e.g. the elderly, the immunocompromised, and the unvaccinated.
  • WebMD News tells us “COVID-19 was the third-leading cause of death in the United States in 2021 for the second straight year, with only heart disease and cancer causing more deaths, the CDC said Friday. * * * The overall number of COVID deaths in 2021 increased around 20% over 2020, when around 384,000 people died from the virus, the CDC said. COVID deaths in 2021 peaked for the weeks ending Jan. 16 and Sept. 11, following holiday periods.”

The WebMD article offers other interesting public health nuggets. For example,

About 693,000 people died of heart disease in 2021, with 605,000 dying of cancer and 415,000 of COVID, the CDC said, citing provisional data that might be updated later.

Unintentional injuries were the fourth-leading cause of death, increasing to 219,000 in 2021 from 201,000 in 2020. Influenza and pneumonia dropped out of the top 10 leading causes of death and suicide moved into 10th place.

Overall, about 3,458,697 deaths were reported in the U.S. last year. The age-adjusted death rate was 841.6 deaths per 100,000 people, an increase of .7% from 2020. The 2021 death rate was the highest since 2003, the CDC said.

From the healthcare business front, Fierce Healthcare reports

Change Healthcare has found a buyer for its payment integrity arm, ClaimsXten, though the sale is contingent on the closure of its merger with UnitedHealth Group.

According to a filing submitted Monday to the Securities and Exchange Commission, ClaimsXten will be sold off to an affiliate of TPG Capital for a base purchase price equal to $2.2 billion in cash. UnitedHealth is listed as the seller.

From the reports department —

  • The National Bureau of Economic Research offers a working paper titled “Pharmacy Benefit Managers and Vertical Relationships in Drug Supply: State of Current Research.”
  • Per HR Morning, “Employer support [of their workforces] is happening in the areas of increased prioritizing employee assistance programs (EAPs), expanded wellness benefits and greater attention to work/life balance. That’s according to Ragan’s 2022 Communications Benchmark Report that surveyed close to 1,000 communicators across industries on opportunities and changes.”
  • Per Health Payer Intelligence, Humana has produced an issue brief that provides “an overview of the policymaking landscape surrounding social determinants of health data collection.”

Weekend update

David Ermer–Congress, COVID-19, U.S. Healthcare–
Photo by Michele Orallo on Unsplash

Congress returns from its two-week-long District / State work break tomorrow and resumes Committee business on Tuesday. The House of Representatives and the Senate also resume floor voting on Tuesday.

The Wall Street Journal adds

Once Congress returns to work, Democrats say they hope to get the bipartisan China competition bill signed into law. In the coming weeks, they are preparing to make a final attempt at resurrecting elements of the healthcare, education and climate package, which included provisions designed to lower the price of some prescription drugs. Sen. Joe Manchin (D., W.Va.), who scuttled the earlier bill in the Senate that all Republicans opposed, has said he could support a narrower package focused on climate and drug prices. * * *

Leaders of the center-left New Democrat Coalition urged the president in a recent meeting to work with Congress to focus on the China legislation and a narrow social spending and climate bill, said Rep. Suzan DelBene (D., Wash.), the group’s chair. In a separate meeting, the Congressional Progressive Caucus urged the president to use executive orders if legislation stalled, said CPC Chair Rep. Pramila Jayapal (D., Wash.).

Republicans say Democrats are out of touch with the electorate and that new spending will add to inflation. They also say that many of Democrats’ proposed actions could actually undercut them at the polls. If Republicans were to win back Congress, “the message to the president would be quit all the left-wing stuff, move to the center and work on things you can agree on,” said Senate Minority Leader Mitch McConnell (R., Ky.).

In other scheduling news, OPM and AHIP will be holding their annual FEHB carrier conference on Wednesday and Thursday this week. The conference will be held virtual. Hopefully next year, the conference will be held in person and a month earlier.

From the Omicron and siblings front, the American Medical Association offers what doctors wish their patients knew about the Omicron BA.2 subvariant. Nancy Crum, MD, an infectious disease specialist at Avita Health System in Galion, Ohio explained

We’ve been seeing a lot more of sore throat and pharyngitis that we didn’t really see before,” said Dr. Crum. Some of the other symptoms experienced are “very similar to the other coronaviruses such as febrile illness and respiratory symptoms.”

“Patients can also have gastrointestinal symptoms such as diarrhea, and loss of taste or loss of smell, although I’ve seen that a lot less with the newer variants,” she said, noting that symptoms for BA.2 may also include muscle or body aches, headache, nausea or vomiting, and congestion.

“We’re seeing very low rates of positivity for coronavirus right now and we’re actually seeing more influenza,” said Dr. Crum. That’s why “everyone coming in with any of those symptoms gets both a COVID test and an influenza test at the same time.”

Bloomberg’s Prognosis adds

The U.S. government is finishing plans to make Pfizer Inc.’s Covid-19 pill available at any pharmacy across the country, with supply increasing as the BA.2 sub-variant drives an uptick in cases and hospitalizations.

The administration will outline a plan [this coming] week aimed at getting the pill, Paxlovid, to additional people who’d otherwise face a more serious case of Covid-19, an administration official said Friday. The official asked not to be identified ahead of an announcement.

Use of oral antiviral pills in the U.S. jumped 103% between March 27 and April 10, the official said. The White House wants to drive that number higher, and signal to health providers to err on the side of prescribing the pills, rather than worrying about scarcity.

Let’s go.

STAT News advises

The World Health Organization said Saturday that 12 countries have reported at least 169 unusual cases of hepatitis in children, with 17 of the children having undergone liver transplants as a consequence. At least one child has died.

The WHO’s European division, which is taking the lead on the investigation into the mysterious outbreak, urged countries to look for, investigate, and report similar cases.

“Although the numbers aren’t big, the consequences have been quite severe,” Richard Pebody, who heads the high threats pathogen team at the WHO’s European division, told STAT in an interview. “It’s important that countries look.” * * *

The U.S. has seen 11 cases — nine in Alabama and two in North Carolina. The first Alabama cases date back to October and November of 2021, the earliest known cases. Pebody said most of the others are more recent. * * *

Suspicion has centered on an unexpected suspect — an adenovirus, specifically adenovirus type 41. At least 74 of the affected children have tested positive for adenovirus infection and molecular testing has turned up evidence of adenovirus 41 in 18 of those children.

Authorities have ruled out any possibility that Covid vaccines might have been involved in these cases. The vast majority of the children were not vaccinated, the WHO statement said.

Cybersecurity Saturday

David Ermer–Cybersecurity–

The Wall Street Journal recently interviewed IBM’s CEO Arvind Krishna. The interview concludes as follows:

WSJ: What is the biggest challenge facing the CIO and enterprise technology going forward?

Mr. Krishna: Cybersecurity is the issue of the decade. I think that is the single biggest issue we all are going to face. You have to take an enterprise approach, layered defenses. You have got to encrypt your data. You have got to worry about access control. You have got to believe you will get broken into. You make sure that you can recover really quickly, especially when it comes to critical systems.

Well put

The Cybersecurity and Infrastucture Security Agency informs us

The Federal Bureau of Investigation (FBI) has released a Flash report detailing indicators of compromise (IOCs) associated with attacks involving BlackCat/ALPHV, a Ransomware-as-a-Service that has compromised at least 60 entities worldwide.

CISA encourages users and administrators to review the IOCs and technical details in FBI Flash CU-000167-MW and apply the recommended mitigations. 

Security Week and Bleeping Computer expand on this FBI alert for those interested.

CISA also added three known exploited vulnerabilities to its catalog.

In other vulnerability news, Cyberscoop tells us

More than 450 security researchers working through the Department of Homeland Security’s “Hack the DHS” bug bounty program identified more than 122 vulnerabilities, 27 of which were deemed critical, according to a DHS statement first obtained by CyberScoop.

The agency awarded $125,600 to participants in the program for finding and identifying the vulnerabilities, the agency said in the statement. The researchers, vetted by the agency before participating, were eligible to receive between $500 and $5,000 for verified vulnerabilities, depending on the severity. * * *

Friday’s results represent the first phase of the DHS bug bounty program. The second phase will consist of a live, in-person hacking event, while the third will identify lessons learned to inform future bug bounty programs.

Cybersecurity Dive reports

Amazon Web Services is scrambling to assist customers after security researchers at Palo Alto Networks found severe vulnerabilities in AWS hotpatches that were supposed to protect customers from the Log4Shell vulnerability. 

AWS released a software tool in mid-December designed to patch vulnerabilities found in the Log4j library, however security researchers at Palo Alto’s Unit 42 discovered code vulnerabilities that could let attackers break out of a container environment and gain escalated privileges. 

After working with Palo Alto researchers for months, Amazon released a new hotpatch earlier this week, Unit 42 said in research released Tuesday. Unit 42 researcher Yuval Avrahami is urging organizations to review their container environments and upgrade to the fixed version. A large number of users may have downloaded the original hotpatches. 

The HHS Health Sector Cybersecurity Coordination Center (HC3) released a comprehensive PowerPoint presentation about insider threats in healthcare.

From the ransomware front HC3 issued an an alert on Hive ransomware.

Hive is an exceptionally aggressive, financially-motivated ransomware group known to maintain sophisticated capabilities who have historically targeted healthcare organizations frequently. HC3 recommends the Healthcare and Public Health (HPH) Sector be aware of their operations and apply appropriate cybersecurity principles and practices found in this document in defending their infrastructure and data against compromise.

Beckers Health IT Issues explains

Here a four things to know about the cyber group, according to the warning: 

1. The group uses many common ransomware tactics, including the exploit of remote desktop protocol or VPN, and phishing attacks, in addition to more aggressive methods like directly calling the victims to apply pressure and negotiate ransom payments.

2. Other tactics deployed by the group include searching the victim’s systems that are tied to backups and either terminating or disrupting those connections, deleting shadow copies, backup files and even system snapshots.

3, Hive also conducts double extortion and supports this with their data leaks site, while operating as a ransomware-as-a-service model.

In total, Hive has claimed attacks on approximately 355 companies within 100 days of operations.

HHS is urging healthcare organizations to increase its preventive security measures, such as two-factor authentication, strong passwords, sufficient backups of the most critical data and continuous monitoring.

Speaking of passwords, Cybersecurity Dive discusses the efforts of the FIDO Alliance to gain industry acceptance of using smartphones as the IT authentication standard while the tech industry presses for new methods.

Friday Stats and More

David Ermer–CDC, CMS, COVID-19, Medicare, U.S. Healthcare, Uncategorized–

Based on the Centers for Disease Control’s Covid Data Tracker and using Thursday as the first day of the week, here are the FEHBlog’s latest weekly charts of new Covid cases and deaths.

Because David Leonhardt in the New York Times recommends keeping an eye on Covid hospital admissions here is the CDC’s latest chart

The weekly new cases and death chart start in the middle of 2021 when we hit all time lows in new cases. Although our new cases total for the past week was 3 times week 27 in 2021, the new hospitalizations level is lower. That’s good news.

The CDC’s weekly review of its Covid stats adds

Currently, there are 39 (1.21%) counties, districts, or territories with a high COVID-19 Community Level, 231 (7.17%) counties with a medium Community Level, and 2,954 (91.63%) counties with a low Community Level. This represents a slight (0.78%) increase in the number of high-level counties, a small (+1.67%) increase in the number of medium-level counties, and a corresponding (−2.45%) decrease in the number of low-level counties. Twenty-five (44.64%) of 56 jurisdictions had no high- or medium-level counties this week.

To check your COVID-19 community level, visit COVID Data Tracker.

Here’s the FEHBlog’s latest weekly chart of Covid vaccinations distributed and administer from the beginning of the COVID vaccination era to the 16th week of 2022.

New vaccinations remain above 2 million per week.

From the Medicare front, the Centers for Medicare Services announced today a proposed rule that would create five new special Medicare enrollment periods.

  • An SEP for Individuals Impacted by an Emergency or Disaster that would allow CMS to provide relief to those beneficiaries who missed an enrollment opportunity because they were impacted by a disaster or other emergency as declared by a Federal, state, or local government entity.
  • An SEP for Health Plan or Employer Error that would provide relief in instances where an individual can demonstrate that their employer or health plan materially misrepresented information related to enrolling in Medicare timely. 
  • An SEP for Formerly Incarcerated Individuals that would allow individuals to enroll following their release from correctional facilities. 
  • An SEP to Coordinate with Termination of Medicaid Coverage that would allow individuals to enroll after termination of Medicaid eligibility.
  • An SEP for Other Exceptional Conditions that would, on a case-by-case basis, grant an enrollment period to an individual when circumstances beyond the individual’s control prevented them from enrolling during the IEP, GEP or other SEPs. 

These “SEPs that would provide individuals who meet certain exceptional conditions and who missed a Medicare enrollment period an opportunity to enroll without having to wait for the GEP and without being subject to a [Part B] late enrollment penalty.”

From the healthcare business front —

Beckers Payer Issues tells us

UnitedHealth Group subsidiary Optum has quietly acquired at least two independent primary care groups in Oregon, according to The Lund Report.

Optum has purchased Eugene-based Oregon Medical Group and Portland-based GreenField Health. Combined, the two systems have about 120 doctors and clinicians at 11 facilities. 

GreenField Health was purchased last year and Oregon Medical Group in late 2020, according to the Lund Report.

Nationwide, UnitedHealth Group has purchased about 1,500 primary care and specialty facilities, totaling 60,000 physicians.

Fierce Healthcare informs us

Humana will divest its majority stake in Kindred at Home’s hospice business to investment firm Clayton, Dubilier & Rice.

As part of the deal, which was announced Thursday, Humana will sell off a 60% stake in KAH Hospice for $2.8 billion in cash, which reflects an enterprise valuation of $3.4 billion and twelve times the division’s forecasted earnings before interest, income taxes, depreciation and amortization (EBITDA) for this year.

Humana said a year ago when it bought out the majority stake in Kindred at Home that it planned to divest the hospice arm. The insurer believes that it can deliver strong patient outcomes in hospice care without owning KAH Hospice outright, Chief Financial Officer Susan Diamond said in a statement.

From the medical research front, STAT News interviews Helmy Eltoukhy and AmirAli Talasaz, Guardant Health’s founders and co-CEOs.

Bay Area biotech Guardant Health is closer than ever to its ultimate goal — developing and deploying a simple, blood-based test that you could get during an annual doctor’s visit to spot cancer early enough that it might be treated more successfully. And 2022 is shaping up to be a big year for the company’s ambitions.

That’s good news for all of us.

Thursday Miscellany

David Ermer–AHRQ, CDC, CMS, COVID-19, Rx coverage, U.S. Healthcare–
Photo by Josh Mills on Unsplash

Today is Earth Day. AHRQ offers “A new AHRQ Views blog post in recognition of Earth Day 2022 highlights the Agency’s emerging efforts to reduce the impacts of climate change.”

From the FEHB front, Fedweek warns federal employees to think hard before rejecting FEHB coverage late in a career. As explained in the article you can lose out on one of the best fringe benefits for federal and postal employees — continuing their FEHB coverage into retirement with the full government contribution.

From the Omicron and siblings front —

STAT News informs us

Experts who advise the CDC met yesterday to discuss a thorny issue: Covid vaccine boosters, specifically the new policy to allow people 50 and older and people who are immunocompromised to get a second booster. By the end of the meeting — during which members of the Advisory Committee on Immunization Practices expressed frustration with the lack of clarity about the goal of the U.S. booster policy — it wasn’t entirely clear why people are being offered a second booster at this time. Data presented by CDC experts suggested the protection that immune-competent people have received from their primary series and first booster is holding up and the expected benefits from the fourth shots are modest at best. ACIP member Beth Bell raised concerns about “booster fatigue” and said offering another dose now could undercut confidence in vaccines that are working well at protecting people from severe Covid. The policy to offer the fourth doses was made without consulting ACIP.

What’s more,

Among the many views expressed around vaccine mandates, one theme persists: the idea that Covid-19 infection protects unvaccinated people against reinfection. While CDC says “getting a Covid-19 vaccination is a safer and more dependable way to build immunity to Covid-19 than getting sick with Covid-19,” a research letter in JAMA Network Open tested the concept of natural immunity by analyzing data from more than 121,000 patients receiving health care in the western U.S. from October 2020 through November 2021, before the Omicron variant took hold. Unvaccinated people who’d been sick with Covid had an 85% lower risk of acquiring Covid again compared to unvaccinated individuals without prior Covid. That level is similar to what mRNA vaccines deliver. Previous infection conferred 88% protection against hospitalization after reinfection and 83% protection against reinfection that did not require hospitalization. The authors conclude natural immunity works as well against both mild and severe illness. One difference: Natural immunity didn’t wane, but mRNA vaccines’ protection did. “This study may have important implications for vaccine policy and public health,” they write.

It is illogical to downplay natural immunity when the worst flu epidemic in U.S. history, the 2018 pandemic, was resolved by a combination of deaths and natural immunity. This is not intended to downplay vaccines. In the FEHBlog’s view, the CDC should be paying more attention to natural immunity from Covid.

From the Covid anti-fraud front, Healthcare Dive reports

The Department of Justice has charged 21 people across the U.S. for pandemic-related healthcare fraud, federal prosecutors said Wednesday.

Defendants — including doctors, medical business executives and fake vaccination card manufacturers — caused nearly $150 million in false billing to federal programs, the DOJ alleged.

The prosecution effort involves some of the “largest and most wide-ranging pandemic-related frauds detected to date,” said Kevin Chambers, the DOJ’s director for COVID-19 fraud enforcement.

From the Food and Drug Administration front —

The American Hospital Association tells us

The Food and Drug Administration seeks comments through June 21 on a potential change that would require outpatient settings to dispense opioid pain medications with prepaid mail-back envelopes and pharmacists to provide patient education on safe disposal of opioids.

“This potential modification to the existing Opioid Analgesic Risk Evaluation and Mitigation Strategy would provide a convenient, additional disposal option for patients beyond those already available such as flushing, commercially available in-home disposal products, collection kiosks and takeback events,” the agency said.

Good idea. Also

Health care providers should not use non-invasive prenatal screening tests alone to diagnose genetic abnormalities due to the potential for false results, the Food and Drug Administration warned last week. Also known as cell-free DNA tests or non-invasive prenatal tests, these laboratory developed tests in most cases are not reviewed by the FDA.

“Patients and health care providers should be aware of the risks and limitations of using these genetic prenatal screening tests and that they should not be used alone to diagnose chromosomal (genetic) abnormalities,” FDA said, citing reports that some patients and providers have made critical health care decisions based on the results without additional confirmatory testing. 

From the Rx coverage front, STAT News reports

Thanks to Covid-19 vaccines and therapies, U.S. spending on pharmaceuticals rose 12% in 2021 as use reached record levels and new prescriptions for acute and chronic care largely recovered from the slowdown seen during the pandemic, according to a new analysis.

Meanwhile, out-of-pocket costs paid by patients hit $79 billion, a $4 billion rise from the year before and the same level seen in 2018 after two years of declining costs. Overall, these costs were relatively low — less than $20 per prescription — but about 1% of all prescriptions filled, or 64 million, ran patients $125, underscoring ongoing barriers to affordability. In fact, 81 million prescriptions were not filled last year.

“We’re not in a very different situation from where we were five years ago except for the intensified, competitive market dynamics. But there are no major changes from a major legislative or policy perspective,” said Murray Aitken, senior vice president and executive director of the IQVIA Institute for Human Data Science, which conducted the analysis.

He also noted that the overall use of health services has returned to pre-pandemic levels, but has not yet made up for the backlog in missed patient visits, screenings and diagnostics, elective procedures, and new prescription starts — which IQVIA called a “concerning gap in preventive and treatment services.”

From the opioid epidemic front, the White House announced today

President Biden sent his Administration’s inaugural National Drug Control Strategy to Congress at a time when drug overdoses have taken a heartbreaking toll, claiming 106,854 lives in the most recent 12-month period. The Strategy delivers on the call to action in President Biden’s Unity Agenda through a whole-of-government approach to beat the overdose epidemic.

The Strategy focuses on two critical drivers of the epidemic: untreated addiction and drug trafficking. It instructs federal agencies to prioritize actions that will save lives, get people the care they need, go after drug traffickers’ profits, and make better use of data to guide all these efforts.

Here is a link to the full report