Cybersecurity Saturday

Cybersecurity Saturday

Roughly a year after we experienced Solar Winds, we have the Apache Log4j flaw. ZDnet tells us that “A flaw in Log4j, a Java library for logging error messages in applications, is the most high-profile security vulnerability on the internet right now and comes with a severity score of 10 out of 10.” Here is link to ZDnet’s FAQ on the the Log4j flaw and the patches available.

ZDnet adds

If there ever was any doubt over the severity of the Log4j vulnerability, director of US cybersecurity and infrastructure agency CISA, Jen Easterly, immediately quashed those doubts when she described it as “one of the most serious that I’ve seen in my entire career, if not the most serious”.

Not surprisingly therefore, Federal News Network reports that

The Cybersecurity and Infrastructure Security Agency issued an emergency directive today [December 17] requiring civilian executive branch agencies to determine all Internet-facing assets with the critical “Log4j” vulnerability and either patch or mitigate any vulnerable software within a week.

By Dec. 23 at 5 p.m., agencies are directed to “enumerate all solutions stacks accepting data from the internet” and then check whether any of them have the Log4j vulnerability using a CISA-managed Github repository available on the agency’s website, according to the new directive.

By the same deadline, agencies are given three options for how to address any vulnerable software: “immediately” update assets where patches are available; mitigate the risk of exploitation using another mitigation measure listed on CISA’s website; or remove the affected asset from their networks.

Bleeping Computer’s The Week in Ransomware focuses its attention on cybercriminal exploitation of this flaw.

Health IT Security adds

At least 39 ransomware groups have attacked the healthcare sector across 27 countries in the past 18 months, data from the CyberPeace Institute’s Cyber Incident Tracer revealed. Despite explicitly saying that they would not target healthcare, 12 groups singled out the sector.

Some healthcare organizations may simply be collateral damage, an accompanying blog post explained. Some ransomware operators used vague terms like “medical organizations” when describing which entities were off limits. Others saw pharmaceutical companies as fair game. Half of the 12 ransomware operators targeted hospitals specifically, despite saying that they would not target healthcare. * * *

Other groups target healthcare by choice. The FIN12 affiliate group has a reputation for going after healthcare organizations. Threat intelligence firm Mandiant discovered that nearly 20 percent of the group’s attacks were targeted at healthcare entities, and over 70 percent were aimed at US-based entities.

Sometimes, healthcare organizations may be targeted out of indifference. Usually, this means that the healthcare organizations fell victim to “spray and pray” tactics, where ransomware operators will execute phishing campaigns or Remote Desktop Protocol (RDP) brute force attacks with the hopes of getting some organizations to fall for the attack.

The Wall Street Journal aptly describes 2021 as “the year that hackers went wild and changed everything.”

The U.S. government in 2021 began to take a more decisive—and prescriptive—role in how digital defenses are constructed, on the back of a string of high-profile cyberattacks against the nation’s critical infrastructure.

Jingle Bells.

Friday Stats and More

Using the CDC’s COVID Data Tracker and Thursday as the first day of the week, here is the FEHBlog’s weekly chart of new COVID cases for 2021:

Here is a link to the CDC’s weekly chart of new COVID admissions which also continues to trend up.

Here is the FEHBlog’s weekly chart of new COVID deaths for 2021.

Here is the FEHBlog’s weekly chart of new COVID vaccinations administered and delivered from the 51st week of 2020 through the 50th week of the 2021. For the second week in a row, administered vaccines including boosters has exceeded 10 million for the week.

Here’s a link to the CDC’s weekly interpretation of its COVID statistics. The CDC weekly review will not be published again until January 7. Hopefully by then the FDA will have granted emergency use authorization to the Pfizer early onset COVID pill. That would be a great holiday gift for America.

The CDC’s Fluview reports that “Seasonal influenza activity in the United States is increasing, including indicators that track hospitalizations. The amount of activity varies by region.”

From the COVID vaccine front, the Wall Street Journal informs us that

Pfizer Inc. and partner BioNTech SE  have pushed back plans to request authorization of their Covid-19 vaccine in children ages 2 to 5, after the shot generated a weaker than expected immune response in a key study. 

The companies said Friday they would begin testing the addition of a third dose in the children, and if successful, would ask U.S. health regulators to authorize use sometime during the first half of 2022.

STAT News tells us that CDC Director Rochelle Walensky has approved her Advisory Committee on Immunization Practice’s unananimous “preferential recommendation to the Covid vaccines based on messenger RNA technology on Thursday — a decision aimed at steering people away from the Johnson & Johnson Covid-19 vaccine because of concerns about a rare but serious side effect.” STAT dives into more detail in an accompanying article titled “The Tragedy of Johnson & Johnson’s COVID vaccine.

In COVID vaccine mandate news the Wall Street Journal reports this evening that

A federal appeals court Friday reinstated Biden administration rules that require many employers to ensure that their workers are vaccinated or tested weekly for Covid-19.

A divided panel of the Sixth U.S. Circuit Court of Appeals dissolved a stay issued by another court that had blocked the rules. The majority, in a 2-t,o-1 ruling, said legal challenges to the administration’s vaccination-and-testing requirements were likely to fail.

This decision was made in the consolidated challenge to the OSHA action. The Sixth Circuit reversed a Fifth Circuit stay of the OSHA action. The plaintiffs are likely to ask all of the 6th Circuit’s active judges to consider this issue, e.g., a motion for rehearing en banc

In other judicial news, STAT News reports that

A federal court judge has reversed the hotly contested Purdue Pharma bankruptcy plan after deciding a bankruptcy judge did not have authority to grant immunity to the Sackler family members who control the controversial drug maker. * * *

One legal expert explained the decision is significant. “The decision is an important recognition of the arguments made (by the U.S. Trustee and the eight states) and the concerns they had. That is an important value for a justice system,” Melissa Jacoby, a professor at the University of North Carolina who specializes in bankruptcy law, wrote us.

So what happens next?

“…It is too soon to know what the effect will be. It is possible the Sacklers will increase their monetary offer to avoid further litigation to try to make the releases fully consensual, even though I can imagine grounds on which the 2nd circuit (appeals court) would reverse the district court,” she continued. “Presumably, they are examining those options right now.”

In M&A news, Healthcare Dive informs us that

— Intermountain Healthcare and Colorado-based SCL Health signed a definitive agreement Wednesday to move forward with merger plans to create an $11 billion health system spanning six states.

— The deal is expected to close next April. Financial terms were not disclosed.

— Intermountain CEO Marc Harrison will serve as the leader of the combined organization.

Thursday Miscellany

Photo by Juliane Liebermann on Unsplash

From the Capitol Hill front, Roll Call reports that

President Joe Biden and Democratic leaders reluctantly acknowledged Thursday that the Senate would soon recess for the year without passing their sprawling $2.2 trillion social safety net and climate spending bill or voting rights legislation. 

From the Omicron front, Bloomberg tells us that

President Joe Biden warned that unvaccinated Americans face “a winter of severe illness and death” as he urged initial doses and booster shots amid a surge of coronavirus cases and the emergence of the omicron variant.

David Leonhardt writing in his New York Times Morning column adds that “about 15 percent of American adults remain unvaccinated.”

From the COVID vaccine front, AHIP informs us that

Today, the CDC’s Advisory Committee on Immunization Practices (ACIP) convened to discuss the recent developments and safety considerations for the Janssen/Johnson & Johnson COVID-19 vaccine. 

ACIP voted unanimously to amend their recommendation: mRNA COVID-19 vaccines are preferred over the Janssen COVID-19 vaccine for the prevention of COVID-19 for those 18 years of age and older. 

Deliberations within the committee stressed the importance of updating the Clinical Considerations and educational materials regarding the vaccine to ensure that anyone who chooses to receive the Janssen adenovirus-based vaccine is informed of the potential risks.  

Earlier this week, the FDA updated its Emergency Use Authorization Fact Sheet to indicate that the Janssen vaccine is contraindicated for individuals with a history of thrombosis with thrombocytopenia syndrome (TTS).  This was based on new information showing that cases of TTS have been reported in both males and females, and that approximately 15% of TTS cases have been fatal.

Following the discussion, the Committee reviewed a presentation on safety data regarding the use of the Pfizer-BioNTech COVID-19 vaccine in children aged 5-11 years old.  Very few adverse events or severe systemic reactions were reported, with most incidents including pain, fever, fatigue, headache, and/or myalgia, and most beginning one or two days following the second dose with symptoms alleviating within a few days.  To date, there have been two deaths in children who received the vaccine, each with children who have complicated medical histories, both of which are still under investigation.

Finally, CDC presented current data about the Omicron variant.  This variant appears to be more transmissible than earlier variants, but more data is needed to know if it causes more severe illness.  Vaccines are expected to protect against severe illness, hospitalizations, and death, with booster vaccines showing increased protection than the two-dose series.  It is unclear how prior infection impacts neutralization.  CDC is continuing to monitor real-world evidence across all populations to inform further action.

Also from the omicron front, Healthcare Dive reports that

— FDA has identified three COVID-19 molecular tests that are not able to detect the omicron variant and warned that the diagnostics from Applied DNA Sciences, Meridian Bioscience and Tide Laboratories will return false negative results.

— The agency on Wednesday updated its list of tests impacted by virus mutations. While FDA continues to gather additional information and work with the three manufacturers to address these issues, it recommended the diagnostics not be used by clinical laboratory staff and healthcare providers.

— Makers of both polymerase chain reaction and rapid antigen tests have said their tests can detect omicron. Siemens Healthineers is the latest company to claim its testing portfolio is unaffected by the variant. However, Tim Stenzel, director of the FDA’s Office of In Vitro Diagnostics and Radiological Health, told test developers Wednesday during a virtual town hall that the agency continues to receive “a lot of inquiries” about omicron and its potential impact on diagnostics and will continue to focus efforts on evaluating molecular and antigen tests.

The Wall Street Journal adds that

Pfizer Inc. and BioNTech SE  say they have asked U.S. regulators to fully approve their Covid-19 vaccine for adolescents ages 12 to 15. The vaccine was fully approved by the U.S. Food and Drug Administration in August for people 16 years and older

From the COVID vaccine mandate front, we have two court decisions:

  • The Society for Human Resources Management explains that “On Dec. 15, the 5th U.S. Circuit Court of Appeals lifted a district court’s order that had blocked the Biden administration’s COVID-19 vaccination directive for health care workers nationwide. But the requirement remains blocked in 24 states.” The 24 states are composed of 14 State plaintiffs in the 5th Circuit case and 10 State plaintiffs in the first PI. The Congressional Research Service recently wrote a report on nationwide injunctions.
  • The government contractor mandate nationwide preliminary injunction (“PI”) followed the same course as the healthcare workers preliminary injunction — a PI issued for three states followed by a court in another state issuing a nationwide injunction. Perhaps the 11th U.S. Circuit Court of Appeals which is hearing the government’s appeal of the government contractor mandate PI (Case No. 21-14269), will follow the 5th Circuit’s lead.
  • The National Law Review reports that

[Also on Dec. 15] The [U.S. Court of Appeals for the] Sixth Circuit denied en banc review in the OSHA vaccine mandate cases.  The vote was a close one, with eight judges voting in favor of initial hearing en banc.  But that’s not enough under the circuit’s rules, which require a majority of the 16 active judges to vote for en banc treatment.  As a result, the current panel reviewing the case will decide whether to continue the stay issued by the Fifth Circuit, which may end up being the most consequential decision in the case until it comes before the Supreme Court.

From the miscellany department —

  • GoodRx brings us up to date on Alzheimer’s Disease research.
  • “The HEALTH CARE TRANSFORMATION TASK FORCE (HCTTF or Task Force), a group of leading health care payers, providers, purchasers and patient organizations, today announced that its provider and payer members reported having 61 percent of their business in value-based payment arrangements at the end of 2020. Value-based care and payment arrangements focus on lowering costs and improving the quality of care to drive overall population health. The new report shows significant progress towards the goal and has increased twofold from the group’s first report of 30 percent in value-based arrangements in 2015.”

Roughly 40% of U.S. healthcare payments were tied to alternative payment models (APMs) last year, with Medicare Advantage claims representing the largest amount, a new survey found.

The survey, published Wednesday by the Health Care Payment Learning & Action Network, showed that more work needs to be done as most healthcare payments were still tied to a fee-for-service model.

“The survey shows we have made limited progress in moving away from fee for service between 2019 and 2020,” said Mark McClellan, M.D., Ph.D., director of Duke University’s Margolis Center for Health Policy and co-chair of the LAN CEO forum, during the LAN Summit Wednesday. “Most payments are still in fee-for-service, especially outside of Medicare.”

  • If you are bit confused by these findings, APMs are a type of value based pricing arrangement. Health Affairs offered a useful article on the various value based payment models earlier his year.

Midweek Update

From the Capitol Hill front, Roll Call reports that

The Senate easily passed the annual defense policy bill on Wednesday, authorizing $768 billion in defense spending for fiscal 2022.

The final tally for the fiscal 2022 National Defense Authorization Act was 88-11. * * *

The legislation marks the 61st straight year that Congress has passed the NDAA. President Joe Biden is expected to sign it into law shortly.

The Federal Times discusses the federal employment aspects of the new law.

The Wall Street Journal adds that “Democrats braced for weeks of delay and uncertainty on their roughly $2 trillion education, healthcare and climate package they had hoped to finish by year end, as efforts faltered to secure the pivotal support of Sen. Joe Manchin (D., W.Va.) for the bill.”

From the Omicron front Bloomberg informs us that

The results from initial studies of the omicron variant of the coronavirus are starting to roll in almost daily, and early suspicions are gaining more support. The mutation is much better at infecting—70 times faster than delta and the original strain. But the severity of illness is likely to be much lower, according to a study from the University of Hong Kong, echoing earlier observations from doctors in South Africa where the variant was first observed. The supercharged speed of omicron’s spread in the human bronchus was found 24 hours following infection, according to the university. However, the study found it replicated in lung tissue much less efficiently than earlier mutations, which may signal “lower severity of disease.”

The FEHBlog ran across not one but two articles prognosticating about the extension of no cost sharing coverage of at home rapid antigen COVID tests scheduled for next month:

  • The Society for Human Resource Management points out a Mercer consulting report on the coverage issue.

HR consultancy Mercer explained: “Under existing guidance (see FAQ Part 43, Q/A-4), at-home COVID tests must be covered without participant cost-sharing, but only when ordered by an attending health care provider who has determined the test is medically appropriate based on current accepted standards of medical practice.”

Mercer noted that “group health plans and insurers currently may (but are not required to) provide coverage of at-home tests without participant cost-sharing even absent a health care provider’s determination of medical necessity. While we await important details, it seems quite possible that forthcoming guidance will significantly expand the scope of required coverage of at-home COVID testing without participant cost-sharing, in short, by eliminating the need to involve a health care provider.”

  • Health Payer Intelligence notes that “In a letter to CMS, the Alliance of Community Health Plans (ACHP) has requested that the federal government establish certain requirements for at-home COVID-19 testing coverage.” ACHP letter builds on Mercer’s concerns.

From the substance use disorder front —

Overdose deaths involving the synthetic opioid, illicitly-manufactured fentanyl (IMF), skyrocketed across the country from 2019 to 2020, researchers found.

Between July 2019 and December 2020, IMF-involved overdose deaths nearly doubled in the West (93.9%), increased 65% in the South and 33% in the Midwest, reported Julie O’Donnell, PhD, of the CDC’s National Center for Injury Prevention and Control in New Orleans, and colleagues.

Moreover these deaths were quick, as 56% of people who died from an IMF-involved overdose did not have a pulse when first responders arrived on the scene, and approximately 40% of IMF-involved deaths also involved a stimulant, O’Donnell’s group wrote in the Morbidity and Mortality Weekly Report.

  • The NIH HEAL Initiative reported that texting and related apps can be used to lengthen use of drugs taken to treat opioid use disorder. Here’s the background:

Medications such as methadone, buprenorphine, and naltrexone are highly effective for treating opioid use disorder. Yet only a fraction of people who could benefit actually receive these medications. Worse, about half of those who start taking them discontinue use within the first 6 months of treatment. Research has shown that the longer people continue treatment, the better their outcome is and the lower their risk of overdose.

  • On the bright side, NIH also reports that

The percentage of adolescents reporting substance use decreased significantly in 2021, according to the latest results from the Monitoring the Future survey of substance use behaviors and related attitudes among eighth, 10th, and 12th graders in the United States. In line with continued long-term declines in the use of many illicit substances among adolescents previously reported by the Monitoring the Future survey, these findings represent the largest one-year decrease in overall illicit drug use reported since the survey began in 1975. The Monitoring the Future survey is conducted by researchers at the University of Michigan, Ann Arbor, and funded by the National Institute on Drug Abuse (NIDA), part of the National Institutes of Health.

From the this and that department —

  • Health Affairs unveiled the National Health Care Spending Report for 2020:

US health care spending increased 9.7 percent to reach $4.1 trillion in 2020, a much faster rate than the 4.3 percent increase seen in 2019. The acceleration in 2020 was due to a 36.0 percent increase in federal expenditures for health care that occurred largely in response to the COVID-19 pandemic. At the same time, gross domestic product declined 2.2 percent, and the share of the economy devoted to health care spending spiked, reaching 19.7 percent. In 2020 the number of uninsured people fell, while at the same time there were significant shifts in types of coverage.

  • The Wall Street Journal graphically points out that emergency room charges can vary significantly for common emergencies in downtown Boston.
  • Fierce Healthcare tells us that

UnitedHealth Group has pushed back the deadline for its nearly $8 billion acquisition of Change Healthcare, according to a new filing with the Securities and Exchange Commission.

Change said in the filing that UnitedHealth informed the company that it was pushing back the deal’s outside date to April 2022. Previous filings suggested that the acquisition could close as early as late February.

Within the merger agreement, both companies have the right to push back the outside date.

UnitedHealth and Change are awaiting the completion of an investigation into the merger by the Department of Justice, which has been probing the deal on antitrust grounds.

Tuesday’s Tidbits

Photo by Patrick Fore on Unsplash

From the Capitol Hill front, the Wall Street Journal reports that

The Senate passed a measure raising the government’s borrowing limit by $2.5 trillion, as Democrats moved to quickly bring the measure to President Biden’s desk and push the next debt-ceiling standoff past the midterm elections.

The Senate voted 50-49 to approve the legislation, sending it to the House, which could pass it as soon as later Tuesday. 

Meritalk informs us that

The Senate on Dec. 14 voted to invoke cloture on the conferenced version of the fiscal year (FY) 2022 National Defense Authorization Act (NDAA), setting up a final vote on Wednesday for the $768 billion defense spending bill. The cloture motion sailed through the Senate by an 86-13 vote, ending debate on the compromise NDAA bill. 

Roll Call adds that

Senate Democrats on Tuesday softened their optimism that their party’s sweeping safety net and climate spending and tax package will pass before Christmas, citing uncertainty about whether Sen. Joe Manchin III, D-W.Va., is ready to support it and procedural steps that are far from complete. 

“It’s a tough timeline,” Michigan Sen. Debbie Stabenow, a member of Democratic leadership, said. “So we’re still pushing forward. We have a lot of agreement. But, you know, if this is not done in the next two weeks, we’ll come back in January and get it done.”

The House passed a $2.2 trillion version of the bill last month. Senate Democrats have released updated text for nine of their 12 committees that have jurisdiction over the package. The Energy and Natural Resources Committee that Manchin chairs is among the three committees that have not released text, along with Environment and Public Works and Judiciary. 

And STAT News reports that

Robert Califf escaped largely unscathed from a two-hour hearing Tuesday vetting him to be commissioner of the Food and Drug Administration. He gushed about his love of high-quality data, skillfully navigated questions on hot-button topics like abortion and drug pricing, and even had personal anecdotes about Covid-19 testing and opioid prescribing at the ready. * * *

The smooth hearing is the latest signal that Califf, who already survived a confirmation process for the FDA’s top job in 2016, will be easily approved for the job again. A vote on his confirmation has not been scheduled, but is expected in early 2022.

From the Delta/Omicron front

STAT News tells us that

The Omicron variant is starting to eat into Delta’s dominance in the United States.

The new variant accounted for 2.9% of sequenced Covid-19 cases in the United States in the week ending Dec. 11. The week before, 0% of cases were from Omicron. Delta accounted for essentially all of the other sequenced cases, according to data from the Centers for Disease Control and Prevention.

The new figures, updated Tuesday, indicate that Omicron started circulating before that week, given how long it can take for infections to be sequenced and reported. They show that Omicron’s advantage over the highly transmissible Delta variant is becoming noticeable in this country. * * *

Experts have said it appears Omicron is taking over faster than Delta did as it became dominant globally earlier this year.

The National Institutes of Health Director’s blog this week offers the latest on the Omicron variant and COVID vaccines.

It’s important to note that scientists around the world are also closely monitoring Omicron’s severity While this variant appears to be highly transmissible, and it is still early for rigorous conclusions, the initial research indicates this variant may actually produce milder illness than Delta, which is currently the dominant strain in the United States.

But there’s still a tremendous amount of research to be done that could change how we view Omicron. This research will take time and patience.

What won’t change, though, is that vaccines are the best way to protect yourself and others against COVID-19. (And these recent data provide an even-stronger reason to get a booster now if you are eligible.) Wearing a mask, especially in public indoor settings, offers good protection against the spread of all SARS-CoV-2 variants. If you’ve got symptoms or think you may have been exposed, get tested and stay home if you get a positive result. As we await more answers, it’s as important as ever to use all the tools available to keep yourself, your loved ones, and your community happy and healthy this holiday season.

The New York Times observes that

As the coronavirus pandemic approaches the end of a second year, the United States stands on the cusp of surpassing 800,000 deaths from the virus, and no group has suffered more than older Americans. All along, older people have been known to be more vulnerable, but the scale of loss is only now coming into full view.

Seventy-five percent of people who have died of the virus in the United States — or about 600,000 of the nearly 800,000 who have perished so far — have been 65 or older. One in 100 older Americans has died from the virus. For people younger than 65, that ratio is closer to 1 in 1,400. * * *

Since vaccines first became available a year ago, older Americans have been vaccinated at a much higher rate than younger age groups and yet the brutal toll on them has persisted. The share of younger people among all virus deaths in the United States increased this year, but, in the last two months, the portion of older people has risen once again, according to data from the Centers for Disease Control and Prevention. More than 1,200 people in the United States are dying from Covid-19 each day, most of them 65 or older.

The FEHBlog certainly hope that more readily available boosters and rapid antigen testing combined with the Pfizer and Merck early onset pills will help stem the death toll. The Wall Street Journal reports tonight that

Preliminary laboratory tests gave encouraging signs that Pfizer Inc.’s PFE 0.62% experimental Covid-19 pill for the newly infected could work against Omicron, the company said. * * * The positive results come as the Food and Drug Administration reviews whether to clear use of Paxlovid in high-risk adults, a decision that could come before the end of the year. * * * Meanwhile, a separate, preliminary analysis provided signs the drug may help people at low risk of severe Covid-19, such as vaccinated individuals who end up becoming sick.

From the tidbits department —

Healthcare mergers and acquisitions surged in 2021, growing 56% in the 12 months through Nov. 15 versus 2020.

There was particularly high growth among physician medical groups, which saw more than 400 deals, as well as managed care and rehabilitation subsectors, according to a new report from PwC. This compares to about 200 to 250 deals per year between 2017 and 2019.

There’s the potential for more consolidation and private equity roll-ups in 2022 and beyond as practices have experienced challenging economics and may face 2022 Centers for Medicare & Medicaid Services (CMS) payment cuts.

  • The Leapfrog Group announced its 2021 top hospitals in our country.

This year, 149 hospitals from across the country received the Top Hospital Award. California, Florida, Massachusetts, New Jersey, and Pennsylvania were the states with the most Top Hospitals, with ten or more hospitals in each state receiving the designation. The Top Hospitals are recognized in four categories: Top General Hospitals (46 recipients), Top Rural Hospitals (23 recipients), Top Teaching Hospitals (72 recipients), and Top Children’s Hospitals (8 recipients).

Full results of the 2021 Leapfrog Hospital Survey are publicly reported and available for free on Leapfrog’s website, providing patients with a resource to make informed decisions about where to seek treatment.

To see the methodology for Top Hospitals, please visit https://www.leapfroggroup.org/tophospitals.

  • The Centers for Disease Control offers six tips for eating healthy on a budget.

Monday Roundup

Photo by Sven Read on Unsplash

From the political front, Politico reports that

[Senator] Joe Manchin (D WV) remains at the negotiating table [with his party’s leadership], despite deep concerns about President Joe Biden’s climate and social spending bill [a/k/a the Build Back Better Act]. 

After speaking with Biden on Monday afternoon, Manchin said he was still “engaged” in discussions. And as he left the Capitol, the key Democratic senator made clear he wasn’t ready to commit to voting for or against a bill that is still coming together behind closed doors.

From the White House, the President issued an executive order on improving customer service performed by government agencies. Federal News Network explains that

Jason Miller, the Office of Management and Budget’s deputy director for management, said the EO also directs agencies to coordinate work on services that reflect common life experiences, including turning 65 and planning retirement, having a child or applying for a small business loan. * * *

The executive order gives senior administration officials 90 days to select a limited number of these customer life experiences to prioritize across government. It requires Miller and other members of the President’s Management Council to update [Presidential senior advisor Neera] Tanden and White House Chief of Staff Ron Klain on progress made improving these customer life experiences every six months.

The EO also gives the General Services Administration six months to develop a roadmap of shared services that agencies can use to improve customer experience.

The administration specifically names Login.gov and the U.S. Web Design System, a set of templates meant to create a common look and feel for agency websites, as tools that all agencies should use to improve federal customer experience.

Here is a link to the White House’s press release on the Executive Order as found on performance.gov.

From the Affordable Care Act front, the Internal Revenue Services has released the final Affordable Care Act coverage reporting forms, 1095-B and 1095-C, along with the final instructions for those forms.

From the Office of Information and Regulatory Affairs’ website, we find that the federal government’s Fall 2021 regulatory agenda has been published. Here is a link to OPM’s Fall 2021 agency rule list. A chill went up the FEHBlog’s spine when he noticed that the ACA provider non-discrimination proposed rule mandated by the No Surprises Act will be published this month due to a statutory requirement. Cost curve up?

From the employer sponsored care front, Healthcare Dive reports that

— The average per-employee cost of employer-sponsored health insurance jumped 6.3% in 2021, as employees and their families resumed care delayed last year due to the pandemic, according to a new survey of employers from Mercer.

— That’s the highest annual increase since 2010. Health benefit costs outpaced growth in inflation and worker compensation through September, the employee healthcare and investment consultancy said.

— The findings raise questions of whether employers are experiencing a temporary correction to the cost trend following a minimal year-over-year increase of just 3.4% in 2020, or if they’re staring down the barrel of a new period of higher cost growth.

No doubt those questions can keep actuaries awake at night.

From the good COVID news department (yes it exists), STAT News informs us that

Paxlovid, Pfizer’s oral treatment for Covid-19, led to an 89% reduction in hospitalization and death in final data from a pivotal trial, the company said today, confirming the results of an earlier analysis.

The news should allay concerns that the efficacy of Pfizer’s pill would wane over time. Molnupiravir, a Covid-19 antiviral from Merck, appeared 50% effective in an interim trial analysis but fell to about 30% in the final tally. Both studies enrolled unvaccinated patients who were recently diagnosed with Covid-19 and had at least one risk factor for severe disease.

The next step for Pfizer is submitting the results to the FDA, which the company expects to do this month, and applying for an emergency-use authorization. The agency is yet to disclose whether it will convene a panel of expert advisers before deciding on Paxlovid.

Based on the President’s winter is coming plan, the FEHBlog’s bet is on the FDA approving the Pfizer drug without delay.

Weekend Update

Congress will remain in session for Committee business and floor voting.

The focus of attention will be the President’s Build Back Better Act. The Senate Finance Committee released the text of its portion of the Senate version of the BBB Act yesterday. The Wall Street Journal explains that

President Biden this week will lobby Sen. Joe Manchin, the centrist West Virginia Democrat, in an attempt to lock in a deal on a roughly $2 trillion social-policy and climate bill that Democrats hope to finish by Christmas.

Passage hinges largely on the support of Mr. Manchin, who hasn’t endorsed the legislation. He has repeatedly raised concerns about the cost of the bill and the potential effect of new government spending on inflation. Messrs. Biden and Manchin plan to talk early this week, a Senate aide said.

Senator Manchin’s vote is critical because the Democrat’s can’t lose one vote in the evenly divided Senate as the Republicans in the Senate all intend to vote against the bill. The Journal adds

With Democrats holding the narrowest congressional majority in decades, passing the sweeping bill is akin to threading yarn through a tiny needle. Democrats already navigated past opposition from Arizona Democratic Sen. Kyrsten Sinema on several of the tax increases they originally had proposed, making revenue-generation intended to pay for the legislation difficult.

Ms. Sinema hasn’t endorsed the House-passed bill. Democrats have also needed to write a bill that lawmakers from the party’s most progressive wing would support, along with centrists.

Because the Senate bill will not mirror the already passed House bill, the two Houses of Congress might convene a conference committee. Time will tell.

Tomorrow is the last day of the current Federal Benefits Open Season. OPM explains that

The Federal Benefits Open Season ends at 11:59 pm Eastern Time on Monday December 13, 2021 for the Federal Employees Dental and Vision Insurance Program (FEDVIP) and the Federal Flexible Spending Account Program (FSAFEDS). Open Season for the Federal Employees Health Benefits Program (FEHB) ends at 11:59 pm, in the location of your electronic enrollment system, on Monday December 13, 2021.

From the No Surprises Act front, the Kaiser Family Foundation offers a consumer friendly overview of the law’s provisions that take effect on January 1, 2021. Basically, FEHB plans will pay certain out-of-network (“OON”) providers (emergency care, air ambulance, and OON providers when the patient is treated at an in-network facility) a qualifying payment amount (“QPA”), net of the in-network cost sharing amount which is the member’s financial responsibility. If the provider is dissatisfied with the QPA, he or she must work out the matter with the health plan. The member therefore is held harmless against the outcome of that controversy.

These QPA provisions, however, are inapplicable to claims submitted for FEHB plan members who have primary Medicare coverage or in the case of fee for service plans have primary Medicare Part A only. Also if another payer is primary to the FEHB plan, e.g., a spouse’s plan, then the primary plan is responsible for compliance with the No Surprises Act. The FEHB plan is responsible only for making the secondary payment, which usually equals the primary plan’s deductibles and co-insurance.

From the health care business front, Medcity News informs us that

After a challenging quarter, insurance company Bright Health is raising $750 million in financing. In an unusual move, another insurance company is joining as an investor. Cigna Ventures and Bright’s largest shareholder, New Enterprise Associates, both participated in the financing.

Head of Cigna Ventures Tom Richards talked about potential opportunities to collaborate with NeueHealth, Bright’s provider enablement platform to help practices move to value-based contracts.

“We seek to be partners of choice and we look forward to exploring new ways that NeueHealth and Evernorth can potentially provide services to each other’s customers and clients,” he said in a news release.

From the Omicron front, Bloomberg reports (recall last week’s post about U.S. experts tracking the U.K.’s experience with Omicron because the United Kingdom started to experience Omicron cases before the U.S.):

Prime Minister Boris Johnson warned the U.K. is facing a “tidal wave” of omicron infections and set an end-of-year deadline for the country’s booster vaccination program. Infections in the U.K. from the new variant doubled in the last day and now make up a third of new cases in London. 

Anthony Fauci, U.S. President Joe Biden’s chief medical adviser, said omicron appears able to evade vaccines and some Covid-19 treatments but that a booster shot can increase protection. At least 30 U.S. states are reporting cases of the variant.  

CNBC adds that “Covid booster shots are “optimal care” as the deadly virus continues to mutate and spread, but the U.S. government is staying firm for the time being on the definition of fully vaccinated, top U.S. infectious disease expert Dr. Anthony Fauci said Sunday.”

Cybersecurity Saturday

From Capitol Hill, per Nextgov, “the House [of Representatives] on Tuesday passed the NDAA conference report—language House and Senate Armed Services Committee leaders agree on that reconciles versions of the bill from each chamber. The next step is a vote on the conference report by the Senate.  (H.R. 4350).

Nextgov adds

“There were intensive efforts to get cyber incident reporting done but ultimately the clock ran out on getting it in the NDAA,” House Homeland Security Committee Chairman Bennie Thompson, D-Miss and Rep. Yvette D. Clarke, D-NY, who chairs the committee’s panel on cybersecurity, said in a joint statement Tuesday.

The annual Defense Authorization Act still “initiates the widest empowerment and expansion of CISA through legislation since the SolarWinds incident,” according to a summary of the bill released by the House Armed Services Committee Tuesday

The bill gives CISA added responsibilities around identifying threats to industrial control systems, and removing cybersecurity vulnerabilities while establishing voluntary partnerships with industrial control system and internet ecosystem companies. 

From the government initiative front, Health IT Security reports that

HHS launched a new website for its 405(d) Program with the goal of aligning healthcare cybersecurity across the industry. Under the Cybersecurity Act of 2015, HHS established the 405(d) Aligning Health Care Industry Security Approaches Program and the 405(d) Task Group, which is comprised of more than 150 industry and government experts.

The program aims to uphold the motto that “cyber safety is patient safety,” and its website contained resources, videos, products, and tools to help raise awareness and promote cybersecurity best practices, the HHS announcement stated.

“Healthcare professionals understand the importance of hand washing when it comes to mitigating the spread of diseases. Similarly, we know that cybersecurity practices reduce the risk of cyber-attacks and data breaches,” the website maintained.

Also the HHS Cybersecurity Program issued a healthcare sector alert yesterday

A highly utilized application called Log4j contains a severe, known vulnerability that is being actively and aggressively attacked. Upon successful exploitation, a compromised system or device can be used to execute arbitrary code, which can serve as the beginning of a larger cyberattack potentially resulting in any number of effects including data exfiltration and ransomware. HC3 advises healthcare and public health organizations to survey their infrastructure and ensure they are not running vulnerable versions of Log4j. Any vulnerable systems should be upgraded, and a full investigation of the enterprise network should commence to identify possible exploitation if a vulnerable version is identified.

Report

Log4j is a very common Java library/framework that provides logging capabilities to any number of software platforms that it serves. In late November, a remote code execution (RCE) vulnerability (tracked as CVE-2021-44228) was identified in certain versions which are now being actively exploited in the wild. Proof of concept exploit code has been circulating social media for several days and is publicly posted on well-known code repositories. The Log4j software is maintained by Apache and they have released an update which should be deployed (after testing, as needed) across all vulnerable devices in the enterprise in a timely manner.

From the interviews department

  • Tech Republic interviews Walgreens Boots Alliance CTO Mike Maresca “about what keeps him up at night and why building internal and external partnerships is key for digital transformation success.”
  • The Wall Street Journal interviews Kathy Hughes, the CISO for Northwell Health, a hospital / healthcare system in New York City and Long Island, and Joey Johnson, the CISO for Premise Health, which offers health and wellness services to employers, among others. This tidbit from the interview grabbed the FEHBlog’s attention:

WSJ: Can you briefly explain a couple of technologies that you had to deploy?

MS. HUGHES: The most significant one was, because we had seen such an uptick in phishing emails, we deployed a technology that actually does a live scan of a URL when it’s clicked within an email. The technology that we had before, if a URL had been accessed that was previously determined and rated to be malicious, it would be blocked. But this enabled us to do that in real time

Cool.

From the hacking front, Cyberscoop reports

Hackers associated with the SolarWinds supply chain compromise have been busy in the year since that attack was revealed, compromising multiple cloud solution companies with the goal of stealing data relevant to Russian interests and finding routes to additional victims, new research reveals.

Findings published Monday [December 6] by a team of analysts at Mandiant collate previous observations and analysis — along with the efforts of “hundreds of consultants, analysts and reverse engineers — to paint a picture of potentially distinct groups working alongside or within a more established Russian intelligence hacking group known as Nobelium, a name given to the group by Microsoft. The group is also known as Cozy Bear.

Last but never least, here is a link to Bleeping Computer’s The Week in Ransomware.

This week has quite a bit of ransomware news, including arrests, a new and sophisticated ransomware, and an attack bringing down 300 supermarkets in England.

This week’s biggest story is a law enforcement operation conducted by the FBI and Ontario Provincial Police (OPP) that arrested a Candian ransomware affiliate allegedly involved in hundreds of attacks.

We also learned about the new ALPHV (aka BlackCat) ransomware that appears to be one of the most sophisticated ransomware families we have seen this year.

Finally, this week’s largest known ransomware attack was on James Hall and Co, which affected point-of-sale systems and led to the temporary closing of over 300 Spar supermarkets in England. This week’s other known attack is on Nordic Choice Hotels by the Conti ransomware gang.

Friday Stats and More

Based on the Centers for Disease Control’s COVID data tracker and using Thursday as the first day of the week, here is the FEHBlog’s weekly chart of new COVID cases for 2021:

STAT News reports today that Omicron may give Delta a run for its money.

As the Omicron variant snowballs in South Africa and widens its inroads in Europe, evidence is mounting that it can outcompete the highly transmissible Delta variant — a potential warning signal for the United States.

The Wall Street Journal adds that

The U.K. is emerging as a testing ground in the battle for dominance between the new Omicron variant of the coronavirus and Delta, the earlier strain that is currently driving most infections in the U.S. and Europe.

How Britain fares against Omicron will offer clues to the U.S. and the rest of the industrialized world about how the variant behaves in a highly vaccinated population, how sick those who are infected get and if its dozens of mutations have given Omicron enough of an advantage on the evolutionary ladder to starve Delta of the hosts it needs to stay on top.

The CDC’s weekly new COVID hospitalizations chart up week to week from 6.500 to 7,500 which is 54% below the number of new hospitalizations in January 2020. The Wall Street Journal adds that

As the pandemic heads into its third year, doctors are screening more effectively for these clots and improving treatment regimens, marking a significant medical advance alongside the vaccines and antiviral pills under review for Covid-19 that get the most attention.

Even before test results come in, doctors may sometimes treat patients with a high dose of anticoagulants if they suspect blood clots, often termed thrombosis, said Michael Streiff, a clot specialist at Johns Hopkins University.

“The incidence of thrombosis was very high in the beginning but has declined over time. I think this is due to better supportive care,” Dr. Streiff said.

Still, some doctors say there’s much to be done to improve outcomes further. Recent studies are helping to define more precise treatment protocols for clots.

Here’s the FEHBlog weekly chart of new COVID deaths for 2021:

The Wall Street Journal notes that

The Omicron variant of Covid-19 has so far caused mostly mild cases of Covid-19 in a small group of largely vaccinated people in the U.S., federal data show.

Among at least 43 people infected with the variant in 25 states in recent days, there has been one hospitalization and no deaths so far, the Centers for Disease Control and Prevention said Friday.

Out of 43 cases identified between Dec. 1 and Dec. 8, nearly 80% of the people infected with Omicron were fully vaccinated, according to CDC data, and one-third had received a booster shot. Fourteen percent of the people had a previous Covid-19 infection. Patients most commonly reported mild symptoms like cough, fatigue, congestion or runny nose, the CDC said. Nearly 60% of cases were in people 18 to 39 years old.

The report is an early piece of the picture scientists are working to assemble on Omicron’s infectiousness and virulencerelative to other variants.

Here’s the FEHBlog’s weekly chart of new COVID vaccinations administered and distributed from the 51st week of 2020 through the 49th week of 2021:

This past week was the first week since June 2021 that administered vaccinations topped 10 million. Slightly over 50% of the U.S. population over 65 is boostered according to the CDC.

Here is a link to the CDC’s weekly interpretation of its COVID statistics which urges all Americans aged 16 and older to get boostered.

From the flu front, the CDC reports that seasonal flu activity remains low but continues to increase. The CDC encourages Americans to fight the flu by getting vaccinated, engage in preventative measures, and take flu antiviral drugs if your doctor prescribes them. We are about a month away from the CDC giving the same advice about COVID.

From the Capitol Hill front, FedWeek informs us that

Congress is moving toward passing a compromise version of the annual DoD authorization bill (S-1605) containing a number of provisions affecting personnel policies government-wide, including two new weeks of paid leave for federal employees on the death of a son or daughter.

The new “parental bereavement leave” replaces a House provision that would have expanded the authority for federal employees to take paid time rather than unpaid time for parental purposes covered by the Family and Medical Leave Act. The Senate version had not included any provision on parental leave.

The compromise provision uses the same definitions for children as under the FMLA; rules likely will be needed to define the policy, including the effective date.

The bill also: extends long-running authorities for all agencies to pay certain special allowances to employees working in areas of active military operations; requires OPM to perform a study of allowances for employees working in remote areas; and orders OPM to establish or update occupational series in the fields of software development, software engineering, data science, and data management.

However, the final version drops House language to require OPM to redefine locality pay areas for wage grade employees so that they align with the areas used for the GS system. Currently, in some cases wage grade employees receive smaller raises than GS employees at the same location. The bill however encourages OPM to address that issue. 

From the judicial front

  • The Society for Human Resource Management brings us up to date on oral arguments before the U.S. Supreme Court this week on human resources and employee benefit issues.
  • The Coalition against Surprise Billing blasted the American Medical Association and the American Hospital Association for bringing a lawsuit against the independent dispute resolution regulations under the No Surprises Act.

From the healthcare business front —

New York-based Hydrogen Health, a joint venture between Anthem, investment firm Blackstone and digital primary care company K Health, is launching its virtual primary care offerings nationwide, the provider announced Dec. 9. 

Anthem and its partners formed Hydrogen Health in April 2021 to leverage artificial intelligence to drive down healthcare costs in both employer and consumer markets. The joint venture offers employers and insurers text and video-based digital primary care, and taps K Health’s artificial intelligence to personalize that care. 

Hydrogen Health shared that since its initial launch with Anthem, its customers now include multiple Fortune 500 companies and other large employers. 

Moving into 2022, the plan anticipates it will expand the conditions it can diagnose and manage and grow its membership by 10 million — all digitally, according to the announcement. 

  • Healthcare Dive reports that on CVS Health’s investors day held yesterday.

— CVS Health plans to ramp up its acquisitions of physician practices and clinics as it continues to pursue its primary care strategy and races with other retail pharmacies to build out medical networks.

— The Woonsocket, Rhode Island-based healthcare behemoth already operates a network of MinuteClinics, urgent care locations staffed by nurse practitioners. But CVS wants to broaden its care delivery strategy into a primary care model, including “physician-led primary care centers with integrated virtual and home assets,” CVS EVP and president of pharmacy services Alan Lotvin said Thursday at CVS’ investor day.

— CVS plans to add a few hundred primary care centers to its network of MinuteClinics, drugstores and health-focused HealthHUB locations launched a few years ago, as it moves from an episodic to more longitudinal approach to care, Lotvin said. CVS also wants to eventually add more specialty services to compete as the retail healthcare market becomes increasingly saturated.

From the benefit design front, Health Payer Intelligence informs us that “Employing personalized, in-home chronic disease management services can have a significant impact on spending for seniors with chronic conditions, a study from Avalere found.”

Patients with quadriplegia saw the highest healthcare spending difference in total cost of care after receiving home healthcare. The group that received the home healthcare solution spent $12,807. In contrast, the group that did not receive in-home chronic disease management support spent nearly $30,000 more, with average spending of $42,709.

The condition that ranked lowest in the top ten chronic conditions was intestinal obstruction or perforation. But even for this condition, patients with the intervention spent on average $17,738 less than their counterparts.

Despite the major differences in total cost of care between the two groups, the group that received the targeted home healthcare intervention did not display drastic differences between healthcare spending levels before and after implementing the intervention.

Thursday Miscellany

Photo by Clarisse Meyer on Unsplash

From the Capitol Hill front, Roll Call reports that

The Senate broke a logjam over the statutory debt limit Thursday, clearing a measure that would allow Democrats to increase the nation’s borrowing capacity on their own without any Republican assistance necessary.

On a 59-35 vote, the Senate sent President Joe Biden a bill granting a one-time exemption to Senate rules so that a debt ceiling increase can go straight to final passage on a simple majority vote, rather than first having to clear a 60-vote procedural hurdle. 

Passage of the fast-track process legislation effectively ends weeks of partisan brinkmanship over whether and how to raise the statutory debt limit. Without congressional relief, the government may be unable to meet all its financial obligations after Dec. 15, Treasury Secretary Janet L. Yellen has warned.

Democrats have yet to release the bill that will actually raise the debt limit, though Senate Majority Leader Charles E. Schumer and Speaker Nancy Pelosi hope to clear that measure before Wednesday to meet Yellen’s deadline.

The legislation heading to the White House also would delay Medicare cuts that would otherwise be triggered Jan. 1, including across-the-board reductions to provider reimbursements as well as separate cuts to physician and laboratory services payments. It would temporarily waive statutory pay-as-you-go rules that would require steeper Medicare cuts next year as well as major reductions in farm price supports and a host of other federal benefits.

So Congress will remain in session next week.

Govexec adds that “The House on Thursday approved a package of reforms to add new protections to federal civil servants, further empower agency watchdogs and limit who can lead federal offices on a temporary basis.” The bill now heads over to the Senate.

From the COVID vaccine front, AHIP informs us that

The U.S. Food and Drug Administration (FDA) today authorized a booster dose of the Pfizer-BioNTech COVID-19 vaccine for 16- and 17-year-olds. Eligible teens will be able to get the shot once they are at least six months past their second dose.

New data from Israel published this week showed that a Pfizer booster increased immunity among citizens 16 and older, and though the study focused on the Delta variant, Pfizer announced this week that a third dose can help fight the Omicron variant.

The Centers for Disease Control and Prevention’s Advisory Committee on Immunization Practices (ACIP) are not expected to meet to develop new clinical recommendations for teen boosters, according to a report from Politico.

From the COVID vaccine mandate front, Federal News Network tells us that

The Biden administration offered more details Thursday for federal contractors tracking the multiple legal challenges to the president’s vaccine mandate, while reporting a slight increase in the number of executive branch employees who have complied with their agency’s own requirements.

Agencies will not enforce the provisions of the president’s federal contractor vaccine mandate while a nationwide preliminary injunction is in place, the Biden administration said.

Specifically, the government won’t enforce those clauses embedded in existing contracts where the work is performed inside the United States or an outlying area and is subject to a recent court order, according to a brief update to the Safer Federal Workforce Task Force issued Thursday.

the Wall Street Journal adds that

General Electric Co., Union Pacific Corp. and other large employers have suspended Covid-19 vaccine requirements for workers after a U.S. court ruling blocked the Biden administration’s plan to mandate vaccines for federal contractors.

A federal judge on Tuesday issued a nationwide preliminary injunction after concluding that federal procurement law didn’t give the administration the clear authority to impose the vaccine rules for contractors. Lawyers for the federal government filed a notice of appeal Thursday.

The court’s injunction applies to the federal government, including OPM, not to the government contractors. The government contractors therefore are free to choose whether or not to continue with their vaccine mandate programs while government enforcement of the program is enjoined. This news nevertheless suggests that the squeeze may not be worth the fallout.

From the No Surprises Act front, the American Hospital Association announced that

The American Hospital Association (AHA) and American Medical Association (AMA), representing hospitals, health systems, and physicians, sued the federal government today over the misguided implementation of the federal surprise billing law. The associations are joined in the suit by plaintiffs including Renown Health, UMass Memorial Health and two physicians based in North Carolina. 

The complaint was filed in the U.S. District Court for the District of Columbia. The plaintiffs also have moved for a preliminary injunction or a summary judgment.

The provider groups are freaking out over the regulator’s decision to use the plan’s payment in No Surprises Act situations, known as the qualifying payment amount, as the lodestar for baseball arbitration purposes in the No Surprises Act independent dispute resolution process. The QPA is based on the health plan network’s median payment as of January 2019 adjusted for inflation and regional differences. The QPA should be similar to what plans pay in-network providers which always has been materially more than the out-of-network rate which usually is based on Medicare’s fee schedule. Paying the out of network providers more than the in-network doctors under the No Surprises Act would disrupt health plan networks. The rule’s lodestar use of the QPA is perfectly reasonable.

From the miscellany department –

  • Beckers Payer Issues reports that “CMS is continuing to use discretion on enforcing payer data exchange guidelines introduced in a May 2020 interoperability rule, HHS stated in a Dec. 7 notice.  * * * “We are now announcing that we expect to extend this exercise of enforcement discretion of the payer-to-payer data exchange requirement until we are able to address the identified implementation challenges through future rulemaking,” the notice stated. “We anticipate providing an update on any evaluation of this enforcement discretion notification and related actions during calendar year 2022.” This is one of the 21st Century Cures Act’s three interoperability initiatives for HHS regulated health plans.
  • “Health and Human Services Secretary Xavier Becerra today announced that Lawrence A. Tabak, D.D.S., Ph.D., the principal deputy director of the National Institutes of Health (NIH), will serve as the acting director of NIH effective December 20, 2021.”

President Joe Biden selected 230 federal leaders to receive a Presidential Rank Award in 2021, nearly double the usual number of employees recognized.

The Presidential Rank Awards are one of the most prestigious civil service recognitions and come with a 35% of base salary award for Distinguished Rank recipients, who have demonstrated sustained, extraordinary career accomplishments, and a 20% award for Meritorious Rank recipients, who have demonstrated sustained accomplishments.

Congratulations to the recipients.