Monday report

David Ermer

I am an attorney who practices law in Washington DC. My practice has involved the Federal Employees Health Benefits Program since 1983.

Monday report

David Ermer–Agentic & Generative AI, CDC, CMS, FDA, Federal employment benefits, Medical / Rx research, Obesity, OPM, Rx coverage, U.S. Healthcare–

Simplicity is a virtue.

From Washington, DC,

  • Beckers Health IT reports,
    • “The Department of Health and Human Services finalized a rule Oct. 26 eliminating 14 federal health IT certification criteria and scaling back AI transparency requirements, with the agency projecting more than $1.5 billion in regulatory cost savings.
    • “The final rule, known as Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity, or HTI-5, reduces compliance requirements for developers participating in the Office of the National Coordinator for Health Information Technology’s certification program.
    • “HHS initially proposed eliminating 34 of the program’s 60 certification criteria in December 2025. The final rule takes a narrower approach, removing 14 criteria and revising seven while leaving 39 unchanged.
    • “Among the changes is the elimination of AI model-card requirements within the decision support interventions certification criterion. Those requirements, established under the HTI-1 rule, were intended to give healthcare organizations information about predictive algorithms and other decision-support tools incorporated into certified health IT.
    • “The rule also removes or revises requirements involving care coordination, patient engagement and certain health data exchange capabilities, and formally removes a clinical decision support criterion that expired Jan. 1, 2025.”
  • More is information about the final rule can be found at healthit.gov/hti5, on LinkedIn, or by following @ONC_HealthIT on X.
  • Healthcare Dive adds,
    • “The healthcare industry is slowly but surely moving away from the old, fragmented and manual way of handling prior authorization toward a modernized electronic system.
    • “CMS-regulated payers, such as Medicare Advantage, Medicaid and marketplace insurers, are now confronting a Jan. 1 deadline to implement the three prior authorization application programming interfaces — sets of rules that enable computer programs to communicate directly with one another —  under a federal interoperability rule that was finalized in 2024.
  • Beckers Hospital Review considers five big questions as the 340B drug rebate pilot nears launch on January 1, 2027.
  • Beckers Payer Issues relates,
    • “Ghost networks have long been a point of frustration, with health plan members sometimes left scrambling to check if a provider is in network — or available at all.
    • “Several health insurers — including Elevance Health and Blue Shield of California, in recent months — have faced lawsuits concerning the accuracy of their provider directories. Some of these complaints said that seemingly bigger networks draw more customers, even if that appearance is ultimately misleading.
    • “But more recent developments have pointed to ongoing issues. One study published in October found more than half of secret-shopper calls made to psychiatrists and psychologists across six Blue Cross Blue Shield plans’ directories indicated errors. Separately, this fall, UnitedHealthcare mistakenly told members that eight clinicians had died before correcting the issue. 
    • “While the No Surprises Act, state laws and CMS rules have targeted ghost networks and network adequacy before, there has been a renewed focus on getting directories right.
    • “On Oct. 13, DataSpring, powered by CAQH, rolled out a new standard to measure provider directory data quality for individual clinicians. DataSpring convened major insurers, the American Medical Association and the National Committee for Quality Assurance to develop a framework rooted in the CMS quality foundation for provider directories.”
  • Per a Department of Health and Human Services news release,
    • “U.S. Department of Health and Human Services (HHS) Secretary Robert F. Kennedy, Jr. brought his “Take Back Your Health Tour” to Texas and Florida last week to advance President Trump’s Make America Healthy Again agenda. Across four days, Secretary Kennedy announced new actions on kidney disease and dementia, promoted stronger nutrition education for future doctors, and worked to expand access to women’s healthcare.
    • “From Tuesday through Friday, Secretary Kennedy met with healthcare providers, patient advocates, medical educators, and pharmaceutical manufacturers in Fort Worth, Texas, and Orange Park, Fort Lauderdale, and Miami, Florida.  At each stop, he advanced concrete actions to prevent chronic disease, improve patient care, and give Americans more information and choices to protect their health.
    • “President Trump has directed us to confront chronic disease and put patients first,” said HHS Secretary Robert F. Kennedy, Jr. “Across Texas and Florida, we put that mission into action — detecting kidney disease earlier, strengthening nutrition education for future doctors, advancing prevention and care for families facing dementia, and expanding access to women’s health treatments. HHS is moving prevention to the center of American health care and giving patients more control over their health.”
  • Bloomberg Law notes,
    • “One of the Department of Labor’s key policy advisers is departing the Employee Benefits Security Administration, following completion of the agency’s recent rulemaking on pharmacy benefit managers and healthcare price transparency.
    • “EBSA Senior Policy Advisor Caitlin Soto announced on LinkedIn that Friday would be her last day, calling her time at the DOL “the honor of my career.”
    • “Leading the Department’s PBM Fee Disclosure rulemaking, after nearly a decade of PBM transparency work, was the highlight,” she wrote in her post. “I’m also proud of our work on behalf of this administration to advance fertility benefits, transparency in coverage, and mental health parity. The list goes on.”
    • “The department is expected to release a rule in the coming days requiring PBMs — which negotiate drug prices for health plans — to disclose detailed compensation information to employers and other health plan sponsors. DOL also recently finalized a rule aimed at strengthening price transparency for medical services.”

From the U.S. Office of Personnel Management front,

  • Federal News Network reports,
    • “More details are emerging on the Trump administration’s revisions to paid administrative leave. Agencies’ ability to pay employees not to work during workforce reduction efforts has been formalized. Paid leave will also be allowed during reduction-in-force notice periods, the Office of Personnel Management said. OPM’s latest guidance comes after it finalized regulations to conform with the rules for the deferred resignation program. OPM is expected to soon update other online resources to reflect the new regulations. — Drew Friedman (Revised administrative leave regulations – Office of Personnel Management)”
  • and
    • “The White House is following a court’s order when it comes to reduction-in-force policies. The Office of Management and Budget and the Office of Personnel Management have formally rescinded two memos calling for reductions in force during shutdowns. The Trump administration agreed to terminate the two memos as part of its settlement in September to end a lawsuit by a coalition of federal employee unions including the American Federation of Government Employees, National Federation of Federal Employees and National Treasury Employees Union. Along with the removing the two memos, the Trump administration agreed to rescind every RIF notice issued during the 2026 shutdown and reinstate employees with back pay from the State Department, General Services Administration and Small Business Administration. Additionally, agencies must remove from their shutdown contingency plans any language authorizing RIFs, or RIF work, during a lapse in appropriations, unless a statute expressly permits it. — Jason Miller (OMB rescinds memo allowing RIFs during shutdowns – Office of Management and Budget)

From the U.S. Food and Drug Administration front,

  • Bloomberg Law reports,
    • “A recently launched FDA initiative targeting rare diseases is a top focus to carry out, the agency’s acting chief said ahead of a public meeting Wednesday to solicit feedback on the framework. 
    • “We’ve got to make sure that that process is in place. We’re working really hard to do it,” Kyle Diamantas, acting commissioner for the Food and Drug Administration, said Monday at the National Organization for Rare Disorders’ breakthrough summit. “It’s a top priority of mine.”
    • “Earlier this month, the agency introduced the Rare Disease Framework Initiative, which seeks to give patients more input and drug companies more transparency in the regulatory process for rare treatments. The initiative aims to develop a fit-for-purpose plan that considers the nuances of each disease and patient needs.”
  • Michigan Engineer relates,
    • “Conventional methods of pulling clots out through the blood vessels can damage fragile vessel walls.
    • “The newly FDA-cleared technology gently pulls on the clot with suction, stretches and thins it with an agitator, and vacuums it out of the body. 
    • “The device was designed by a team of neurosurgeons and engineers at the University of Michigan and is being commercialized by U-M startup Endovascular Engineering.”
  • Per a Pfizer news release,
    • “Pfizer Inc. (NYSE: PFE) today announced that the U.S. Food and Drug Administration (FDA) has expanded approval of TALZENNA® (talazoparib) in combination with XTANDI® (enzalutamide) to the treatment of men with metastatic androgen pathway modulation-naïve or -sensitive (mAPMN/S) prostate cancer (PC) with homologous recombination repair (HRR) gene mutations, including both BRCA and non-BRCA mutations. mAPMN/S is also known as metastatic hormone-sensitive prostate cancer (mHSPC).
    • “This approval makes TALZENNA, an oral poly ADP-ribose polymerase (PARP inhibitor), plus XTANDI, an androgen receptor pathway inhibitor (ARPI), available in an earlier line, providing an opportunity to delay disease progression at a critical stage when more patients may experience greater benefit.”

From the judicial front,

  • Bloomberg Law reports,
    • “Eli Lilly & Co. is forming a new battlefront over a weight loss treatment that has yet to secure FDA approval, intensifying a legal drive to protect its blockbuster obesity franchise.
    • “The pharmaceutical giant has filed at least 11 federal lawsuits against a range of online vendors and wellness clinics making copycat versions of its experimental drug retatrutide, accusing them of illegally selling or facilitating access to a product not approved by any regulator in the world.
    • “The crackdown escalates the company’s broader legal campaign against businesses making copies of its powerful therapies, establishing a new wave of aggressive challenges over a drug predicted to outperform currently marketed weight loss treatments. Retatrutide is still in clinical trials for obesity, type 2 diabetes, and other related conditions.” * * *
    • “Lilly’s endeavor to protect retatrutide is also focusing on the FDA, as it plans to submit an application to the regulator in the first quarter of next year. 
    • “The drugmaker is simultaneously in a legal battle with the regulator after the agency determined a few years ago that retatrutide is a drug and not a biologic — a crucial designation that shapes its market exclusivity and when Medicare can negotiate its price.
    • “A biologic designation would grant retatrutide 12 years of protection from competitors, while small molecule drugs get five. Significant for Lilly, a biologic classification would prohibit compounded versions. 
    • “The FDA earlier this month doubled down on retatrutide’s drug label after a federal court sent the determination back to the agency for review, concluding the product doesn’t meet an amino acid length threshold that would count it as a biologic.
    • “An appeals court is now weighing whether it has jurisdiction to review the battle.”

From the public health and medical / Rx research front,

  • Beckers Clinical Leadership reports,
    • “Nearly 1 in 10 adults hospitalized with respiratory syncytial virus infection died in the hospital or within 30 days of discharge, according to preliminary CDC data.
    • “Researchers analyzed RSV hospitalization data from the CDC’s Respiratory Virus Hospitalization Surveillance Network, which tracks hospitalizations with lab-confirmed influenza, COVID-19 or RSV in 14 states and more than 300 hospitals. The analysis included 18,301 RSV hospitalizations among adults across eight seasons from 2014 to 2024.” 
  • MedPage Today lets us know,
    • “Obesity in young adulthood was associated with significantly increased likelihood of early-onset cancers in an observational study, a risk that persisted into middle age.
    • “Men had a higher cancer risk than women, and abdominal fat further increased cancer risk beyond BMI alone.
    • “Cancer rates were highest for thyroid, endometrial, and ovarian cancers.”
  • STAT News relates,
    • “Women’s hearts are different from men’s. Research from clinical trials that have required female participants only since 1993 have repeatedly drummed home that message, from varying chromosomes in heart muscle cells to different heart attack symptoms and causes. Yet wide gaps remain in heart health care for girls and women across specialties. 
    • “Recognizing that clinical fragmentation and the resulting harm to women’s health, four medical societies — the American Heart Association, American Academy of Pediatrics, Society for Maternal-Fetal Medicine, and the American College of Obstetricians and Gynecologists — have issued a framework intended to unite clinicians and patients over a lifetime of care, all aimed at dethroning cardiovascular disease as the leading cause of death in women. In that spirit, three articles offering guidance across the course of a woman’s life were published Monday in Circulation.
    • “Their message: Because female-specific biology affects girls’ and women’s hearts throughout their lives, it requires connected, holistic care starting in adolescence to reflect transitions not found in the male models that have dominated health care: periods, pregnancy, perimenopause, and menopause.” 
  • Radiology Business points out,
    • “The performance of digital breast tomosynthesis—commonly referred to as 3D mammography—improves steadily with patient age, underlying the effectiveness of screening in an elderly population. 
    • “That’s according to new large-scale research from Massachusetts General Hospital, published Friday in RSNA’s Radiology Imaging Cancer. 
    • Current mammography guidelines remain largely age-based, with the influential U.S. Preventive Services Task Force’s last update in 2024 advocating for screening starting at 40. However, USPSTF claimed current evidence was insufficient to weigh the benefit of screening for women 75 and older. 
    • “Researchers with the Harvard University-affiliated institution recently sought to address this knowledge gap, analyzing data from over 300,000 mammograms. They found screening to be increasingly effective, particularly among the elderly, based on common quality benchmarks. 
    • “Cancer detection and sensitivity increased, false-positive rates declined, and specificity improved, resulting in particularly strong performance among female individuals aged 70 years and older,” lead author Leslie R. Lamb, MD, MSc, with Boston-based Mass General’s Department of Radiology, and colleagues wrote Oct. 23. “These findings provide a contemporary benchmark for screening DBT performance across age groups and contribute to the ongoing reassessment of age-based screening guidelines,” they added later. 
  • Healio notes,
    • “Most U.S. women know physical activity reduces breast cancer risk, but only one-quarter meet recommended levels.
    • “A majority know alcohol raises cancer risk, but two-thirds consume alcohol to some extent.”
  • Health Day adds,
    • Marijuana legalization may be landing more people in the hospital with heart problems, a new study suggests.
    • For the study, researchers analyzed more than 50 million hospital discharge records spanning 2012 to 2018. They compared Western states, where recreational marijuana sales began in 2014, with other U.S. regions.
    • The study — led by Dr. Samuel Slavin, of the Boston University Chobanian & Avedisian School of Medicine — found that hospital admissions for several serious heart conditions rose faster after legalization.
    • For each year of sales, admission rates were nearly 4% higher for heart failure, 3% higher for heart attacks and just over 2% higher for atrial fibrillation — an abnormal heart rhythm.
    • Rates for stroke, deep vein blood clots and tachycardia — a fast heartbeat — were also higher, but not statistically significant.
    • While the study cannot prove cause and effect, researchers said their findings “point to potential adverse effects of recreation legalization on population health.”
  • The Washington Post tells us about “the most important things to do to stay healthy while traveling.
    • “An infectious-diseases doctor shares essential tips to prepare for any health issues while traveling in another country.”
  • Beckers Behavioral Health informs us,
    • “Nearly 1 in 3 young adults in the U.S. reported using generative AI to seek substance-related information, with higher rates of use among Black and male respondents, according to a study published Oct. 19 in JMIR Formative Research.
    • “Researchers at Rutgers, the State University of New Jersey in New Brunswick, surveyed 995 U.S. adults ages 18-29 in April 2026 through the online research platform Prolific. The cross-sectional study examined the prevalence and frequency of, and reasons for, substance-related AI use, along with demographic differences and perceptions of the technology.”
  • and
    • “Researchers have identified evidence supporting a potential subtype of clinical depression, known as “circadian depression,” defined by disrupted sleep-wake patterns and associated with more severe symptoms and poorer responses to commonly prescribed antidepressants, according to a study published Oct. 20 in The British Journal of Psychiatry.
    • “The study, led by researchers from the University of Sydney’s Brain and Mind Centre, analyzed data from 11,380 adults with depression in the Australian Genetics of Depression Study. Researchers classified participants as having a circadian subtype if they met at least three of six criteria related to sleep and circadian disruption: social jetlag, seasonality, delayed sleep midpoint, evening chronotype, morning tiredness and hypersomnia. They compared clinical characteristics, self-reported antidepressant responses and genetic risk profiles between groups.”
  • Physicians’ Weekly informs us,
    • “Compared with patients with normal weight or overweight, the odds of death after emergency general surgery increase 92% for patients with underweight and 59% for patients with frailty, according to findings presented at the American College of Surgeons (ACS) Clinical Congress 2026 in Washington, DC.
    • “Our study shows that patients who are both underweight and frail have the worst outcomes,” said lead study author Ellen Cohn, MD, MPH, of the University of Chicago, in a news release. “We also saw that frailty reduces the positive impact of the obesity paradox — the finding that patients who are overweight, but not at the extremes of obesity, tend to have better outcomes. That protective effect is lost if a patient is frail.”   
  • Per Fierce Pharma,
    • “Fresh off the excitement of Rasonque’s big splash in pancreatic cancer, the oncology community has another impressive clinical win to celebrate. Amgen’s T-cell engager Imdelltra has posted a massive survival benefit in small cell lung cancer, delivering what Chief Medical Officer Paul Burton, M.D., Ph.D., called a “watershed moment” for the field.
    • “When added on top of AstraZeneca’s Imfinzi, Imdelltra reduced the risk of death by 58% as a first-line maintenance therapy for patients with extensive-stage SCLC who had not progressed following initial treatment with Imfinzi and chemotherapy.
    • “The result came from the phase 3 DeLLphi-305 study, which showed that, compared with Imfinzi alone, Imdelltra plus Imfinzi improved median overall survival by 8.4 months to 21.1 months. These data are being presented during a presidential symposium at the European Society for Medical Oncology Congress 2026 and simultaneously published in The New England Journal of Medicine.”
  • and
    • “As a cornerstone of Merck & Co.’s post-Keytruda oncology strategy, sac-TMT has cleared a clinical milestone. In its first global phase 3 win, the TROP2 antibody-drug conjugate delivered results that are “pretty consistent” with earlier China data, according to Marjorie Green, M.D., Merck’s head of oncology clinical development.
    • “Sac-TMT, partnered with China’s Kelun-Biotech, reduced the risk of death by 32%—and the risk of disease progression or death by 41%—compared with chemotherapy in patients with previously treated endometrial cancer. The patients had received prior treatment with platinum-base chemo and PD-(L)1 inhibitor therapy.
    • “Derived from the TroFuse-005 trial and presented at the European Society for Medical Oncology 2026 Congress, the data gave sac-TMT its first positive global phase 3 report out of 18 trials that Merck has launched in one of the industry’s broadest clinical development programs for a single drug.” 
  • and
    • “Novartis lifted the veil on its phase 3 wins in relapsing multiple sclerosis (RMS), announced in early September. 
    • “Not only did the company’s BTK inhibitor Rhapsido reduce relapses and disease progression compared to Aubagio, an older RMS treatment from Sanofi, but it did so without inciting any liver issues, a side effect that has proven to be an ongoing barrier to success of the drug class in this indication. 
    • “Novartis said it plans to seek regulatory approval globally in RMS. Its applications will be backed by data from the Remodel-1 and Remodel-2 trials presented at MSToronto last week and simultaneously published in The Lancet.”
  • BioPharma Dive adds,
    • “An antibody-drug conjugate from BioNTech and DualityBio met its main goal in a Phase 3 study in breast cancer, but may only have a “limited” impact in people with the condition, the companies said Monday.
    • “The treatment, known as trastuzumab pamirtecan, successfully delayed tumor progression in a trial of people whose breast tumors express low, but still detectable levels of the HER2 protein. The improvement on that measure was “modest,” though, and treatment was also associated with higher rates of interstitial lung disease — a potentially deadly kind of lung inflammation — than the companies had seen in earlier testing.” 
  • The Wall Street Journal reports,
    • “Roche Holding ROP said it expects a pill it is developing to become the new standard treatment for an advanced form of lung cancer, and the company’s first shot at an emerging field within the oncology market.
    • “The Swiss drugmaker is working on several drugs that target a driver of cancers that long eluded the industry. A breakthrough in pancreatic cancer from U.S. biotech Revolution Medicines put the field on investors’ radar, and Roche aims to venture into it with lung-cancer medicine divarasib.
    • “In study results presented Sunday at the annual congress of the European Society for Medical Oncology in Madrid, Roche said its drug lowered the risk of death by 44% compared with available treatments from Amgen and Bristol-Myers Squibb. The late-stage clinical trial compared the effects of the drugs on patients with a specific type of lung cancer who had been previously treated.
    • “Fewer participants who took divarasib dropped out of the trial due to side effects than those who received the existing drugs, Roche said.
    • “The data are practice-changing,” Roche’s Deputy Chief Medical Officer, Stefan Frings, said in an interview.”

From the U.S. healthcare business and artificial intelligence front,

  • Fierce Healthcare reports,
    • “Earlier this year, UnitedHealthcare unveiled Avery, a generative AI companion aimed at supporting care coordination for its members.
    • “At the time, the tool was available to about 6.5 million of its members in employer plans and 160,000 people enrolled in Medicare Advantage. Now, the insurer is expanding access to 21 million of its members, growing the tool’s reach at a faster clip than was initially expected.
    • “To date, the company has found that Avery has resolved 90% of its member interactions, and in the remaining 10% of cases, can complete a handoff to a human advocate to offer member support. 
    • “As we’re seeing some of the statistics and some of the feedback that we’re getting from users around the success we’ve had within the early phases of Avery, it’s just making sense to open up that application into more and more of the population,” Craig Kurtzweil, chief data and analytics officer at UnitedHealthcare, told Fierce Healthcare.”
  • and
    • “Building stronger bridges between payers and providers will prove critical in addressing the biggest challenges facing healthcare: affordability and access.
    • “It’s with that backdrop that Aetna is releasing its latest provider survey, a quarterly poll that seeks to better understand providers’ perspective on their insurer counterparts and where there’s room to continue developing trust between the two. In the third quarter survey, provided first to Fierce Healthcare, Aetna found a trust score of 6 out of 10, on par with the 6.1 score seen in Q2.
    • “The tally makes for a significant increase from the first quarter, where the trust score was 5.4.
    • Steve Nelson, president of Aetna, told Fierce that “trust is at an all-time low,” so the insurer has been putting an emphasis on addressing some of the biggest pain points that erode that trust, including administrative burdens like prior authorization and increasing transparency.
    • “It’s not just a hope and a prayer here,” he said. “We’re actually making progress.” 
  • and
    • “Doximity inked a partnership with Wolters Kluwer Health to embed UpToDate’s evidence-based clinical content directly within Doximity Ask, the company’s AI clinical decision support tool.
    • “In the coming weeks, at health systems that use both products, clinicians will see an answer based on UpToDate’s 13,000 clinical topics and best practice guides alongside Doximity Ask’s response, without leaving the Ask workflow.
    • “Doximity is a digital platform for U.S. medical professionals that offers workflow tools such as a telehealth solution, a clinician-to-patient dialer tool and digital faxing capabilities.
    • “The company aims to become a leading AI platform for doctors with plans to scale its clinical AI suite, including its ambient note-taking tool Scribe and clinical AI assistant and medical search engine Ask. A year ago, Doximity acquired clinical AI company Pathway and then integrated Pathway’s datasets and its AI into its free Doximity GPT product to offer DoxGPT (now Ask).”
  • Beckers ASC Review relates,
    • “On Oct. 26, Cincinnati-based Bon Secours Mercy Health agreed to acquire Brentwood, Tenn.-based Surgery Partners through its affiliate HealthSpan Partners in a take-private deal valued at about $5.7 billion including debt. 
    • “The transaction would add more than 200 ASCs, surgical hospitals and physician practices across 30 states, along with about 5,000 affiliated physicians, to a 47-hospital system — making the latest in a growing group of health systems that have shifted ambulatory care from a nice-to-have to a strategic imperative.
    • “It most recently follows St. Louis-based Ascension’s $3.9 billion acquisition of Nashville, Tenn.-based Amsurg, which closed earlier this year, and comes as Dallas-based Tenet Healthcare keeps adding to United Surgical Partners International, its surgical arm and the nation’s largest ASC portfolio.”

Weekend report

David Ermer–Agentic & Generative AI, Congress, FDA, Medical / Rx research, Rx coverage, U.S. Healthcare–

Simplicity is a virtue.

From Washington, DC,

  • Congress remains on the campaign trail this week.
  • Per an October 23, 2024 Department of Health and Human Services news release,
    • “The Trump Administration today announced the America First Seafood Strategy, Restoring American Seafood Competitiveness [PDF], a coordinated federal plan to strengthen American seafood production, modernize infrastructure, expand markets for U.S. fishermen and processors, and combat unfair foreign competition. The strategy advances President Trump’s Executive Order, Restoring American Seafood Competitiveness, and his commitment to rebuild America’s seafood industry, strengthen domestic production, and Make America Healthy Again by expanding access to nutritious, American-caught seafood as part of a healthy diet.” * * *
    • “The draft [FDA] guidance notes that U.S. origin statements should be fully substantiated. Ensuring the integrity of these statements helps protect both consumers and the producers who invest in American sourcing. For more information, visit Seafood.gov.
  • FedSmith reports,
    • “The Social Security Administration (SSA) announced on October 20 that it is including a new insert with Social Security cards mailed to newborns through its Enumeration at Birth program. The insert explains how parents can claim and manage a Trump Account, including how eligible children can receive a one-time $1,000 contribution from the Treasury Department.”
    • “The full announcement is available in SSA’s official release.”

From the U.S. Office of Personnel Management front,

  • FedSmith explains “How Starting an HSA This Open Season Can Cut Costs, Lower Taxes, and Build Savings.”
  • Yahoo Finance adds,
    • “A 62-year-old taking an overnight mail-processing job is choosing a paycheck, but the job works mostly as a health insurance plan. As of January 1, 2025, postal workers left the Federal Employees Health Benefits program for the Postal Service Health Benefits (PSHB) program. A non-career hire can join PSHB after an initial term, and the Postal Service pays most of the premium; after five years of career service and continuous enrollment, that subsidized plan becomes retiree coverage for life.
    • “A 62-year-old taking an overnight mail-processing job is choosing a paycheck, but the job works mostly as a health insurance plan. As of January 1, 2025, postal workers left the Federal Employees Health Benefits program for the Postal Service Health Benefits (PSHB) program. A non-career hire can join PSHB after an initial term, and the Postal Service pays most of the premium; after five years of career service and continuous enrollment, that subsidized plan becomes retiree coverage for life.”

From the public health and medical / Rx research front,

  • STAT News reports,
    • “No surprise, the arena-sized room was packed with ESMO attendees eager to see Georgina Long of the Melanoma Institute Australia present the intismeran INTerpath-001 study results. The unfortunate data leak on Thursday made her talk less dramatic, but at the end, she received extended applause and a limited standing ovation. 
    • Long summarized the intismeran results — a 42% reduction in the risk of disease recurrence and a 38% reduction in the risk of distant metastasis-free survival — as a “new benchmark for adjuvant treatment of melanoma.”
    • “More critically,” she added, “it establishes intismeran as a landmark advance in personalized cancer medicine.” 
    • “The full trial data will be published next month in the New England Journal of Medicine, Long also noted. 
    • “Inge Marie Svane of the University of Copenhagen, the discussant following the data presentation, was positive if not overly enthusiastic about the trial, describing the results as “compelling” and adding that they “mark a crucial moment for personalized cancer vaccines.”
    • “But Svane also pointed to a number of outstanding questions, including whether there would be a survival benefit with intismeran, and what exactly was driving the vaccine’s benefit — was it the specific targeting of the neoantigens, or was it the general immune boost that studies have suggested mRNA vaccines provide?
    • “She also took no position on the best way to treat the approximately 40% of higher risk melanoma patients enrolled in the study — a key debate with commercial implications. If intismeran is approved, it will compete against neoadjuvant immunotherapy, or treating patients before surgery. Svane laid out pros and cons of each approach, leaving the question of which will benefit patients more unanswered.”
  • Healio relates,
    • “A phase 3 clinical trial revealed that the investigational vaccine candidate — known as LB6V — showed more than 70% efficacy against confirmed Lyme disease, according to results presented at IDWeek.
    • “But, in the end, the drug failed to hit its primary endpoint.
    • “LB6V has a “clinically meaningful” efficacy, researcher Paul G. Auwaerter, MD, clinical director of the division of infectious diseases and professor of medicine at Johns Hopkins University School of Medicine, said during the presentation.” * * *
    • “I believe that LB6V is safe and has a favorable side-effect profile,” Auwaerter said.” * * *
    • “Auwaerter did not mention the drug’s potential approval or launch during his presentation.”
  • Genetic Engineering and Biotechnology News adds,
    • “The results of a preclinical study headed by researchers at Johns Hopkins University School of Medicine suggest that the Bacillus Calmette-Guerin (BCG) vaccine, which is widely used to prevent tuberculosis and treat bladder cancer, may also have properties that reduce the risk for dementia. BCG is a live, weakened vaccine made from an altered strain of the bacterium Mycobacterium bovis.
    • “The team found that in mice genetically engineered to develop biological symptoms of dementia (PS19 mice), those animals that received the BCG vaccine were less likely to show hallmark signs of the disease, such as neurofibrillary (tau) tangles (NFTs) in the brain, sustained immune cell activation, and memory loss compared to mice that received no vaccine. BCG-treated mice performed better in a novel object recognition test, and showed improved maintenance of body-weight and survival.
    • “Research lead William Bishai, MD, PhD, co-director of the Johns Hopkins Center for Tuberculosis Research, believes that myeloid cells in the central nervous system and brain are using information from BCG to recognize and help the body respond to the formation of plaques and tangles characteristic of Alzheimer’s disease and related dementias. Bishai said, “We’re hard at work trying to understand the detailed mechanism for how it works, but this research points to early clues that aspects of trained immunity are likely driving this response.”
  • Health Day lets us know,
    • “Jumping rope, stair climbing, power yoga, vigorous cleaning and gardening can all count as at-home cardio
    • “Adults should aim for 150 to 300 minutes of moderate or 75 to 150 minutes of vigorous activity weekly
    • “Short bursts of movement add up, so even climbing a few flights of stairs counts toward your weekly goal.”

From the U.S. healthcare business and artificial intelligence front,

  • pwc consulting informs us,
    • “American healthcare was built by local institutions and independent physicians, yet it is now evaluated on national cost trends, consistent quality, and compliance with standardized payment models, all while still being expected to deliver care locally and personally. That tension, not any single policy or technology, is the throughline behind every challenge in this paper.
    • “The system faces seven distinct but connected challenges, spanning consumer expectations, care coordination, innovation speed, regional divergence, chronic care, national infrastructure, and technology adoption.
    • “Each of these seven structural challenges have a clear historical parallel, from 19th-century public health reform to the rise of AI, showing these are patterns, not new problems.
    • “The real bottleneck isn’t invention, it’s adoption that challenges the conventional norms and barriers that keep proven solutions from reaching scale. Time and again, technology and care models have proven themselves years or decades before the system used them.
    • “The next era won’t be measured by activity, it’ll be measured by impact. The organizations that win will likely be judged by how much healthier people became, not how many visits, procedures, or dollars were logged along the way.”
  • Beckers Hospital Review reports,
    • “Duluth, Minn.-based Essentia Health reported a 1.2% operating margin in fiscal 2026, down from 2.2% a year earlier, as expenses outpaced revenue growth ahead of its proposed merger with Bloomington, Minn.-based HealthPartners.
    • “Essentia reported $42.3 million in operating income for the fiscal year ended June 30, down 41% from $71.6 million in fiscal 2025, according to its Oct. 14 audited financial report. 
    • “Operating revenue increased 6.4% year over year to $3.49 billion, while operating expenses rose 7.5% to $3.45 billion. Patient service revenue grew 7.1% to $3.41 billion, driven primarily by outpatient revenue, which increased from $2.48 billion to $2.67 billion. Inpatient revenue rose from $673 million to $702 million. Salaries, wages and benefits increased 6.3% to $2.02 billion, while supply expenses climbed 11.4% to $809.5 million.
    • “Essentia reported $281.8 million in nonoperating gains, up from $169 million in fiscal 2025, driven largely by investment gains. The system posted a $324 million in net income, compared with $241 million a year earlier.”
  • and
    • “Greensboro, N.C.-based Cone Health plans to acquire three pharmacy businesses in Reidsville, N.C., expanding its retail pharmacy footprint and adding long-term care pharmacy services.
    • “The agreement includes Carolina Apothecary, Belmont Pharmacy and Rx Care, which have served Rockingham County residents for decades. The deal is expected to close in early 2027, pending regulatory approvals and closing conditions.
    • “The businesses will become Cone Health Community Pharmacy locations, offering closer coordination between pharmacists and healthcare providers, competitive medication pricing and onsite vaccinations.’
  • Beckers Payer Issues adds,
    • “AI, new product lines, shrinking broker networks and increasingly self-directed consumers will reshape the health insurance landscape in 2027, according to two reports from Forrester published Oct. 14, which covered the global insurance and healthcare industries broadly.
    • “Here are the firm’s 10 health insurance industry predictions for next year:
      • “Half of the 10 largest payers will launch alternative health plans.
        • “Existing alternative health plan examples include UnitedHealthcare’s Surest and Health Care Service Corporation’s new Easify Edge product’.
      • “More than half of consumers will start their healthcare journey using public AI models (such as ChatGPT or Claude), with 42% of consumers polled by Forrester already using an answer engine for healthcare advice.” 
      • “A third of insurers will integrate agentic AI into customer experience, but most will not let it make binding coverage or claims decisions. Forrester pointed to Allianz’s Project Nemo as an example of how large payers are using agentic AI to automate analysis and orchestrate workflows.”
      • “AI agents, not physicians, will perform 20% of routine care check-ins.”
      • “GLP-1 adoption will reach 20% of Americans, inspiring new drug pathways.”
      • “At-home tests will become a new digital divide and increase healthcare inequities.”
  • Beckers Physicians Leadership tells us,
    • “Median pay for cardiologists 35 and younger fell about 19% in 2025, even as overall cardiology compensation reached a record high, according to an October MedAxiom’s 2026 Cardiovascular Provider Compensation and Production Survey.
    • “Early-career cardiologists earned a median $476,850 in 2025, down from $586,769 in 2024. It was the second straight annual decline for the group. Over the same period, overall median compensation per full-time cardiologist rose nearly 5%, to $727,712 from $694,954, and every cardiology subspecialty posted its highest median pay in the survey’s history. 
    • “MedAxiom described the decline as surprising, given how hard cardiology programs are working to recruit physicians. The report doesn’t collect starting salary data, so it uses physicians 35 and younger as a proxy for early-career pay.”

Cybersecurity Saturday

David Ermer–Agentic & Generative AI, Congress, Cybersecurity–

From the frontier AI front,

  • The American Hospital Association News reports,
    • “Two critical vulnerabilities have been discovered in Hypertext Preprocessor, or PHP, a widely-used open-source scripted language for web development, its creators announced Oct. 21. The vulnerabilities reportedly impact a majority of the world’s websites. The two issues can allow unauthenticated remote code execution. The notice advises all PHP users to download updates immediately, as all PHP installations serving web requests are at risk. The National Security Agency advised organizations to take their systems offline if an immediate update is not feasible, and that the agency will soon issue specific guidance. An AHA Cybersecurity Advisory released Oct. 21 provides additional details and recommendations.”
  • The Wall Street Journal explains why this is a frontier AI story.
    • “First, artificial intelligence heralded the Bugmageddon. Now it is triggering an all-hands-on-deck cyber emergency. 
    • “The creators of PHP, a technology that powers as much as 70% of the world’s websites, disclosed a critical security issue Wednesday that could be leveraged by hackers to take control of any system running its software. That would allow an attacker to steal information or launch a cyberattack on anyone visiting a hacked website.
    • “Security researchers found the vulnerability using AI. Now web administrators are scrambling to protect themselves from the vulnerability, which cutting-edge AI systems could quickly exploit.”
    • “Ryan Austin, a researcher at Calif, uncovered the flaws with help from GPT-5.6 Sol, one of OpenAI’s most advanced models, during an audit of PHP’s source code in August [2026]. OpenAI funded that and other audits, part of an effort by AI companies to help open-source projects address software vulnerabilities now being uncovered by artificial intelligence systems.
    • “The class of bugs had been hiding in PHP’s source code for years. A security researcher had flagged it as a problem area decades earlier, but the flaw had been considered too difficult to exploit and was largely forgotten, Duong said. 
    • “AI found a way. Austin figured out how to control the code that was running in the computer’s memory with as few as a few dozen requests to a server running PHP. On smaller systems, the hack takes just seconds. On more complex ones, it can take hours.” * * *
    • “PHP2Shell is “the most severe AI vulnerability that was ever found,” and one that was likely too complex to have been discovered without AI, said Ami Luttwak, Wiz’s co-founder. 
    • “Duong and the other researchers kept its existence a closely guarded secret while they worked on fixes, for fear that an AI-aided hacker might find and exploit it before they were done. 
    • “The patching effort was massive. There are close to 200 files being fixed and developers wrote over 10,000 lines of code during the process. 
    • “Eventually, a patch date was set: October 22. Then, the inevitable happened. News of the patch leaked out Tuesday, in a post to Hacker News, just under two days before the patch release.
    • “Dusch’s team decided to rush out the patch. On Tuesday, they warned the world to stand by and expect a critical security update on Wednesday [October 21].”
  • Bleeping Computer and Cybersecurity Dive add,
    • [BC] “Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday [October 21]. * * *
    • “According to Amazon, the first exploitation attempts began on Saturday, October 17 (four days before the PHP2Shell patches were released), and attackers deployed multiple proof-of-concept PHP2Shell exploits hours after disclosure from VPN IP addresses.
    • “The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” said AWS chief information security officer CJ Moses.
    • “The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.”
    • “Moses added the PHP2Shell vulnerabilities are “now being broadly exploited in the wild,” though it’s unclear how many attacks are successful, and warned that “defenders should not assume the public disclosure date is the earliest date of exploitation.”
  • and
    • [CD] “Security researchers warn that millions of websites remain at risk as exploitation attempts against two critical flaws in PHP have surged. 
    • “The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can enable an attacker to achieve remote-code execution. Each has a severity score of 9.2 out of 10. 
    • “Exploitation attempts have surged since the vulnerabilities were first disclosed, and researchers have uncovered threat activity from Potassium, a Mirai-derived botnet originally discovered in March. 
    • “Arctic Wolf said it observed an exploitation attempt that combined a “command-execution validation with a second-stage payload delivery.” 
    • “Two malicious binaries were identified within the payload hosting infrastructure, but Arctic Wolf said it did not find enough evidence to show successful downloading or execution. 
    • “Researchers from Sophos also observed threat activity linked to Potassium, but they were able to block an attack. An examination of the sample showed an updated and ‘significantly expanded’ version of the botnet variant, Sophos said.” 
  • Here is a link to the October 23 alert from CISA about the PHP vulernability.
    • “CISA has updated this Alert [originally published October 21] to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance.“
  • Dark Reading offers expert guidance on mitigating the PHP vulnerability.
    • “Fixing the critical PHP flaws is not as simple as clicking “Update.” Here’s how to assess your risk, and what you can do to protect yourself.”
  • The Wall Street Journal observes,
    • “The pace and volume of the AI-powered attacks are starting to overwhelm the incident-response firms that respond to cyber breaches. Pundits are referring to the month as “Black October,” and many in the field are predicting more to come.
    • “We expect that there’s going to be a massive number of compromise disclosures in the coming weeks and months,” said Steven Adair, president of the cybersecurity firm Volexity.
    • “Incident responders such as Adair say that AI tools are now being used by nation-state hackers from China and Russia as well as criminals looking to steal data and install ransomware. 
    • “One of the tools they are using is a Chinese open-source hacking tool called Artex, which uses artificial intelligence to automate the process of breaking into a computer network. 
    • “This week Microsoft said that “threat actors across multiple geographic regions” were using Artex to speed up attacks on hundreds of companies. Earlier this month, a cyberattack used Artex to steal data on about 68,000 people from South Korean banks.
    • “Hackers are using AI for reconnaissance, to analyze vast swaths of data they steal and even to rapidly build exploit code that can be used to break into networks, said Sherri Davidoff, founder of the security consulting firm LMG Security.”

From the cybersecurity and law enforcement front,

  • Cyberscoop reports,
    • “A new bipartisan House bill would charge the federal government with developing formal guidance for defending AI models against distillation attacks.
    • “The AI Cyber Defense Act, shared exclusively with CyberScoop ahead of release, is sponsored by Reps. Pat Harrigan, R-N.C., and George Whitesides, D-Calif. It would direct the National Institute for Standards and Technology to develop voluntary industry standards and best practices for preventing distillation attacks from foreign entities from four countries: Russia, China, Iran and North Korea.
    • “In an interview, Harrigan told CyberScoop it is “incredibly expensive” for the U.S. AI industry to maintain its six-to-12 month lead over other countries, and distillation attacks give other parties an incentive to copy other models while keeping their own spending low.
    • “He said he believes countries such as China are making a strategic choice to hold back on full investment of their own AI industry, instead betting they can drift behind American companies as they perform the arduous and expensive research and development to advance the field.”
  • Beckers Health IT relates,
    • “HHS will keep HIPAA civil monetary penalties at 2025 levels and skip its annual inflation adjustment for 2026, the department said in an Oct. 21 Federal Register notice.
    • “The freeze traces to last year’s federal government shutdown. The Bureau of Labor Statistics did not produce October 2025 consumer price index data during the lapse in appropriations from Oct. 1 to Nov. 12, 2025. Federal agencies need that month’s data to calculate the yearly penalty multiplier, so no 2026 multiplier exists.
    • “The Office of Management and Budget canceled the 2026 adjustments for federal agencies in an April 17 memo. HHS’ notice cites that guidance.” * * *
    • “The current HIPAA ceiling is about 46% higher than the $1.5 million cap set under the 2009 Health Information Technology for Economic and Clinical Health Act.”
  • The Cybersecurity Hub Newsletter, writing in LinkedIn, informs us,
    • “The United States has ordered federal civilian agencies to remove DeepSeek technology from their information systems and exclude the Chinese artificial intelligence developer’s products from future procurement, widening restrictions on its role in government operations.
    • “A Department of Homeland Security notice made public on October 19 covers DeepSeek, affiliated companies and third-party products and services developed using DeepSeek implementations. The measure therefore reaches beyond the company’s chatbot to software supplied by other businesses that incorporates its technology.
    • “The official notice, scheduled for Federal Register publication invokes the Federal Acquisition Supply Chain Security Act of 2018. DHS says the decision followed a review of a Federal Acquisition Security Council recommendation and supporting evidence. Its stated scope concerns federal civilian procurement and information systems; it does not announce a nationwide prohibition on private use.”
  • Tech Target reminds us,
    • “The U.S. government is moving closer to requiring covered critical infrastructure organizations to report significant cyber incidents within 72 hours and ransomware payments within 24 hours. But for operators of industrial control systems, the challenge will extend beyond deadline compliance; they must first determine whether an incident has occurred, establish what was compromised and decide whether the data driving physical processes can still be trusted.”
  • Per Security Week,
    • “Effective and efficient use of complex agentic systems is important for all organizations, but recognizing, preventing and recovering from them going rogue could be an existential necessity.
    • “NIST, the NSA, and CISA recognize the increasing potential for AI agents to behave in an unexpected and potentially harmful manner, and has responded with a list of key practices for both preparing for and responding to such behavior. The report (Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation) uses the term super intelligence (SI) rather than artificial intelligence (AI) in line with presidential executive order 14434.
    • “In the report, the ten key practices are grouped into five stages: prepare, detect, respond, recover, and report. For clarity, the report also includes three useful terminology definitions covering AI agents, AI control incident, and AI control near-miss.”
  • The National Institute of Standards and Technology announced
    • “The initial public draft (ipd) of NIST Special Publication (SP) 800-100r1 (Revision 1), Information Security Handbook: A Guide for Executive Leadership, is now available for comment.” * * *
    • “The draft covers:
      • “An overview of key NIST frameworks and how they relate to one another
      • “Governance, including risk management fundamentals and enterprise risk management
      • “Topics organized under the CSF’s Identify, Protect, and Detect/Respond/Recover functions
      • “Continuous monitoring strategy and roles
    • “A public comment review period is open from October 12 to December 4, 2026. Commenters are encouraged to use the comment template and submit feedback to sp800-100-comments@nist.gov.”

From the cybersecurity breaches and vulnerabilities front,

  • MedTech Dive reports,
    • “Quest Diagnostics is the latest medtech company to disclose that it was hit by a cyberattack.
    • “The testing services company identified unauthorized access to its Quanum Lab Services Manager system on Wednesday [October 21], according to a filing with the Securities and Exchange Commission. Quest’s Quanum LSM system is used by certain clients to place test orders as well as to receive and look up results. Quest paused access to the system upon discovering the incident.
    • “While Quest is still determining the full scope of the attack, it believes that an unauthorized party accessed certain patient records. Quest, in the filing, did not detail what patient records were accessed or how many records were involved.”
  • HIPAA Journal lets us know that “Data breaches have been announced [recently] by UltraMobile Imaging in New York, Artistic Smiles in Colorado, Parkview Health in Indiana, and Cognitive Behavior Therapy Center in Virginia.
  • Federal News Network fills us in about insider cybersecurity threats.
    • “Les Bernys, the executive director of the Department of Defense Cyber Crime Center, said the number of insider cyber incidents reported over the last six months far outpaced any other time in DC3 history.
    • “DC3 says more broadly, critical incident reports, which include insider threats, from defense companies have increased by over 50% in the last fiscal year. DC3 says it can’t give complete figures due to the anonymity of the DIB companies reporting.
    • Bernys said DC3 is seeing two kinds of insider threats.
    • “One type are former DoD employees who did malicious things to the network before they left or still have access to data after they left and were trying to exfiltrate data and, possibly, doing nefarious things with that data,” he said after speaking at the ACT-IAC Cybersecurity Summit on Oct. 14. “The second type of incident are companies are reporting that they have hired individuals who they thought were Americans but were North Korean. These incidents aren’t coming in huge numbers, but the increase is noticeable.”
    • “He added companies are struggling to better verify their applicants.”
  • CISA added eight known exploited vulnerabilities to its catalog this week
    • October 20, 2026
      • CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
      • CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
      • CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
      • CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability  
      • CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
      • CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability
        • The Plex Medica Service KVEs are PHP Shell vulnerabilities discussed in the frontier AI section above. Bleeping Computer also discusses the KVEs here.
        • Cybersecurity News discusses the EG Secure Solutions KVE here.
        • The Hacker News discusses the Siemens KVE here.
    • October 23, 2026
      • CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability
        • Security Week discusses this KVE here.
    • October 23, 2026
      • CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability 
        • GitHub discusses this KVE here.
  • Bleeping Computer points out,
    • “GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.
    • This security issue is tracked as CVE-2026-110264 and was reported by a security researcher using the ‘joaxcar‘ handle through GitLab’s HackerOne bug bounty program.
    • “CVE-2026-110264 stems from an integer overflow weakness in GitLab’s Regular Expression Compiler, a background engine that parses and validates regular expressions in configuration files.
    • “GitLab has fixed the vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, and warned users to patch their instances immediately.
    • “GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression,” the company said.”
  • Cyberscoop tells us,
    • “Microsoft researchers attributed the recent supply-chain attack targeting ConnectWise customers’ Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940.
    • “As early as September 2026, Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries,” Microsoft Security Research wrote in a blog postWednesday. 
    • “The nation-state group, which has been active since 2021, targeted organizations in aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits. 
    • “Storm-0940 initiated a widespread, but ultimately unsuccessful, password-spraying campaign immediately preceding the compromise of ConnectWise’s Cloud Backup service. During a four-day stretch ending Oct. 14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, researchers said.”
  • Cybersecurity Dive informs us,
    • “An Indian company’s serious error in creating high-level encryption certificates has prompted major web browsers to block the certificates before hackers can use them to spoof websites.
    • “The issue involves intermediate certificates created by the Indian firm eMudhra, a company with the authority to issue certificates that are trusted by Google Chrome, Microsoft Edge, Mozilla Firefox and other browsers. Certificate issuers use intermediate certificates to “sign” individual website certificates that assure users of the sites’ legitimacy and security. But eMudhra recently failed to apply the proper procedures when creating eight of its intermediate certificates, producing keys that were shockingly weak.” * * *
    • “Leading web browsers responded by severing their trust relationships with the eight weak intermediate certificates. Google and Mozilla published blog posts detailing their responses to the discovery.
    • “Users should update their browsers and operating systems to the latest versions as soon as possible,” Dennis Jackson, a member of Mozilla’s cryptographic engineering team, wrote on an explainer page about the incident.
    • “There is no evidence that hackers generated any fraudulent website certificates by exploiting the weaknesses in eMudhra’s keys.”
  • and
    • “Threat actors are deploying agentic AI in more sophisticated ways to automate aspects of their hacking campaigns, according to CrowdStrike.
    • “In 2026, CrowdStrike Intelligence has documented several incidents in which threat actors used AI not only to create tooling or artifacts, but to conduct agentic campaigns in which AI agents make decisions and execute commands,” the security firm said in a report published on Wednesday [October 21].

From the ransomware front,

  • The American Hospital Association New reports,
    • “A joint advisory issued Oct. 20 by U.S. and international agencies warns of recent activity by the SafePay Ransomware group. The group has been active since 2024, attacking critical infrastructure organizations, including healthcare, across North America and around the world. The agencies said SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems and using phishing tactics. The actors then gain control of the network by creating new accounts or taking over existing ones and use legitimate system tools to move through the network to identify valuable files and disable security protections. Next, the actors encrypt the victim’s files and leave a ransom note demanding payment in cryptocurrency. The advisory includes recommended security measures to reduce the risk of SafePay ransomware attacks.”
  • Cybersecurity Dive adds,
    • “Palo Alto Networks researchers warned that ransomware operators have stepped up exploitation of a high-severity flaw in the company’s GlobalProtect portal, months after it was first disclosed. 
    • “The authentication bypass vulnerability, tracked as CVE-2026-0257, allows an attacker to establish unauthorized VPN connections to the remote-access product. The flaw has a severity score of 7.8 out of 10. 
    • “Researchers warn that Qilin and INC ransomware groups are exploiting the vulnerability, according to a report by Unit 42, the threat intelligence and incident response arm of Palo Alto Networks. The company tracks those groups under the names Spikey Scorpius and Tarnished Scorpius, respectively.” 
  • Info Security Magazine relates,
    • “Almost 3000 ransomware attacks took place between July and September 2026 and the figure marked a significant increase when compared with the same period last year.
    • “According to an analysis by Nord Security, the 2894 ransomware attacks which took place during the quarter represents a 50% increase when compared with the same period last year.
    • “It also represents a slight increase when compared with the previous quarter of this year, as the July to September period saw an 8.6% rise in ransomware attacks when compared with April to June.
    • “Published on October 21, the Nord Security report suggested that the significant rise in ransomware activity is a result of the impact of law enforcement takedowns on ransomware groups.
    • “Researchers suggested that the action against the likes of  Lockbit, BlackCat and RansomHubhelped to reduce ransomware activity during 2025.
    • “Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware’s new era,” said Vakaris Noreika, VP of product research and development at Nord Security.”
  • Acronis takes “a closer look at a not-so-gentle ransomware-as-a- service operation.”
    • “The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked.”
  • Tech Target offers a tip about
    • “How to tackle a ransomware readiness self-assessment, with template
      • “Ransomware readiness self-assessments are key to spotting vulnerabilities and preparing for third-party assessments. Use this template to evaluate your organization’s preparedness.”

From the cybersecurity business and defenses front,

  • The Wall Street Journal reports,
    • “As businesses and consumers increasingly adopt artificial intelligence agents, 1Password is aiming to position itself to deliver solutions for growing challenges around security, access and trust.
    • “The Canadian late-stage cybersecurity startup has surpassed $500 million in annual recurring revenue, up from $400 million in November 2025, with a free cash flow margin in the double digits, the company said.
    • “The growth has been driven by an explosion in coding assistants and agents in enterprise settings, whose access to company secrets and systems needs to be closely managed, Chief Executive David Faugno said.
    • “The agents can actually take those secrets and do things that are unpredictable,” Faugno said in an interview. “You have to be very, very clear about what access you give it, and how you monitor and maybe even revoke that access, and humans have to stay in control.”
  • Cybersecurity Dive relates,
    • “The size of the cybersecurity insurance market is growing quickly as more businesses try to guard against the damage from a major hacking incident.
    • “Total U.S. domestic cyber direct written business has nearly tripled since 2020, making cyber insurance one of the fastest-expanding segments in insurance,” the National Association of Insurance Commissioners said in a statement Wednesday [October 21] about its new report on the topic.
    • “Chubb, Beazley and St. Paul Travelers are the top three insurers by the value of their direct written premiums, according to the report.”
  • Dark Reading adds,
    • “Cyber Insurance’s New Reality: Underwriting Isn’t Enough
      • “Rising AI, social engineering, and cloud risks are pushing carriers beyond risk transfer and deeper into cybersecurity itself.”
  • Cyberscoop warns,
    • “Encryption isn’t enough to protect data wherever it goes 
      • “Once data is in use, encryption falls short. A tested approach that replaces sensitive values with realistic substitutes could make stolen information far less useful to hackers.”
  • Per the Cybersecurity Hub Newsletter,
    • :Your SIEM detected the incident, Could you prove it six months later?
    • “That question comes up more often than it should. Usually during an audit.
    • “The incident was investigated. The threat was contained. The alert was closed. Six months later an auditor asks for the investigation record, the incident timeline, and the documentation showing what was reviewed and what was decided.
    • “The security controls worked. The paper trail did not.
    • “We put together the Managed SIEM Compliance Evidence Checklist for NIS2 and DORA to help teams find those gaps before a review does.”
  • Here’s a link to Dark Reading’s CISO Corner.

Friday report

David Ermer–Agentic & Generative AI, CDC, CMS, Congress, COVID-19, FDA, Medical / Rx research, Medicare, No Surprises Act, OPM, Patient safety, Rx coverage, U.S. Healthcare–

Simplicity is a virtue.

From Washington, DC,

  • Beckers Payer Issues reports,
    • “The House Committee on Oversight and Government Reform announced an investigation into pharmacy benefit managers Optum Rx, CVS Caremark and Express Scripts Oct. 23, reviewing their auditing practices of independent pharmacies. 
    • “The investigation stems from concerns “that independent pharmacies have potentially been targeted for punitive audits in retaliation for their public support of legislation recently passed by the committee,” the committee’s chairman, James Comer, R-Ky., said.
    • “Under HR 6610, PBMs for Federal Employees Health Benefits Program plans would pay in-network pharmacies a benchmark price with a capped margin. The PBMs would also pay a dispensing fee that aligns with what the state Medicaid program pays. The Pharmaceutical Care Management Association, which represents PBMs, pushed back against the bill amid the committee’s July markup.
    • “Let’s understand this bill for what it is: a huge cash transfer from taxpayers to pharmacists and nothing more,” PCMA President and CEO David Marin said in a July 22 statement. “It makes providing health benefits to federal workers far more expensive, simply as a gift to one industry.”
    • “Mr. Comer said that since the July markup, several independent pharmacies that backed the bill received more audit notices than usual.”
  • The FEHBlog heartily agrees with PCMA. The FEHB and PSHB programs should not be treated like test subjects.
  • Beckers Hospital Review explains the “6 ways the federal government is going after drug prices.”and lists “Medicare’s proposed 2027 pay cuts, by specialty.”
  • The American Hospital Association News relates,
    • “The Centers for Medicare & Medicaid Services has launched a new initiative to help recruit and retain nurses in nursing homes, the agency announced Oct. 23. Under the Nurses for Nursing Homes initiative, nursing students and licensed nurses interested in working in a nursing home could be eligible to qualify for up to $40,000 in student loan repayment and/or a $10,000 stipend in exchange for a three-year commitment to work in a qualifying nursing home in a rural or higher labor-shortage area. CMS said the $275 million program is expected to support more than 4,000 nurses nationwide and will be funded through civil monetary penalties collected by CMS and states from nursing homes. CMS has committed $100 million, while states are committing to at least $175 million. A website for the program includes details on eligibility requirements, open positions, details on how to apply and other information.”
  • and
    • “The Centers for Medicare & Medicaid Services Oct. 23 released a proposed rule implementing new Health Insurance Marketplace eligibility verification requirements enacted under public law 1, which was signed into law in July 2025. Beginning in plan year 2028, this proposal would require the Marketplaces to verify certain eligibility information before providing advance premium tax credits and cost-sharing reductions, particularly related to citizenship and lawful presence status; residency; non-employer-sponsored minimum essential coverage; and annual household income, family size and eligible noncitizen status. The rule also would require enrollees to provide or confirm key eligibility information annually to continue receiving financial assistance, essentially ending automatic reenrollment for enrollees receiving premium tax credits.  Comments are due 30 days after publication in the Federal Register.”
  • STAT News tells us,
    • “The Trump administration late on Thursday proposed a rule that would severely restrict future U.S. investment in the Chinese biotech sector but still allow American drugmakers to buy the rights to medicines invented in the country.
    • “The Treasury Department proposed the rule to implement a law, called the Comprehensive Outbound Investment National Security Act, that restricts U.S. investment in industries of concern to national security. The department added biotechnology to the list of industries subject to COINS restrictions, joining the likes of semiconductors, artificial intelligence, and quantum technology.
    • “The proposal would prohibit U.S. companies from entering financial transactions with Chinese biotech companies or Chinese manufacturers of biotechnology-related equipment and tools, according to the research firm Veda.
    • “We are surprised by the aggressiveness of the proposed rule,” Veda stated in a research note to clients. “Both in terms of its prohibition of all biotechnology-related transactions and the broadness of the definition of biotechnology.”

From the U.S. Office of Personnel Management front,

  • Kevin Moss, writing in Federal News Network, points out “What’s changing in FEHB for 2027 (and ways to save)” during the Federal Benefits Open Season which begins on November 9, 2026.
  • Fedsmith calls attention to benefit matters that federal and postal employees and annuitants may need to address before yearend.

From the U.S. Food and Drug Administration front,

  • Beckers Health IT reports,
    • “The FDA has issued its most serious recall classification for certain hospital glucose meters after a software issue that could cause test results to be assigned to the wrong patient was linked to one serious injury.
    • “The recall affects Nova Biomedical’s StatStrip Glucose Hospital Meter System Gen 2.0, a handheld device used by hospitals to measure patients’ blood glucose levels.”
  • Beckers Hospital Review adds,
    • “The FDA has warned Baxter International over significant manufacturing violations at its Baxter Healthcare drug manufacturing facility in Round Lake, Ill., including deficiencies involving contamination controls and sterile injectable production.
    • “The agency identified the violations during a March 23-April 2 inspection, according to a Sept. 29 warning letter. The FDA said environmental monitoring had detected cephalosporin in multiple areas outside the intended production area since January 2025 and cited deficiencies in Baxter’s monitoring program.
    • “The FDA also identified deficiencies involving aseptic processing, visual inspection of sterile injectable drugs and investigations into leaking products and sterility failures. The agency said Baxter’s current equipment, process and airflow design posed “excessive contamination risk.”
  • MedTech Dive relates,
    • “Edwards Lifesciences has won Food and Drug Administration approval for its Pascal Precision system for tricuspid valve repair, the company said Wednesday.
    • “Pascal’s expanded label covers use in patients with symptomatic severe tricuspid regurgitation. Edwards previously received FDA approval for the device in degenerative mitral regurgitation.
    • “The approval should expand the group of tricuspid repair patients that Edwards can treat, Leerink Partners said in a note to investors.”
  • PharmExec informs us,
    • “The FDA today approved a subcutaneous induction regimen for AbbVie’s Skyrizi (risankizumab-rzaa) in adults with moderately to severely active Crohn’s disease. The decision lets patients start treatment at home with an on-body injector (OBI) induction pack instead of an intravenous infusion and continue with the same device during maintenance.1
    • “AbbVie filed for the new regimen April 27 and had said it anticipated approval later in 2026. The decision changes how therapy begins, not who is eligible, because intravenous induction remains an option.1
    • “People living with Crohn’s disease need treatments that can deliver meaningful disease control from the start,” said Roopal Thakkar, M.D., executive vice president, research and development, chief scientific officer, AbbVie. “With the approval of subcutaneous induction, we are building on the strong efficacy of Skyrizi while giving patients and physicians greater flexibility in how treatment is initiated. This is one more example of how AbbVie continues to advance treatment to better meet the needs of people living with Crohn’s disease.”
  • Cardiovascular Business lets us know,
    • “Eko Health has received U.S. Food and Drug Administration (FDA) clearance for Core 300, a new artificial intelligence (AI)-enabled stethoscope that offers both traditional analog and advanced digital listening capabilities. 
    • “The Core 300 stethoscopes give clinicians the ability to instantly switch from traditional listening to digital listening when evaluating both pediatric and adult patients. The technology behind Eko Health’s digital listening capabilities includes up to 35x amplification, noise cancellation and real-time heart data that is then displayed on the device. 
    • “These stethoscopes can also be connected to the Eko App or Eko’s FDA-cleared AI models for additional benefits. In addition, the battery life was designed to last for weeks at a time.” 

No Surprises Act News

  • The American Hospital Association News reports,
    • “The Centers for Medicare & Medicaid Services Oct. 23 announced that the submission period opened for petitions to deny the recertification of three independent dispute resolution entities. Members of the public, providers, facilities and others can submit a petition, which must identify the IDR entity seeking recertification and detail the reasons for the petition. The three organizations seeking recertification are National Medical Reviews Inc.; Keystone Peer Review Organization, Inc., which also does business as Acentra; and MCMC Services LLC. The petition period is open through Oct. 29. The departments of Health and Human Services, Labor, and the Treasury will make a final decision on recertification after reviewing any petitions submitted.” 

From the judicial front,

  • Fierce Healthcare reports,
    • “Centene has become the latest insurer to sue the federal government over its 2027 Medicare Advantage star ratings.
    • “In a lawsuit filed Thursday in Georgia’s Southern District Court, the company argues that the Centers for Medicare & Medicaid Services violated the Administrative Procedure Act in determining its latest scores. Centene says that CMS ran afoul of “core statutory safeguards” in deploying 17 measures.
    • “The use of those measures ultimately caused “significant injury” to the company, according to the complaint. For 2027, 9% of Centene’s members are enrolled in plans with at least four stars, which declined from 18% in the prior year.
    • “In implementing each of the individual Star measures that Centene challenges, CMS violated applicable law and thereby caused Centene to lose out on hundreds of millions of dollars in revenue that Centene could use to strengthen benefits, reduce premiums, and improve health outcomes,” the company said in the lawsuit.”

From the public health and medical / Rx research front,

  • The Centers for Disease Control and Prevention announced today,
    • “COVID-19, flu, and RSV are key indicators of overall respiratory illness activity
    • “The amount of acute respiratory illness causing people to seek health care is very low.
    • RSV activity is very low in most areas of the country.
    • “COVID-19 activity remains elevated in some regions but is declining nationally.
    • “Seasonal flu activity is increasing in many parts of the country but remains low nationally.
    • “Rhinovirus/Enterovirus (RV/EV) is elevated nationally, and parainfluenza viruses (PIV) are increasing.”
  • Beckers Clinical Leadership adds,
    • “Hawaii, Florida and Louisiana are reporting the highest percent of influenza-like illnesses.
    • “The CDC defines influenza-like illness, or ILI, as a fever of 100 degrees or greater, along with a cough and/or sore throat. The agency collects data on outpatient visits to healthcare providers for respiratory illness through ILINet. ILI percentages are weighted for state population and compared to baseline levels to assess flu activity. For more information on how the metric is calculated, click here.
    • “Hospitals reported 4,811 new flu admissions in the week ending Oct. 17, up from 4,024 the week prior, according to the CDC’s latest FluView report. About 2.2% of outpatient visits involved patients with respiratory illness. This metric sits below the national baseline of 2.9% and is up from 2.1% the week prior.”
    • The article ranks the State by their ILI percentages.
  • and
    • “The CDC has now activated six emergency responses for pathogens in 2026 — the latest a level 3 response to a record dengue outbreak in Florida — a pace that underscores how many infectious disease threats are landing on hospitals and public health agencies at once. 
    • “From a fatal new spillover in France to a bird flu outbreak left uncontained on a U.S. mink farm, the past several weeks have handed infection prevention and clinical leaders a dense cluster of public health concerns.”
  • The American Hospital Association News tells us,
    • “There are now 1,338 confirmed measles cases in Pennsylvania this year as the state’s ongoing outbreak continues, according to the latest data from the Pennsylvania Department of Health. Of those, 255 individuals have been hospitalized. The agency said that more than 56,000 doses of the measles, mumps and rubella vaccine were administered by healthcare providers across the state in September, and more than 39,000 have been administered so far this month. Providers typically administer 25,000 doses per month, the department said. Nationally, there have been 4,588 confirmed measles cases this year, according to the latest update from the Centers from Disease Control and Prevention. The vaccination status of 96% of cases is unvaccinated or unknown.” 
  • The University of Minnesota’s CIDRAP reports,
    • “Two new studies underscore the importance of the hepatitis B virus (HBV) vaccine birth dose, with a US study predicting that dropping or delaying initial vaccination would drive up chronic infections and an Ethiopian study finding lower mother-to-child transmission (MTCT) with birth-dose receipt.
    • ‘After US Health and Human Services (HHS) Secretary Robert F. Kennedy Jr. panned the first study, as well as the New York Times’coverage of it, on X, experts quickly pointed out deficiencies in his objections.”
  • The Washington Post relates,
    • “While cigarette smoking is still the primary risk factor for lung cancer, a growing proportion of patients with the disease are nonsmokers like [Bryant] Lin [M.D.]. Last week, Pope Leo had part of his right lung removed because of adenocarcinoma, the most common type of lung cancer. He is not known to have ever lit up.
    • “The drop in smoking rates in the United States and other countries has unexpectedly shed light on this as an emerging health issue. Never-smoker lung cancer is now the eighth leading cause of cancer-related death in the U.S. and the fifth most common cause of cancer-related deaths worldwide.
    • “Because I’m a physician, most people make the assumption I’ve never smoked, and they ask, ‘Why did you get lung cancer?’” Lin said. “Then I explain to them that roughly one out of five people with lung cancer in the United States have never smoked.”
    • “A growing body of research is identifying the disease’s unique clinical characteristics. In September, a study described a rare mutation concentrated in the southeastern U.S. that puts never-smokers at 60 times higher risk of developing lung cancer. The demographics of patients are also distinct — for instance, women who have never smoked are more than twice as likely to get lung cancer as men who have never smoked.”
    • “Two-thirds of nonsmoking-related lung cancer happens in women, so there’s certainly an association with female sex,” said Jaclyn LoPiccolo, a medical oncologist at the Dana-Farber Cancer Institute and author of the mutation study. “Nonsmoking-related lung cancer is also more common in people of East Asian descent, but whether that’s a genetic or environmental association, we don’t yet know.” 
    • “Regardless of gender or ethnicity, risk factors include exposure to secondhand smoke, radon, air pollution and asbestos. A family historyof any cancer diagnosed before age 50 in a first-degree relative is associated with increased lung cancer risk in nonsmokers.”
  • Health Day points out,
    • “For patients with atrial fibrillation (AF) and acute ischemic stroke, early initiation of rhythm control is associated with a lower risk for recurrent stroke or systemic embolism (SE), according to a study published online Oct. 21 in Neurology.”
  • and
    • “Women who enter menopause prematurely may have a higher risk of heart problems, due in part to higher blood sugar levels, a new study says.
    • “Women with menopause that occurred before age 40 had higher rates of heart disease and insulin resistance, researchers reported Tuesday at the annual meeting of The Menopause Society.
    • “Our findings suggest that insulin resistance may be one important pathway linking premature menopause with increased cardiovascular disease risk, highlighting the importance of cardiometabolic health in women who experience menopause before age 40,” lead researcher Zailing Xing said in a news release. She is assistant professor of epidemiology at Florida A&M University.”
  • MedPage Today adds,
    • “Neurokinin (NK)-receptor antagonists improved sleep disturbances in menopausal women, a meta-analysis of randomized controlled trials showed.
    • “Among women with moderate-to-severe vasomotor symptoms, the agents were associated with improvements in sleep disturbance as early as 4 weeks (standardized mean difference [SMD] -3.94, 95% CI -5.71 to -2.16) compared with placebo, reported Maria Julia Lemos, MD, of Kurah Women’s Health Institute in Macaé, Brazil, and colleagues.
    • “This trend continued at 12 weeks (SMD -3.11, 95% CI -4.60 to -1.61) and 24 weeks (SMD -2.04, 95% CI -3.93 to -0.15), Lemos reported during a presentation at the Menopause Society annual meeting that was co-published in Menopause.
    • “For women with hot flashes who can’t or don’t want to use hormone therapy, especially when poor sleep is one of their main complaints, these drugs are a good option to consider,” Lemos told MedPage Today. “They may help women sleep better, not just have fewer hot flashes.”
  • Harvard Health notes,
    • “A new pill that dramatically lowers harmful LDL cholesterol may be a good option for people who can’t tolerate statins or who haven’t lowered their LDL enough despite their current treatment with cholesterol-lowering drugs.
    • “Approved by the FDA in July 2026, enlicitide (Lipfendra) is the first oral version of a class of drugs known as PCSK9 inhibitors. These drugs work by mimicking the effect of a naturally occurring variant in the PCSK9 gene that leads to very low LDL levels. But the original drugs — which are given by injection once or twice a month — aren’t widely used. Some people aren’t comfortable giving themselves an injection. Also, most insurance companies won’t cover the cost (which range from $200 to $500 or more per month) until a person has tried other therapies without success.
    • “Enlicitide is a daily pill that must be taken on an empty stomach with a sip of water, black coffee, or plain tea. It lowers LDL by nearly 60%, which is similar to the injectable PCSK9 drugs. Less than 10% of users experienced either dizziness or diarrhea, the two most common side effects. A month’s supply will cost about $300; for now, insurance coverage remains unclear.”
  • Per STAT News,
    • “A multiple sclerosis treatment from Novartis cut by a third the rates of relapses that people with the condition have compared to a standard treatment, data presented Friday show. While that efficacy doesn’t match the performance of a rival drug from Roche, Novartis’ treatment has a cleaner safety profile that could give it a shot at being competitive in the market.”
  • and
    • “A chemotherapy-free combination of Tango Therapeutics’ experimental drug vopimetostat and Revolution Medicines’ recently approved Rasonque shrank tumors in 82% of patients with advanced pancreatic cancer, early-stage data presented at ESMO show. The Phase 1/2 trial enrolled 22 heavily pretreated patients whose tumors harbor MTAP deletions, a genetic alteration found in roughly 40% of pancreatic cancers.”
  • Beckers Hospital Review adds,
    • “Bristol Myers Squibb said Oct. 23 a study participant died from septic pneumonia about six weeks after receiving a dose of a CAR-T cell therapy being tested for multiple sclerosis. 
    • “The phase 1 trial included 66 patients with highly active relapsing multiple sclerosis or progressive forms of multiple sclerosis. In the study, most adverse events were “brief and reversible,” according to BMS. 
    • “After receiving the CAR-T therapy, zolacabtagene autoleucel, 28 of the 66 participants experienced cytokine release syndrome events, or hyperinflammation. Six patients had immune effector cell-associated neurotoxicity syndrome, including one life-threatening case, which resolved within two to four days.”

From the U.S. healthcare business and artificial intelligence front,

  • Beckers Payer Issues reports,
    • “Blue Cross Blue Shield of Massachusetts and Burlington, Mass.-based Tufts Medicine are partneringon a new health plan for BCBS employees, as well as AI implementation to streamline prior authorization.
    • “The HMO, Tufts Medicine Alliance Network, includes access to Tufts Medicine, Boston Children’s Hospital and Dana-Farber Cancer Institute. The HMO also provides next-day primary care access and specialist access within 21 days, according to an Oct. 22 news release.
    • “BCBS told Becker’s that about 35% of its workforce lives within the plan’s region, and that the plan will be available during their open enrollment. BCBS and Tufts Medicine said they are considering expanding the HMO’s availability to other employers in the future and are collaborating on similar offerings.”
  • Fierce Pharma relates,
    • “Last week’s federal holiday, Columbus Day, led to an unsurprising dip for prescriptions of both Novo Nordisk’s Wegovy pill and Eli Lilly’s oral GLP-1 rival Foundayo in the U.S. 
    • “In the prior-week reporting period, Novo’s Wegovy pill saw prescriptions fall slightly to around 173K versus the 173.5K tallied the week ending Oct. 9, according to Citi and Jefferies analysts, both of whom leverage prescribing data from IQVIA.”
    • “For that same period, prescriptions of Eli Lilly’s GLP-1 pill Foundayo slipped around 4% week over week to 58K. 
    • “The minor reversal for both drugs shouldn’t come as a surprise, given that national holidays are liable to impact weekly prescribing trends. 
    • “Looking at the broader oral GLP-1 market, Lilly’s share presently sits a little higher than 25%, according to the Jefferies team, while Novo holds a nearly 75% piece of the pie. 
    • “Meanwhile, as Novo and Lilly vie over the ever-important U.S. obesity market, the GLP-1 opportunity taking shape across other massive countries like China, India and Brazil could grow from $6.6 billion now to a whopping $22 billion by the middle of the next decade, according to a new J.P. Morgan estimate reported by Reuters Friday.” 
  • MedTech Dive tells us,
    • “Qiagen said Wednesday it has agreed to a takeover offer from EQT Private Equity valued at 10.8 billion euros (about $12.1 billion), including approximately $1.1 billion of debt.
    • “The agreement comes less than two months after the testing company, long a rumored takeover target, installed Jonathan Pratt as its new CEO. Six years ago, Thermo Fisher Scientific was set to buy Qiagen, but the deal fell apart after shareholders objected to the price.
    • “William Blair analysts, in a Thursday note, said EQT’s all-cash offer of 46.50 euros per share (about $52.20) was reasonable, given Qiagen’s relatively lower growth profile.”
  • Beckers Health IT informs us,
    • “Philadelphia-based Jefferson Health’s ambient AI rollout was associated with up to 16.6% less after-hours documentation and up to 39.3% faster chart closure among its most active users, according to a study published Oct. 23 in NEJM Catalyst Innovations in Care Delivery.
    • “The analysis covered 5,234 clinicians with access to Abridge’s ambient documentation tool, which runs inside Jefferson’s Epic EHR. It also covered 283,028 ambulatory encounters with matched patient experience surveys from July 1 to Dec. 31, 2025. Use was voluntary, and about 34% of clinicians with access actively recorded visits.
    • “Results were reported in two cohorts that reflect the separate EHR instances of Jefferson and Allentown, Pa.-based Lehigh Valley Health Network, which merged in August 2024. Among 637 clinicians who met the usage thresholds, Epic Signal data comparing 12 weeks before and after adoption showed several declines. Time in notes per appointment fell 10.5% and 17.3%. “Pajama time” fell 8.9% and 16.6%. Time to chart closure fell 25.3% and 39.3%. Weekly progress note volume held steady or rose.”

Thursday report

David Ermer–Agentic & Generative AI, CDC, CMS, FDA, Federal employment benefits, Medical / Rx research, Medicare, OPM, U.S. Healthcare–

Simplicity is a virtue.

From Washington, DC,

  • The Wall Street Journal reports,
    • “A top ally of Health Secretary Robert F. Kennedy Jr. is departing the Trump administration after frustrations with White House delays on Kennedy’s food agenda. 
    • “Calley Means, a senior adviser to Kennedy who also worked in the White House to further “Make America Healthy Again” policies, quit his role on Thursday, he told The Wall Street Journal.
    • “I leave with tremendous respect for President Trump and Robert F. Kennedy Jr.,” he said. “This movement is in the first inning and just getting started.” Means said he would continue working to further Kennedy’s MAHA agenda.”
  • Per a Health and Human Services Department news release,
    • “The U.S. Department of Health and Human Services (HHS) today announced the 2026 Update to the National Plan to Address Alzheimer’s Disease and Related Dementias, taking Department-wide actions to guide coordinated federal action on dementia risk reduction, research and innovation, care, and support for people living with dementia and their families. Secretary Kennedy made the announcement at the Broward Health Medical Center in Fort Lauderdale, Florida.
    • “Millions of American families have seen the devastating toll of Alzheimer’s disease and related dementias,” said HHS Secretary Robert F. Kennedy, Jr. “Under President Trump, HHS is shifting the national strategy toward prevention, earlier detection, and faster development of better diagnostics and treatments. We are advancing gold-standard science, reducing risk where we can, improving care, and giving patients and families stronger support at every stage of the disease.”
    • “The updated plan puts greater emphasis on reducing dementia risk across the lifespan and translating scientific discoveries into better prevention, diagnosis, treatment, and care. It also formally recognizes related dementias in the plan’s title, reflecting public input and the shared challenges that patients and families face across different forms of dementia.” * * *
    • “Details on the National Plan and participating agencies’ initiatives are available at hhs.gov/aging/adrd.”
  • The New York Times adds,
    • “Alzheimer’s Researchers Look at an Unusual Data Point: Head Shape.
      • “Could the geometry of our brains increase the risk of Alzheimer’s disease? It’s a provocative question, but one that some scientists are beginning to explore.”
  • Beckers Health IT relates,
    • “HHS plans to award Anthropic a sole-source contract to keep its workforce on the company’s Claude AI tools without an open competition.
    • “The agency posted a notice of intent Oct. 19 on SAM.gov for a “limited continuity of services award.” The award would run until the department completes a competitive multiple-award blanket purchase agreement for enterprise frontier AI models. The notice did not list a contract value or projected award date.
    • “HHS argued that only Anthropic can meet the requirement because Claude is the company’s proprietary model family and is already integrated into department infrastructure. Covered capabilities include chat, drafting and summarization, coding assistance, agentic features, connectors, and administrative controls such as single sign-on and audit export.” * * *
    • “The notice comes as Anthropic’s discounted General Services Administration OneGov deal is set to expire Oct. 31, FedScoop reported. HHS rolled out Claude across the department in December 2025 after Anthropic offered its services to agencies for $1 a year.”
  • Beckers Hospital Review tells us,
    • “Under the Healthcare False Claims Act Self-Disclosure Pilot Program, companies that meet the requirements can settle disclosed conduct through a coordinated civil release that covers the False Claims Act and certain HHS administrative authorities, according to an Oct. 22 news release shared with Becker’s. 
    • “To qualify, healthcare companies must:
      • “Reveal all relevant details of the potential violations;
      • “Provide documents that show the full nature and scope of the conduct;
      • “Detail remedial steps taken;
      • “Repay the government under the protocol, which applies a multiplier of 1.25 to 1.6
    • “The multiplier depends on various factors, including how quickly the company provided disclosure, and the scope and duration of the misconduct, whether senior leadership was involved, the company’s financial benefit, and whether the company inherited the liability via a transaction but fixed the issue promptly.
    • “In return, companies will get a Justice Department release for disclosing the conduct. As part of the resolution, the HHS Office of Inspector General will not impose exclusion or require a corporate integrity agreement. CMS will also not revoke billing or enrollment privileges, and neither CMS nor OIG will impose civil monetary penalties.”

From the U.S. Office of Personnel Management front

  • Tammy Flanagan, writing in Govexec, considers
    • “If you already have FEHB, should you sign up for Medicare B?
      • “Pairing your federal health plan with Medicare can lower out-of-pocket costs, but monthly premiums and income-based surcharges add up. Here’s what to consider before deciding whether the extra coverage is worth the price.”
  • FedWeek tells us,
    • “Several key figures are increasing for 2027 in the Social Security program affecting both current employees and retirees.
    • “For the former group, the 6.2 percent Social Security payroll tax will apply on up to $192,300 of earnings, up from $184,500. For FERS employees, that tax cuts off at that threshold and from there on they pay only the civil service retirement contribution (which is 0.8, 3.1 or 4.4 percent, depending on when they were hired).
    • “Above the cutoff CSRS Offset employees continue to pay 6.2 percent into Social Security and their pertinent percentage into the federal retirement fund, but all the money after that point goes into the federal retirement fund instead. Employees under “pure” CSRS don’t pay the Social Security payroll tax.
    • “For those drawing Social Security benefits, the earnings test applying to beneficiaries aged 62 through their “full” retirement age (65-67, depending on year of birth; 67 for those born in 1960 and after), will rise from $24,480 to $25,56v0. Those beneficiaries lose $1 in Social Security benefits for every $2 in earnings through employment or self-employment earnings above the limit.
    • “A separate earnings test applies only to earnings for months in the year an individual reaches full retirement age but prior to the individual attaining that age. One dollar in benefits will be withheld for every $3 in earnings above $67,920, up from $65,160. There is no limit on earnings beginning the month an individual attains full retirement age.”

From the U.S. Food and Drug Administration front,

  • The Washington Post reports,
    • “Federal health officials are investigating a multistate salmonella outbreak that has been linked to raw oysters and sickened 27 people across a dozen states. 
    • “Five of the cases have involved hospitalizations, health officials said. 
    • “The Centers for Disease Control and Prevention said an investigation is underway of infections linked to raw oysters harvested by the Little Wicomico Oyster Co. from the Little Wicomico River’s harvest area in Virginia. 
    • “The company recalled oysters harvested from that area from Sept. 18 through Oct. 8. People are advised not to eat, sell or serve them, officials said.”
  • Per an FDA news release,
    • “The U.S. Food and Drug Administration today announced the launch of the Neuroscience Advancement and Innovation Nexus (NAIN), a new agency program aligned with the Trump Administration’s efforts to accelerate medical innovation and deliver breakthrough treatments. NAIN is designed to advance the science, tools, and regulatory approaches needed to support the development of medical products for conditions affecting the brain and nervous system. NAIN’s inaugural initiative, the Alzheimer’s Prevention Accelerator, will focus on advancing medical products that help delay or prevent Alzheimer’s disease. Both efforts support the National Alzheimer’s Project Act (NAPA), the federal government’s comprehensive roadmap for coordinated action on Alzheimer’s and related dementias.”
  • Beckers Hospital Review tells us,
    • “The FDA has granted accelerated approval to Ultomiris (ravulizumab) to reduce proteinuria in adults with primary immunoglobulin A nephropathy at risk for disease progression, making it the first and only C5 complement inhibitor approved for this use.
    • “The approval followed Priority Review and was based on a prespecified interim analysis of the I CAN phase 3 trial, according to an Oct. 21 news release. Ultomiris demonstrated a 43.4% reduction in proteinuria compared with placebo at 34 weeks.
    • “Ultomiris is administered intravenously every eight weeks in adults, based on body weight, following a loading dose. The trial’s safety profile was consistent with the known profile of Ultomiris, with no new safety concerns identified.”
  • BioPharma Dive informs us,
    • “Compounding pharmacy Apothecary Pharma has issued a voluntary recall of its copycat version of Eli Lilly’s obesity drug Zepbound, stating in a notice that it couldn’t definitively guarantee the medication’s safety.
    • “The recall, of which Apothecary notified the Food and Drug Administration in September, covers 22 lots of compounded tirzepatide, the active ingredient in Lilly’s medicine. Those lots have beyond-use dates ranging from Oct. 8 to Nov. 26.
    • “Apothecary’s recall comes as Lilly and Novo, the only makers of FDA-licensed GLP-1 obesity medications, have sought to stop companies from selling compounded counterparts. The recall could help bolster Lilly and Novo’s claims that the knockoff versions don’t have the same quality, safety or efficacy as the FDA-approved ones.”
  • STAT News adds,
    • “For the popular diabetes and obesity medications known as GLP-1s, addiction medicine is one of many possible promising next acts.
    • “Eli Lilly is investigating a new drug, brenipatide, and testing it in alcohol use disorder. A new company called Baseline Therapeutics is studying a GLP-1 receptor agonist in alcohol, cocaine, and methamphetamine use disorders; Altimmune is testing one called pemvidutide for alcohol. Addiction medicine specialists are hopeful that the Food and Drug Administration may soon approve a new medication for alcohol use disorder — the first in two decades. 
    • “But some telehealth platforms that specialize in treating addiction aren’t waiting. In the last year, a few companies have begun to market off-label prescriptions of GLP-1s, both branded and compounded, to treat alcohol use disorder and other addictions. 
    • “Trying to drink less but your doctor won’t prescribe a GLP-1?” reads a Facebook ad from a telehealth brand called Livelyhood, which started offering the drugs in April. “Livelyhood can.” 
    • “Another, called Quel, launched in September as an online extension of the off-label prescribing at a Pennsylvania-based addiction treatment center.” * * *
    • “Telehealth companies recognized the potential for opportunism in prescribing GLP-1s for addiction ahead of FDA approval, while maintaining that their platforms are the exception. And it’s not necessarily lucrative: “Economically, GLP-1 for alcohol use disorder is much tougher than pretty much any other GLP-1 indication,” said Lively. 
    • “If that’s the case, Witkiewitz wonders: Why not wait for an FDA approval? Klein and Lira said they look forward to prescribing new drugs if they are approved. But Witkiewitz worries that if early adopters see bad outcomes, patients could be deterred from seeking approved treatments in the future. “We’re so close to having this done right and well, or having it done in a way that protects patients to the best of our abilities,” she said. “Caution is warranted, and some patience is warranted.”

From the fraud, waste and abuse front,

  • Beckers ASC Review reports,
    • “Five physicians are among 15 defendants charged in a Los Angeles healthcare fraud takedown involving $2 billion in alleged fraudulent claims, according to an Oct. 22 news release from the U.S. Attorney’s Office for the Central District of California. 
    • “Most of that total comes from a $1.6 billion substance abuse treatment scheme that DOJ calls the largest of its kind it has ever prosecuted. The physicians’ cases make up a smaller share.”
  • The Wall Street Journal adds,
    • “A Southern California drug-rehab operator allegedly engaged in an elaborate scheme that involved providing recovering addicts with illegal drugs in order to keep billing their insurers for treatment, according to federal prosecutors. 
    • “Facilities associated with Nathan Young submitted more than $1.6 billion in claims to major health insurers and were paid over $210 million between 2020 and 2026, including billings for “non-existent and woefully inadequate ‘therapy’ sessions,” prosecutors said in a recently filed criminal complaint.
    • “Young and his father, David Young, were arrested last week. Lawyers representing the Youngs didn’t respond to requests for comment. The Youngs were charged with healthcare fraud and violating an anti-kickback statute, according to federal prosecutors.” 

From the public health and medical / Rx research front,

  • Cardiovascular Business reports,
    • “Forty-three percent of on-duty firefighter fatalities over the last 35 years were attributed to cardiac causes, according to a new study published in JACC: Advances.[1] These findings call into question the types of screenings firefighters should undergo to detect potential heart problems.
    • “Researchers at Cedars-Sinai Health Sciences University explored autopsy findings from more than 3,000 on-duty firefighter deaths. The group said the proportion of cardiac-related fatalities has steadily increased over the years However, cardiac related deaths have been on the decline for the general U.S. population over the same time period.  
    • “These findings might indicate the need to change annual health screenings for firefighters. Current national screening recommendations rely on exercise stress testing, which can identify ischemic issues with blood flow, but may miss hidden structural remodeling of the heart that could lead to sudden cardiac arrest.
    • “Our research shows there may be a blind spot when it comes to routine heart screenings for firefighters in the U.S.,” senior author Alan Kwan, MD, assistant professor of cardiology in the Smidt Heart Institute at Cedars-Sinai, said in a statement. “Identifying heart conditions when they can be treated is key to addressing these new findings.”
  • Health Day relates,
    • “Newly eligible younger adults are less likely to have discussed colorectal cancer (CRC) screening with their clinician compared with their older counterparts, according to a study published online Oct. 18 in the Journal of General Internal Medicine to coincide with the American Association for Cancer Research Conference on The Science of Cancer Health Disparities, held from Oct. 18 to 21 in Atlanta.” * * *
    • “This finding strongly suggests that patients who are newly age-eligible for screening are not receiving adequate information about their screening options from a health professional, and that could be contributing to low screening rates in this age group,” [lead researcher] Jordan Baeker Bispo, Ph.D., M.P.H. said in a statement.
  • and
    • “Smartphones are costing teenagers a good night’s sleep, a new study says.
    • “Teens who use their phones late into the evening suffer from delays in falling asleep, shorter total sleep time, and sleep that’s more restless and broken, researchers reported Oct. 19 in JAMA Pediatrics.
    • “These findings suggest that reducing evening smartphone use, particularly after 10 p.m. and immediately before bedtime, may help improve sleep health in adolescents,” concluded a team led by Dr. Dimitri Christakis, a professor of general pediatrics at Seattle Children’s Research Institute.”
  • Nature adds,
    • “The speed at which regions of the brain mature during early adolescence can forecast the emergence of mental-health conditions up to four years before symptoms develop, according to a study of nearly 12,000 young people in the United States.
    • “By tracking the brains of adolescents over six years in nearly 30,000 scans, researchers mapped how the brain’s outer layer, the cerebral cortex, thins as children grow into teenagers. The team observed that sensory areas of the cortex thinned, or matured, first, followed by the regions responsible for complex thought.
    • “The findings, posted on 11 October on the preprint server bioRxiv1 ahead of peer review, challenge the theory that psychiatric disorders are caused by defects in specific brain circuits. Instead, they indicate that vulnerability to mental-health symptoms could involve disruption of the brain’s developmental timeline and could be set in motion by genes that are active before birth.
    • “The work “provides one of the clearest pictures yet of how the cortex develops from childhood into adolescence”, says Avram Holmes, a systems neuroscientist at Rutgers University in New Brunswick, New Jersey, who was not involved in the study. “It makes you think about the timing of brain development, not just the location [in the brain], when we look at psychiatric symptoms,” he says.
  • Beckers Clinical Leadership informs us,
    • “Receiving a personalized mRNA-based cancer vaccine alongside immunotherapy lowered the risk of recurrence or death by 42% versus immunotherapy alone in a phase 3 clinical trial of patients with surgically resected stage 2B to 4 melanoma.
    • “The vaccine, called intismeran autogene and jointly developed by Merck and Moderna, was tested in combination with Merck’s immunotherapy Keytruda after surgery as part of the phase 3 INTerpath-001 trial, according to an Oct. 22 news release from the companies. 
    • “The trial results were leaked online Oct. 22, The Wall Street Journal reported, two days before Merck and Moderna were expected to present the data at the European Society for Medical Oncology conference in Madrid.” * * *
    • “Read the latest trial results from Merck and Moderna here.”  
  • Fierce Pharma points out,
    • “Delaying the use of subcutaneous Parkinson’s disease treatments by one year increases annual medical costs by 59.1%, AbbVie-sponsored research found.
    • “The study, which researchers will present (PDF) at the AMCP Nexus Conference this month, modeled the impact of delaying the initiation of two subcutaneous therapies by one year. One therapy comprised foslevodopa and foscarbidopa, the combination that AbbVie sells as Vyalev. The other therapy featured apomorphine, the active ingredient in Supernus Pharmaceuticals’ Onapgo.” 

From the U.S. healthcare business and artificial intelligence front,

  • The Wall Street Journal reports,
    • “A KFF survey shows the average cost of a family health plan rose 5% this year, while workers’ contributions increased 9% to $7,471.
    • “Employers are facing healthcare cost increases driven by high-cost drugs and hospitals raising prices and using AI tools to boost billing.
    • “To manage rising costs, some employers are increasing workers’ premium contributions, raising deductibles and dropping coverage for GLP-1 drugs.”
  • Beckers Payer Issues relates,
    • “Molina Healthcare reported $38 million in net income for the third quarter of 2026, a 52% year-over-year drop from $79 million.
    • “The insurer attributed the decline mainly to a higher consolidated medical loss ratio, which was  92.9% in Q3, up from 92.6% a year earlier. Total revenue for the quarter was $11.1 billion, down 3.4% year over year. Premium revenue fell approximately 4% to $10.5 billion, reflecting lower membership in Medicaid and the ACA marketplace, partially offset by rate updates.
    • “With the apparent plateauing of medical cost trend, which remains at elevated levels, and the strength of recent rate updates for 2027, we believe we are likely observing the beginning of the turn in Medicaid margins,” President and CEO Joseph Zubretsky said in an Oct. 21 news release.”
  • and
    • “Medicare Advantage annual enrollment kicked off Oct. 15, and the ACA open enrollment period is around the corner. Employers are also navigating cost pressures, opening the door to innovative plans.
    • “Insurers have been primed to consider new health plans across commercial and government programs, and many are biting.
    • “Not every organization rolling out health plans in the coming years is a traditional insurer, however. For example, Tacoma, Wash.-based MultiCare Health System and the Muscogee (Creek) Nation are entering the MA market.
    • “The trend has extended to the employer space. Tech-enabled healthcare company Included Health said it will introduce health plans for self-insured employers Jan. 1, 2028, following its acquisition of Firefly Health, a clinically integrated health plan and advanced primary care company. Health technology and benefits administration platform Judi Health is launching a Medicare Part D Employer Group Waiver Plan, as well.”
  • Fierce Healthcare tells us,
    • “Redesign Health is making a major push deeper into health system-led innovation, merging with Sheba Medical Center’s innovation arm ARC Global.
    • “Together, the organizations want to create an end-to-end platform that helps health systems turn ideas originating with their own clinicians and operators into technology products and standalone companies that can then be scaled across a global network, company executives said. The deal was announced Thursday.
    • “The combined company is valued at approximately $2 billion, according to a source with knowledge of the deal.”
  •  and
    • “Talkiatry is expanding virtual therapy services nationwide as part of a broader push to provide comprehensive behavioral health services across the acuity spectrum, from low to high.
    • “As a national mental health practice that provides in-network psychiatry and therapy, the expansion also positions the company to offer broader behavioral health services to health systems, payers and employers.
    • “The company initially built its scale around telepsychiatry, with more than 800 employed psychiatrists and a large national insurance footprint. Talkiatry claims to be the nation’s largest private employer of psychiatrists as well as the preferred in-network psychiatry partner for more than 70 U.S. health systems.”
  • Per MedTech Dive,
    • “Labcorp said Tuesday that it has agreed to acquire Myriad Genetics’ prenatal health testing business for $210 million.
    • “The deal covers tests for assessing fetal risk of certain conditions and other aspects of prenatal care. Labcorp expects the tests to add about $160 million in revenue in year one. 
    • “Evercore ISI analysts see room for Labcorp to improve the economics of the acquired business using its infrastructure and to broaden access to the tests through its provider relationships.”
  • SmartBrief informs us,
    • “AI is making medical information easier to access.  According to a recent KFF poll, nearly a third of US adults have used AI for health information or advice in the past year, and nearly 1 in 5 have used it to compare treatment options.
    • “The appeal is clear. People can ask health questions in their own words and get answers almost immediately. But receiving an answer and knowing how and when to use it—and whether they can rely on it—are different things.
    • “Health plans will see an increasing number of members using AI to evaluate their care options. That reality creates a need for plans to fill in the gaps of today’s AI capabilities.”
    • The article identifies pathways.
  • Beckers Health IT adds,
    • “Microsoft’s AI diagnostic system correctly diagnosed 83.2% of complex New England Journal of Medicine cases, compared with 36.1% for generalist physicians, according to a study published Oct. 22 in Science.
    • “The system, called Diagnostic Orchestrator, or DxO, simulates a panel of physicians. It starts from a brief clinical presentation, then asks questions, orders tests and revises the differential diagnosis step by step. Microsoft researchers tested it on 304 NEJM clinicopathological conference cases and 325 emergency department admissions from the MIMIC-IV-ED dataset.
    • “On the emergency cases, DxO running OpenAI’s GPT-5 reached 80.3% accuracy, compared with 46.8% for physicians.
    • “The researchers also tracked estimated testing costs, using the chargemaster of Kaiser Permanente Washington’s Central Hospital in Seattle. With no budget limits, DxO averaged $5,431 per complex case. With budget constraints, it hit 80.9% accuracy at $2,241. Physicians using search and reference tools averaged $4,725.” * * *
    • “Microsoft plans to evaluate DxO in real-world settings through a partnership with Beth Israel Deaconess Medical Center in Boston, TechCrunch reported Oct. 22.”

Midweek update

David Ermer–ACA, CDC, CMS, FDA, Federal employment benefits, Medical / Rx research, Mental health care, U.S. Healthcare–

Simplicity is a virtue.

From Washington, DC,

  • The American Hospital Association News reports,
    • “The Centers for Medicare & Medicaid Services Oct. 21 announced that Amazon, Axon Enterprise, Inc., Google, Meta and Oracle Corp. are in support of its prior authorization pledge announced last year. The pledge involves streamlining prior authorization processes and increasing transparency for patients and providers by 2027. The AHA recently launched a new website on prior authorization, containing prior authorization news and resources. The website will be updated with additional resources and guidance as they become available.”
  • and 
    • “The AHA submitted comments to the Centers for Medicare & Medicaid Services Oct. 21 on its preliminary calendar year 2027 Medicare clinical laboratory fee schedule rates. The AHA said the preliminary rates highlight the need for substantial reforms to CMS’ methodology, saying they are based on incomplete data. The AHA discussed the requirement under the Protecting Access to Medicare Act that called for hospital outreach laboratories and other clinical laboratories to report their private payer data to CMS between May 1 and July 31, 2026. Only 2% of laboratories paid under Medicare Part B reported any information at all to CMS. The AHA noted there was widespread confusion among laboratories that did report their data regarding whether they were suitably qualified as “applicable laboratories” and what data they needed to report. The AHA expressed concerns that the underreporting means CMS’ preliminary 2027 rates do not reflect the “market-based payments” that Congress mandated under PAMA, resulting in substantial proposed cuts to Medicare CLFS reimbursement for hundreds of codes. The AHA said these cuts threaten seniors’ access to essential clinical laboratory testing and continued investment in diagnostic innovation.
    • “The AHA also said it was concerned that CMS’ approach to collecting applicable private payer information directly from clinical laboratories is inadequate for setting fully “market-based” rates. To help address these concerns, the AHA urged CMS to provide support and technical assistance to Congress as it considers the Reforming and Enhancing Sustainable Updates for Laboratory Testing Services (RESULTS) Act of 2025, which consists of efforts designed to improve private payer data collection by CMS to set Medicare Part B CLFS rates.” 
  • Healthcare Dive relates
    • “Some major insurers in the Affordable Care Act exchanges are expanding into new counties for 2027, even as many of their peers run for the exit amid ongoing cost and policy turbulence.
    • Centene, the largest ACA insurer in the U.S., is expanding into 55 additional counties in Alabama, Iowa, Illinois, Louisiana, Michigan, New Jersey and Texas next year; while Oscar Health, one of the fastest-growing carriers in the exchanges, is adding 140 new counties, including by entering South Carolina for the first time.
    • “The changes, announced in press releases Tuesday, show a continued bet on the ACA among some major participants in the exchanges, which may see a growth opportunity as their competitors downsize and leave their members looking for new carriers.”

From the U.S. Office of Personnel Management front,

  • FedSmith explains “Prescription Drug Coverage: What Every Federal Employee Should Check.”
    • Learn how to save on FEHB prescription costs by reviewing your medications, checking formularies, and comparing mail-order and retail pharmacy options.
  • FedWeek reports,
    • “More than a year after creating the deferred resignation program—and enticing some 140,000 persons to leave federal employment under those offers last year—the Trump administration has formally put it into regulation.
    • “A notice in the October 19 Federal Register finalizes rules proposed in June giving agencies broad authority to use extended periods of administrative leave, formerly typically limited to only a few days or even hours, for that purpose. The rules also authorize putting employees on that form of paid leave—also called excused absence—between receiving a RIF notice and the RIF separation date, and “to facilitate the voluntary resignation of employees with documented poor performance or misconduct” under a settlement agreement.
    • “They also clarify certain technical aspects of deferred resignation offers, including specifying that agencies have sole authority over whether to grant an employee’s request to withdraw acceptance of such an offer.”

From the U.S. Food and Drug Administration front,

  • Fox 10 News in Mobile, Alabama, reports,
    • “The FDA issued its highest-risk warning for a California-based company amid concerns over a multistate cheese E. coli outbreak.
    • “The Class I classification applied to all affected Graziers raw milk cheese products manufactured by California-based Sierra Nevada Cheese Company, including Monterey Jack, jalapeño jack, medium cheddar and sharp cheddar varieties, according to a press release. 
    • “The affected products were distributed in Arizona, California, Colorado, Florida, Georgia, Illinois, Indiana, Maryland, New Jersey, Oregon, Texas, Washington and Wisconsin.
    • “Investigators said 13 people in nine states became sick. More than half of those infected were children age 5 and younger.”
  • Health lets us know,
    • “Check your medicine cabinet: More than 4 million tubes of toothpaste have been recalled nationwide. According to the Food and Drug Administration (FDA), the toothpaste was initially recalled on Sept. 10 over deviations from Current Good Manufacturing Practice (CGMP), which ensures the identity, strength, quality, and purity of drugs. On Monday, the FDA gave the recall the second-highest risk level, Class II, for the possibility of temporary or reversible health effects.”
  • Per a company news release,
    •  BioCryst Pharmaceuticals, Inc. (Nasdaq: BCRX) today announced the U.S. Food and Drug Administration (FDA) has approved its supplemental New Drug Application (sNDA) for use of the oral pellet formulation of once-daily ORLADEYO® (berotralstat) for prophylactic therapy in adults and adolescents aged 12 years and older. The new 150 mg ORLADEYO pellet formulation provides an alternative administration option for adults and adolescents who may have difficulty swallowing, prefer not to take a capsule or choose to remain on a pellet formulation beyond age 12. 
    • With this approval, prescribers can now provide their adult and adolescent patients with the option to take once-daily, orally administered ORLADEYO for prophylaxis to prevent attacks of HAE [hereditary angioedema] in either capsule or pellet formulation. The ORLADEYO pellet formulation is sprinkle-like in appearance and size and can be poured directly into the mouth and swallowed immediately with water or milk, or sprinkled over a spoonful of soft, non-acidic food.
  • Cardiovascular Business reports,
    • “The U.S. Food and Drug Administration (FDA) has cleared Elucid’s FFR-IQ software for the noninvasive estimation of fractional flow reserve from coronary CT angiography (FFR-CT). The artificial intelligence (AI)-based technology incorporates coronary anatomy and plaque composition into its estimation of coronary physiology to provide more accuracy.
    • “Plaque composition, coronary anatomy and physiology are closely connected,” Amir Ahmadi, MD, clinical associate professor of medicine (cardiology) at the Icahn School of Medicine at Mount Sinai and Elucid’s lead scientific advisor, said in a statement. “BioIntegrated FFR-CT incorporates anatomy and plaque characteristics into the physiological estimate itself. Together with plaque assessment, this approach can help physicians evaluate the significance of an individual lesion while also addressing the patient’s broader atherosclerotic disease and need for preventive treatment.”
    • “Elucid said physicians told the company they want a more accurate FFR-CT algorithm that considered other factors that could impact hemodynamics; this newly approved algorithm does just that.
    • “Elucid is now the third vendor to offer FFR-CT commercially in the U.S., following prior approvals by Heartflow in 2016 and KeyaMed in 2022. Other vendors are also developing their own versions of FFR-CT. Interest in the technology has also increased rapidly recently as coronary CT angiography (CCTA) continues to rapidly gain momentum among care teams.”

From the judicial front,

  • The American Hospital News reports,
    • “The U.S. District Court for the District of Maine should deny motions by several drug companies and Pharmaceutical Research and Manufacturers of America to intervene in the lawsuit challenging the administration’s revised 340B rebate model, the AHA and its co-plaintiffs argued in a filing submitted Oct. 21.
    • “The AHA and plaintiffs noted that the court previously rejected similar intervention requests in litigation over an earlier version of the 340B rebate model, finding that the federal government could adequately defend its own policy.
    • “The AHA, Maine Hospital Association and four safety-net hospitals filed suit Oct. 9 to stop the revised rebate program, arguing that it would impose more than $1 billion in annual administrative costs on hospitals and divert resources away from patient care. The lawsuit seeks to prevent implementation of the program, which is scheduled to take effect Jan. 1, 2027.” 

From the fraud, waste, and abuse front,

  • The AP reports,
    • “President Donald Trump and Vice President JD Vance on Tuesday announced a $25 million program to encourage the public to blow the whistle on suspected fraud in the U.S. government as they ramp up efforts to end the abuse of federal programs and dollars.
    • “The White House said that under the Fraud Whistleblower Incentive Program, anyone who submits a tip that leads to a fraud conviction or a significant federal enforcement action is eligible to receive up to $30,000, and that the Justice Department will administer the program.”

From the public health and medical / Rx research front,

  • STAT News reports,
    • “[S]ome experts in health communication believe the time has come to reconsider the way government agencies communicate to the public about the [measles] virus. Yes, measles can be deadly, they say, but counterintuitively, health officials would have more success if their messaging clearly confirmed what many parents already know: Most children will survive.
    • “Public health agencies and experts should say forthrightly that for most healthy children measles is an unpleasant, self-limited illness from which they recover completely,” Peter Sandman, a retired risk communication expert formerly at Rutgers University, said in an email. “It has to be said repeatedly and emphatically.” 
    • “Public health experts STAT spoke to emphasized that there are many downstream health issues that could befall children who are infected with measles, and that vaccines are crucial and safer than trying to build immunity through exposure to the disease. But saying most children recover could ultimately build trust.”
  • NBC News adds,
    • “The Pennsylvania Department of Health issued an alert Monday to doctors about an increase in measles infections in pregnant women, as well as a concerning rise in congenital measles — a disease that’s rarely, if ever, seen in the U.S. 
    • “The department said that 66 pregnant women in Pennsylvania had been diagnosed with measles since the state’s outbreak began in April. “Getting measles while pregnant increases the risk of miscarriage, early labor, and low birth weight,” a department spokesperson said in an email.” 
  • Per MedPage Today,
    • “Children who started the two-dose human papillomavirus (HPV) vaccine series at age 9 or 10 years were more than twice as likely to get both shots versus those who began later, a cluster randomized trial showed.
    • “Across 31 U.S. pediatric practices, kids who were recommended to receive HPV vaccination starting at age 9 or 10 had better initiation and completion rates by age 13 versus those who received vaccination starting at age 11 or 12:
      • Initiation rates: 77.1% vs 67% (adjusted HR 2.52, 95% CI 1.93-3.27)
      • Completion rates: 61.6% vs 45.1% (aHR 2.85, 95% CI 2.12-3.83)
    • “What our data show is that the age at which families first hear about the HPV vaccine recommendation changes how many children are protected, and how soon,” said Sean O’Leary, MD, MPH, of the Children’s Hospital Colorado Anschutz Medical Campus in Aurora, during a press briefing ahead of the IDWeek annual meeting. “For clinicians who now start at 11 or older, we would suggest at least considering earlier introduction in their offices.”
  • The New York Times relates,
    • “In the United States, rabies can seem like a disease of the past, a remote risk caused by a mostly vanquished virus. But in recent months, this ancient foe has returned to the spotlight.
    • “A handful of unusual outbreaks have made headlines: rabid beavers at a Maryland state park, a cluster of goat cases at a North Carolina petting zoo. Officials in several states, including Idaho and Alabama, flagged surges in animal cases; California set an annual record for rabid bats.
    • “And last month, the Centers for Disease Control and Prevention issued a national health advisory, citing reports of “local increases in human rabies exposures.” The agency reported an uptick in the use of medical interventions — antibody treatments and vaccines — designed to protect people exposed to potentially rabid animals.
    • “So far, no human rabies cases have been reported in 2026. And it’s unclear whether the reported surges reflect a real increase in rabies risk. But they are worth keeping a close eye on, experts said, and highlight the persistence of rabies as a complex, ever-evolving threat.”
  • Beckers Clinical Leadership points out how this season’s flu cases compare to past seasons.
    • “As of early October, the rate of outpatient visits for flu-like illness was tracking as the third-highest since 2010. In the week ending Oct. 10, about 2.1% of outpatient visits were for respiratory illness — up from 1.6% during the same week last season, CDC data shows. This marks the third highest weekly rate behind the 2022-23 season (2.5%) and the 2023-24 season (2.4%). The CDC classified both of these seasons as moderately severe.”
  • Beckers Behavioral Health notes,
    • “States that legalized online sports betting saw increases in antidepressant and anti-anxiety medication use, along with outpatient diagnoses of depression and anxiety, a study published Oct. 14 in JAMA Psychiatry found.
    • “Researchers at the Baltimore-based Johns Hopkins Bloomberg School of Public Health analyzed employer-sponsored health insurance claims from January 2016 to December 2023. The study compared 22 states that legalized online sports betting between 2018 and 2022 with 13 states that had not legalized it by the end of 2023.
  • Health Day tells us,
    • “More teen girls are vaping than boys.
    • “About 7.8% of teen girls vape compared to 4.6% of boys.
    • “Less than half of 1% of all teens smoke cigarettes.”
  • and
    • “Black children’s race may put them at greater risk for a more severe form of asthma.
    • “Black kids are nearly three times as likely to suffer from T2-high asthma as white kids.
    • “This increased risk comes regardless of environmental or social factors like neighborhood air quality or family income, researchers say.”
  • Per BioPharma Dive,
    • “A Roivant subsidiary will ask regulators to approve a new indication for its anti-inflammatory medicine brepocitinib after posting successful results in two Phase 3 studies in an eye condition called non-infectious uveitis that can lead to blindness.
    • “In the trials, known as Clarity-1 and Clarity-2, patients were able to last for a median of more than 48 weeks before “treatment failure,” a measure of eye inflammation and other markers, compared with 12 weeks for those on a placebo. The brepocitinib patients also went 40 weeks without needing immunosuppressive steroids, setting a new bar in treating the disease. And the drug succeeded on every secondary endpoint, including resolving macular edema, the company said Wednesday.
    • “The Roivant unit, Priovant Therapeutics, already has Food and Drug Administration approval to sell brepocitinib under the brand name Lisraya to treat adults with the skin disease dermatomyositis. Priovant now plans to submit a supplemental application to expand the medicine’s use in the first half of next year.”

From the U.S. healthcare business front,

  • The Wall Street Journal reports,
    • Elevance Health ELV lifted its guidance for the year again after higher premium yields and pharmacy growth drove profit and revenue higher, offsetting a drop in membership.
    • “The health-insurance company on Wednesday said it now expects earnings per share of at least $22 for 2026, up from the prior $20.10. Adjusted earnings per share is now seen at $29 or higher, up from previous guidance of at least $27 a share.
    • “Analysts expect adjusted earnings of $27.26 a share for the year, according to FactSet.” * * *
    • “The company said it benefited from higher premium yields, increased product revenue from its pharmacy benefit manager CarelonRx, and growth in service fees.
    • “The benefit-expense ratio, a closely watched metric that compares health costs with premium revenue, improved by 70 basis points to 90.6%, driven by better performance in Medicare Advantage and individual Affordable Care Act plans.”
  • Beckers Payer Issues adds,
    • “Newly enabled competition between Blue Cross Blue Shield plans is continuing to contribute to Elevance Health’s commercial insurance business, leadership said on the company’s quarterly earnings call Oct. 21.
    • “Dubbed the “second blue bid,” the provision stems from a $2.67 billion settlement that resolved class action allegations dating back to 2012 that BCBS plans conspired to divide up markets to avoid competing with one another. The settlement eliminated a rule that required large employers to work with the BCBS plan covering their headquarters’ geography, thereby allowing certain national accounts to solicit bids from a competing Blues plan.
    • “Elevance, which owns 14 BCBS companies, said in January that it won nine of 11 second blue bid accounts in its first year competing under the provision. Morgan Kendrick, the company’s president of commercial and specialty health benefits, said on the third quarter earnings call that second blue bid opportunities have also been a component of its 1.7 million-member national accounts pipeline for 2027. 
  • and
    • “Elevance named Jeff Park as president of healthcare services subsidiary Carelon, effective Dec. 1. Mr. Park was most recently president of health technology company Waltz Health. Along with other healthcare leadership roles, he previously served as COO of pharmacy benefit manager Optum Rx, according to his LinkedIn profile.” * * *
    • “Carelon revenue grew 5.4% year over year, reaching $19.3 billion for the third quarter. This was spurred by CarelonRx product revenue and further expansion of Carelon Services risk-based solutions. Carelon’s operating margin was 4.7%, up from 4.2% in third-quarter 2025.
    • “CarelonRx’s operating gain was $616 million for the quarter, up 10.8% year over year. Its operating margin grew to 5.3%, up 20 basis points from the same period last year.”
  • and
    • “Horizon Blue Cross Blue Shield of New Jersey has agreed to acquire multispecialty physician group Summit Health’s New Jersey operations, including CityMD urgent care sites in the state, the insurer confirmed to Becker’s.
    • “We are excited by the opportunity to preserve access to high quality care for all of Summit Health’s patients, improve healthcare quality and affordability for our members, and to support the continued independence of Summit Health’s physicians and clinicians for the benefit of New Jerseyans,” a Horizon spokesperson said Oct. 21.
    • “The deal is subject to regulatory review and financial terms were not disclosed. Summit operates more than 120 locations across New Jersey, New York and Connecticut, while CityMD operates more than 180 urgent care centers across the three states.” 
  • Fierce Healthcare relates,
    • “Kaiser Permanente’s Risant Health has tapped Oklahoma’s largest nonprofit provider as the next to join its growing cadre of regional health systems.
    • “Integris Health and the nonprofit value-based care platform announced Wednesday their signed definitive agreement, which is subject to regulatory review but could close in early 2027. Financial terms were not disclosed. 
    • “The deal would make Integris the third regional health system to join Risant, following Pennsylvania’s Geisinger Health and North Carolina’s Cone Health, both deals that closed in 2024.”
  • and
    • “Alcon—the eye-focused pharma spun out of Novartis—is handing over $550 million to buy outNeurotech Pharmaceuticals, its encapsulated cell therapy platform and commercial medicine Encelto.
    • “Encelto, greenlit in March of 2025, is the first and only FDA approved therapy for macular telangiectasia type 2, a rare and progressive type of central vision loss. So far, the drug is only available in the U.S., where Neurotech estimates there are 25,000 MacTel patients and 2,000 to 3,000 new diagnoses each year. Through the merger, Alcon will now endeavor give the drug-device combo a more global reach, the pharma said in a statement. 
    • “Neurotech will also bring the tech behind Encelto to Alcon. The biotech’s encapsulated cell therapy approach pairs a surgically placed implant with cells that have been genetically engineered to produce therapeutic proteins. In the case of Encelto, the implant continuously releases recombinant human ciliary neurotrophic factor (rhCNTF), a protein that can travel to the retina and protect the photoreceptors—cells that are implicated in MacTel vision loss.” 
  • The Wall Street Journal informs us,
    • “Abbott ABT Laboratories plans to separate its nutrition business into an independent company by the end of next year, distancing itself from an embattled unit that has dragged down earnings and been the subject of years of litigation.
    • “The newly created company, set to house brands including Pedialyte electrolyte beverages and Similac infant formula, is expected to generate about $8.5 billion in annual sales.
    • “Chief Executive Robert Ford said the separation will allow both companies to sharpen focus and direct resources more effectively. Abbott will dial in on its core portfolio, which includes higher-growth categories such as medical devices and diagnostics, while the nutrition company will aim to capitalize on growing demand in the global nutrition market.
    • “We believe both businesses will be better positioned for the future as independent organizations,” Ford said on a call with analysts.”
  • Beckers Hospital Review lets us know,
    • “There are more than 400 birth centers in the U.S., and the number varies widely by state, from 92 in Texas to none in 10 states, according to Oct. 15 data the American Association of Birth Centers shared with Becker’s. Six states and the District of Columbia have one birth center.
    • “The count includes all birth centers known to the association, said Kate Bauer, executive director of AABC. She said state differences stem from factors such as state regulations, the midwifery workforce, insurance reimbursement and other elements that affect sustainability.
    • “An Oct. 20 Commonwealth Fund report on freestanding birth centers found that birth center births accounted for 0.62% of U.S. births in 2024, up from 0.23% in 2004, though access varies widely by state.”
  • Per Radiology Business,
    • “Capitol Imaging Services is expanding in South Florida with the acquisition of four outpatient centers. 
    • “The private equity-backed, Houston-based radiology group is buying Impression Imaging for an undisclosed sum, the two announced Tuesday. Capitol said the move establishes a strong presence in the Sunshine State and “marks an important step” as the group expands into molecular imaging and theranostics. 
    • “Founded in 2012 by physicians, Impression Imaging operates Florida locations in the communities of Tamarac, Pembroke Pines, Boca Raton and Coral Springs. 
    • “The addition of Impression Imaging to the Capitol Imaging Services network aligns perfectly with our mission to provide patients and physicians with the highest quality screening and advanced diagnostic imaging services,” John Stagg, CEO of Capitol Imaging, said in an announcement Oct. 20. “This acquisition expands our presence in Florida while strengthening our commitment to bringing cutting-edge imaging technology, precision diagnostics and greater patient access to every medical community we serve.”

Tuesday report

David Ermer–Agentic & Generative AI, CDC, CMS, Congress, FDA, Federal employment benefits, Medical / Rx research, Medicare, No Surprises Act, OPM, Rx coverage, U.S. Healthcare, Uncategorized–
  • Simplicity is a virtue.

From Washington, DC

  • The American Hospital Association News reports,
    • “The AHA Oct. 20 expressed support for the Addressing Boarding and Crowding in the Emergency Department (ABC-ED) Act (S. 1974), bipartisan legislation designed to improve data collection on hospital capacity and ED boarding. The bill is sponsored by Sens. Chris Coons, D-Del., and David McCormick, R-Pa. In its letter to the bill’s sponsors, the AHA emphasized that the causes of ED boarding and crowding are complex and have become persistent and growing challenges for hospitals and health systems nationwide.”
  • Beckers Payer Issues relates,
    • “A newly introduced House bill is targeting the methodology behind Medicare Advantage star ratings, adding more pressure to a program that has seen years of litigation from insurers.
    • “The Medicare Advantage Strengthening Transparency and Accountability in Rating Systems Act, or MA STARS Act, was introduced Sept. 21 by Rep. Mike Kelly, R-Pa., and would direct the federal government to rewrite star ratings policy beginning with the 2031 contract year.
    • ‘Under the bill, CMS would have to exclude any measure that is unrelated to clinical quality, outcomes or experience, or is not reasonably attributable to the actions of the plan and its delegated entities, such as contracted providers and subcontractors. Measures built on enrollee surveys would also be excluded if the survey has more than 10 questions, fails to draw responses from a diverse group, or misses minimum response and sampling standards set by HHS.
    • “Measures that no longer distinguish performance among most contracts would also come out of the calculations, while new measures could be added only if they relate to clinical quality, outcomes or experience.”
  • and
    • “As Medicare Advantage faces concerns regarding plan oversight, possible overpayments and care access, RAND researchers assembled experts to unpack potential reforms.
    • “Published in Health Affairs Oct. 5, the study consisted of two rounds with nearly 40 panelists. They rated 15 policy reform ideas on a nine-point scale. These ideas had high-level framing and were drawn from panelist suggestions and published research. The policy list was updated between the two rounds.
    • “While none of the proposed policies were found to simultaneously benefit all stakeholders — beneficiaries, plans and the government — the researchers identified the three “most feasible near-term reforms” that would benefit beneficiaries while not harming health plans and the government. These are standardizing supplemental benefits, limiting the number of plans an insurer can offer and reforming agent commissions.”
  • Medical Daily tells us,
    • “A senior federal health official has acknowledged that Medicare’s experiment with AI-assisted prior authorization is falling short. “There are a lot of things about WISeR that are not working,” Centers for Medicare & Medicaid Services (CMS) Deputy Administrator Kimberly Brandt said Oct. 15 at a conference in Santa Fe, New Mexico, Nextgov/FCW reported.
    • “The admission matters most for people with Original Medicare in the six states where the test runs: Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington.
    • “For older adults and their caregivers, the main issue is time. When a needed procedure waits on approval, pain, wound healing, and mobility can all suffer. Knowing how the system works can help families push for faster answers.”
  • Per Health and Human Services Department news releases,
    • “The U.S. Department of Health and Human Services (HHS) today launched the Kidney Care National Plan, a coordinated department-wide strategy focused on revitalizing American kidney care.
    • “As part of the Make America Healthy Again initiative, the new Kidney Care National Plan will address the root cause of disease and implement better treatments for Americans at every stage of kidney disease. The Plan identifies where federal action can improve kidney care across the entire spectrum of kidney disease, eliminate regulatory barriers to support innovation and a well-functioning kidney market, and deliver greater choice and superior outcomes to Americans.
    • “President Trump changed the course of kidney care in 2019 by challenging a system that waited for patients to reach kidney failure,” said HHS Secretary Robert F. Kennedy, Jr. “Now HHS is building on that work by detecting kidney disease earlier, expanding treatment and home-care options, removing barriers to innovation and transplantation, and strengthening safety across the transplant system. Our goal is simple: preserve kidney health, give patients more choices, and help more Americans avoid kidney failure and live longer, healthier lives.”
    • Link to the Kidney Care National Plan Fact Sheet
  • and
    • “The U.S. Department of Health and Human Services (HHS), through the Health Resources and Services Administration (HRSA), today announced seven awards through its new Sickle Cell Disease Regional Care Excellence (SoRCE) Program. The awards establish Regional Coordinating Hubs to help people with sickle cell disease access high-quality care and community services closer to home.
    • “Americans living with sickle cell disease should not have to travel long distances or overcome unnecessary barriers to receive effective care,” said HHS Secretary Robert F. Kennedy, Jr. “Early treatment can prevent serious complications and help patients live healthier lives. The Trump Administration is expanding access to proven treatments and specialized care so more patients can get the support they need in the communities they call home.”
    • “Approximately 100,000 people in the United States live with sickle cell disease. Early and ongoing treatment can prevent or reduce serious complications, yet many people face barriers to preventive care, specialty services, and disease-modifying therapies. The SoRCE Program aims to improve access and quality of care while tracking indicators of quality of life.” * * *
    • “See the FY 2026 SoRCE Program award recipients.”

From the U.S. Office of Personnel Management front,

  • FedScoop has named OPM Director Scott Kupor one on its 11 FedScoop 50 2026 Golden Gov: Federal Executives of the Year. Congratulations Director Kupor.
  • Director Kupor added to his Secrets of OPM blog a post titled Free is Good which concerns open source software and super intelligence efforts.
  • The ABA Banking Journal reports,
    • “As the Office of Personnel Management considers possible changes to federal employee health benefits, it should create more opportunities for employees to select health savings account-qualified, high-deductible health plans, the American Bankers Association HSA Council said in a letter to the agency.”

From the U.S. Food and Drug Administration front,

  • Per FDA news releases,
    • “The U.S. Food and Drug Administration today released final guidance establishing a clear framework for how drug companies can develop, distribute, and label apps used alongside their prescription medicines. The guidance ends longstanding uncertainty by providing recommendations about when app content is subject to FDA submission requirements, when an app should be mentioned on a drug’s official label, and what companies should submit to the agency.
    • “Mobile apps are playing a growing role in how patients manage their medications and health conditions,” said Captain Chris Wheeler, Pharm.D., Director of the Division of Medical Policy Programs within FDA’s Center for Drug Evaluation and Research. “This guidance helps ensure that the information these tools provide is accurate, evidence-based, and clearly communicated to both patients and their providers.”
    • “The guidance addresses three key questions for industry: when app content is treated as FDA-required labeling versus promotional labeling, when an app should be referenced in a drug’s official prescribing information, and what companies should submit to FDA when they distribute app content to users.”
  • and
    • “The U.S. Food and Drug Administration yesterday approved the first generic of Climara Pro (estradiol and levonorgestrel transdermal system, 0.045 mg per day/0.015 mg), a transdermal hormone therapy patch for women with an intact uterus applied once a week. The approval aligns with FDA’s Public Health Pillar: Increasing Access to Affordable Medicines & Medical Products.
    • “Menopause is a universal experience for women, and it can greatly affect a person’s quality of life. This approval makes effective treatment more accessible,” said Acting FDA Commissioner Kyle Diamantas, J.D. “Approvals like this reflect FDA’s ongoing commitment to expanding American patient access to safe, affordable, high-quality medications.”
    • “The generic estradiol and levonorgestrel transdermal system is therapeutically equivalent to Climara Pro, which is indicated for use in women with an intact uterus for:
      • “Treatment of moderate to severe vasomotor symptoms due to menopause
      • “Prevention of postmenopausal osteoporosis.”
  • and
    • “The U.S. Food and Drug Administration today approved Hibsago (bepirovirsen) injection, in combination with existing antiviral therapy, to treat chronic hepatitis B virus (HBV) infection in certain adults without cirrhosis. Hibsago is the first FDA-approved antisense oligonucleotide to treat chronic hepatitis B. Hibsago is approved for certain adults without cirrhosis who have been taking HBV antiviral therapy for at least six months, have suppressed levels of HBV in their blood and have hepatitis B surface antigen (HBsAg) levels of 3,000 IU/mL or less, as determined by an FDA-authorized test. 
    • “For many people living with chronic hepatitis B, treatment can mean taking antiviral medication for years to keep the virus suppressed,” said Wendy Carter, DO, Acting Director of the Office of Infectious Diseases in the Center for Drug Evaluation and Research. “Hibsago provides a new treatment approach that gives some patients the possibility of maintaining control of the virus after all chronic HBV treatment has ended. This approval represents an important advance for people living with this serious disease.”

No Surprises Act News

  • The American Hospital Association News tells us,
    • “The Centers for Medicare & Medicaid Services Oct. 20 published two qualifying payment amount audits under the No Surprises Act. The audits were of CareSource in Indiana and the School Employees Retirement Systemin Ohio, with both required to complete corrective actions following the audits. The CareSource audit focused on almost 25,000 claims, primarily concerning emergency and non-emergency services, while the School Employees Retirement System audit focused on six air ambulance claims. Both audits were conducted between Jan. 1, 2022, and May 31, 2023.”

From the fraud, waste and abuse front,

  • The Oklahoma Voice reports.
    • “Oklahoma’s Medicaid payment error rate is well below the national average, according to the agency that administers the program. 
    • “Oklahoma’s “improper payment rate” for Medicaid, also known as SoonerCare, was 0.15% in 2025 compared to the national average of 6.12%, according to the Oklahoma Health Care Authority.” * * *
    • “Oklahomans expect every taxpayer dollar to be spent the right way, and we hold ourselves to that standard,” said Aaron Morris, interim CEO of the Health Care Authority, in a statement. “We are continuously enhancing our tools to ensure Medicaid dollars are preserved and available to fund services for Oklahomans in need.”
    • “In 2022 Oklahoma’s Medicaid program had not yet made the switch to managed care, but overall, the state’s Medicaid error rate was 1.95%, the second lowest rate in the nation. * * *
    • “In the three years since the last review, the agency worked on “rigorous staff quality control and enhanced data integrity,” said Rebecca Sheppard, a spokesperson for the Health Care Authority. 
    • “The Health Care Authority is “continually adapting its strategy” to combat fraud through firewalls, automated application screenings and data validation exchanges with partners like Equifax, according to a news release. 
    • “OHCA’s broader plan to protect program integrity combines strict provider credentialing and revalidations of high-risk providers with targeted post-payment audits that verify medical necessity and proper documentation,” according to a news release.” 

From the public health and medical / Rx research front,

  • Beckers Clinical Leadership reports,
    • “Flu season is off to an unusually early start, with wastewater surveillance, emergency department data and local health departments from Virginia to California all indicating increased virus activity. 
    • “An earlier-than-usual rise does not guarantee a worse season, but on nearly every surveillance measure — and in a growing list of states — the virus is proliferating.
    • “Thirty-eight states are seeing a “high” level of influenza A in wastewater, according to Wastewater SCAN, a dashboard developed by Stanford (Calif.) University. The 12 states still at a “low” level are clustered in the Midwest: Kansas, Illinois, Indiana, Iowa, Michigan, Minnesota, Missouri, Ohio, Nebraska, North Dakota, South Dakota and Wisconsin.” * * *
    • “Officials across states are urging residents to get vaccinated by the end of October, noting the shot takes about two weeks to take full effect. El Paso County, Colo., is “seeing an earlier rise in higher numbers of flu,” public health official Haley Zachary told CBS affiliate KKTV, after the state reported its first pediatric flu death of the season. In Kentucky, where cases are running above last year’s level, EDs are already treating flu-like illness earlier than usual, CBS and The CW affiliate WKYT reported.”
  • Health Day relates,
    • “Food sensitivity appears to change as a child ages
    • “More kids become sensitive to food allergens as they grow older
    • “Peanut is an early and persistent allergen, but others become prominent by age five.”
  • and
    • “Epilepsy is strongly associated with young-onset dementia (YOD; age younger than 65 years), according to a study published online Oct. 14 in Neurology.”
  • Radiology Business tells us,
    • “Despite anxiety pertaining to the exam, many breast cancer survivors report high confidence in contrast-enhanced mammography (CEM) and would recommend it to other survivors as part of their post-treatment surveillance plan. 
    • “Survey findings published in Insights Into Imaging are offering new insight into how patients feel about having to complete CEM exams for monitoring purposes after cancer treatment. In recent years, the exam has emerged as a promising alternative to digital mammography, which has limited sensitivity in post-op patients.” 
  • Cardiovascular Business informs us,
    • “Researchers with NYU Langone Health may have identified a new way to predict heart transplant rejection without the need for an invasive biopsy. Their findings were recently published in the Journal of Heart and Lung Transplantation.[1]
    • “The study combined blood biomarkers with electrocardiogram (ECG) heart rhythm recordings into an artificial intelligence (AI) model and then compared the results directly against the gold-standard myocardial biopsy results. The team found the AI accurately identified when a transplant patient’s body starts attacking a donated heart.”
  • and
    • “Advanced artificial intelligence (AI) models can anticipate when older heart failure patients may start to experience functional decline, according to new findings published in the Journal of Cardiac Failure.[1]
    • “Researchers explored data from more than 6,000 patients 65 years old or older who were hospitalized for heart failure and prescribed rehabilitation. The median age of the cohort was 82 years old. An advanced machine learning model was then developed capable of evaluating a patient’s one-year risk of experiencing functional maintenance, functional decline or death. Functional decline was specifically defined as anyone who transitions to a housebound/ bedridden lifestyle due to their health.” 
  • Healthcare IT News adds,
    • “The relationship between clinicians and clinical knowledge is changing, according to a new JAMA study that suggests a “growing share of knowledge access is shifting from recall to retrieval.” 
    • “Researchers also say by characterizing the scale, distribution and clinical content of clinician-AI interactions, their findings fill an evidence gap needed to further frameworks that properly evaluate and guide AI use in clinical practice.” * * *
    • A significant number of medical practitioners are using AI in the clinic to explore treatment options for their patients in areas outside their clinical specialty, said Harvard in announcing the findings of what it’s calling the “first large-scale study of how often clinicians use artificial intelligence tools in patient care.”
    • “Harvard Medical School and Brigham and Women’s Hospital – along with researchers from Seattle Children’s Hospital, New York University’s Grossman School of Medicine, Massachusetts General Hospital and the National Bureau of Economic Research in Cambridge, Massachusetts – analyzed two-and-a-half years of OpenEvidence usage data. 
    • “The goal was to understand what types of clinicians are making queries, and how they are using the AI-driven findings. 
    • “Among 950,000 clinicians who submitted more than 270 million queries of artificial intelligence over a two-and-a-half-year period, queries were highest for nurse practitioners, followed by physician assistants and physician residents and fellows, according to the report, published Oct. 15.
    • “Use of clinical AI was also higher among physicians in oncology/hematology, internal medicine and family medicine and lower among those in ophthalmology, radiology, orthopedics and anesthesiology, said researchers from Boston-based Mass General Brigham in an email to Healthcare IT News.” 
  • BioPharma Dive points out,
    • “An experimental pill from Boston-based Rapport Therapeutics narrowly succeeded in a mid-stage study focused on bipolar mania, an outcome that analysts described as unexpected and a potential stepping stone to a billion-dollar-plus market.
    • “Rapport’s study enrolled around 250 adults with bipolar mania, who, once a day for three weeks, were given either a placebo or the company’s drug, “RAP-219.” Researchers then evaluated participants on several health measures, with the most important being how they fared on a 0 to 60-point clinical scale where higher scores reflect more severe bipolar symptoms. According to Rapport, those on its drug improved an average of 15.4 points by the third week, versus 12.3 points among the placebo group.
    • “That 3.1-point difference was just enough for the results to be statistically significant. Rapport said that, compared to the control arm, drug-treated patients showed improvements across all 11 components of the scale, which evaluates things like mood, speech, irritability and aggression. RAP-219 also beat the placebo on a “secondary” measure that used a different mania severity scale.
    • “The drug was well-tolerated, according to Rapport, with all so-called treatment-emergent adverse events being mild to moderate.” 
  • The New York Times calls attention to “5 Common Medications That Can Mess With Your Sleep.”
    • “Certain prescription and over-the-counter drugs are known to keep people awake. We asked experts for some of the biggest offenders.” * * *
    • “Any sleep disruptions that result from taking a medication should be discussed with a doctor, Dr. Neubauer said.
    • “Adopting healthy sleep habits could also help counter the medication’s side effects, Dr. White added. Try to avoid consuming caffeine after around 2 p.m., don’t drink alcohol just before bed, keep your bedroom dark and cool and maintain a consistent sleep schedule.”

From the U.S. healthcare business and artificial intelligence front,

  • STAT News reports,
    • “Officials at Dana-Farber Cancer Institute and Beth Israel Lahey Health celebrated on Monday the start of work on their new $1.68 billion Boston hospital to treat cancer patients, the only medical center of its kind in New England.
    • “The clanking of cranes slated to descend over the Longwood site also brings the impending divorce of Dana-Farber and its longtime partner, Brigham and Women’s Hospital, one step closer. Meanwhile, Brigham’s parent, Mass General Brigham, has launched its own rival cancer institute and is constructing new buildings and renovating other spaces to compete.”
  • Fierce Healthcare relates,
    • “Hackensack Meridian Health has signed a definitive agreement to pick up Central New Jersey’s Hunterdon Health, a $230 million deal that would grow the state’s largest health system to 19 total hospitals. 
    • “The pair had signed a letter of intent to merge in June and are now pursuing state and federal regulatory reviews. The announcement did not outline a potential timeline for the merger’s close.
    • “The agreement does outline a $200 million capital investment on behalf of Hackensack Meridian, which the nonprofits said would go toward facilities, programs and Central New Jersey communities Hunterdon serves.” 
  • Beckers Hospital Review tells us,
    • “Tampa, Fla.-based Moffitt Cancer Center recorded operating income of $238.4 million (6.9% operating margin) for fiscal year 2026, up from operating income of $127.5 million (4.2% margin) in fiscal 2025, according to its financial report for the 12 months ended June 30.  
    • “Moffitt reported total revenue of $3.4 billion in fiscal 2026, a 14.3% increase year over year. Patient service revenue rose 14% to $3 billion. Other revenue, which includes state appropriations and grants, increased 14% to $345 million.
    • “Total expenses were $3.2 billion for fiscal 2026, an 11.1% increase year over year. Salaries, wages, benefits and faculty fees totaled $1.5 billion, a 12.7% increase. Supplies rose 8.1% to $1.2 billion. Purchased services increased 21% to $276 million.”
  • and
    • offers a “nonexhaustive” list of “87 health systems with strong operational metrics and solid financial positions, according to reports from credit rating agencies Fitch Ratings and Moody’s Investors Service released in 2026.”
  • The Wall Street Journal informs us,
    • “Front-line nurses are leaving bedside roles in droves due to burnout, understaffing, verbal abuse and workplace violence.
    • “The annual turnover rate for bedside registered nurses hit 18% last year, according to NSI Nursing Solutions.
    • “Losing a nurse is expensive for hospitals, with research at Emory Healthcare showing it costs the system around $78,000 anytime a nurse leaves.”
  • and
    • “AstraZeneca is partnering with Oracle to use artificial intelligence, cloud and data capabilities to refine clinical research.
    • “The collaboration will initially explore clinical-trial recruitment, earlier diagnosis and drug-safety monitoring.
    • “The first program under the partnership will focus on hypertension care and clinical research in Abu Dhabi.”
  • Beckers Health IT adds,
    • “OpenAI has acquired Orchestra Bio, an AI-powered platform that helps biopharma teams coordinate the drug development process.
    • “OpenAI announced the deal Oct. 20 and did not disclose financial terms. The company plans to combine Orchestra’s team and technology with Rosalind, its suite of AI models and tools for life sciences research, which includes the GPT-Rosalind reasoning model and Rosalind Workbench.
    • “Orchestra Bio’s platform lets scientists and program leaders hand off the monitoring and tracking of studies to AI agents. When a problem hits one part of a drug program, such as a failed manufacturing batch that could delay the start of a clinical trial, the agents identify which activities and timelines are affected, gather relevant information and compare response options. Scientists and program leaders then decide how to proceed.
    • “OpenAI said the combined effort aims to build agents that connect scientific findings to the studies, decisions and next steps needed to advance a potential medicine.”
  • Medical Economics discusses “how unbundled maternity care codes could change OB/GYN pay in 2027.”
  • Per the American Hospital Association News,
    • “The median annual net launch price for new prescription drugs increased 35% from 2022 to 2025, to $257,000, according to a report released by the Institute for Clinical and Economic Review and West Health. Nearly 25% of drugs in 2025 launched above $500,000 and 34% launched between $200,000 and $500,000. The groups found that even if drug characteristics impacting launch prices remain constant, such as product type, therapeutic class, and orphan or ultra-rare status, launch prices may continue to increase.”

Monday report

David Ermer–Agentic & Generative AI, CDC, CMS, FDA, Federal employment benefits, Medical / Rx research, Medicare, No Surprises Act, OPM, Patient safety, Rx coverage, SCOTUS, U.S. Healthcare–

Simplicity is a virtue.

From Washington, D.C.

  • Per a White House news release,
    • “First Lady Melania Trump advanced a landmark program to improve women’s health through a new executive order that strengthens research, prevention, diagnosis, treatment, and care for girls and women throughout every stage of life.
    • “Previous generations fought for women’s rights. Our generation will fight to discover the cures that will ensure a woman can live her life in health and to the fullest,” The First Lady said from the White House.
    • “The Executive Order establishes a White House Women’s Health Task Force and establishes a new Women’s Health Division within the National Institutes of Health to accelerate scientific discoveries to improve women’s health outcomes.” * * *
    • “To learn more about the Executive Order, read the fact sheet released by the White House.”
  • Bloomberg Law reports,
    • “The Trump administration’s move to integrate artificial intelligence agents with Medicare patient data is facing concerns the tech push could put sensitive health information at risk.
    • ‘Since 2025, the Centers for Medicare & Medicaid Services has partnered with more than 700 companies, including Google, Microsoft, and OpenAI, to build its Health Technology Ecosystem, an agency revamp seeking to modernize how Medicare patients use their health data.
    • “Patient and privacy groups, though, warn that without safeguards, the rapid expansion into AI could leave Medicare patients vulnerable to the same pitfalls plaguing the broader health industry.
    • “We are at this incredible inflection point right now, but we really need strong consumer protections to keep pace with all of that innovation,” said Lisa Bercu, senior director of health policy at the National Consumers League.”
  • The American Hospital Association News adds,
    • T”he AHA provided recommendations to the Food and Drug Administration Oct. 19 on potential regulatory frameworks for generative artificial intelligence-enabled medical devices. The AHA expressed support for a flexible, risk-based regulatory framework that protects patients without impeding responsible innovation. Among its suggestions, the AHA recommended the FDA refine the proposed risk heuristic for evaluating the risk of GenAI applications and provide labelling guidance on “informational action directing” devices versus “action taking” devices. The AHA also requested the agency to align premarket clearance and post-deployment evaluation and monitoring activities under a total product lifecycle and clarify that GenAI-enabled clinical decision support and administrative tools are not subject to FDA oversight.” 
  • Beckers Health IT notes,
    • “Somerville, Mass.-based Mass General Brigham researchers built an AI foundation model, trained on more than 40 million face images, that estimates biological age and predicts cancer survival from a single photograph.
    • “The model, called FAHR-Face, powers two tools detailed in a study published Oct. 19 in The Lancet Digital Health. FAHR-FaceAge estimates a patient’s biological age more accurately than prior algorithms. FAHR-FaceSurvival predicts survival outcomes directly from a face photo of a patient with cancer.
    • “The gap between a patient’s FAHR-FaceAge and chronological age was independently linked to survival. The two tools’ predictions were only weakly correlated, and combining them improved survival-model fit in an external validation cohort of cancer patients.
    • “Hugo Aerts, PhD, director of the Artificial Intelligence in Medicine program at Mass General Brigham, said the work is, to the team’s knowledge, “the first demonstration” that an AI model can directly predict cancer survival from a photograph, per an Oct. 19 news release.”

From the U.S. Office of Personnel Management front,

  • Per an OPM news release,
    • “The US Office of Personnel Management (OPM) has finalized a rule removing the governmentwide time-in-grade restriction for advancement to covered competitive-service General Schedule positions at GS-6 and above. The restriction generally required employees to spend 52 weeks at a lower grade before they could be considered for promotion, even if they met the qualifications for higher-level work.
    • “The old rule made the calendar a gatekeeper. If someone is qualified and ready to take on more responsibility, the government shouldn’t make them wait another year just because the clock says so,” said OPM Director Scott Kupor. “This rule allows agencies to reward demonstrated merit over tenure. Employees still have to meet the standards for the job, and promotions still have to follow merit procedures.”
  • Director Kupor further discusses the significance of this rule change in his Secrets of OPM blog here.
  • FedWeek reports,
    • “OPM has issued a “Government-Wide Recruitment Strategic Plan” for senior agency leaders, HR officials and hiring managers that incorporates many of the administration’s previously announced hiring initiatives while setting a goal that one-third of hires should be “early career.”
    • “Aligned to the Trump administration’s workforce management agenda, Federal agencies should hire patriotic Americans and make hiring decisions based on merit, not proxies. A college degree, or years of tenure, may or may not tell us whether someone is the best fit for a job. Demonstrated skills do,” says the document, attached to a memo to agencies.
    • “Agencies will emphasize lawful, fair, and open competition, grounded in job-related competencies and merit-based skills assessments. Nowhere is this more urgent than in early career recruitment. The federal government is exponentially under-indexed on early career talent,” it says.”
  • and
    • “In its newly released “Governmentwide Recruitment Strategic Plan” (see related story), OPM said it is looking for “disciplined execution by all agencies, not just OPM” which will be looking for “indicators of success” by agencies in carrying it out.
    • “Says a cover memo from OPM director Scott Kupor, “Successful implementation requires unwavering commitment and disciplined execution by every agency, not just OPM. Agency leaders and Chief Human Capital Officers must align recruitment with workforce needs, strengthen early-career talent pipelines in pursuit of the Plan’s hiring goals, measure outcomes, and hold their organizations accountable for results.”
  • FedSmith encourages readers to “Look Beyond Premiums: Understanding the Real Cost of Your [FEHB or PSHB] Health Plan.
    • Learn to choose the best FEHB health plan by weighing premiums, deductibles, copays, and out-of-pocket costs for total yearly expenses.

From the U.S. Food and Drug Administration front,

  • Beckers Hospital Review reports,
    • “The FDA has granted accelerated approval to an immunotherapy that may spare some patients with locally advanced rectal cancer from undergoing chemotherapy, radiation and surgery.
    • “The approval covers London-based GSK’s dostarlimab-gxly — sold under the brand name Jemperli — as a standalone treatment for adults with previously untreated stage 2 or 3 locally advanced rectal cancer, according to an Oct. 19 news release from the agency.
    • “Eligible patients’ tumors must be identified by an FDA-authorized test as mismatch repair-deficient or microsatellite instability-high, the release said.” 
  • Reuters relates,
    • “Haemonetics (HAE.N) said on Monday the US Food and Drug Administration ​approved its device designed to seal ‌arterial openings created during minimally invasive heart and vascular procedures.
    • “The device, PerQseal ⁠Elite, uses a fully absorbable ​patch that dissolves over time ​and does not leave a permanent implant in the body.”
  • MedTech Dive tells us,
    • “The Food and Drug Administration has cleared the Twiist automated insulin delivery, or AID, system for use in adults with insulin-treated Type 2 diabetes. 
    • “Sequel Med Tech, which sells the device, disclosed the 510(k) clearance on Friday. The FDA granted the clearance to Deka Research and Development, Sequel’s partner on Twiist.
    • “The FDA cleared Twiist after researchers linked the AID system to reduced blood sugar and increased time in the target glycemic range in a clinical trial.”
  • Cardiovascular Business adds,
    • “Masimo, a California-based medtech company, has secured U.S. Food and Drug Administration (FDA) clearance for its smartSET pulse oximetry platform to identify signs of atrial fibrillation (AFib) and deliver alerts to its Radius Vital Signs Monitor. The newly cleared feature continuously evaluates a patient’s pulse waveform data, flagging clinicians when additional follow-up care may be necessary.
    • “When a patient deteriorates on a general care floor, respiratory compromise and cardiac arrhythmias often develop silently between routine rounds,” Basil Matta, BA, MB, BCh, BAO, Masimo chief medical officer, said in a statement. “By bringing AI-driven pattern recognition directly into the pulse oximetry workflow, smartSET helps clinicians see subtle physiological shifts earlier. It bridges the gap between spot checks, giving care teams actionable insight when minutes count.”
    • “For more than three decades, Masimo has expanded what clinicians can expect from pulse oximetry,” added Tim Benner,Masimo president. “With smartSET, we are bringing intelligent sensing and AI-enabled detection to the bedside—building on our signal-processing expertise to turn continuous monitoring data into meaningful clinical insight.”
  • and
    • “A new size-adjustable pulmonary valve approved by the U.S. Food and Drug Administration (FDA) could reduce the number of open-heart surgeries children with congenital heart disease need as they grow.
    • “Cardiovascular Business spoke to Emile Bacha, MD, chair of the department of surgery and surgeon-in-chief at NewYork-Presbyterian Hospital/Columbia University Medical Center, to learn more. Bacha, a lead investigator in the clinical trial that supported FDA clearance of the Edwards Lifesciences Autus size-adjustable pulmonary valve, said this device addresses the longstanding challenge of valves not being able to grow with pediatric patients into adulthood.
    • “This is indeed an important new advance in the field of treatment of pediatric heart disease,” Bacha, a past president of the American Association for Thoracic Surgery (AATS), explained. “When we replace a valve in a one-year-old they will grow, but the valve is not going to grow. As a consequence, we have to constantly reoperate on this child to upsize the valve. It’s very traumatic for the kids. And those are very big surgeries that involve sternotomy. So it’s not insignificant at all. Instead of having two, three, four or more surgeries, that child will have two, three or four catheterization procedures, which are much, much less invasive.”

From the Medicare Advantage front

  • KFF offers
    • [an explainer that] tackles such subjects as what changes Medicare beneficiaries can make during open enrollment; how Medigap and other forms of supplemental coverage factor into coverage decisions; how Medicare Advantage plans and Part D stand-alone prescription drug plans vary; and the tradeoffs involved when deciding whether to enroll in traditional Medicare versus Medicare Advantage. Get the details.
    • Additional analyses explore how the average Medicare beneficiary will have 28 Medicare Advantage prescription drug (MA_PD) plans available for general enrollment in 2027 (the number of plans varies widely across states), and how Medicare Advantage plan availability varies widely by county in 2027.
    • An analysis of the Part D stand-alone prescription drug plan (PDP) marketshows that there will be a modest reduction in the number of PDPs for 2027, along with modest premium increases less than $10 per month for many enrollees — but much larger monthly premium increases of $50 or more for others if they don’t switch plans.

No Surprises Act News

  • STAT News reports,
    • “Before it won a lucrative government contract, iMPROve Health’s very future was in question.   
    • “The Michigan-based nonprofit lost over $2 million in 2022 alone — over a third of its revenue — on top of losses in previous years. There were budget cuts; it ditched the office, went remote, and even discussed selling the company. 
    • “We had conversations about, ‘Should we merge and be an organization that someone acquires?’ We had those conversations,” said Richard Murdock, a former iMPROve board member.
    • “Three years later, iMPROve boasts a 70% profit margin, almost as high as that of tech giant Nvidia. Its revenue has grown 13-fold. The turnaround is thanks to the company’s new government-backed role: picking winners in high-stakes payment disputes between health care providers and health insurers.
    • “It’s not the only nonprofit making massive sums by acting as an arbitrator in the program, created under a 2020 law to protect patients from unexpected out-of-network bills. Two others, C2C Innovative Solutions and IPRO, are raking in cash as well. For every dollar the three nonprofits made last year, about half was pure profit.” 

From the judicial front,

  • Bloomberg Law reports,
    • “The Trump administration requested the US Supreme Court weigh in on its latest loss over regulation of surprise medical bills, asking whether courts can use the Administrative Procedure Act to universally vacate federal rules.
    • “A ruling in favor of the administration could potentially upend a sprawling web of litigation over federal regulation, including ramifications for lawsuits over rules governing the Affordable Care Act, Medicare, and Medicaid.
    • “The US Court of Appeals for the Fifth Circuit improperly used universal vacatur as a default remedy to overturn provisions of a rule calculating payment benchmarks in arbitration disputes for unexpected out-of-network bills, the administration argued in its petition for certiorari filed Wednesday.”
  • Fierce Healthcare relates,
    • “Healthcare AI startups OpenEvidence and Doximity settled a contentious legal fight over allegations of corporate espionage and cyberattacks, alongside counterclaims of defamation and misinformation.
    • “The two companies reached a settlement in principle on Thursday, leading to a dismissal of all claims and counterclaims with prejudice on Friday, according to court filings in the U.S. District Court in the District of Massachusetts. As part of the dismissal, the judge also ruled that each party would bear its own costs and attorneys’ fees.
    • “Legal representatives for both companies did not respond to requests for comment. The joint notice of settlement did not provide details on the agreement.”
  • Per a Justice Department news release,
    • “Somerset Lifesciences Inc. (Somerset) has agreed to pay $4 million to resolve common law claims for causing Medicare Part D (Medicare) to pay for its prescription-only (Rx-only) generic drug Olopatadine when it was no longer eligible for Medicare coverage. Medicare does not cover drugs that can be purchased by retail customers over-the-counter (OTC) without a prescription. In 2020, the brand name version of Olopatadine switched from Rx-only to OTC, and Somerset was required to change Olopatadine’s label from Rx-only to OTC as well. Instead, Somerset continued to label and sell Olopatadine as Rx-only and caused Medicare to wrongfully pay claims for an OTC drug.” * * *
    • “Except for the admissions contained in the settlement agreement, the claims resolved by the settlement are allegations only and there has been no determination of liability.“

From the public health and medical / Rx research front,

  • Cardiovascular Business reports,
    • “Regular exercise is an essential piece of the puzzle when trying to prevent or manage cardiovascular disease (CVD), according to a new scientific statement from the American College of Cardiology. The team behind the document recommends prescribing exercise to patients whenever appropriate, explaining even a little bit of movement can make a major impact.
    • “The most important message is that some activity is better than none,” Jonathan N. Myers, PhD, chair of the statement’s writing committee and a health research scientist with the Palo Alto VA Healthcare System, said in a statement. “Patients do not need to become athletes to improve their cardiovascular health. Small increases in physical activity can produce meaningful benefits, particularly for those who are currently inactive.”
    • “Myers et al. emphasized that poor cardiorespiratory fitness is a “powerful and independent predictor” of adverse health outcomes. In fact, the risks of poor cardiorespiratory fitness are comparable to what clinicians see with smoking, hypertension, diabetes and other well-known risk factors. 
    • “To this day, however, cardiologists and other cardiovascular care professionals often meet with patients without prescribing any kind of regular exercise routine.” 
  • The American Medical Association lets us know “what doctors want patients to know about food poisoning.”
    • “Food poisoning can cause vomiting, diarrhea and dehydration. Learn how to spot warning signs, recover safely, prevent illness and when to call your doctor.”
  • MedTech Dive shares the opinions of “5 doctors [who] weigh in on the promise, limitations of Grail’s multicancer test.”
    • “As the closely watched screening test moves closer to Food and Drug Administration approval, MedTech Dive asked cancer experts what encourages and concerns them most about Galleri.”
  • Beckers Hospital Review tells us,
    • “Patients taking GLP-1 medications had lower rates of major cardiovascular complications and infections after surgery than those not taking the drugs, according to a study of more than 2 million adults presented Oct. 18 at the American Society of Anesthesiologists’ Anesthesiology 2026 annual meeting in San Diego.”
  • and
    • “As healthcare leaders celebrate the FDA’s approval of daraxonrasib — a pancreatic cancer drug that nearly doubled survival in clinical trials — two harsh realities remain: most pancreatic cancer patients are still diagnosed at a late stage, and those treated with daraxonrasib will eventually develop resistance to it.
    • “Pancreatic cancer is the third-leading cause of cancer death in the U.S., representing 3.2% of new cancer cases but 8.4% of cancer deaths. Only 14.6% of pancreatic cancers are diagnosed before they spread to other parts of the body, according to SEER data. 
    • “To catch pancreatic cancer before it spreads, researchers are turning to AI.”
  • Healio informs us,
    • “In the years after becoming eligible for biologic therapy, 70% of adults with severe asthma achieved a lower yearly rate of exacerbations with just standard care, according to data published in CHEST.
    • ““In patients with severe asthma and frequent exacerbations, review their blood eosinophil counts from previous years,” Freda Yang, MBChB, MD, honorary clinical senior lecturer at the National Heart and Lung Institute, Imperial College London, and consultant respiratory physician at Royal Brompton Hospital, told Healio.
    • “Persistent eosinophilia suggests continued frequent exacerbations and a likely need for long-term biologics,” Yang said. “Patients without it may improve with standard care or need biologics for a shorter period. As an observational study, these findings need confirming in prospective trials.”
  • STAT News points out,
    • “An oral treatment from Gilead Sciences eliminated the symptoms experienced by patients with a type of inflammatory bowel disease, mid-stage study results reported Monday that could boost the biotech’s push to develop new drugs for inflammatory and autoimmune conditions. 
    • “A 200-milligram daily dose of the Gilead pill, called emvistegrast, taken for 12 weeks resulted in a 23% placebo-adjusted clinical remission rate for patients with moderate to severe ulcerative colitis, the Phase 2 study showed. The statistically significant improvement exceeded Wall Street analyst expectations.
    • “Emvistegrast has the potential to be a best-in-class oral for patients with ulcerative colitis,” Swati Tole, Gilead’s senior vice president overseeing clinical development of its inflammatory disease medicines, told STAT on Friday. “Patients with inflammatory bowel disease, while they have other therapies available, still have persistent symptoms. A majority do not achieve remission, so seeing these data was encouraging for us.” 
  • BioPharma Dive adds,
    • “A rare disease drug previously spurned by the Food and Drug Administration will get another shot at approval after positive Phase 3 results that sent shares of its developer, Disc Medicine, soaring by more than 35%. 
    • “Disc said Monday that the treatment, bitopertin, met all of its main and secondary objectives in a Phase 3 trial in erythropoietic porphyria, an uncommon disease causing hypersensitivity to light. The findings position Disc to resubmit an approval application to the Food and Drug Administration by the end of the year and possibly launch the therapy in 2027.” 

From the healthcare business front,

  • Beckers Hospital Review reports,
    • “Austin, Texas-based Ascension Seton has signed a definitive agreement to acquire a hospital and two urgent care centers in the north Austin area from Cedar Park, Texas-based Family Hospital Systems.  
    • “The deal includes Austin-based Family Hospital at Lake Travis, according to an Oct. 1 news release from Ascension Seton shared with Becker’s. The hospital provides 24/7 emergency care and inpatient care, according to Family Hospital Systems’ website. 
    • “The deal also includes Cedar Park-based Family Medical Center at Lakeline and Family Medical Center at Round Rock (Texas), which offer urgent care, primary care and on-site imaging, according to Family Hospital Systems’ website. 
    • “Ascension Seton, which is part of St. Louis-based Ascension, said the acquisition will give families in Austin’s outer metro area more access to emergency services. The health system said the move supports the market’s growth, patient care and long-term sustainability.”
  • and
    • “UnitedHealth Group’s count of subsidiaries and related entities has reached 2,807, according to the latest “Sunlight Report,” updated in October.
    • “The report comes from the Center for Health & Democracy and is funded by Arnold Ventures. The updated report identified more entities since the findings published in July 2025, factoring in 2024 year-end and 2025 Schedule Y state insurance filings, publicly confirmed 2026 transactions and U.S. Securities and Exchange Commission filings through the second quarter of 2026.” * * *
    • “UnitedHealth’s acquisitions have slowed since the original report’s data window. From early 2024 to the end of 2025, 368 entities joined and 268 left. The report documented two acquisitions in 2026: benefits administration platform Alegeus Technologies and six surgery centers through a Federal Trade Commission order.” 
  • Beckers Clinical Leadership relates,
    • “Nurse scientists are calling on hospitals, payers and credentialing bodies to overhaul how they measure nursing care, arguing that today’s metrics capture only a sliver of what nurses actually do.
    • “In a viewpoint published Oct. 19 in JAMA Internal Medicine, three nurse researchers — led by Lori Kennedy, PhD, RN, director of the Center for Nursing Science at Sacramento, Calif.-based UC Davis Health — proposed a set of nurse-sensitive outcome measures spanning nine domains of acute and critical care nursing practice, along with a framework to develop them.
    • “Their central critique: the nurse-sensitive metrics CMS relies on focus almost entirely on patient harm, including hospital-acquired infections, falls, pressure injuries and restraint use. Those measures matter, the authors wrote, but they “measure nursing by its absence.”
    • “When nursing value is expressed only as harm incurred, the economic case for nursing investment becomes purely defensive,” they wrote. Institutions tally the cost of each central line-associated bloodstream infection, they noted, but not the value of a nurse catching signs of sepsis before a patient becomes hypotensive and requires an ICU transfer.” * * *
    • “The proposed framework builds on the 2024 “Blueprint for Change in Acute and Critical Care Nursing,” a call to action from a national panel of nursing science leaders that included Dr. Kennedy.”
  • Beckers ASC Review tells us,
    • “Chicago-based Northwestern Medicine has opened a new outpatient center on the Northwestern Medicine Huntley (Ill.) Hospital campus. 
    • “The 80,000-square-foot facility will provide services including general surgery, cardiovascular, gastroenterology and pulmonary medicine, according to an Oct. 19 news release from Northwestern Medicine. 
    • “The expansion will add about 300 new jobs over the next three years.” 
  • Beckers Payer Issues informs us,
    • “Cigna Healthcare in the first quarter of 2027 will roll out Health Sense, a tailored customer and clinical support model that brings together health, benefits and cost information. 
    • “While the model will initially roll out for customers with oncology and cardiometabolic needs, Stanley Crittenden, MD, chief medical officer at Cigna Healthcare, told Becker’s that the team is just getting started.
    • “Don’t look at this as just a one-time product launch, but think about this as a more iterative process where we’re going to be adding more conditions,” he said.
    • “Cigna chose to roll out Health Sense to those with oncology and cardiometabolic conditions first because they often have complex and costly care journeys, Dr. Crittenden said. He did not share which conditions could be on the horizon next, but he said the team is considering other areas where patients have “the greatest needs and the highest complexity that would benefit from earlier intervention.” Dr. Crittenden said Cigna is currently focused on learning from the initial rollout and validating outcomes.”
  • and
    • “CVS Health named Maria Wilson, MD, as chief medical officer of Oak Street Health, the company’s value-based primary care centers for older adults. 
    • “Dr. Wilson has been with Oak Street Health since 2017, most recently serving as an executive medical director, according to her LinkedIn profile. 
    • “It’s a privilege to take on this role in a place where I’ve seen firsthand what our providers and care teams can do,” Dr. Wilson said in an Oct. 16 LinkedIn post. “Value-based care is about getting the right care to patients at the right time while supporting the provider care teams who deliver it, and I’m excited to help lead that work.”
  • The New York Time points out “professionals [who] may be the best kept secret in elder care.
    • “They can arrange a move to a senior living facility, deal with Medicare and Medicaid, recommend doctors, drive a client to the dentist, and much more.”
  • NBC News notes, “Many Women Are Still Struggling to Fill Estrogen Patch Prescriptions. What to Do If You Can’t Get Yours
    • “As demand for menopause treatment increases, estrogen patches are hard to find at pharmacies. Here’s what to do if you can’t refill your prescription.”
  • Per the Wall Street Journal,
    • “Roche Holding entered a licensing agreement with Hansoh Pharmaceutical Group that could net the Chinese drugmaker more than $15 billion.
    • “Hansoh will receive $400 million upfront and $110 million after a year, plus potential payments subject to targets and royalties on sales.
    • “The collaboration aims to advance a portfolio of antibody-drug conjugates, which are targeted cancer therapies, across multiple cancer types.”
  • and
    • “Germany’s Merck KGaA agreed to buy U.K. biotech company Silence Therapeutics for $1.3 billion.
    • “Merck is offering $20 in cash for each American depositary share of Silence Therapeutics, more than double its Friday closing price.
    • “The deal aims to strengthen Merck’s rare-disease pipeline by adding divesiran, an experimental drug ready for late-stage clinical trials.”

Weekend update

David Ermer–CDC, CMS, Congress, Medicare, No Surprises Act, OPM, Rx coverage, U.S. Healthcare–

Simplicity is a virtue.

From Washington, DC,

  • Congress remains on the campaign trail this week.
  • Beckers Hospital Review reports,
    • :CMS is pitching new guardrails for pharmacy benefit managers and Medicare Advantage plans under a proposed rule released Oct. 16.
    • “The proposed rule would implement sections of the Consolidated Appropriations Act of 2026. Comments are due Dec. 15.
    • “Starting Jan. 1, 2028, PBMs and their affiliates would only be able to accept flat-dollar, itemized service fees for Part D drugs. The fees could not depend on drug prices or rebates. Manufacturer rebates and discounts would remain allowed if they are fully passed through to the plan sponsor.” * * *
    • “Beginning in contract year 2028, MA organizations would need to estimate “a letter grade” for their provider directory accuracy based on a provider sample. In 2029, CMS would publicly post these scores, and plans would need to show them in their directories.
    • “If an MA enrollee books a provider listed as in network, that enrollee would pay no more than the lesser of the in-network or other cost-sharing. This would still apply if the provider ends up being out of network. That protection would begin in contract year 2028.”
  • The American Hospital Association News tells us,
    • “The Centers for Medicare & Medicaid Services announced that it will exercise enforcement discretion for inpatient rehabilitation facility admissions from Oct. 1, 2026 through March 31, 2027, with respect to the timing of the initial interdisciplinary team meeting requirement. As of Oct. 1, the initial IDT meeting must occur on or before four days from the date a patient is admitted to an IRF in order to implement appropriate treatment services; establish or review the patient’s stated rehabilitation goals; and identify problems that could impede those goals. This requirement was finalized in the fiscal year 2027 IRF prospective payment system final rule. The AHA had urged CMS not to finalize this requirement, in part due to its inconsistent descriptions of when the four-day threshold would be met relative to admission. 
    • “During this six-month moratorium, Medicare Administrative Contractors will enforce the initial IDT meeting timing requirement that had been in effect during FY 2026. This means they will not deny or non-affirm a claim based solely on the timing of the initial IDT meeting if an IDT meeting occurs at least once per week throughout the duration of a patient’s stay. CMS said that all other applicable IRF coverage and documentation requirements remain in effect.” 

From the U.S. Office of Personnel Management front,

  • The FEHBlog has noticed that 2027 FEHB and PSHB brochures are beginning to shown up in downloadable form on plan open season websites.
  • OPM posted in the Federal Register a Paperwork Reduction Act notice about its efforts to extend its Postal Service Health Benefits Program portal for collecting family member documentation to the FEHB Program. The public comment deadline is December 18. 2026.
  • OPM’s Office of Inspector General posted its Top OPM Management challenges for the current 2027 federal fiscal year.

No Surprises Act News

  • The American Hospital Association News reports,
    • “The Centers for Medicare & Medicaid Services announced that the submission period opened Oct. 16 for petitions to deny the recertification of five independent dispute resolution entities. Members of the public, providers, facilities and others can submit a petition, which must identify the IDR entity seeking recertification and detail the reasons for the petition. The five organizations seeking recertification are Maximus Federal Services, Inc.; ProPeer Resources LLC; C2C Innovative Solutions, Inc.; Medical Evaluators of Texas ASO, LLC; and Federal Hearings and Appeals Services, LLC. The petition period is open through Oct. 23. The departments of Health and Human Services, Labor, and the Treasury will make a final decision on recertification after reviewing any petitions submitted.” 

From the judicial front,

  • Beckers Hospital Review reports,
    • “AbbVie, Bristol Myers Squibb, Boehringer Ingelheim and PhRMA are asking to intervene in the hospital industry’s lawsuit seeking to block HRSA’s revised 340B Rebate Model Pilot Program, according to court filings in the U.S. District Court for the District of Maine.
    • “AbbVie and its Pharmacyclics unit, Bristol Myers Squibb and Boehringer Ingelheim filed a motion to intervene Oct. 14, and PhRMA filed its own motion Oct. 15 in American Hospital Association v. Kennedy. The drugmakers said they want to defend the rebate plans HRSA approved for their drugs, including AbbVie’s Imbruvica, Linzess and Vraylar, Bristol Myers Squibb’s Eliquis and Pomalyst and Boehringer’s Jardiance, Ofev and Tradjenta. They argued that the government’s representation of their interests “may be inadequate,” the standard for intervening, because, unlike HRSA, they face duplicate discount losses and civil penalties.”

From the public health and medical/Rx research front,

  • Beckers Clinical Leadership reports,
    • “The share of flu tests coming back positive rose from 3.9% to 5% in the week ending Oct. 10, the CDC’s first FluView report of the 2026-27 season shows. ED visits and outpatient visits for flu also climbed.
    • “Seasonal flu activity remains low, but test positivity, outpatient visits for flu-like illness, ED visits with a flu diagnosis and lab-confirmed hospitalizations have all been rising since late August or early September. Activity is highest on the West Coast, and the CDC said early-season levels are higher than typical for this time of year but within expected seasonal variation. Influenza A(H1N1) accounted for 96.4% of the influenza A viruses that public health labs subtyped during the week.”
  • Health Day relates,
    • “Poorer maternal dietary quality is associated with infantile colic and eczema, according to a study published online Oct. 12 in JAMA Network Open.
    • “Emily Oken, M.D., M.P.H., from Harvard Medical School and Harvard Pilgrim Health Care Institute in Boston, and colleagues estimated associations of maternal diet quality and intakes of specific allergenic foods with infant eczema and colic in a prospective cohort of 2,128 mother-child pairs unselected for atopic risk. Food frequency questionnaires were administered in early and mid-pregnancy, and the Mediterranean Diet Score (MDS) and Dietary Inflammatory Index (DII) were calculated.”
  • and
    • “If you’re in your 60s, 70s or even older, you might think your days of productively pumping iron are behind you.
    • “That’s just not true, said Dr. Adil Ahmed, an assistant professor in the Joseph Barnhart Department of Orthopedic Surgery at Baylor College of Medicine in Houston.
    • Building and maintaining muscle is a great way to stay all-round healthy, he said.
    • “The protective effect of muscle and muscle mass has been well studied — everything from the musculoskeletal system to orthopedics and even brain health,” Ahmed said in a Baylor news release. “Building muscle in your body has been well shown to delay dementia and the effects of dementia and preserve cognitive function.”
    • “Strength training also helps your bones. It’s one of the best ways to help aging bones stay dense and strong, Ahmed said.
    • “It’s a very good protective long-term process,” he said.” 

From the U.S. healthcare business front,

  • Modern Healthcare tells us,
    • “Health systems are increasingly selling their real estate to ease financial pressure and fuel expansion, and regulators are pushing back.
    • “Health systems are seeking relief from higher costs and lower reimbursement by selling the buildings and land that house their hospital and outpatient facilities. Those deals provide an immediate capital infusion to shore up finances and fund growth, but can expose providers to higher long-term costs as buyers become more selective and state and federal policymakers increase oversight. 
    • “This is trading a short-term fix for a long-term cost,” said Jim Baker, founder and executive director of the Private Equity Stakeholder Project, a nonprofit watchdog group that opposes private equity investment in healthcare.” 
  • BioPharma Dive reports,
    • “Estuary Biotherapeutics, a California-based genetic medicines developer, officially launched on Friday, backed by nine figures worth of funding and a management team stocked with former Biogen leaders.
    • “Forged in 2022, Estuary is built around research conducted by its scientific co-founders Stefan Somlo and Michael Caplan, both professors at the Yale School of Medicine. Somlo’s lab has made major discoveries about an inherited disorder where certain genetic mutations cause cysts that progressively damage the kidneys and often lead to renal failure. Through a landmark study published in the journal Nature Genetics, Somlo’s team found that, in mice, reactivating proteins called polycystins could shrink the cysts and reverse kidney inflammation and scarring.
    • “And in Caplan’s lab, scientists determined that only a small piece of the full polycystin protein is needed to suppress this “autosomal dominant polycystic kidney disease.” Those findings suggest that helpful genetic material can be successfully packaged up and delivered to the kidneys with the standard “viral vectors” used for gene therapy.
    • “Taken together, Estuary believes its technology and expertise will bring about the first-ever treatment that can halt or reverse, rather than just slow, the most common inherited kidney disorder. Estimates hold that ADPKD affects about 1 in every 400 to 1,000 people. Just one drug, tolvaptan, is specifically approved to treat it.”
  • Fierce Pharma offers us a look inside “Teva’s Weltruza launch and Novo’s GLP-1 strategy.”

Cybersecurity Saturday

David Ermer–Agentic & Generative AI, Congress, Cybersecurity–

From the frontier AI front,

  • Beckers Health IT reports,
    • “OpenAI said one of its internal AI models broke through security on a government statistics website to get hospital-bed data the site had refused to give it.
    • “The model was in reinforcement learning training at the time, according to a misalignment report the company updated Oct. 15.
    • “The incident happened June 17, and OpenAI discovered it Aug. 13. The model’s task was to find a district’s historical hospital-bed totals on the site. OpenAI did not name the website or the country.
    • “After the site denied it access several times, the model used the site’s file-download feature to pull application and configuration files from outside the folder that feature was meant to serve. “Those files contained a database connection string, a secret used to sign authorization tokens and email login credentials.
    • “The model then found that the site’s code read identity data from authorization tokens without checking their signatures. It built unsigned tokens, got past the statistics endpoint’s authorization checks and saved 24 years of data, far more than the single year it had been asked for.”
  • Bleeping Computer lets us know,
    • “Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers.
    • “The company’s experiments showed that models could identify unfamiliar devices, connect them into a network, and prepare them to run an AI model.
    • “Although the researchers successfully distributed the Gemma4-26B-A4B model from Google DeepMind on 15 off-brand Android TV boxes, they did not demonstrate a fully autonomous, self-replicating AI worm running on real IoT hardware.
    • “However, they estimate that smaller models could achieve self-replication by the end of the year if they continue to improve at their historical rate.
    • “Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes,” Anthropic warns.”
  • Cyberscoop adds,
    • “The federal government is advising AI companies to set more industry standards for securing agents in sandbox testing environments.
    • “In joint guidance from the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) at the Department of Commerce, AI companies are encouraged to lean more heavily on cybersecurity technical controls, independent testing and evaluation of new models and develop “shut down policies” that govern when a model or test should be taken offline.
    • “The guidance comes after a summer when OpenAI, Anthropic, Google, Meta and other companies say their AI models escaped from testing environments and hacked real organizations and websites. The problem has bedeviled frontier AI companies, with many of their own researchers saying it’s possible that hundreds – even thousands – of similar sandbox escapes may have occurred over the summer, raising major questions about the lack of effective monitoring in place.
    • “While these incidents highlight the importance of traditional cybersecurity principles and practices, they also introduce novel considerations for incident prevention, response, and reporting,” the agencies wrote. “These novel considerations primarily stem from the agentic nature and advanced cyber capabilities of cutting-edge SI systems.”
  • Federal News Network notes,
    • “Artificial intelligence is accelerating cybersecurity threats, while AI adoption is posing urgent risks around data, identity, trust and operational decision-making. Agencies grappling with those challenges are exploring how to securely adopt AI for both general purpose use and cyber defense.
    • “Thomas Edgar, the chief cybersecurity scientist at Pacific Northwest National Laboratory, said PNNL’s research explores both the risks and opportunities posed by advanced AI models.
    • “Trying to benchmark and understand how bad these models could be if they’re used to target our critical infrastructure,” Edgar said during AI driven defense and the future of the SOC discussion. “But we do prototypes and proof of principle type research, and so AI has been a boon for us to help us kind of iterate and try things faster, supporting our reverse engineering, vulnerability analysis, protocol analysis, data analysis. We’re really looking at how we can really extract optimization out of AI to make us more efficient and effective, and then ultimately transition that off to our government sponsors and our critical infrastructure, so that they can take advantage of what we’ve learned.”

From the cybersecurity policy and law enforcement front

  • Cyberscoop reports,
    • “Members of Congress are pressing the Trump administration to expand the federal government’s role in securing artificial intelligence, wanting new safety standards and regulations, independent testing of models and more “aggressive” use of AI for defensive cybersecurity purposes.
    • “In a letter, Sens. Maria Cantwell, D-Wash., and Mike Rounds, R-S.D., said that multiple incidents of frontier AI models escaping sandbox protections and breaching real companies, organizations and governments necessitate a stronger federal role in regulating the technology.”
  • Security Boulevard informs us,
    • “The FBI has arrested Canadian cybersecurity expert Edward Dubrovsky, accusing him of conspiring with ShinyHunters in the breach of the agency’s systems.
    • “The attack exposed sensitive information of thousands of FBI employees, including job details, specializations, and medical records, after hackers exploited an unpatched Oracle PeopleSoft vulnerability.
    • “Dubrovsky’s arrest follows the detention of other alleged ShinyHunters associates as investigators pursue the prolific extortion group, which the FBI says has breached more than 140 organizations since 2025 and extorted $70 million.”
  • The American Hospital Association News tells us,
    • “Microsoft and Health-ISAC Oct. 15 announced that they disrupted three cybercriminal businesses that provided services to threat actors to attack more than 75,000 organizations worldwide, including healthcare. The businesses were found to be part of a wider, Chinese-language cybercriminal marketplace supplying malicious services to threat actors around the world. Investigators that included Microsoft, Health-ISAC, Japan’s National Police Agency and other organizations collaborated to seize and redirect domains for infrastructure operating the three criminal businesses — YAM Store, CoGUI and Iron Man. The businesses collectively enabled more than 1 billion malicious messages that targeted consumers, healthcare organizations, financial institutions and other entities in more than 150 countries, generating tens of millions of dollars.” 
  • Bleeping Computer adds,
    • “The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group’s operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean [(DPRK)] remote IT worker schemes.
    • “Famous Chollima (a.k.a. WageMole) is commonly tracked as a DPRK threat actor associated with fraudulent IT-worker schemes that generate revenue for the DPRK regime.” * * *
    • “Laptop farms are locations where facilitators host employer-issued computers that North Korean IT workers access remotely to appear based in the United States.
    • Law enforcement agents seized approximately 187 laptops and KVM input devices, which were used by Famous Chollima operatives that cybersecurity company CrowdStrike had been tracking since April 2025.
    • “CrowdStrike researchers say that DPRK IT workers used several methods to send the company-issued laptops to the “farm,” instead of the address in the provided identity documents: 
      • Submit fake theft reports to trigger replacement shipments to the farm’s address
      • Rotate through residential addresses to obscure the final destination
      • Claim last-minute relocations to divert devices mid-shipment
      • Abuse IT staffing roles they sometimes hold to covertly redirect shipments
    • “CrowdStrike says public exposure has pressured the operatives, leading them to rely more on spoofing device identifiers or even reusing identifiers across victim organizations.
    • “While CrowdStrike acknowledges that actions like Lonestar Roundup will likely have limited impact, the company called the operation “the beginning of a broader U.S. law enforcement effort to dismantle Famous Chollima’s U.S. infrastructure.”

From the cybersecurity breaches and vulnerabilities front

  • HIPAA Journal reports,
    • “In July 2026, 77 healthcare data breaches affecting 500 or more individuals were reported to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights. July was the third consecutive month in which large healthcare data breaches increased, with a month-over-month increase of 10%.” * * *
    • “A majority of the data breaches reported in July were due to hacking and other IT-related incidents, including all but one of the 23 data breaches affecting 10,000 or more individuals. In July, 67 of the month’s data breaches (87%) were reported as hacking/IT-related incidents, involving the protected health information of 33,446,371 of the month’s affected individuals (99.9%). The average breach size was 499,200 individuals, and the median breach size was 4,851 individuals.” * * *
    • “In July, network servers were the most common location of breached protected health information, followed by email systems.”
  • and
    • “Cyberattacks on healthcare organizations are continuing to rise, are becoming costlier to resolve, and are increasingly negatively impacting patient care, according to a recent survey conducted on behalf of the cybersecurity firm Proofpoint. The findings were published in the 2026 Ponemon Healthcare Cybersecurity Report.
    • “The survey was conducted by the Ponemon Institute and included 705 responses from IT and IT security practitioners whose responsibilities include setting cybersecurity policies, selecting vendors and contractors, and managing security budgets. The respondents included public healthcare providers (22%), private healthcare providers (18%), healthcare insurers (18%), payers (11%), healthcare insurance companies (10%), with the remainder from life sciences, pharma, and biotechnology companies.” * * *
    • “While hacking incidents continue to increase, insider risk continues to be a problem in healthcare, with 97% of organizations experiencing at least two data loss or exfiltration incidents in the past 12 months, with an average of 21 incidents at each organization. More than half of respondents (54%) said these incidents impacted patient care, and 56% of respondents said these insider incidents resulted in an increase in mortality rates.
    • “Cybersecurity incidents are increasingly disrupting clinical operations, consuming organizational resources, and affecting care delivery,” explained Proofpoint.  “The healthcare organizations that will be most successful in the years ahead will be those that combine cyber resilience, identity security, human risk management, supply chain security, and AI governance into a unified strategy focused on protecting both operations and patient outcomes.”
  • Cybersecurity Dive relates,
    • “Days after a cyberattack targeting French supermarket refrigerators, thousands of controllers across the globe are visible online and at risk of compromise. 
    • “Hundreds of grocery stores in France were targeted in a sophisticated attack, in which hackers gained access to programmable controllers that regulate commercial refrigeration systems. 
    • ‘Hackers were able to manipulate controls inside the refrigerators, causing systems to overheat – and in some cases catch fire – leading to millions of dollars in damage. 
    • Hackers targeted vulnerabilities in Danfoss AK-SM, Danfoss AK-SC, Copeland xweb and Dixell xweb controllers, according to ANSSI, France’s national cybersecurity agency.” * * *
    • Security researchers say the problems begin in the design of these systems, where security is not a top priority. 
    • “People who design systems, people who build systems, they usually believe that people will be well behaved,” Aleksandr Yampolskiy, co-founder and CEO of Security Scorecard, told Cybersecurity Dive. “But hackers are not well behaved.”
    • “High-severity vulnerabilities in Danfoss controllers were publicly disclosed in an August report by Claroty, a firm that specializes in industrial cybersecurity. Researchers found high-severity flaws in the web management interface of Danfoss systems that could allow an attacker to take control of a device.
    • “The vulnerabilities were tracked as CVE-2025-41451 and CVE-2025-41452. Researchers originally alerted Danfoss to the flaws in 2025 before releasing the report under a coordinated disclosure process. The manufacturer patched the flaws and issued additional guidance. 
    • “The attacks impacted hundreds of supermarkets across multiple chains, including Carrefour, Monoprix, Cooperative U and Intermarche. 
    • “A spokesperson for Copeland confirmed that a vulnerability was found in discontinued end-of-life controllers. The company is actively working with impacted customers to mitigate the risk.”
  • CISA added nine known exploited vulnerabilites to its catalog this week.
    • October 13, 2026
      • CVE-2026-96951 Microsoft Windows Command Injection Vulnerability
      • CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
        • CISA separately advises about the Ivanti KVE here.
        • SOC Prime discusses the Microsoft Windows KVE here.
    • October 14, 2026
      • CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability 
      • CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability
      • CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability 
      • CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability 
        • The Hacker News discusses the Palo Alto Networks KVE here.
        • SOC Prime discusssed the Cisco KVE here.
        • The Hacker News discusses the Ahsay KVEs here.
    • October 15, 2026
      • CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability 
        • TechNadu discusses the Atlassian KVE here.
    • October 16, 2026
      • CVE-2025-61624. Fortinet Multiple Products Path Traversal Vulnerability
      • CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability 
        • Cybersecurity Dive discusses the Beyond Trust KVE here.
        • CISA also gives separate advice on the Beyond Trust KVE here.
        • The Hacker News discusses the Fortinet KVE here.
  • SC Media lets us know,
    • “We had a lot of predictions in place at the start of 2026, most of which have come to fruition. But in several cases, reality moved even faster than we expected.
    • “The biggest change we have seen so far in 2026 was not a single new attack technique. It’s the way several trends have come together. AI now helps attackers move much faster than before, identities are becoming more important than malware, and legitimate tools and trusted platforms are increasingly becoming the attack path themselves.”

From the ransomware front

  • Beckers Health IT reports,
    • Ransomware attacks and unverified ransomware claims targeting U.S. healthcare organizations increased 64% in the third quarter of 2026 from the second quarter, an Oct. 15 report from cybersecurity research company Comparitech found. * * *
    • The U.S. accounted for 185 of the 306 healthcare ransomware incidents and claims tracked worldwide between July and September. Of those U.S. incidents, 26 were confirmed, including 23 involving healthcare providers.
    • Healthcare technology companies experienced the largest quarter-over-quarter increase among the healthcare business categories highlighted in the report. Comparitech identified 22 incidents and claims targeting those companies, up 175% from eight in the previous quarter. Medical manufacturers accounted for another 51 incidents and claims, a 28% increase from the second quarter.
    • “Saber Healthcare Group had the largest reported ransomware-related breach, affecting 427,084 people. The organization confirmed in July that a cyberattack had encrypted some files and disrupted services. In September, it began notifying individuals of a breach involving medical information, health insurance details and Social Security numbers. Other large breaches identified in the report involved Park Place Behavioral Healthcare, affecting 71,702 people; Hawaii Family Dental, affecting 45,853; WindRose Health Network, affecting 33,158; and Vernon & Waldrep OB-Gyn Associates, affecting 17,435.
    • “The median reported ransom demand was $300,000 for healthcare providers and $150,000 for healthcare businesses. No ransom payments were officially confirmed during the reporting period.
    • “The Gentlemen made the most claims against healthcare providers, with 18, followed by INC with 14. Qilin led claims against healthcare businesses with 15. Chaos had the most confirmed attacks in each category.”
  • The HIPAA Journal adds,
    • “The tactics of ransomware groups are constantly changing to increase pressure on victims to give in to their demands. Initially, file encryption alone was sufficient; however, as victims improved cyber resilience and were able to recover their encrypted files from backups, tactics had to evolve. Ransomware groups incorporated data theft into their attacks and started threatening to sell or leak the stolen data if the ransom was paid. This double extortion approach proved highly successful, with the threat of a data leak alone sufficient to prompt many victims to pay up.
    • “Encryption and data leak threats are no longer enough, as the percentage of victims paying ransoms continues to fall. According to a recent survey commissioned by the Identity Threat Detection and Response (ITDR) firm Semperis, the percentage of ransomware victims paying ransoms has fallen from 78% in 2024 to 69% in 2025, and 59% in 2026.
    • “Ransomware groups have responded by adopting more aggressive tactics, and a trend has emerged of ransomware groups issuing personal threats against company employees and their friends and family members. The survey revealed that 37% of ransomware attacks involved threats against friends or family members of staff members, and 41% of respondents to the survey said they had been a target of physical or psychological intimidation.
    • “While contacting individuals whose data was stolen in an attack has been adopted by several groups in the past, the threats have generally been limited to the publication of personal data, but threats are becoming more severe. Ransomware groups are now issuing threats of physical violence and are contacting employees and their friends and family members via text, email, or phone, confirming that they know where they live, work, and even where their children go to school.” * * *
    • “I’ve spoken with CISOs that had strong relationships with law enforcement,” said Courtney Guss, AVP of Crisis Management, Semperis. “They’ve found it to be a much faster route to information and resources than they would otherwise have found on their own, which can often help them recover more quickly. So, knowing those contacts and building those relationships in advance should be part of your crisis management plan.” Semperis also recommends strengthening identity resilience, preparing for identity system breaches, and practicing incident response procedures time and again against realistic scenarios, including tabletop exercises involving all team members involved in the ransomware response.”
  • BitSight offers a “DragonForce Ransomware Profile: From Affiliate Program to Cybercrime Cartel”

From the cybersecurity business and defenses front

  • The Wall Street Journal reports,
    • “Proofpoint has agreed to acquire data-security company Varonis Systems for about $6.3 billion, as artificial-intelligence security continues to drive deals and investment across the cybersecurity industry.
    • “Proofpoint will pay $49.75 a share in cash for Varonis, a 52% premium over the stock’s June 22 closing price, the final trading day before reports of a potential sale first surfaced. The transaction is expected to close in the first half of 2027, subject to approval from Varonis shareholders and regulatory bodies.
    • “The acquisition comes as cybersecurity vendors scramble to expand their AI capabilities, both to defend against threats that use the technology and to safeguard corporate systems increasingly accessed by autonomous AI tools.
    • “Varonis specializes in securing sensitive corporate data and managing access controls, while Proofpoint primarily focuses on email protection and user-level threat defense.”
  •  and
    • “Quantum-computing company IonQ IONQ struck an all-stock deal to buy Elisity in a transaction that values the cybersecurity firm at up to $1.3 billion, executives told The Wall Street Journal. 
    • It is a bet that cybersecurity will be even more critical for companies as quantum computing and AI systems become more powerful and advanced, said IonQ Chairman and Chief Executive Niccolo de Masi. 
    • “The bad guys are going to keep taking advantage of new technology,” he said in an interview. “Unfortunately, we are entering the most dangerous years, vis-à-vis cybersecurity risks.” * * *
    • “Founded in 2019, Elisity offers a platform that aims to prevent cyber attackers or ransomware from spreading across organizations. Some of its big customers include healthcare companies and hospitals.” * * *
    • “IonQ, which works closely with the U.S. Defense Department, has been on an acquisition spree to become a one-stop shop for its customers. Earlier this year, it struck its biggest deal yet, a $1.8 billion takeover of chip maker SkyWater Technology.”
  • Cybersecurity Dive relates,
    • “The open-source software community needs to understand several key lessons in order to improve its cybersecurity posture, according to IBM, which operates a clearinghouse for analyzing and disclosing open-source vulnerabilities.
    • “Finding a vulnerability is only the start,” IBM said in a report published on Thursday [October 15]. “Security teams must understand the risk, determine whether action is needed, find a usable fix, then get that fix to the software that needs it.”
    • “The new report — the first in a series collecting insights from IBM’s clearinghouse — is meant to help software maintainers and their customers, including businesses, better understand systemic risks in the open-source ecosystem.”
  • and
    • “Hackers could break into businesses by going after internet-exposed AI tools that often contain serious vulnerabilities, the internet monitoring firm Censys warned in a report published on Wednesday [October 14].
    • “The growing complexity of the AI ecosystem — in which public-facing services rely on a sprawling web of back-end products, many of them neglected by security teams — creates additional security risks, researchers said.
    • The Censys report also analyzed internet exposures of industrial control systems (ICS), finding that many of them ran traditional IT services that made them more hackable.
  • A human pentester considers when how AI pentesting stacks up against human pentesting.
    • “AI pentesting and human pentesting are different, and once you stop trying to rank them the comparison gets a lot more useful.
    • “The agents are finding serious issues in applications that human testers have already been through multiple times. They’ll read a whole codebase, work through every path in it, and write up every instance of what they find with the fix down to the line of code.
    • “And you can run one whenever you want. For what a single human engagement costs you can run four AI pentests, which means you can do deep testing on a regular basis rather than once a year.
    • “That’s a key thing that is missed by human pentesting, and often applications have undergone a lot of untested changes in between pentests.”
  • Per the Cybersecurity Hub Newsletter,
    • “Anthropic has launched OSS Scanner, a free service that uses its most capable AI models to search open-source software for security vulnerabilities, expanding its efforts to help developers identify weaknesses before attackers exploit them.
    • “The service offers participating projects periodic security scans. Its launch introduces a faster route for distributing findings to maintainers who want early access to potential vulnerabilities.
    • “The central trade-off is human review. Reports from the new service are generated and delivered without prior human triage, leaving participating projects to establish whether a reported issue is valid and warrants a fix. That could accelerate remediation for teams with sufficient expertise, but it also raises questions about how much additional assessment work maintainers can absorb.”
  • Here’s a link to Dark Reading’s CISO Corner.