Welcome back, Congress

David Ermer

I am an attorney who practices law in Washington DC. My practice has involved the Federal Employees Health Benefits Program since 1983.

Welcome back, Congress

David Ermer–Congress, Federal employment benefits, Medical / Rx research, OPM, U.S. Healthcare–

From Washington, DC,

  • The AP summarizes the issues facing Congress this month.
    • “The most urgent task for Congress is to avoid a government shutdown on Sept. 30, when federal funding runs out. And it’s so far unclear if Republicans and Democrats will be able to agree on how to do that.
    • “Congress will have to pass a short-term spending measure to keep the government funded for a few weeks or months while they try to finish the full-year package. But Republicans will need Democratic votes to pass an extension, and Democrats will want significant concessions.
      Senate Democratic Leader Chuck Schumer’s vote with Republicans to avoid a shutdown in March prompted furious backlash within his party.”
  • Roll Call explains Congress’s expected activities this week.
  • Speaking of which, the House Appropriations Committee will mark up the Financial Services and General Government appropriations bill on Wednesday September 3 at 10:30 am ET. This is the bill that funds OPM and the FEHB Program, among other items.
  • Bloomberg Law adds,
    • “House Republicans are taking a middle-of-the road approach to funding the federal health department by making deeper cuts than their Senate counterparts but granting only some of President Donald Trump’s wishes.
    • House appropriators unveiled their version of the appropriations bill for the Health and Human Services Department on Monday, which provides the department $108 billion in discretionary funding, cutting $7 billion—or 6%—from the previous year.
    • Read the bill text here and summary here.
    • This is lower than the $116 billion proposed in the Senate, but still higher than the $94.7 billion in Trump’s budget request.
  • Federal News Network reports,
    • “Most civilian federal employees will see a 1% pay increase in 2026, according to a pay plan the White House quietly transmitted to Congress, with one big exception: Law enforcement officers will see bigger raises, though it’s not yet clear exactly which ones.
    • “For the majority of workers, the annual increase is the smallest it’s been since 2021, when President Trump also directed a 1% increase during his last year in office. Presidents are required to submit an “alternative pay plan” by Sept. 1 of each year in order to keep larger formulaic raises from taking effect the following year under the Federal Employee Pay Comparability Act (FEPCA).
    • “However, a yet-to-be-determined number of federal law enforcement officers will get a 3.8% raise next year, in line with the increase military members will receive in 2026.
    • “In the same message to Congress, the president said the law enforcement raise is meant “to increase recruitment and retention in critical law enforcement roles and to ensure our great Federal law enforcement officers are treated fairly.”
    • “But it will be up to federal agencies and the Office of Personnel Management to determine which employees will be eligible for the larger law enforcement raise. Starting on Tuesday, OPM will begin consulting with agencies to identify “categories” of law enforcement personnel who will receive it.”

From the public health and medical research front,

  • NBC News reports,
    • “Six deaths from rabies have been reported over the last 12 months in the U.S., the highest number in years, according to the Centers for Disease Control and Prevention. From rabid skunks in Kentucky to gray foxes in Arizona and raccoons on Long Island, wild animals in more than a dozen places across the U.S. have experienced a rise in the deadly disease, at least partly driven by shrinking natural habitats and better surveillance.
    • “We are currently tracking 15 different likely outbreaks,” said Dr. Ryan Wallace, who leads the rabies team at the Centers for Disease Control and Prevention. Areas with outbreaks include Nassau County, New York, which issued a health threat over rabid animals last month, as well as Cape Cod, Massachusetts, and parts of Alaska, Arizona, California, Indiana, Kentucky, Maine, North Carolina, Oregon and Vermont.
    • “There are parts of the United States where it does seem like we’re getting more calls and more reports,” Wallace said, noting an increase in rabid foxes in the West and rabid bats across the country. “Whether those numbers are truly significant increases, we can only tell at the end of the year. But right now, at peak rabies season, it does seem like activity is higher.”
  • The Wall Street Journal reports,
    • “Novo Nordisk said its blockbuster Wegovy weight-loss drug cuts the risk of heart attack, stroke or death by 57% compared with Eli Lilly’s Mounjaro and Zepbound.
    • “The Danish pharmaceutical giant said Sunday that the study suggests the heart-protective benefits of semaglutide—the active ingredient in Wegovy—may not be the same for all GLP-1 drugs such as tirzepatide, which is the active ingredient in Lilly’s Mounjaro and Zepbound.
    • “The real-world study used evidence gathered from actual patient experiences rather than a controlled trial, it said.
  • Per Medscape
    • “A noticeable deficit of highly unsaturated lipids — including omega-3 fatty acids — found in women with Alzheimer’s disease (AD) but not in cognitively healthy women is linked to worse cognition and biomarkers of neurodegeneration and inflammation, new research showed. 
    • “Investigators found no significant difference in lipid profiles in men with AD compared to healthy peers, and the effects of unsaturated phospholipids on AD were not mediated by cholesterol, low-density lipoprotein (LDL), or apolipoprotein B.
    • “The study reveals that Alzheimer’s lipid biology is different between the sexes, opening new avenues for research,” senior author Cristina Legido-Quigley, PhD, from King’s College London, UK, said in a statement. 
    • “Our study suggests that women should make sure they are getting omega fatty acids in their diet — through fatty fish or via supplements. However, we need clinical trials to determine if shifting the lipid composition can influence the biological trajectory of Alzheimer’s Disease,” Legido-Quigley said. 
    • “The study was published online August 20 in Alzheimer’s & Dementia.”
  • and
    • “Current US heart failure guidelines that use a single cut point for natriuretic peptides (NPs) can underestimate the risk for the disease for people with obesity, according to a study published recently in Circulation: Heart Failure.
    • “The 2022 joint guidelines from the American Heart Association, the American College of Cardiology, and the Heart Failure Society of America added NP as a biomarker for higher risk, with a threshold of 125 pg/mL to up-classify individuals from stage A (at-risk) to stage B (pre-heart failure).
    • “But concentrations of the proteins typically are lower in people with obesity, said Jennifer Ho, MD, a cardiologist at Harvard Medical School in Boston, so she wondered whether clinicians who follow the recommendations might be underestimating the risk for heart failure in their patients with obesity.”
  • Consumer Reports, writing in the Washington Post, tells us about “Labneh, a Middle Eastern dairy food, has a tangy flavor and health benefits similar to that of yogurt.”
  • “A Wall Street Journal article explains what it means to give up ultra processed foods and another informs us
    • “Fiber-Packed Foods Are Hitting Store Shelves. Be Careful, Doctors Say. Researchers link fiber used in processed foods with inflammation and other health problems.” 

From the U.S. healthcare business front,

  • Modern Healthcare reports,
    • The healthcare industry continues to face rapid transformation, with financial, technological and operational pressures reshaping how organizations deliver care. CommerceHealthcare® has identified key mid-year developments that are influencing strategic decision-making across the sector. The year to date can be characterized by the following:
      • Financial update
      • Fresh uncertainties and persistent “structural” issues cloud the industry’s generally improving financial health.
      • There is ongoing commitment to automation and technology investment.
      • Patient affordability pressures fuel the need for financial assistance programs.
      • Migration from status quo operational models to substantially new ones is paramount.
    • A scan of leading metrics reveals both the progress and the prevailing challenges:
      • Cash. Days cash on hand varies widely across health systems.
      • Profitability: Through April, hospital margins are running near or above 3% versus the mid-1% range throughout 2024.[1] Smaller hospitals continue to struggle in 2025, as do physician groups. The median investment (loss) per physician full-time equivalent stands at an annualized $347,240, a 4.8% increase compared to 2024, and a 16.3% jump from 2023.”[2]
      • Revenue/volume: Larger hospitals experienced 24 consecutive months of year-over-year (YOY) growth through April in gross operating, inpatient and outpatient revenues.
  • HR Dive tells us,
    • “When faced with an overly complicated or long application, 57% of job candidates have abandoned it in the middle of the process due to frustration, according to an Aug. 14 report from LiveCareer.
    • “On top of that, 41% of job seekers said they think fewer than a quarter of their applications make it to a real person, which adds to their frustration during an increasingly tough labor market.
    • “The biggest job search frustrations stem from a lack of communication and confusing application processes, leading many candidates to give up on the job search,” Jasmine Escalera, a career expert for LiveCareer, wrote in the report.
    • “The majority of U.S. workers believe the application process should take less than 30 minutes, according to a survey by Employ, Inc. A third also said they’d quit an application if it took too long.”

Cybersecurity Dive

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front,

  • Per a Congressional news release,
    • “U.S. Senators Bill Cassidy, M.D. (R-LA), chair of the Senate Health, Education, Labor, and Pensions (HELP) Committee, and Maggie Hassan (D-NH) requested information from Aflac following a recent cyberattack on their internal data systems.
    • “This comes amid increasing cyberattacks on the health care sector. In 2024, there were over 700 large data breaches that impacted approximately 276 million Americans. These attacks not only threaten Americans’ sensitive health data, but delay lifesaving care to patients.
    • “The recent cybersecurity incident affecting Aflac’s supplemental insurance systems highlights the continuing risk to patients and other stakeholders,” wrote the senators. “While Aflac has stated that it ‘stopped the intrusion within hours,’ additional transparency is needed about whether the intruders accessed private consumer and patient data, how Aflac safeguarded protected health information (PHI) prior to the incident, and steps that the company intends to take going forward.”
  • Per a National Institute of Standards and Technology news release,
    • “A revision to NIST’s catalog of security and privacy safeguards [(NIST SP 800-53)] aims to help organizations better manage risks related to software updates and patches. 
    • “The catalog revision is part of NIST’s response to a recent executive order on strengthening the nation’s cybersecurity.
    • “Completed with the help of a real-time commenting system, the revision is available in several different formats, some of which are machine-readable.”
  • Dark Reading tells us,
    • “Updated federal agency guidelines for software bills of materials (SBOM) were recently released by the US Cybersecurity and Infrastructure Security Agency (CISA) with rules intended to push for additional transparency among software and component vendors. Experts agree the new rules are a hopeful step forward but worry they overlook some serious issues facing today’s software supply chain. 
    • “Since 2021, when the federal minimum SBOM guidelines initially were released, the idea has been debated in information security circles as a great concept, but just not feasible in the real world. Vendors pushed back, arguing that the regulations are onerous. And in the ensuing years, with federal agencies leading the way, SBOMs have been embraced to varying degrees. The SBOM challenge has been connecting the gorge between the information they provide, and the ability for cyber teams operationalize it. 
    • “CISA recently released its 2025 update to SBOM guidelines for federal agencies, and while experts say they are hopeful things are headed in the right direction, they also acknowledge skepticism across the cybersecurity industry about some aspects of the new guidance.” 
  • Per a CISA news release on August 26,
    • “Today, the Cybersecurity and Infrastructure Security Agency (CISA) released the Software Acquisition Guide: Supplier Response Web Tool, a no-cost, interactive resource designed to empower information technology (IT) and industry decision makers, procurement professionals and software suppliers strengthen cybersecurity practices throughout the software procurement lifecycle.
    • “The Web Tool builds on the “Software Acquisition Guide for Government Enterprise Consumers: Software Assurance in the Cyber-Supply Chain Risk Management (C-SCRM) Lifecycle”, offering a streamlined, digital experience that simplifies how users assess software assurance and supplier risk.
    • “This tool demonstrates CISA’s commitment to offering practical, free solutions for smarter, more secure software procurement,” said CISA Director of Public Affairs, Marci McCarthy. “Transforming the Software Acquisition Guide into an interactive format simplifies integrating cybersecurity into every step of procurement.”
  • Per Cyberscoop,
    • “The Treasury Department on Wednesday [August 27] expanded efforts to disrupt the pervasive North Korean technical worker scheme by imposing sanctions on people and organizations serving as facilitators and fronts for the country’s years-long conspiracy effort to defraud businesses and earn money despite international sanctions. 
    • “Vitaly Sergeyevich Andreyev, Kim Ung Sun, Shenyang Geumpungri Network Technology and Korea Sinjin Trading Corp. were all sanctioned by the Treasury Department’s Office of Foreign Assets Control for their alleged roles in the scheme orchestrated by the North Korean government.”

From the cybersecurity vulnerabilities and breaches front,

  • Cybersecurity Dive reports,
    • “Chinese government-backed hackers are targeting critical infrastructure and government computer systems as part of a yearslong campaign that includes the well-known Salt Typhoon activity, the U.S. and 12 other countries said on Wednesday.
    • “The data stolen through this activity against foreign telecommunications and Internet service providers (ISPs), as well as intrusions in the lodging and transportation sectors, ultimately can provide Chinese intelligence services with the capability to identify and track their targets’ communications and movements around the world,” the allied governments said in a joint advisory.
    • “The China-linked campaign has penetrated organizations in more than 80 countries, including more than 200 targets in the U.S., an FBI spokesperson told Cybersecurity Dive.
    • The advisory describes the attackers’ techniques, from initial access to data exfiltration; describes an incident in which the hackers tried to decrypt network traffic to collect administrator credentials; suggests strategies for threat hunting; and recommends mitigation activities.
  • and
    • “Hackers stole user credentials from Salesforce customers in a widespread campaign earlier this month, according to researchers at Google Threat Intelligence Group, who warned that the thefts could lead to follow-up attacks.
    • “A threat actor that Google tracks as UNC6395 targeted Salesforce instances using compromised OAuth tokens that were associated with the customer engagement vendor Salesloft’s Drift AI chat agent.
    • “Researchers believe the hackers’ primary goal was to harvest credentials, as they stole large amounts of data from numerous Salesforce instances.
    • “Google’s Threat Intelligence Group “is aware of over 700 potentially impacted organizations,” Austin Larsen, a principal threat analyst at the company, told Cybersecurity Dive in a statement. “The threat actor used a Python tool to automate the data theft process for each organization that was targeted.”
    • “The attacks did not involve any vulnerability in the Salesforce platform, according to researchers. After stealing the data, the hackers looked for sensitive credentials, including access keys and passwords for Amazon Web Services as well as access tokens for the Snowflake cloud platform. 
    • “The attacks largely occurred between Aug. 8 and Aug. 18, researchers said. By Aug. 20, Salesloft had begun working with Salesforce to revoke all active access and refresh Drift tokens, according to Google.”
  • Bleeping Computer adds,
    • “Consumer credit reporting giant TransUnion warns it suffered a data breach exposing the personal information of over 4.4 million people in the United States, with BleepingComputer learning the data was stolen from its Salesforce account.
    • “TransUnion is one of the three major credit bureaus in the United States, alongside Equifax and Experian. It operates in 30 countries, employs 13,000 staff, and has an annual revenue of $3 billion.”
  • Per Security Week,
    • “Multiple phishing campaigns deploying ConnectWise ScreenConnect for remote control demonstrate the sophistication, extent, and danger of AI-supercharged social engineering.
    • “An ongoing ScreenConnect threat example highlights primary aspects of modern cybercriminality: AI-enhanced, scaled, and sophisticated social engineering; use of trust and stealth to deceive security controls; and maximum use of the professionalized crime-as-a-service (CaaS) ecosphere.
    • “Current ScreenConnect campaigns differ in their attack details, but all conform to the basic process: a phishing attack leading to deployment of ScreenConnect to allow remote access and potential control of the victim organization. Researchers have found more than 900 targeted enterprises around the world.”
  • CISA added five known exploited vulnerabilities to its catalog this week.
    • August 25, 2025
      • CVE-2024-8069 Citrix Session Recording Deserialization of Untrusted Data Vulnerability
      • CVE-2024-8068 Citrix Session Recording Improper Privilege Management Vulnerability
      • CVE-2025-48384 Git Link Following Vulnerability
        • Cyber Press discusses these KVEs here.
        • Cybersecurity Dive adds more details on the Citrix KVEs here.
        • Bleeping Computer adds more details on the Git Link KVE here.
    • August 26, 2025
      • CVE-2025-7775 Citrix NetScaler Memory Overflow Vulnerability
        • Bleeping Computer discusses this KVE here.
    • August 29, 2025
      • CVE-2025-57819 Sangoma FreePBX Authentication Bypass Vulnerability
        • Bleeping Computer discusses this KVE here.

From the ransomware front,

  • Cybersecurity Dive reports,
    • “Federal and state authorities are investigating a ransomware attack that has disrupted key services across the state of Nevada.
    • “The Sunday [August 24] attack interrupted multiple government services, including phone systems and state agency websites. 
    • “The attackers were able to exfiltrate data during the intrusion, but officials still don’t know what they took, Tim Galluzi, Nevada chief information officer and executive director of the Governor’s Technology Office, said during a press conference Wednesday.
    • “The process of analyzing the information to determine exactly what was taken is complex, methodical and time consuming,” Galluzi said, adding that it would be reckless to speculate on the nature of the stolen information.
    • “The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI are helping Nevada officials respond to the intrusion. In a statement Wednesday [August 27], CISA said its threat hunters are helping analyze Nevada’s computer networks and mitigate any potential impact from the hack.
  • Security Week adds on August 29,
    • “Four days after the hackers hit the state’s network, certain state offices have resumed working with the public, some Nevada state’s departments have reverted to pen and paper operations to serve the public, and the Nevada Health Authority has restored some of its operations, including Medicaid and the benefits program.
    • “However, the Access Nevada application portal remains inaccessible, certain phone lines are down, the Child Care & Development Program cannot access case files or certifications, and DMV offices were closed on Wednesday, although its website has been restored.
    • “Emergency services and essential operations have remained available throughout the outage. Additional information can be found on this recovery status page.”
  • SpotlightPA reports,
    • “The Pennsylvania Office of Attorney General was the victim of a ransomware attack earlier this month, Spotlight PA has learned.
    • “The attack, first reported by the office on Aug. 11 as a “cyber incident,” has impaired many functions of the agency, as some staff and prosecutors remain unable to access archived emails, files, and internal systems crucial to pursuing cases on behalf of the commonwealth.
    • “The office confirmed the attack to Spotlight PA on Friday [August 29].
  • KERA News relates,
    • A cybersecurity breach in Greenville [,Texas] has affected the city’s ability to access police and other records.
    • The city’s servers were attacked by a ransomware group on Aug. 5.
    • “Upon identification, the City immediately implemented protective measures, isolated affected systems where appropriate, contacted law enforcement and engaged a third-party cybersecurity firm to mitigate the event and restore services,” the city said in a news release.
    • Greenville’s emergency 911 service was not affected and remains in operation, however, some phone lines may experience intermittent outages or busy signals, the city said.
  • Per Cyberscoop,
    • “A financially motivated threat group operating since 2021 has refined its technical tradecraft, honing its focus on cloud-based systems that allow it to expand ransomware operations beyond the scope of on-premises infrastructure, Microsoft Threat Intelligence said in a report released Wednesday [August 27].
    • “By leveraging cloud-native capabilities, Storm-0501 has exfiltrated large volumes of data with speed, destroying data and backups within victim environments and encrypted systems. “This is in contrast to threat actors who may have relied solely on malware deployed to endpoints,” Sherrod DeGrippo, director of threat intelligence strategy at Microsoft, said in an email.
    • “This evolution is about both a technical shift and a change in impact strategy,” DeGrippo said. “Instead of just encrypting files and demanding ransom for decryption, Storm-0501 now exfiltrates sensitive cloud data, destroys backups, and then extorts victims by threatening permanent data loss or exposure.”
    • “Storm-0501 targets opportunistically by searching for unmanaged devices and security gaps in hybrid cloud environments. By exploiting these vulnerabilities, it can evade detection, escalate its access privileges and sometimes move between user accounts. This approach amplifies the impact of its attacks and raises its chance for a payout, according to Microsoft.”
  • and
    • “Researchers at cybersecurity firm ESET claim to have identified the first piece of AI-powered ransomware in the wild.
    • “”The malware, called PromptLock, essentially functions as a hard-coded prompt injection attack on a large language model, causing the model to assist in carrying out a ransomware attack.
    • “Written in Golang programming code, the malware sends its requests through Ollama, an open-source API for interfacing with large language models, and a local version of an open-weights model (gpt-oss:20b) from OpenAI to execute tasks.
    • “Those tasks include inspecting local filesystems, exfiltrating files and encrypting data for Windows, Mac and Linux devices using SPECK 128-bit encryption.
    • “According to senior malware researcher Anton Cherepanov, the code was discovered Aug. 25 by ESET on VirusTotal, an online repository for malware analysis. Beyond knowing that it was uploaded somewhere in the U.S., he had no further details on its origins.
    • “Notably, attackers don’t need to deploy the entire gpt-oss-20b model within the compromised network,” he said. ”Instead, they can simply establish a tunnel or proxy from the affected network to a server running Ollama with the model.”
    • “ESET believes the code is likely a proof of concept, noting that functionality for a feature that destroys data appears unfinished. Notably, Cherepanov told CyberScoop that they have yet to see evidence of the malware being deployed by threat actors in ESET telemetry.”

From the cybersecurity defenses front,

  • Cyberscoop lets us know,
    • “Chief information security officers are increasingly concerned about the risk of a cyberattack, and a growing number say they have experienced a material loss of data over the past year, according to a report released Tuesday by Proofpoint. 
    • “Two-thirds of CISOs said their organizations have experienced a material loss of sensitive information over the past year, compared with only 46% in the prior year, according to the report. Meanwhile, three-quarters of CISOs fear they are at risk of a material cyberattack over the next 12 months.
    • “The increase reflects not only heightened risk but also a cultural shift among CISOs, according to Proofpoint.
    • “CISOs are becoming more transparent, especially in light of increased regulatory scrutiny and evolving board expectations,” Patrick Joyce, global resident CISO at Proofpoint, told Cybersecurity Dive.
    • “The annual “Voice of the CISO” report is based on a survey of 1,600 CISOs at organizations in 16 countries. The survey took place during the first quarter of 2025, and all respondents worked at organizations with more than 1,000 employees.”
  • Dark Reading offers ransomware defense tips here and cloud security tips here.
  • The Wall Street Journal reports,
    • “Cybersecurity concierge services offer tailored protection against online threats for high-profile individuals, including monitoring and data scrubbing.
    • “These services, costing from $1,000 to tens of thousands annually, attract those with substantial assets and a significant digital footprint.
    • “Demand is rising, with wealth managers for cyber protection, especially after experiencing breaches.”
  • Here is a link to Dark Reading’s CISO corner.

Friday report

David Ermer–CDC, COVID-19, FDA, Medical / Rx research, Medicare, No Surprises Act, OPM, U.S. Healthcare, Uncategorized–

From Washington, DC,

  • Here’s a link to this week’s blog post from the OPM Director Scott Kupor. The week’s post concerns the federal government’s budget.
  • Per an OPM news release,
    • The U.S. Office of Personnel Management (OPM) today announced that its guidance memorandums to federal agencies will now be housed directly on OPM.gov to make them easier to find and more accessible. The former page will be transitioned to a new page on OPM’s website and will also be available here.
  • The New York Times reports,
    • “CVS and Walgreens, the country’s two largest pharmacy chains, are for now clamping down on offering Covid vaccines in more than a dozen states, even to people who meet newly restricted criteria from the Food and Drug Administration.
    • “On Thursday, Amy Thibault, a spokeswoman for CVS, said the vaccine was not available at pharmacies in 16 states, citing “the current regulatory environment” and emphasizing that the list could change.
    • “On Friday, CVS issued an update: It could administer vaccines in 13 of the 16 states, and in the District of Columbia, to people who had obtained a prescription from a doctor or other medical provider. (As of Friday morning, its online scheduling tool still did not allow anybody to book an appointment in those places; Ms. Thibault said an update was in progress.) In Massachusetts, Nevada and New Mexico, CVS still cannot offer the shots at all, Ms. Thibault said.
    • “She did not provide an explanation for the change.
    • “Walgreens said in a statement that it was “prepared to offer the vaccine in states where we are able to do so” to people who met the F.D.A. criteria. When a New York Times reporter tried to schedule vaccine appointments in all 50 states, the Walgreens website said patients would need a prescription in 16 of them. Though there is some overlap, it’s not the same set of 16 as CVS, underscoring the level of confusion.” * * *
    • “CVS will make the vaccines readily available nationwide if the advisory panel recommends them, Ms. Thibault said. (In the 34 states where the company hasn’t set limits, people can simply check a box when they make an appointment online to attest that they meet the F.D.A. criteria, without a prescription or other documentation.) But since the panel hasn’t yet made a decision, the company is holding back in states where it believes its pharmacists need a C.D.C. endorsement.”
  • Fierce Healthcare informs us,
    • “While data released earlier this week raised questions about the administrative costs associated with No Surprises Act (NSA) arbitrations, a second study suggests the legislation is working to reduce out-of-pocket costs for members.
    • “Researchers at Harvard University and Mass General Brigham examined a sample of 17,351 privately insured adults, 8,204 of which lived in states that gained protections against surprise billing thanks to the legislation. The remaining 9,147 lived in states where some kind of program was already in place to protect consumers against these costs.
    • “The study found a significant decrease in out-of-pocket spending for people living in the new intervention states. The study attributes savings of $567 in yearly out-of-pocket costs to the protections.
    • “In fact, the study suggests that these protections are leading to greater savings for consumers than other policy changes such as Medicaid expansion and the drug pricing policies under the Inflation Reduction Act (IRA). Expanded Medicaid was tied to a $152 decrease in annual out-of-pocket spending, while the IRA is estimated to drive $400 in savings each year for people with Medicare Part D coverage.”
    • “Our study findings support anecdotal reports that the NSA has successfully shielded patients from surprise billing,” the researchers wrote.
  • FEHBlog note — The two studies do not contradict each other.
  • The American Academy of Actuaries released a report on Medicare’s financial condition.
    • “Consistent with prior trustees’ reports, the 2025 Medicare Trustees Report stresses the serious financial challenges facing the Medicare program. It remains critical to address the HI [Medicare Part A trust fund] shortfall sooner rather than later. In addition, Medicare spending will continue to grow faster than the economy, increasing the pressure on beneficiary household budgets as well as the federal budget, threatening the program’s sustainability.
    • Medicare’s financial challenges could be more severe than projected, which leaves policymakers with the challenge to address the short- and longer-term challenges of program solvency while understanding the potential implications on beneficiary’s ability to afford and receive appropriate health care. Understanding the implicit and explicit consequences of any potential change or lack thereof requires continued collaboration between actuaries, program and agency staff, consumer advocates, and Congress.

From the Food and Drug Administration (FDA) front,

  • Fierce Pharma reports,
    • “While Sanofi originally had its eye on tolebrutinib when it purchased its partner Principia Biopharma for $3.7 billion five years ago, another one of the BTK inhibitors inherited from the biotech has made it across the FDA finish line first.
    • “The drug rilzabrutinib, which is now approved as Wayrilz in immune thrombocytopenia (ITP), has been hailed (PDF) by Sanofi as a potential “multi-indication blockbuster” that could deliver 2 billion to 5 billion euros at its sales peak. 
    • “The FDA’s approval on Fridayspecifically clears Wayrilz for use in adults with persistent or chronic ITP who haven’t responded to prior therapy. 
    • “The regulatory endorsement marks the first approval for a Bruton tyrosine kinase (BTK) inhibitor to treat ITP in the U.S., where the condition is estimated to affect around 100,000 people, Mike Quigley, Ph.D., Sanofi’s CSO and global head of research, said in an interview with Fierce.”
  • and
    • “Aiming to deliver blockbuster sales of its Alzheimer’s disease-fighting antibody Leqembi in its 2027 fiscal year, Eisai has cleared a key regulatory hurdle in its quest to grow the medicine’s reach.
    • “The FDA has approved a once-weekly subcutaneous maintenance dose of the drug in an autoinjector, dubbed Leqembi IQLIK, according to a joint press release from the Japanese pharma and its commercialization partner Biogen.
    • “In line with the label of the drug’s intravenously infused formulation, Leqembi IQLIK is cleared for use in Alzheimer’s patients with mild cognitive impairment or mild dementia. Patients may switch to the new subcutaneous maintenance dose after 18 months of intravenous (IV) initiation treatment every two weeks, or they can opt to stick with infusions every four weeks for maintenance therapy, Eisai said in its release.
    • “IQLIK’s approval could be a “gamer changer” in Alzheimer’s treatment, Katsuya Haruna, senior group officer and EVP of US business operations at Eisai, said in an interview with Fierce Pharma, noting that the 15-second injection is now the first and only amyloid therapy that can be administered at home.”

From the public health and medical research front,

  • The Centers for Disease Control and Prevention announced today,
    • “COVID-19 activity is increasing in many areas of the country. Seasonal influenza activity is low, and RSV activity is very low.
    • “COVID-19
      • “The percentage of COVID-19 laboratory tests that are positive is going up across the country. Emergency department visits for COVID-19 are increasing among all ages. COVID-19 wastewater activity levels and model-based epidemic trends (Rt) indicate that COVID-19 infections are growing or likely growing in most states.
    • “Influenza
    • “RSV
      • “RSV activity is very low.
  • The University of Minnesota’s CIDRAP adds,
    • “SARS-CoV-2 detections in wastewater are “very high” in Alabama, Hawaii, Louisiana, Nebraska, Nevada, South Carolina, Texas, Utah, and Washington, DC. They are high in 11 states. “Nationally, the wastewater viral activity level for COVID-19 is currently moderate,” the CDC said.
    • “In comparison, flu and respiratory syncytial virus (RSV) wastewater levels are listed as very low nationwide. ED visits for those two diseases are also listed as very low, but they are increasing for flu.”
  • Per Medscape,
    • “For older adults, the vaccine against respiratory syncytial virus (RSV) appears to be most effective in the first year after administration, according to new researchthat shows the benefits of the immunization fall roughly 60% within about 1.5 years.
    • “The database analysis showed that among adults aged 60 years or older, the effectiveness of the RSV vaccine at preventing infections fell from 71% at the 4-month mark to 40% 19 months after receipt.
    • “For clinicians, “the big takeaway is that the RSV vaccine works well, especially in the first year, and remains worth recommending to older patients, especially those at higher risk,” said Kersten Bartelt, RN, a research clinician at Epic Research, an arm of the records company, who helped conduct the analysis.”
  • The New York Times reports,
    • “A salmonella outbreak linked to eggs has sickened 95 people across 14 states, federal health officials said on Thursday. Eighteen people have been hospitalized.
    • “The company Country Eggs, of Lucerne Valley, Calif., has issued a recall of its large brown cage free “sunshine yolks” and “omega-3 golden yolks” eggs, according to the Food and Drug Administration.
    • “The recalled eggs were sold in grocery stores and delivered to food service distributors in California and Nevada between June 16 and July 9 and have sell-by dates between July 1 and Sept. 18. The recalled cartons were also sold under the brand names Nagatoshi Produce, Misuho and Nijiya Markets.
    • “Most of the people who have become ill so far — 73 of the 95 — are from California, according to the Centers for Disease Control and Prevention. But infections have been reported in 13 other states across the country, including in Washington State, Minnesota, New York and Pennsylvania. No one has died.”
  • Kaufmann Hall lets us know,
    • “A new report shows that the difference between expected and observed mortality rates for hospitalized surgical patients continues to improve. Hospitals have achieved nearly a 20% increase in survival rates for these patients compared with expected, reflecting advances in evidence-based care and safety practices. However, the analysis, from Vizient and the American Hospital Association, also finds that the average length of stay has risen by almost a full day over the past five years, due to increasing patient acuity and insurer-related delays in post-acute care placement, particularly in Medicare Advantage plans. This trend suggests ongoing challenges in balancing improved patient outcomes with efficient hospital throughput.”
  • Per Fierce Pharma,
    • “Flying high after an FDA approval four months ago to treat generalized myasthenia gravis (gMG), Johnson & Johnson’s much-touted Imaavy (nipocalimab) has taken a hit, coming up short as part of a combination therapy in a rheumatoid arthritis (RA) trial.
    • “Without revealing data from the phase 2a Daisy proof-of-concept study, J&J said that after 12 weeks, Imaavy provided no added benefit when added to an anti-TNFα therapy in patients with refractory RA.
    • “Based on these findings, Johnson & Johnson has decided not to proceed with the clinical development of nipocalimab in combination with an anti-TNFα therapy for RA,” the company said in its release.
    • “Despite the setback, J&J added that it is still “confident” that Imaavy can live up to the $5 billion-plus peak sales potential the company has pegged for the FcRn-blocking monoclonal antibody.”
  • Per Fierce Biotech,
    • “Zydus Therapeutics has racked up a phase 2b/3 win in primary biliary cholangitis (PBC), clearing the path to a filing to establish the company as a challenger to Gilead Sciences, Intercept Pharmaceuticals and Ipsen.
    • “The phase 3 part of the trial randomized 149 people to receive the PPAR agonist saroglitazar or placebo. After 52 weeks of daily oral dosing, 48.5% of patients on the Zydus drug met the biochemical response, achieving the primary endpoint of the trial. Zydus plans to discuss the data with the FDA with hopes of filing for approval in the first quarter of 2026.
    • “If approved, saroglitazar will enter a market served by other drugs, including rival PPAR agonists. The FDA approved two PPAR agonists in PBC last year, clearing Gilead’s Livdelzi and Ipsen’s Iqirvo to compete for the market with Intercept’s FXR agonist Ocaliva.
    • “Gilead reported (PDF) a 62% biochemical response rate in the study that supported approval of Livdelzi. Ipsen’s Iqirvo achieved (PDF) a 51% biochemical response rate in its pivotal trial.
    • “Unlike the PPAR agonists, Intercept’s Ocaliva carries a boxed warning. The FDA rejected a filing for full approval of the product in November—while leaving the accelerated nod in place—and flagged liver injury reports in December.”

From the U.S. healthcare business front,

  • Fierce Healthcare reports,
    • “The University of Pennsylvania Medical Center (UPMC) continues to flip last year’s losses, reporting this week a $348.6 million operating income (2.1% operating margin) for the six months ended June 30 thanks to increased volumes and a tighter underwriting margin.
    • “The integrated nonprofit had posted a $313.3 million operating loss (-2.2%) during the same period a year prior. Both half-year periods included tens of millions in restructuring costs—$30 million in 2025 and $87.8 million in 2024—under an effort the system had launched last year.
    • “For its second quarter alone, UPMC notched a $111.2 million operating gain compared to the prior year’s $210.3 million operating loss, both inclusive of restructuring costs. Total operating revenue during the first half of 2025 came to $16.5 billion.”
  • Beckers Payer Issues points out “Californians enrolled in Medicare Advantage are facing slower growth in healthcare costs compared to those in traditional Medicare, according to new research from the UCLA Center for Health Policy Research.”
  • Genetic Engineering and BioTechnology News offers its “updated A-List of the top 10 best-selling prescription drugs based on 2024 sales. Top-selling drugs are ranked based on sales or revenue reported for 2024 by biopharma companies in press announcements, annual reports, investor materials, and/or conference calls. Each drug is listed by name, sponsor(s), 2024 sales, 2023 sales, and the percentage change between those years.”
  • BioPharma Dive tells us,
    • “Novo Nordisk is again looking for help outside its own laboratories as it works to build on the success of Ozempic and its sister medicine Wegovy.
    • “In the latest deal, Novo will provide research funding for Replicate Bioscience as well as up to $550 million in payments to work on new treatments for obesity, Type 2 diabetes and other cardiometabolic disorders.
    • “The agreement includes an unspecified amount of cash upfront as well as money tied to certain milestones, Replicate said Thursday.”
  • Per Fierce Pharma,
    • “Pfizer is taking a curtain call for Vyndaqel, the low-dose version of its blockbuster tafamidis franchise for the rare heart disease transthyretin amyloid cardiomyopathy (ATTR-CM).
    • “Pfizer will discontinue Vyndaqel in the U.S. by the end of 2025, multiple amyloidosis patient groups alerted their members on social media earlier this month.
    • “The move will leave the high-dose Vyndamax as the only tafamidis brand on the market.
    • “This decision was made to enhance patient-centered care and convenience as Vyndamax offers the same active ingredient and clinical benefits as Vyndaqel, but in a single capsule taken once daily, making it easier for patients to take their prescription,” according to the posts, which appear to be relaying a message from Pfizer.”

Thursday report

David Ermer–CDC, COVID-19 vaccine, FDA, Federal employment benefits, Medical / Rx research, Mental health care, Obesity, Rx coverage, U.S. Healthcare–

From Washington, DC,

  • The Washington Post reports,
    • “The White House on Thursday selected a top deputy of Health and Human Services Secretary Robert F. Kennedy Jr. to serve as acting head of the Centers for Disease Control and Prevention after a clash over vaccine policy ended in the departure of several agency leaders, according to two people familiar with the decision.
    • “The selection of Jim O’Neill, currently the deputy secretary of HHS, as interim leader of the CDC, potentially clears a path for Kennedy to continue his efforts to overhaul federal vaccine policy after the agency’s previous leader, Susan Monarez, balked at his requests.” * * *
    • “Pressed by lawmakers in his confirmation hearings in May about his public health beliefs, O’Neill said that he was a staunch supporter of vaccines.
    • “I’m very strongly pro-vaccine, I’m an adviser to a vaccine company, I support the CDC vaccine schedule,” he told senators in one exchange. But he also said that the federal government had overreached during the coronavirus response, and he criticized the Biden administration’s efforts to mandate coronavirus vaccines for federal workers.”
  • BioPharma Dive informs us,
    • “A federal vaccine panel recently remade by Health and Human Services Secretary Robert F. Kennedy Jr. will meet in September to discuss and potentially vote on recommendations for vaccines against COVID-19, hepatitis B and measles. 
    • A”ccording to a federal notice posted Thursday, the Advisory Committee on Immunization Practices will meet Sept. 18 and 19. A detailed agenda is not yet available, but the notice mentions that vaccines for respiratory syncytial virus may also be discussed. 
    • “The anticipated meeting will be the second by the reconstituted ACIP since Kennedy fired all 17 of its prior members and replaced them with seven hand-picked advisers. In the first, the new panelists appeared skeptical of evidence supporting COVID shots’ safety and efficacy and debated a controversial preservative that’s long been a target of vaccine skeptics despite data showing it to be generally safe.” 
  • Per a Congressional news release,
    • “Today, U.S. Senator Bill Cassidy, M.D. (R-LA), chair of the Senate Health, Education, Labor, and Pensions (HELP) Committee, called for the U.S. Department of Health and Human Services Advisory Committee on Immunization Practices (ACIP) to indefinitely postpone their September 18th meeting.
    • “Serious allegations have been made about the meeting agenda, membership, and lack of scientific process being followed for the now announced September ACIP meeting. These decisions directly impact children’s health, and the meeting should not occur until significant oversight has been conducted. If the meeting proceeds, any recommendations made should be rejected as lacking legitimacy given the seriousness of the allegations and the current turmoil in CDC leadership,” said Dr. Cassidy.”
  • Per another Congressional News release,
    • “U.S. Senate Finance Committee Chairman Mike Crapo (R-Idaho) announced the Committee will convene for a markup followed by a hearing on President Trump’s 2026 Health Care Agenda on Thursday, September 4. The markup will be held at 9:30 AM and will be immediately followed by the health care hearing at 10:00 AM.
    • “Secretary Kennedy has placed addressing the underlying causes of chronic diseases at the forefront of this Administration’s health care agenda,” said Crapo. “I look forward to learning more about the Department of Health and Human Services’ Make America Healthy Again actions to date and plans moving forward.”
  • The Congressional Research Service issued a report about “Expiring Health Provisions of the 119th Congress” while Healthcare Dive points out “top healthcare legislation to watch so far this year. Federal lawmakers have proposed dozens of bills targeting core healthcare issues, including 340B, Medicaid, AI and site-neutral payments.
  • The American Hospital Association News notes,
    • “The Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology Aug. 26 released a notice seeking comments on a proposed survey of health technology companies to assess implementation and experiences with information blocking, the 21st Century Cures Act and health care application programming interfaces. Comments must be submitted by Sept. 25.”
  • and
    • “The AHA Aug. 26 responded to a request for information as part of the introduction of the Healthy Moms and Babies Act, bipartisan legislation that seeks to improve maternal and child health by increasing services and support and coordinating care. The AHA responded to a request to provide feedback on how to incorporate a low-volume payment adjustment for home health models for pregnant and postpartum women. In response to the RFI from the bill’s co-sponsors, Sens. Chuck Grassley, R-Iowa, and Maggie Hassan, D-N.H., the AHA highlighted the financial and staffing challenges that rural hospitals face, among other issues, which can lead to obstetric unit closures and other reductions in labor and delivery services.”
  • Per Beckers Hospital Review,
    • The American Hospital Association sharply criticized a 340B rebate model pilot program from the Health Resources and Services Administration, an agency of HSS, warning the model threatens to undermine three decades of success under the existing 340B drug pricing program. 
    • In an Aug. 27 letter addressed to Thomas Engels, administrator of the HRSA, the AHA outlined serious concerns about the agency’s decision to shift from upfront discounts to a rebate model for select Medicare Part D drugs. 
    • The association also urged the agency to abandon the pilot, calling the model a “solution in search of a problem” that could harm safety-net hospitals. “There is no sound reason for HRSA to make such a profound change,” the letter stated. “We are confident that what it calls a ‘test’ will ultimately fail.” 
  • Tammy Flanagan, writing in Govexec, discusses “Important dates for Social Security and Medicare; Key milestones and deadlines every beneficiary should know.” 

From the Food and Drug Administration front,

  • MedPage Today reports,
    • “The FDA approved the first-ever generic form of a GLP-1 receptor agonist specifically indicated for weight loss, Teva Pharmaceuticals announced Thursday.
    • “The generic form of liraglutide (Saxenda) is indicated for adults with obesity or overweight with at least one weight-related comorbidity in combination with diet and exercise, as well as for adolescents ages 12 to 17 who are over 132.2 lb with obesity.
    • “Liraglutide was first approved in 2014 for chronic weight management in adults, and this indication was expanded in 2020 to include teens.” * * *
    • “This is the first GLP-1 generic for weight loss, but other generics have been previously approved for type 2 diabetes, including liraglutide (Victoza) and exenatide (Byetta).”

From the public health and medical research front,

  • JAMA informs us,
    • “Question  Does partial heart transplant provide a safe and effective valve replacement option that also has capacity for growth in patients with congenital heart disease?
    • “Findings  In this case series of 19 patients who underwent partial heart transplant, all valves demonstrated functional durability and growth over time with maintenance immunosuppression. No patient experienced valve-related reintervention, and leaflet measurements confirmed true tissue growth.
    • “Meaning  Partial heart transplant appears to be a safe and feasible procedure that enables valve growth, representing a promising solution to overcome the limitations of current nongrowing valve replacement options.”
  • The New York Times writes about youngsters who successfully have received partial health transplants.
  • Per MedPage Today,
    • “A study of over 112,000 U.S. adults found that 14% started a GLP-1 receptor agonist after bariatric surgery.
    • “Timing of GLP-1 agent initiation after bariatric surgery varied, and optimal timing needs to be investigated further.
    • “Sleeve gastrectomy patients and those who regained more weight after surgery were more likely to start a GLP-1 agent.”
  • and
    • “Estradiol hormone therapy was associated with higher memory scores in postmenopausal women.
    • “Transdermal estradiol was linked with better episodic memory, while oral estradiol was tied to prospective memory.
    • “Alzheimer’s risk is higher in women and may be related to menopausal loss of neuroprotective sex steroids.”

From the U.S. healthcare business front,

  • STAT News reports,
    • “Novo Nordisk has taken the next step in selling its drugs directly to patients by pointing them to telehealth providers that can write prescriptions for its popular obesity medication Wegovy. The company now links to select virtual providers on the NovoCare direct-to-patient pharmacy website it launched earlier this year, joining other pharma giants that have leaned into direct sales through their own online portals. 
    • “These new direct-to-consumer medication sites combine telehealth access points with pharmacy fulfillment, coupons, and patient information — sometimes with exclusive cash-pay pricing. Eli Lilly launched LillyDirect in January 2024 and was followed by Pfizer’s patient-facing site PfizerForAll later in the year. Partnering with telehealth companies is growing as a pharma marketing tactic even as the practice has come under scrutiny from lawmakers and health policy experts who raise concerns it may create improper relationships between drugmakers and health care providers.”
  • The American Medical Association offers details on GLP-1 spending in the U.S.
  • Healthcare Dive reports,
    • “Walgreens is officially a private company after the troubled retailer’s $10 billion sale to private equity firm Sycamore Partners closed Thursday.
    • “Moving forward, Walgreens’ healthcare subsidiaries Shields Health Solutions, CareCentrix and VillageMD will operate as separate businesses. The Boots Group, Walgreens’ international retail pharmacy chain, will also be spun out, creating five standalone companies.
    • “Sycamore appointed retail veteran Mike Motz as Walgreens CEO, replacing current chief executive Tim Wentworth. Motz has formerly served as CEO of Staples U.S. Retail, a Sycamore portfolio company, and as president of Canada-based pharmacy chain Shoppers Drug Mart.” 
  • Modern Healthcare relates,
    • “Lewis Drug locations are set to become part of Sanford Health this fall, following a decades long partnership between the two organizations. 
    • “Lewis Drug, a retail pharmacy company, will continue to operate under its own brand, according to a Thursday press release. Its existing staff will be employed by Sanford Health. 
    • “The two organizations have a joint venture, Lewis Family Drug, comprised of 44 locations offering retail items and pharmacy services. Sanford Health operates clinics at 11 Lewis Drug locations. While there are no immediate plans for additional clinics after the deal is expected to be finalized this fall, Sanford is open to that possibility in the future, Nick Olson, executive vice president and chief financial officer of Sanford Health, said Thursday.”
  • and
    • “U.S. Digestive Health, a large gastroenterology practice in Southeastern Pennsylvania, has been sold by private equity firm Amulet Capital Partners to SCA Health, a subsidiary of UnitedHealth Group under the Optum umbrella. 
    • “The deal, completed in January with little public notice, shifts a network of about 150 physicians and 24 ambulatory surgery centers across Pennsylvania and Delaware to the nation’s largest health insurer. Financial terms were not disclosed.
    • “Amulet, based in Greenwich, Connecticut, formed U.S. Digestive in 2019 by consolidating three regional practices.” 
  • Per Beckers Payer Issues,
    • “The California and Texas medical associations are urging Cigna to rescind a new policy they say will increase administrative burdens and create a barrier to appropriate reimbursement.  
    • “Beginning Oct. 1, Cigna’s new Evaluation and Management Coding Accuracy policy will review CPT evaluation and management codes 99204-99205, 99214-99215, and 99244-99245 for billing and coding accuracy. Some services may be adjusted by one level when guidelines are not met. 
    • “To better align with the American Medical Association’s Evaluation and Management services guidelines, Cigna Healthcare will implement a new reimbursement and coding accuracy policy for E/M codes that are being inappropriately billed as a higher level,” a Cigna spokesperson told Becker’s. “This review will only apply to approximately 3% of in-network physicians who have a consistent pattern of coding at a higher E/M level compared to their peers. Claims will be individually reviewed for coding accuracy and payment may be adjusted by one level to meet AMA guidelines. Physicians may request reconsideration or appeal our decision if they feel the higher payment is appropriate.”

Midweek Update

David Ermer–CDC, CMS, COVID-19 vaccine, Generative AI, Government Contracting, Medical / Rx research, Medicare, No Surprises Act, OPM, Patient safety, U.S. Healthcare, Uncategorized–

From Washington, DC,

  • Meritalk reports,
    • “With the Office of Personnel Management (OPM) on track to lose one-third of its workforce by the end of the year, OPM Director Scott Kupor said on Tuesday that he’s looking to technology to help steady the agency during its ongoing restructuring.
    • “Kupor, who the Senate confirmed as OPM director last month, said that his team is currently conducting a “reprioritization” effort to determine the top critical areas for the agency to focus on – and whether or not they need more headcount to get the job done.
    • “There may be cases where maybe we actually are short people,” Kupor said during an Aug. 26 event hosted by Federal News Network.
    • “We’re not perfect, and I fully acknowledge that there just may be areas where we need to revisit. So, there will be, I’m sure, some places where we have cut deeper than was appropriate, and we’ll have to make some changes,” he said.
    • “Some of those hiring efforts could target fresh talent, but Kupor said the agency may also look to rehire some employees who chose to participate in the deferred resignation program.”
  • The Wall Street Journal reports at 8:35 pm ET Wednesday,
    • “Susan Monarez, the director of the Centers for Disease Control and Prevention, has been pushed out of the job, a senior Trump administration official said Wednesday.
    • “Monarez, who led the agency for less than a month, clashed with Health and Human Services Secretary Robert F. Kennedy Jr. and members of his staff, the official said. President Trump had nominated her to lead the CDC in March after dropping his first pick. Previously the agency’s acting director, Monarez was the first CDC head without a medical degree in more than 70 years.
    • “Lawyers for Monarez said in a statement that she has neither resigned nor received notification from the White House that she has been fired. They also said she will not resign. “When CDC Director Susan Monarez refused to rubber-stamp unscientific, reckless directives and fire dedicated health experts, she chose protecting the public over serving a political agenda,” they said. “For that, she has been targeted.”
    • “Three senior CDC leaders, including Dr. Debra Houry, the agency’s chief medical officer, submitted their resignations Wednesday, according to emails viewed by The Wall Street Journal.”
  • Healthcare Dive tells us,
    • “The process set up by the No Surprises Act to settle disputes between providers and insurers about out-of-network claims is generating billions of dollars in extra costs for the healthcare system — costs that could trickle down in the form of higher consumer premiums, according to a new analysis.
    • “Independent dispute resolution, or IDR, has created an estimated $5 billion in total costs between its inception in 2022 and the end of last year, according to the report published in Health Affairs on Monday. The high amount of claims, significant provider participation and lofty offer amounts are driving the spending, researchers found.
    • “The analysis raises questions for policymakers concerned about curbing healthcare costs. In particular, Washington should consider tackling the high volume of ineligible disputes clogging up the process — and scrutinize the role of private equity, given providers backed by the firms are responsible for an outsized portion of disputes, researchers said.”
  • FEHBlog note — The No Surprises Act arbitration which is supposed to resemble baseball arbitration fails to include the safeguards found in actual baseball arbitration like a hearing at which the parties have access to both offers and can debate them before the decisionmakers.
  • Fierce Healthcare informs us,
    • “The National Committee on Quality Assurance (NCQA) has launched an artificial intelligence working group to determine how to best measure performance of high-risk AI once it has been deployed by health plans and providers. 
    • “The 35-year-old organization runs a spate of quality measurement and reporting programs, like health plan accreditation and the Healthcare Effectiveness Data and Information Set (HEDIS) measures used by 90% of health plans, according to the Office of the Assistant Secretary for Planning and Evaluation. 
    • “The NCQA has convened more than 30 organizations to share their experiences using AI and help create standards for the technology. Some members of its AI working group are the American Academy of Family Physicians, America’s Health Insurance Plans, Blue Cross Blue Shield of Tennessee, the Community Care Plan, Covered California, the Kaiser Foundation Health Plan and United HealthCare.
    • “As the modality of care, as the channels of healthcare delivery continue to evolve, and as we continue to see a very evolving healthcare delivery landscape, we do want to take a very hard look at what additional things we can do to continue putting that lens on quality and putting quality front and center,” Vik Wadhwani, chief transformation officer at NCQA, said in an interview.”
  • Kushner & Co. reminds us that the time for circulating Medicare prescription drug creditable coverage notices is approaching. The deadline is October 15, 2025.
    • For 2025, with the Inflation Reduction Act lowering the out-of-pocket maximum to $2,000 (from $8,000 in 2024), many employer prescription drug plans—and especially those with High-Deductible Health Plans—may find that their plans are no longer creditable. Further, new changes for 2026 may also impact these notices. Be sure to check with your group medical plan insurance carrier or TPA [or PBM] to ensure you’re in compliance in determining whether your prescription drug plan is creditable or noncreditable.
  • The FAR Council today finalized the inflation adjustments to FAR thresholds which take effect on October 1, 2025. The key change for FEHB carriers is the following:
    • “The cost or pricing data threshold at FAR 15.403–4, for contracts awarded before July 1, 2018, increases from $750,000 to $950,000. For contracts issued on or after July 1, 2018, the threshold increases from $2 million to $2.5 million.”
    • 90 Fed. Reg. 41873 (August 27, 2025)
    • OPM’s FEHBAR treats this threshold as the subcontract preapproval threshold for experience rated carriers and the flow down trigger for the significant events clause. 48 C.F.R. Secs. 1652.222-70, 1652.244-70.

From the Food and Drug Administration (FDA) front,

  • The Wall Street Journal reports,
    • “The Food and Drug Administration authorized three new Covid-19 vaccines—from Pfizer and its partner BioNTech, and Moderna and Novavax—that target a variant of the coronavirus known as LP.8.1. This was the dominant circulating strain when FDA advisers picked a target in May. 
    • “The companies are expected to begin shipping doses to pharmacies and other vaccination sites within days. This is the fourth-year companies have updated Covid shots to target the primary variant that is circulating, in hopes the shots will better protect people from severe illness through the fall and winter months.
    • “In a change this year, the FDA cleared use of the updated vaccines in a smaller population. The three vaccines are cleared for everyone 65 and older, and for people in younger populations who have underlying conditions that put them at higher risk of severe Covid-19. 
    • “Pfizer’s vaccine was cleared for at-risk people ages 5 through 64, Moderna’s in at-risk people six months and older, and Novavax for at-risk people 12 and older.
    • “In previous years, U.S. health officials recommended the booster shots in most people six months and older, even if they didn’t have at-risk conditions.” * * *
    • “In deciding on vaccine coverage, health insurers typically follow recommendations by the Advisory Committee on Immunization Practices, or ACIP, which advises the CDC. They may also consider clinical recommendations from medical societies. 
    • “No meeting has been scheduled for ACIP to consider the new updated boosters. Kennedy fired all members of the ACIP in June and replaced them with people including some vaccine skeptics.
    • “A trade group for health-insurance companies, America’s Health Insurance Plans, said health plans will continue to follow requirements for ACIP-recommended vaccines.”
  • FEHBlog note — Indeed, the Affordable Care Act requires that health plans waive cost sharing for in-network administration of vaccines recommended by ACIP and confirmed by the CDC (or the HHS Secretary in the event of a vacancy in the CDC directorship.).
  • Cardiovascular Business adds,
    • “The U.S. Food and Drug Administration (FDA) is warning the public about a new safety issue associated with Johnson & Johnson MedTech’s Automated Impella Controller (AIC). 
    • “This latest alert was put in place after Johnson & Johnson MedTech received reports that some of the Pump Driver Circuit Assemblies of its AICs contain 25V-rated tantalum capacitors instead of the expected 35V-related tantalum capacitors. This can cause the pump’s performance to suffer, and there a risk of the pump stopping altogether and triggering an “Impella Failure” or “Impella Stopped. Controller Failure” alarm. 
    • “One patient death has been linked to this issue. 
    • “This alert covers a total of 69 AICs. Full lists of the affected product codes and serial numbers are available as part of the FDA’s advisory. Anyone with one of the affected devices is urged not to use it any longer. Instead, the device should be quarantined until additional information is made available.
    • “The FDA is currently reviewing information about this potentially high-risk device issue and will keep the public informed as significant new information becomes available,” according to the advisory.”

From the judicial front,

  • Bloomberg Law reports,
    • “Cigna Health & Life Insurance Co. reached a class-wide settlement in a family’s lawsuit saying the insurer breached its fiduciary duties by failing to maintain an up-to-date list of in-network medical providers.
    • “The parties reached a preliminary agreement after a mediation session with a retired judge and plan to file details of the deal for court approval by Sept. 19, they said in a status report docketed Monday in the US District Court for the Northern District of Illinois. The filing didn’t include details about the terms of the settlement.” * * *
    • “Judge Manish S. Shah allowed portions of the case to advance in February, saying the family has a viable fiduciary breach claim based on Cigna’s failure to properly resolve the matter in a way that didn’t force them to foot the bill. But Shah dismissed the family’s claim for wrongfully denied benefits under the Employee Retirement Income Security Act because Cigna correctly paid their benefits according to the terms of their health plan.”

From the public health and medical research front,

  • Fierce Healthcare lets us know,
    • “Advancements in technology, testing and imaging have transformed cancer detection and risk assessment, enabling them to be faster and more precise.
    • “But providing patients with a cancer risk score or identifying those at high risk is only one step in cancer prevention. Getting patients to act on their cancer risk and get supplemental screening is the next big leap, and CancerIQ is focused on closing this gap.
    • “The company, which offers healthcare providers a cancer-focused precision health platform, developed new capabilities to provide patients at elevated risk for cancer with “hyper-personalized” patient education, engagement and navigation support. The new features were built on insights from thousands of high-risk patient journeys and backed by behavioral science with the aim to drive sustained follow-through on supplemental screenings that detect cancer earlier, according to executives.
    • “The first release focuses on screening breast MRI, with plans to support additional patient populations, including those eligible for low-dose lung CT.”
  • BioPharma Dive reports,
    • “People with early breast cancer who were treated in a late-stage study with Eli Lilly’s drug Verzenio and standard hormone therapy lived longer than those given hormone therapy alone, the company reported Wednesday.
    • “The summary results come from Lilly’s monarchE study, which began in 2017 and enrolled more than 5,600 adults with high-risk breast cancer that tested positive for hormone receptors but negative for a protein called HER2. Lilly said the improvement in survival was “statistically significant and clinically meaningful.”
    • “The study previously met its main goal, showing the addition of Verzenio improved invasive disease-free survival — data that supported a 2021 approval in this treatment setting. The overall survival findings, which were a secondary endpoint, will be presented at an upcoming medical meeting, Lilly said.”
  • STAT News relates,
    • “Akeso, a Chinese biotech with a drug positioned to rival Merck’s megablockbuster Keytruda, has reported for the first time that the therapy can improve patient survival.
    • “The therapy, ivonescimab, showed a statistically significant survival benefit as a second-line treatment when combined with chemotherapy to treat non-small cell lung cancers. The patients’ cancers had progressed after getting therapies targeting EGFR, a protein that can drive tumor growth. 
    • “The company described the results of the Chinese trial as clinically meaningful in a report for the first half of the year released on Tuesday. But it didn’t delve into details, which Akeso plans to share at an upcoming medical conference.”
  • Per Fierce BioTech,
    • “Amylyx’s withdrawn-from-market Relyvrio has failed to make an impact on primary or secondary endpoints in a rare neurodegenerative disease, prompting the company to discontinue the program.
    • “Oral therapy Relyvrio, which Amylyx is again referring to as AMX0035, was tested in progressive supranuclear palsy (PSP), a fatal and rapidly progressing condition that impacts mobility, eye movements, swallowing and speech. Currently, there aren’t any approved treatments for the disease.”
    • “Amylyx’s phase 2/3b study was measuring AMX0035’s impact on disease progression and severity using a 28-item, condition-specific scale. The phase 2 portion of the trial found no difference in patients receiving AMX0035 compared to placebo at 24 weeks, according to an Aug. 27 company release.
    • “Given the results, the company has discontinued the phase 2b trial, plus a related open-label extension study. Amylyx has also terminated plans for the phase 3 portion of the study.”
  • Per Health Day,
    • ‘Few teens with depression receive treatment, with disparities seen based on residence, gender, and race, according to a study published online Aug. 20 in PLOS Mental Health.
    • “Su Chen Tan, from the University of Tennessee in Knoxville, and colleagues used data from adolescents (aged 12 to 17 years) with major depressive episodes (MDE) participating in the 2022 U.S. National Survey on Drug Use and Health to assess mental health service utilization by rurality, race/ethnicity, gender, age, health insurance coverage, and poverty level.
    • “The researchers found that 19.2 percent of adolescents experienced MDE, but only 47.5 percent received treatment within the past year. There were significantly lower odds of receiving specialist treatment for adolescents in rural areas versus their urban counterparts (adjusted odds ratio [aOR], 0.64). Further, odds of receiving telehealth services were significantly lower for rural adolescents (aOR, 0.64) but were significantly higher for adolescents with insurance (public insurance: aOR, 2.99; private insurance: aOR, 3.82). Compared with younger adolescents, older adolescents had lower odds of utilizing school-based services (aOR, 0.52). Female adolescents had greater odds of utilizing any mental health treatment than male adolescents (aOR, 1.59), while Black adolescents had significantly lower odds of utilizing any mental health treatment versus non-Hispanic White adolescents (aOR, 0.36).”
  • and
    • “Two-thirds of women in their child-bearing years have an increased risk for birth defects due to a lifestyle factor they can change, a new study says.
    • “These risk factors — low levels of vitamin B9 (folate), unmanaged diabetes or exposure to tobacco smoke — increase the odds of a serious birth defect in any child they might have, researchers said.
    • “Heart defects, cleft palates and defects of the brain and spinal cord are among the problems that could be headed off if women took steps to improve their health prior to pregnancy, researchers reported today in the American Journal of Preventive Medicine.”

From the U.S. healthcare business front,

  • Healthcare Dive points out Blue Shield of California names interim CEO Mike Stuart to permanent chief executive.
  • Beckers Payer Issues notes,
    • “AM Best has downgraded its outlook for the health insurance sector from stable to negative, citing escalating medical costs and increased utilization across government, commercial and ACA plans.
    • “The credit rating agency noted higher utilization of specialty drugs, increased physician visits, more inpatient admissions and a surge in behavioral health claims. The coding intensity of medical services has also increased, according to an Aug. 25 news release.”
  • STAT News reports,
    • “Dressed in red and black jackets reminiscent of Star Trek uniforms, the heads of Epic’s data and AI divisions, Phil Lindemann and Seth Hain, described an aspirational vision for artificial intelligence at the end of last week’s Epic UGM keynote. Using the data stored in Cosmos — Epic’s de-identified patient record research database — the company trained an AI model that can generate many possible future timelines for a patient, then tell the doctor which outcomes are most likely, like what might happen during a hospital stay, or if the patient might end up in the emergency department in the next year. 
    • “Just as a large language model can be trained once and then used to generate different kinds of text, like an email or a poem, without being specifically trained on how to write either emails or poems, Epic’s “large medical model,” trained on all sorts of medical events and outcomes, could replace individual predictive medical algorithms. If the model, which Epic calls CoMET — the Cosmos Medical Event Transformer — can achieve performance similar to machine learning algorithms specifically trained to predict readmissions or asthma attacks, “that’s a breakthrough in how we can get risk prediction embedded into clinical care,” said Lindemann.
    • “This idea isn’t entirely new. Researchers like Arkadiusz Sitek at Massachusetts General Hospital have built models that predict future patient medical events before. But, Sitek told STAT, the scale of CoMET is impressive and suggests this approach will work in a large population. Epic trained and evaluated its model on 115 billion medical events from 118 million unique patient records collected from January 2012 to April 2025. The work was detailed in a preprint posted last week with Microsoft and Yale researchers.”
  • FIerce Healthcare informs us,
    • “Four hospitals are sending heart failure patients home with a virtual care support team under a newly unveiled collaboration between the American Heart Association (AHA) and remote chronic disease monitoring platform Cadence.
    • “The American Heart Association Connected Care pilot program aims to reduce 30-day readmissions by addressing “critical gaps in heart failure care” that occur after heart failure patients leave the hospital.
    • “It will see the participating hospitals integrate program referrals into their discharge workflows. Enrolled patients are given and taught to use connected vital sign monitors, which a Cadence virtual care team uses to provide ongoing clinical support, adjust treatments or direct the patient to an in-person provider if necessary.
    • “Almost one in four heart failure patients are readmitted to the hospital within 30 days of discharge, and fewer than a fifth receive post-discharge medical therapies in line with clinical guidelines, according to study data cited in the announcement.”
  • Beckers Hospital Review identifies “five new drug shortages and discontinuations, according to drug supply databases from the FDA and the American Society of Health-System Pharmacists.” 

Tuesday report

David Ermer–Congress, Medical / Rx research, No Surprises Act, Obesity, OPM, Rx coverage, U.S. Healthcare–

From Washington, DC,

  • The Government Accountability Office informs us
    • “Health care spending is higher in the U.S. than in any other high-income country. Yet, our health outcomes are worse. 
    • “It’s a tough issue to tackle. But when GAO faces tough policy challenges, the Comptroller General of the U.S. (and head of GAO) can convene a forum of experts to get their insights.  
    • Today’s WatchBlog post looks at our recent report about a forum on health care spending and quality of care.” * * *
    • During our forum on health care spending, experts from government, academia, and industry identified five key areas where—if action was taken—costs could be reduced and care improved. We provided approaches in these key areas to Congress in our report as potential options for addressing this issue.   
  • Politico reports,
    • President Donald Trump plans to appoint Dan Scavino, a longtime loyalist and White House deputy chief of staff, to run the Presidential Personnel Office, empowering him with the power to decide who can and cannot serve in the administration.
    • “Dan Scavino is one of President Trump’s most trusted and longest serving advisors,” said White House Press Secretary Karoline Leavitt. “There is nobody better to ensure the president’s administration is staffed with the most qualified, competent, and America First-driven workers. There is much still to be done and Dan’s leadership will ensure the highest quality, most dedicated workforce ever.”
  • Health Affairs Forefront offers a No Surprises Act litigation status check written by Professor Katie Keith.
    • “Nearly five years ago, President Trump signed the No Surprises Act into law, establishing new patient protections against surprise medical bills. Since the law took effect in 2022, millions of consumers have been protected from unexpected bills for out-of-network care—from emergency services to anesthesia to air ambulance rides. While the law has successfully protected consumers from the most common types of surprise out-of-network bills, its implementation has been hobbled by aggressive litigation.”

From the public health and medical research front,

  • The Wall Street Journal reports,
    • “Eli Lilly LLY said a third late-stage study of its experimental anti-obesity pill hit its key goals, paving the way for the drugmaker to begin regulatory submissions.
    • “Eli Lilly on Tuesday said the Phase 3 study of orforglipron in adults with obesity or overweight and type 2 diabetes met the primary and all key secondary endpoints at all three doses, showing significant weight loss, meaningful A1C reductions and improvements in cardiometabolic risk factors at 72 weeks.
    • “The Indianapolis company said study participants lost an average of 22.9 pounds, or 10.5% of their body weight, on the highest dose, with A1C, a measure of blood-sugar levels, reduced by an average of 1.8%.
    • “Eli Lilly said orforglipron also showed a safety profile consistent with injectable GLP-1 medicines, such as its blockbuster Mounjaro and Zepbound drugs.
    • “Eli Lilly said it now has the full clinical data package it needs to initiate global regulatory submissions for orforglipron this year.”
  • BioPharma Dive adds,
    • “An RNA medicine developed by Regeneron Pharmaceuticals and Alnylam Pharmaceuticals helped control symptoms of the chronic autoimmune disease generalized myasthenia gravis in adults enrolled in a late-stage study, Regeneron said Tuesday.
    • “Regeneron also tested the RNA medicine, called cemdisiran, together with an antibody drug it developed and sells as Veopoz for another disease. However, study results suggested the combination was not as effective as cemdisiran alone.
    • “Regeneron, which licensed cemdisiran from Alnylam, plans to submit the drug for U.S. approval in myasthenia gravis sometime in the first quarter next year. It is also testing the drug in paroxysmal nocturnal hemoglobinuria and geographic atrophy that is tied to age-related macular degeneration.”
  • Genetic Engineering and Biotechnology News notes,
    • “Germ cells pass DNA to the next generation and undergo massive reorganization of their DNA packaging to generate totipotency, or the ability to differentiate into any cell type. Understanding the mechanism of germ cell nucleome formation can offer valuable applications for addressing infertility. 
    • “In a new study published in Nature Structural & Molecular Biology titled, “The mitotic STAG3-cohesin complex shapes male germline nucleome,” researchers from Kyoto University have discovered STAG3-cohesin, a new mitotic cohesin complex that helps establish the unique DNA architecture of spermatogonial stem cells, which give rise to sperm. This discovery offers new strategies for treating infertility and certain cancers.”
  • JAMA posted a research letter about “Trends in County-Level MMR [Measles, Mumps and Rubella] Vaccination Coverage in Children in the United States.”
    • “Although the national- and state-level declines in MMR coverage are well documented, MMR vaccination coverage can vary substantially within a state.6 We generated a standardized dataset with annual county-level vaccination rates for children from 2017 to 2024 for all states in the US where this information was available and evaluated spatiotemporal trends in vaccination coverage during this period. This open, high-resolution dataset serves as a resource to explore the US vaccination landscape and its implications for vaccine-preventable disease.”
  • Per MedPage Today,
    • “Moderate-to-severe traumatic brain injury (TBI) increased malignant brain tumor risk in a large retrospective study of civilians.
    • “This risk persisted when findings were meta-analyzed with data from two other cohorts.
    • “The results echoed outcomes that emerged in an earlier study of young U.S. war veterans with TBI.”
  • Consumer Reports, writing in the Washington Post, lets us know “what can make you dizzy? Could it be an inner-ear issue? Your medications? How to figure out the problem — and fix it.”

From the U.S. healthcare business front,

  • Bloomberg Law reports,
    • “Rising health-care costs are fueling the comeback of a strategy to limit hospital bills, but the evolving model requires employers to take on more work and risk in ditching the big insurance companies.
    • “Reference-based pricing” typically determines a provider’s payments from Medicare rates, plus a premium ranging from 25-50%. Those rates fluctuate depending on the market and provider type, but advocates say they usually shave around 30% off a plan’s annual costs.
    • “The strategy is part of employers’ ongoing search for alternatives to traditional health insurance as they confront an expected 9% spike in costs next year. But hospitals say RBP vendors are just middlemen looking to profit at patients’ expense.” * * *
    • “The whole thing is very ugly from a patient perspective in the sense of it’s often not very clear what the rules are,” said Molly Smith, American Hospital Association’s group vice president for policy. “They often don’t understand whether or not they have a network.”
    • “RBP companies blame the bad reputation on early iterations that sparked a series of lawsuits and left patients with steep bills. Many vendors today collaborate more with providers and protect patients, they said.
    • “The differences in the models is how you deal with access issues, how do you deal with balance bills,” said Scott Ray, founder of RBP vendor 6 Degrees Health.”
  • Modern Healthcare adds,
    • “Concierge and direct primary care practices are gaining traction among physicians, employers and patients increasingly frustrated with traditional care pathways.
    • “The growth of these practices, where patients pay membership fees in exchange for increased access to physicians, is a symptom of Medicare and Medicaid reimbursement that has not kept pace with inflation, advisers, doctors and policy experts said. Growing care backlogs, coding and documentation tasks that take doctors away from patients and seemingly ever-rising health insurance premiums are also contributing, they said.
    • “A year ago, I would’ve told you these care models were a slowly evolving, quiet phenomenon,” said Dr. Zirui Song, an associate professor of healthcare policy at Harvard Medical School and a primary care provider at Massachusetts General Hospital. “It is now evolving quite rapidly — it is not so quiet anymore.”
  • Beckers Hospital Review provides us with large for-profit healthcare system “payer mixes by patient service revenue, patient admissions or both in the first six months of 2025,” and tells us about three new drugs that OptumRx, a UnitedHealth subsidiary, is tracking this year. 
  • BioPharma Dive relates “Biopharmaceutical firms in the U.S. and Europe are increasingly turning to China’s biotech sector for new medicines. Follow this year’s dealmaking with this database.”
  • Per Fierce Healthcare,
    • “Health tech company Waltz Health will merge with Eversana with the goal of shaking up access to prescription drugs.
    • “The deal will bring together Waltz’s proprietary drug marketplaces and direct-to-payer model with Eversana’s global pharmaceutical commercialization platform. In tandem, the two platforms will be well positioned to tackle the misaligned incentives in the drug supply chain and close gaps for patients, the companies said.
    • “The combination will be especially critical in driving down the cost of pricey specialty pharmacy products, including GLP-1s, according to an announcement. Financial terms of the deal were not disclosed.”
  • Per Modern Healthcare,
    • “Independent laboratory company Quest Diagnostics and Corewell Health entered a definitive agreement to build a jointly owned lab in Michigan. 
    • “The Diagnostic Lab of Michigan would be based at the Corewell Health Southfield Center in Southfield, Michigan. It would focus on automated microbiology and high-throughput molecular testing.
    • “Quest would also manage Corewell Health’s 21 inpatient and outpatient hospital labs as part of the joint venture. Financial terms were not disclosed.” 

Monday report

David Ermer–CDC, CMS, FDA, Medical / Rx research, Medicare, Mental health care, U.S. Healthcare, Uncategorized–

From Washington, DC,

  • Fierce Healthcare tells us,
    • “Medicare patients have increasingly checked themselves out of the hospital against the advice of medical staff since 2006, with a temporary spike in self-discharges coinciding with the COVID-19 public health emergency, according to a new claims review conducted by the Department of Health and Human Services Office of Inspector General (HHS OIG).
    • “The increasing rate of acute care hospital discharges against medical advice (AMA) was prevalent across most demographics including enrollee type, hospital size, population density and medical condition, the office wrote in its review published Thursday.
    • “That said, discharges AMA increases were higher among hospitals with lower quality-of-care ratings (as measured by overall hospital quality star ratings) and among dually enrolled patients and those with mental health diagnoses.
    • “The HHS OIG said the rate increases are noteworthy, as Medicare patients who left AMA were more than twice as likely to be readmitted to the hospital or die within 30 days of discharge compared to those discharged to their homes.”
  • Beckers Clinical Leadership informs us,
    • The American College of Obstetricians and Gynecologists and the American Academy of Pediatrics are diverging from the CDC’s vaccine recommendations, which no longer advise routine COVID-19 shots for healthy children and pregnant women.
    • On Aug. 22, ACOG published clinical guidance regarding vaccination during pregnancy. The OB-GYN group reaffirmed support for COVID-19 inoculation during pregnancy, adding that data show COVID-19 vaccines protect pregnant patients and infants from COVID-19 complications. 
    • “Three days before, the pediatrics organization released its annual vaccine recommendations. The AAP’s 2025-26 virus season guidance says children between 6 months and 2 years old should receive a COVID-19 vaccine; the CDC advises “shared clinical decision-making” between the clinician and parent or patient.” 
  • The Groom Law Group opines,
    • “On January 17, 2025, the ERISA Industry Committee (“ERIC”) filed suit against the Departments alleging that the 2024 {Mental Health Parity] Final Rule exceeded the Departments’ statutory authority, violates the Due Process Clause of the Fifth Amendment, is arbitrary and capricious, and otherwise violates the Administrative Procedure Act.
    • “In light of the litigation challenging the 2024 Final Rule, the Departments announced a non-enforcement policy of the Final Rule while they reconsider the 2024 Final Rule, including whether to issue a notice of proposed rulemaking rescinding or modifying the regulation. The Departments’ announcement noted that MHPAEA’s statutory obligations, including the requirements related to [Non-Quantitative Treatment Limitations] NQTL comparative analyses, as amended by the CAA, 2021, continue to have effect.  The Departments also stated that they will “undertake a broader reexamination of each department’s respective enforcement approach under MHPAEA, including those provisions amended by the CAA, 2021.”
    • “Importantly, plans and issuers are still required to develop and maintain MHPAEA NQTL comparative analyses and provide them to regulators upon request.  In addition, plans must also make NQTL comparative analyses available upon request to:
      • “Applicable state authorities.
      • “A participant or beneficiary (including a provider or other person acting as a participant’s or beneficiary’s authorized representative) who has received an adverse benefit determination related to MH/SUD benefits; and
      • “Participants and beneficiaries who request the comparative analyses at any time under ERISA section 104.”
  • Beckers Hospital Review helpfully explains the 340B drug program.
    • “More than three decades ago, Congress created the 340B program to help safety-net hospitals and clinics​​ expand resources and care for underserved communities. 
    • “By requiring pharmaceutical companies to offer deep discounts on outpatient drugs, the program has become a hallmark resource to help health systems support vulnerable patients. In recent years, however, the program has drawn scrutiny from federal lawmakers as several drugmakers have introduced alternative rebate and drug pricing models, raising questions about the direction of the program. 
    • “Hospitals have also faced increased scrutiny in recent years over how they are utilizing 340B savings. This intensified after a Senate report published in April found some of the largest health systems were exploiting the system. According to the report, Cincinnati-based Bon Secours Mercy Health and Cleveland Clinic generated hundreds of millions of dollars by acquiring discounted 340B drugs and then charged patients significantly higher prices. Both health systems defended their participation in the 340B program, telling Becker’s they operated the program in compliance with federal rules.”
  • Check it out.  

From the Food and Drug Administration (FDA) front,

  • MedPage Today reports,
    • “The PCSK9 inhibitor evolocumab (Repatha) got the FDA’s blessing for cardiovascular protection, with or without a history of cardiovascular disease (CVD).
    • “Evolocumab is now indicated for the wider pool of adults at increased risk for major adverse cardiovascular events (MACE) — namely cardiovascular death, myocardial infarction, stroke, unstable angina requiring hospitalization, or coronary revascularization — 10 years after it first hit the market.
    • “The drug keeps its older LDL cholesterol-lowering indication in adults with hypercholesterolemia, adults and children with heterozygous familial hypercholesterolemia, and individuals with homozygous familial hypercholesterolemia.”
  • Per Fierce Pharma,
    • “Less than three weeks after lifting a pause on the use of Valneva’s chikungunya vaccine Ixchiq, the FDA has done an about-face, banning the use of the shot in the United States.
    • “On Friday [August 22], the agency suspended Valneva’s license “based on serious safety concerns,” citing 21 hospitalizations and three deaths, including one from encephalitis directly attributed to the live-attenuated vaccine. With the decision, the price of the French company’s shares has plummeted by 22%.
    • “In a release, Valneva called (PDF) the FDA’s decision “sudden,” after the regulator had lifted a previous halt on the use of the vaccine in older adults on August 6. The company added that the agency’s move came after it received four reports of side effects from its Vaccine Adverse Event Reporting System (VAERS), each happening outside of the U.S. The reports included one user who was hospitalized for two days.
    • “Valneva believes all cases describe symptoms consistent with those previously reported during clinical trials and post-marketing experience, particularly among the elderly individuals for whom the vaccine’s prescribing information includes warnings and precautions,” the company said in its statement.”
  • MedTech Dive relates,
    • “Boston Scientific has recalled carotid artery stents because of a manufacturing defect that has led to additional interventions to recover the devices.
    • “The Food and Drug Administration, which shared information about the recall Friday [August 22], said the company reported six cases that required additional intervention as of July 29.
    • “Boston Scientific told customers not to use affected Carotid Wallstent Monorail Endoprosthesis devices last month. The recall affected 26,570 devices, 1,333 of which are in the U.S.”

From the public health and medical research front,

  • The Washington Post reports,
    • “A rare human case of a flesh-eating parasite known as New World screwworm has been confirmed in a Maryland resident as the Trump administration is trying to prevent the resurgence of an insect largely eradicated from livestock decades ago.
    • “The case was confirmed Aug. 4 in a person who had traveled to the United States from El Salvador, said Andrew Nixon, a spokesman for the Department of Health and Human Services.
    • “The resident has recovered without evidence of infecting other humans or animals, state health officials said in a statement Monday.
    • “A recent New World screwworm outbreak in Central America has raised concerns that it could spread to the United States and devastate the cattle industry. But state and federal health officials said the Maryland case is not cause for alarm, and plans for a new sterile fly production facility in South Texas aim to tamp down global threats from the pest.
    • “The risk to public health in the United States from this introduction is very low,” Nixon said.
    • Livestock are not at particular risk due to the Maryland case, the National Cattlemen’s Beef Association said.”
  • STAT News points out,
    • “In a milestone for the newly resurgent field of xenotransplantation, a 39-year-old brain-dead person in China has become the first human to receive a lung from a pig. With consent from the person’s family, researchers took the organ from a CRISPR’d pig, trimmed it, and stitched it into their chest, where it remained for nine days.
    • “The procedure was intended to test whether pigs that have been gene-edited to make their organs less recognizable to the human immune system — and thus less prone to rejection — could one day be used to supply hospitals for transplants. In the past few years, surgeons in the U.S. have transplanted pig hearts and kidneys into both living patients and people who had been declared clinically dead because they lacked brain function. Last year, doctors in China became the first to attempt a similar procedure with a liver from a pig. This is the first time anyone has tried it with a lung. 
    • “The clinical need for donor lungs is enormous. According to the Global Observatory on Donation and Transplantation, 8,236 lung transplants were performed worldwide in 2024, an increase of 6% over the previous year, but tens of thousands more patients remain on waitlists. The results of the experiment, which were published Monday in Nature Medicine, are exciting, experts told STAT, because they suggest that lung xenotransplantation could, one day in the future, become an option for patients. But they also point to how much more work has to be done before that day can arrive.” 
  • Per MedPage Today,
    • “People who carried the Alzheimer’s disease APOE4 risk gene had a lower risk of developing dementia if they followed a Mediterranean diet, an observational study of healthcare professionals suggested.
    • “Adherence to the Mediterranean diet more effectively modulated dementia-related metabolites in APOE4 homozygotes than in people with lower genetic risk, wrote Dong Wang, MD, ScD, of Mass General Brigham in Boston, and colleagues in Nature Medicine.
    • “We found that greater adherence to the Mediterranean diet was associated with a lower risk of dementia and slower cognitive decline in the overall study population,” said co-author Yuxi Liu, PhD, also of Mass General Brigham. 
    • “The protective association was most pronounced among individuals carrying two copies of the APOE4allele, where each one-unit increase in the Mediterranean diet score was associated with approximately a 35% lower risk of dementia,” Liu told MedPage Today. “These findings suggest that adherence to the Mediterranean diet may mitigate the elevated genetic risk conferred by APOE4.”
  • Health Day notes,
    • “Pediatricians should screen children annually for mental or developmental issues, the American Academy of Pediatrics (AAP) recommends in a new clinical report.
    • “The recommendation comes in response to a mental, emotional and behavioral health crisis that’s been brewing among America’s youth, the AAP says.
    • “Up to 1 in 5 children in the U.S., including kids as young as 2, are living with a mental or behavioral health problem like depression, anxiety, ADHD or suicidal thoughts and feelings, according to the report published online today in the journal Pediatrics.
    • “And in 2020, suicide became the second-leading cause of death among kids aged 10 to 14 and the third-leading among 15- to 24-year-olds. AAP said the rate increased 41% between 2000 and 2017.
    • “The AAP argues that pediatricians are in the best position to spot early concerns and get children the help they need.”
  • The American Medical Association lets us know what doctors wish their patients knew about taking naps.

From the U.S. healthcare business front,

  • Beckers Hospital Review reports,
    • “Philadelphia-based Thomas Jefferson University, owner of Jefferson Health, recorded an operating loss of $196 million (-1.2% operating margin) in fiscal 2025, down from an operating income of $1.3 million (0% margin) in 2024, according to its Aug. 22 financial report. 
    • “The results for the year ended June 30 include 11 months of Lehigh Valley Health Network activity, according to the report. Jefferson merged with the Allentown, Pa.-based health system on Aug. 1, 2024. On a 12-month pro forma basis, Jefferson’s operating loss was $197 million.
    • “Due to the Lehigh Valley Health Network acquisition, Jefferson saw significant increases to its operating revenue and operating expenses in 2025. Revenue rose 57.6% year over year to $15.8 billion. Operating expenses rose 59.5% year over year to $16 billion. 
    • “Jefferson attributed the unfavorable financial results in 2025 primarily to the Jefferson Health Plan, pharmacy trend and organizational inflationary pressures.”
  • Health Leaders Media tells us,
    • “Rural health systems and hospitals are struggling to stay open and don’t have the resources on hand to treat more of their patients.
    • “Telemedicine platforms can enable small providers to connect with specialists at larger organizations, giving them the opportunity to treat more patients rather than transferring or referring them elsewhere.
    • “Larger health systems can also use the technology to create a hub-and-spoke platform that allow them to market their specialists and services to other hospitals.”
  • Per BioPharma Dive,
    • “AbbVie has bought a psychedelic compound from a little-known drug company, in a deal that could be worth north of $1 billion.
    • “The acquisition, announced Monday, makes AbbVie one of the few large pharmaceutical firms to significantly invest in an area of drug development that many on Wall Street expect to become quite lucrative. Analysts at RBC Capital Markets recently wrote the psychedelic space is “approaching a tipping point” as larger studies near completion. Just last week, the small biotechnology company Reunion Neuroscience announced plans to push its main drug, which boosts certain brain proteins that interact with psychedelics like LSD and psilocybin, into late-stage testing.
    • “That news came less than two months after U.K.-based Compass Pathways disclosed data from a relatively large study wherein patients with hard-to-treat depression were given a version of a psychedelic compound found in many mushroom species. Gilgamesh Pharmaceuticals also unveiled positive results this year, from a mid-stage clinical trial focused on a drug that works similarly to Reunion’s.”
  • Fierce Healthcare adds,
    • “BeOne Medicines is monetizing its stake in Amgen’s first-in-class lung cancer drug Imdelltra for up to $950 million.
    • “Royalty Pharma will pay BeOne $885 million upfront for certain royalty payments from Amgen tied to ex-China sales of its DLL3 T-cell engager Imdelltra.
    • “Within the next 12 months, BeOne has an option to sell additional royalty rights to Royalty for up to $65 million.
    • “The royalties represent “a significant portion” of “tiered mid-single digit” payments based on Imdelltra’s annual sales above $1.5 billion, BeOne said in an Aug. 25 securities filing. Royalty, in a separate release, said the royalty level is about 7%.”
  • and
    • “With a buyout of scPharmaceuticals worth up to $360 million, MannKind is looking to dive into the large and growing field of cardiometabolic treatments.
    • “Endocrine and orphan lung disease-focused MannKind will shell out $5.35 per share—plus a contingent value right (CVR) of $1.00 per share—to buy scPharmaceuticals and Furoscix, the latter company’s on-body infuser that delivers furosemide.
    • “The total deal value of $360 million represents a 31% premium to scPharmaceuticals’ Aug. 22 closing price, according to a Monday press release.
    • “With the deal, MannKind will add scPharmaceuticals’ Furoscix to its lineup of marketed products. The 2022-approved drug is an on-body infuser that delivers generic furosemide as a self-administered, subcutaneous loop diuretic to help relieve the fluid retention and swelling that accompany heart failure and other conditions.”
  • Per MedTech Dive,
    • “Terumo plans to acquire OrganOx, a maker of organ preservation devices, in a roughly $1.5 billion deal that will allow the Tokyo-based medical device maker to enter the transplantation sector.
    • “OrganOx’s liver perfusion system supplies oxygenated blood, medications and nutrients to the donor organ near body temperature. The device allows functional assessment of the organ to support the decision on whether to transplant.
    • “U.K.-based OrganOx launched the system in 2022 in the U.S., where it competes with an organ preservation device from TransMedics Group. Called Metra, OrganOx’s system is also approved in the U.K., European Union, Australia and Canada.”
  • and covers the key medtech issues to watch in the final months of the year.
  • Fierce Healthcare adds,
    • “As fitness trackers get artificial intelligence updates, Google developed an AI-powered personal health coach for the Fitbit app. Built with Gemini, the AI-based health coach combines a fitness trainer, a sleep coach and a health and wellness advisor.
    • “We set out to build a new kind of coach: world-class expertise that’s always available whenever you need it. It constantly adapts based on your personal health and wellness metrics and is uniquely tailored to your goals and real-life circumstances,” said Andy Abramson, head of product at Fitbit.
    • “Fitbit will roll out a preview of the personal health coach as part of Fitbit Premium in the redesigned app available with the latest Fitbit trackers, Fitbit smartwatches and Pixel Watches.
    • “The health coach can build personalized fitness plans, with detailed workout suggestions and metric targets that focus on weekly progression. The coach can adjust workout plans based on real-time data and daily insights.”

Weekend update

David Ermer–Congress, Generative AI, Government Contracting, Medicare, U.S. Healthcare–

From Washington, DC

  • Congress will return to Capitol Hill for Committee business and floor voting on September 2.
  • JAMA considers Medicare Part D benefit designs following the Inflation Reduction Act.
    • “Question How did prescription drug coverage in Medicare Part D plans change after the Inflation Reduction Act (IRA)?
    • “Findings In this cross-sectional study of enrollees in Medicare Part D stand-alone and Medicare Advantage plans, from 2019 to 2025 mean deductibles and the proportion of patients with coinsurance for preferred brand-name drugs increased. For stand-alone plans, these increases were observed before and after the IRA changes took effect in 2025, but for Medicare Advantage plans, the changes were abrupt in 2025.
    • “Meaning The IRA limited annual out-of-pocket costs to $2000 for Medicare Part D beneficiaries, but concurrent design changes by Part D insurers, particularly among Medicare Advantage plans, may lead to higher cost sharing for some beneficiaries who do not reach this limit in 2025.

From the public health and medical research front,

  • Medscape informs us,
    • “Among hospitalized children and teens, respiratory syncytial virus (RSV) mostly affects younger, otherwise healthy infants, while the lesser-known human metapneumovirus (HMPV) tends to affect older children, many of whom have preexisting health conditions, according to a study published in Pediatrics.
    • “Researchers and other experts said the findings will hopefully promote the development of HMPV vaccines and affordable rapid diagnostic tests for the virus in outpatient settings.
    • “HPMV is not on people’s radar,” said John V. Williams, MD, chair of the Department of Pediatrics at the University of Wisconsin School of Medicine and Public Health in Madison, Wisconsin. “It was the largest prospective apples-to-apples comparison [on RSV and HMPV]; it has tremendous importance in that sense.”
  • The University of Minnesota’s CIDRAP tells us,
    • A study of more than 4 million children in South Korea found no association between antibiotic exposure during pregnancy or early infancy and increased incidence of autoimmune diseases, researchers reported yesterday in PLOS Medicine.
    • The study, conducted by researchers with Sungkyunkwan University in South Korea, is the latest to examine whether early exposure to antibiotics is associated with increased risk of childhood-onset diseases and neurodevelopmental conditions. Antibiotics are the most commonly prescribed medication in young children and are frequently overused, and animal research suggests antibiotic exposure at an early age may increase the risk of these conditions by disrupting the gut microbiome while it’s still developing.
    • To date, studies exploring potential links between early antibiotic exposure and development of autoimmune diseases have produced conflicting results. But the authors of the new study say previous research has been limited by potential confounding variables, such as infection and genetic factors.
  • Healio lets us know,
    • “The prevalence of certain gut-brain interaction disorders increased significantly during the COVID-19 pandemic, with the largest increase observed in irritable bowel syndrome, according to cross-sectional study results.
    • “Earlier studies focused on people who actually had COVID-19 and found a much higher risk of IBS after infection. Our study is different; we looked at the whole adult population, not just those infected, and still found a big jump in IBS rates,” Christopher V. Almario, MD, MSHPM, associate professor of medicine and co-director of Cedars-Sinai Center for Outcomes Research and Education, told Healio. “This suggests it’s not just the virus itself, but also broader effects of the pandemic — stress, isolation, dietary changes — that additionally likely played a role.”
  • and
    • “Three speakers outlined how AI is likely to have a major impact on the future of preventive cardiology.
    • “At the American Society for Preventive Cardiology Congress on CVD Prevention, the speakers discussed the importance of preventive cardiologists being involved in shaping the direction of AI in medical care, ways in which use of AI can promote health equity and how AI programs can be used for early detection of CV conditions.” * * *
    • :A priority for the future is to develop, validate and deploy AI-based screening for CVD, Pierre Elias, MD, assistant professor of cardiology and biomedical informatics at Columbia University and medical director for artificial intelligence at New York-Presbyterian Hospital, said during a presentation. 
    • “We have mammograms, we have colonoscopies; we have no equivalent for most forms of cardiovascular disease,” he said. “Every doctor in this room has had a patient that makes them think, why am I meeting them so late in the disease course? The way that we diagnose most forms of cardiovascular disease is either too expensive or too invasive to do on a population level.”

From the U.S. healthcare business front,

  • The New York Times explains why “President Trump’s planned pharmaceutical tariffs threaten to hit many of the most common and well-known drugs that Americans take.”
  • Fierce BioTech reports,
    • “Tempus AI has acquired the digital pathology developer Paige, including its FDA-cleared, artificial intelligence-powered programs for spotting the signs of cancer.
    • “The deal totals $81.25 million, which includes Tempus paying out Paige’s remaining commitment to Microsoft Azure for its cloud-computing services. The transaction will also be “paid predominantly” in Tempus stock, according to the company.
    • “Tempus set its eyes on the former Fierce Medtech Fierce 15 winner in part for its massive, anonymized dataset, which encompasses nearly 7 million digitized pathology slides and clinical data licensed from Memorial Sloan Kettering Cancer Center.” 
  • HR Dive shares an attorney’s opinion pointing out “three DEI approaches employers must reconsider to avoid federal ire. The principles set forth in a recent DOJ memo are likely to be applied by the EEOC to all employers under Title VII, attorney Jonathan Segal writes.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front,

  • Federal News Network tells us,
    • “The House Homeland Security Committee plans to convene in early September to mark up a reauthorization bill for a soon-to-expire cybersecurity law that’s viewed as critical to cyber collaboration across government and industry.
    • “In a statement, House Homeland Security Committee Chairman Andrew Garbarino (R-N.Y.) confirmed the committee will mark up a reauthorization bill for the Cybersecurity Information Sharing Act of 2015 once Congress returns from August recess.
    • “Reauthorizing the Cybersecurity and Information Sharing Act is essential as the deadline nears and as threats evolve,” Garbarino said. “The House Committee on Homeland Security plans to mark up our legislative text for its reauthorization shortly after Congress returns from recess in September. In a 10-year extension, I will preserve the privacy protections in the law, and I aim to provide enhanced clarity to certain pre-existing provisions to better address the evolving threat landscape.”
    • “CISA 2015, as it’s known, expires at the end of September. The law provides liability protections and privacy guardrails to especially encourage private sector organizations to voluntarily share data with each other and government agencies.”
  • Cybersecurity Dive reports,
    • “The Cybersecurity and Infrastructure Security Agency (CISA) has updated its recommendations for the minimum features of a software bill of materials (SBOM), the latest step in the agency’s campaign to encourage transparency in the software market.
    • “The updates and additions included in this document will better position Federal Government agencies and other SBOM consumers to address a range of use cases, understand the generation process, and improve data quality,” CISA said in the new publication, which it released on Thursday [August 21].” * * *
    • “The publication, which is open for public comment through Oct. 3, is aimed primarily at government agencies but is also designed to help other organizations understand what to expect from their vendors’ SBOMs.”
  • and
    • “The National Institute of Standards and Technology [NIST] wants public feedback on a plan to develop guidance for how companies can implement various types of artificial intelligence systems in a secure manner. 
    • “NIST on Thursday [August 14] released a concept paper about creating control overlays for securing AI systems based on the agency’s widely used SP 800-53 framework. The overlays are designed to help ensure that companies implement AI in a way that maintains the integrity and confidentiality of the technology and the data it uses in a series of different test cases. 
    • “The agency also created a Slack channel to collect community feedback on the development of the overlays.”
  • Per NIST news releases,
  • and
    • “NIST has released the initial public draft (IPD) of Special Publication (SP) 1331, Quick-Start Guide for Using CSF 2.0 to Improve the Management of Emerging Cybersecurity Risks, for public comment. The document highlights the topic of emerging cybersecurity risks and explains how organizations can improve their ability to address such risks through existing practices within the cyber risk discipline in conjunction with the NIST Cybersecurity Framework (CSF) 2.0. The guide also emphasizes the importance of integrating these practices with organizational enterprise risk management (ERM) to proactively address emerging risks before they occur. 
    • “The comment period is open through September 21, 2025, at 11:59 PM. Please send your feedback about this draft publication to csf@nist.gov.”
  • Per an HHS news release,
    • “Today [August 18], the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with BST & Co. CPAs, LLP (“BST”), a New York public accounting, business advisory, and management consulting firm, concerning a potential violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. BST is a HIPAA business associate and receives financial information that also contains protected health information (PHI) from a HIPAA covered entity.” * * *
    • “The settlement resolves an investigation of BST that OCR initiated after receiving a breach report that BST filed on February 16, 2020. BST reported that on December 7, 2019, BST discovered that part of its network was infected with ransomware, impacting the PHI of its covered entity client. OCR’s investigation determined that BST had failed to conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by BST.
    • “Under the terms of the resolution agreement, BST agreed to implement a corrective action plan that will be monitored by OCR for two years and paid $175,000 to OCR.”
  • Cybersecurity Dive informs us,
    • “Federal prosecutors on Tuesday [August 19] charged an Oregon man for allegedly running a global botnet-for-hire operation called Rapper Bot that used hacked IoT devices to conduct large-scale distributed denial-of-service (DDoS) attacks.
    • “Authorities charged Ethan Foltz, 22, with one count of aiding and abetting computer intrusions. Police executed a search warrant at Foltz’s house on Aug. 6, shut down the botnet and took control of its infrastructure, according to the U.S. Department of Justice.
    • “Rapper Bot allegedly used between 65,000 and 95,000 infected devices for DDoS attacks that often measured between two and three terabits per second. The largest attack may have exceeded six terabits per second, prosecutors said.
    • “Rapper Bot was “one of the most powerful DDoS botnets to ever exist,” said Michael Heyman, the U.S. attorney in Alaska, where authorities believe the botnet infected at least five devices.”
  • Cyberscoop adds,
    • “A 20-year-old Florida man received a 10-year federal prison sentence Wednesday for his role in the notorious Scattered Spider cybercrime organization, marking the first conviction of a member from the group responsible for breaching more than 130 major companies.
    • “Noah Michael Urban, 20, of Palm Coast, Fla., pleaded guilty to conspiracy, wire fraud and aggravated identity theft charges in two separate federal cases spanning Florida and California. A federal judge sentenced Urban to 120 months in prison with three years of supervised release and ordered him to pay $13 million in restitution to victims.
    • “The sentence exceeded federal prosecutors’ recommendation of eight years, reflecting the scope of Urban’s criminal activities that investigators say caused between $9.5 million and $25 million in total losses.”

From the cybersecurity vulnerabilities and breaches front,

  • The American Hospital Association News informs us,
    • “The FBI Aug. 20 released an advisory warning of malicious activity by Russian cyber actors targeting end-of-life devices running an unpatched vulnerability in Cisco Smart Install software. The agency said the actors, attributed to the Russian Federal Security Service’s Center 16, have been detected collecting configuration files for thousands of networking devices associated with U.S. entities across critical infrastructure sectors. On some devices, the files were modified to enable unauthorized access to the devices. The vulnerability was initially publicized in 2018.
    • “If you have vulnerable equipment in your network, please pay particular attention to ensuring that it is patched and running as securely as possible,” said Scott Gee, AHA deputy national advisor of cybersecurity and risk. “It is recommended that hospitals also make this equipment a priority for replacement since it’s no longer supported for updates by Cisco. It is also a good time to review the process for patch management and equipment upgrades, particularly focusing on patching known exploited vulnerabilities. The Cybersecurity Infrastructure and Security Agency maintains a catalog of KEVs.”
  • CISA added two known exploited vulnerabilities to that catalog this week.
  • Cyberscoop adds,
    • “The Chinese state-backed threat group Silk Typhoon has raised the pace of attacks targeting government, technology, legal and professional services in North America since late spring, according to CrowdStrike.
    • “We were calling this jokingly, ‘the summer of Murky Panda,’ because we’ve seen so much activity from them over the last couple of months,” said Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, using the firm’s nomenclature for the cyberespionage group.
    • “CrowdStrike has worked on more than a dozen cases involving Murky Panda during the past few months, including two active incident response cases, Meyers said. The group, which has been active since at least 2023, is “one of the top-tier Chinese threats that we’ve been seeing a lot this summer,” he said.
    • “Murky Panda exemplifies how Chinese attackers are gaining access to victim networks and infrastructure via vulnerabilities, unmanaged devices, the cloud and pivots between cloud services. 
    • “The group’s advanced techniques in cloud environments are evident, as it enables prolonged access and lateral movement to downstream victims by abusing delegated administrative privileges in cloud solution providers, CrowdStrike said in a research report released Thursday. [August 21].
  • Bleeping Computer reports,
    • “Hackers have stolen the personal information of 1.1 million individuals in a Salesforce data theft attack, which impacted U.S. insurance giant Allianz Life in July.
    • “Allianz Life has nearly 2,000 employees in the United States and is a subsidiary of Allianz SE, which has over 128 million customers worldwide and ranks as the world’s 82nd largest company based on revenue.
    • “As the company disclosed last month, information belonging to the “majority” of its 1.4 million customers was stolen by attackers who gained access to a third-party cloud CRM system on July 16th.” * * *
    • “On Monday, data breach notification service Have I Been Pwned revealed the extent of the incident, reporting that the email addresses, names, genders, dates of birth, phone numbers, and physical addresses of 1.1 million Allianz Life customers were stolen during the breach.
    • “Bleeping Computer has also confirmed with multiple people affected by this breach that their data (including their tax IDs, phone numbers, email addresses, and other information) in the leaked files is accurate.
    • “Many other high-profile companies worldwide were also breached in this campaign, including Google, Adidas, Qantas, Louis Vuitton, Dior, Tiffany & Co., Chanel, and, most recently, human resources giant Workday.”
  • Cybersecurity Dive notes,
    • The attack [on WorkDay] follows a string of social-engineering intrusions linked to ShinyHunters, a hacker group associated with an underground cybercrime collective known as The Com. The Com also has ties to the notorious hacker team Scattered Spider, which has targeted companies in multiple industries over the past several months, including retail, insurance and aviation. 
    • ShinyHunters has launched numerous attacks in recent months targeting Salesforce instances, according to researchers at Google. The group targeted one of Google’s own Salesforce instances earlier this month. 
    • Reliaquest recently published evidence of possible collaboration between ShinyHunters and Scattered Spider, including ticket-themed phishing domains and Salesforce credential-harvesting pages. 
  • Per Dark Reading,
    • “In this interview from Black Hat USA 2025, Philippe Laulheret, a senior vulnerability researcher at Cisco Talos, discusses his discovery of the “ReVault” vulnerability affecting millions of Dell business laptops. 
    • “Laulheret found that the Control Vault (also called a unified secure hub) — a control board connecting peripherals like fingerprint readers and smart card readers to Dell Latitude and Precision laptops — contained multiple security flaws that allow any user to communicate with the board through undocumented APIs, potentially leading to memory corruption, code execution, extraction of secret keys, and permanent firmware modification.”
  • Per Bleeping Computer,
    • “Six major password managers with tens of millions of users are currently vulnerable to unpatched clickjacking flaws that could allow attackers to steal account credentials, 2FA codes, and credit card details.
    • “Threat actors could exploit the security issues when victims visit a malicious page or websites vulnerable to cross-site scripting (XSS) or cache poisoning, where attackers overlay invisible HTML elements over the password manager interface.
    • “While users believe they are interacting with harmless clickable elements, they trigger autofill actions that leak sensitive information.
    • “The flaws were presented during the recent DEF CON 33 hacker conference by independent researcher Marek Tóth. Researchers at cybersecurity company Socket later verified the findings and helped inform impacted vendors and coordinate public disclosure.
    • “The researcher tested his attack on certain versions of 1Password, Bitwarden, Enpass, iCloud Passwords, LastPass, and LogMeOnce, and found that all their browser-based variants could leak sensitive info under certain scenarios.”
  • and
    • “A new infostealer malware targeting Mac devices, called ‘Shamos,’ is targeting Mac devices in ClickFix attacks that impersonate troubleshooting guides and fixes.
    • “The new malware, which is a variant of the Atomic macOS Stealer (AMOS), was developed by the cybercriminal group “COOKIE SPIDER,” and is used to steal data and credentials stored in web browsers, Keychain items, Apple Notes, and cryptocurrency wallets.
    • “CrowdStrike, which detected Shamos, reports that the malware has attempted infections against over three hundred environments worldwide that they monitor since June 2025.”

From the ransomware front,

  • Cybersecurity Dive reports on August 20,
    • “The pharmaceutical and biotechnology company Inotiv Inc. is investigating a cyberattack that led to hackers encrypting the firm’s data, it said in a filing on Monday with the U.S. Securities and Exchange Commission. 
    • “The Aug. 8 attack disrupted access to certain data storage and business applications, according to Innotiv. The company said it is working to bring certain systems back online and has moved some operations to offline alternatives in order to maintain business continuity.  
    • The company has restricted access to its systems, retained third-party experts and notified law enforcement, according to its SEC filing.” * * *
    • “The hackers behind the Qilin ransomware have claimed credit for the attack, according to researchers at Huntress and Kroll.”
  • Bleeping Computer adds on August 22,
    • “Kidney dialysis firm DaVita has confirmed that a ransomware gang that breached its network stole the personal and health information of nearly 2.7 million individuals.
    • “DaVita serves over 265,400 patients across 3,113 outpatient dialysis centers, 2,660 in the United States, and 453 centers in 13 other countries worldwide. The company reported revenues of over $12 billion in 2024 and of $3.3 billion for the second quarter of 2025.
    • “In April, the healthcare provider revealed in a filing with the U.S. Securities and Exchange Commission (SEC) that its operations were disrupted after attackers partially encrypted its network over the weekend.
    • “According to a dedicated website with more information regarding the resulting data breach, the attackers gained access to DaVita’s network on March 24 and were evicted after the company detected the incident on April 12.” * * *
    • “Although the kidney dialysis firm hasn’t linked the attack to a specific ransomware operation, the Interlock ransomware gang claimed responsibility for the breach in late April.
    • “Interlock also leaked the allegedly stolen data on its dark web portal after negotiations with DaVita had failed, claiming it had stolen roughly 1.5 terabytes of data from the company’s compromised systems, or nearly 700,000 files containing what appeared to be sensitive patient records, insurance details, user account information, and financial data.”
  • Dark Reading points out that “Researchers highlight how Warlock, a new ransomware heavyweight, uses its sophisticated capabilities to target on-premises SharePoint instances.”

From the cybersecurity business and defenses front,

  • Cybersecurity Dive reports,
    • “Enterprise software spending will sustain double-digit growth through 2029, according to Forrester projections. Vendor revenues grew 11% on average during the first quarter of the year, the analyst firm said in a July report.
    • “Infrastructure software spend will lead the charge, increasing 13.3% over the next four years, as enterprises stock up on cloud services, security tools and AI capabilities. The market for application software, a category that includes IT operations management, enterprise resource planning, and supply chain tools, will see slower growth of 9.5%, the firm said.
    • “Database management services will help shore up software market growth, as enterprises lay the groundwork for generative AI and agentic automation tools. The firm previously estimated off-the-shelf AI governance software spend to more than quadruple from 2024 to 2030, nearing $16 billion and capturing 7% of the software market.”
  • and
    • “Many business leaders still aren’t following cybersecurity best practices to protect their organizations from costly intrusions, according to a report that the consulting giant Unisys published on Tuesday [August 21].
    • “Only 62% of organizations have or are setting up a zero-trust network architecture, only 61% are prioritizing post-incident recovery and only 45% deploy or plan to deploy managed detection and response software.
    • “Only 42% of organizations said they use or plan to use digital identity and access management services, which are considered essential for stopping attacks that exploit legitimate credentials.”
  • Dark Reading informs us,
    • “Cyber insurers are testing out new ways to hold policyholders accountable for outdated security, limiting payouts when policyholders fall prey to attacks that use older vulnerabilities or take advantage of holes in the organizations’ defenses.
    • “Potential risk-limiting approaches include a sliding scale of accountability — and payouts — based on an unpatched vulnerability’s half-life, or whether a company failed to fix a critical vulnerability within a certain number of days, according to a blog post penned by cyber insurer Coalition, which does not support such approaches. Dubbed CVE exclusions, after the Common Vulnerabilities and Exposures (CVE) system widely used to assign identifiers to software security issues, the tactic is not yet widely adopted, and most examples are from insurers outside the US, the firm stated.
    • The limits could start showing up in companies’ policies, however, if demand for cyber insurance continues to grow, creating a seller’s market, says John Coletti, head of cyber underwriting at Coalition
    • “While we will not name names, there are specific examples of this occurring within the industry,” he says. “A company should be highly skeptical of buying a policy with a CVE exclusion.”
  • Info-Security Magazine relates,
    • “The US National Institute of Standards and Technology (NIST) has published new guidelines it claims will help organizations optimize their efforts to detect face morphing software.
    • “Face morphing is a type of deepfake technology that enables threat actors to blend the photos of two people into a single image. In doing so, it simplifies identity fraud by tricking face recognition systems into erroneously identifying an image as belonging to both original individuals.
    • “In this way, individual A can assume the identity of individual B and vice versa, NIST said.
    • “The new report, Face Analysis Technology Evaluation (FATE) MORPH 4B: Considerations for Implementing Morph Detection in Operations (NISTIR 8584), offers an introduction to the topic and key detection methods.
    • “It focuses mainly on the pros and cons of various investigatory techniques, and ways to prevent morphs from entering operational systems in locations such as passport application offices and border crossings.”
  • Here is a link to Dark Reading’s CISO Corner.

Friday report

David Ermer–CDC, COVID-19, FDA, Federal employment benefits, Medical / Rx research, NIH, OPM, U.S. Healthcare–

From Washington, DC,

  • Here is a link to the OPM Director’s weekly blog post.
    • “Of course, government doesn’t – and shouldn’t – function like private entrepreneurship. We can’t shoot for the moon and embrace unbridled risk as do venture-backed startups. But government can embrace a growth mindset – not leaving good enough alone, but instead always thinking about ways in which we can improve operational efficiency, try new things, and embrace change.”
  • Govexec reports,
    • “President Trump has just nine days to issue his likely plan to freeze federal employees’ salaries in 2026, before sizeable automatic and across-the-board increases take hold.
    • “Each August, the president must issue an alternative pay plan, declaring an economic emergency to avert the automatic implementation of sizeable increases to locality pay due to the 1990 Federal Employees Pay Comparability Act. Administrations of both parties have bemoaned the way that the law calculates those automatic adjustments, hence the annual sidestep of that provision.”
  • and
    • “The Internal Revenue Service is no longer planning to pursue layoffs as it seeks to rebuild parts of its workforce. The tax agency is now working to plug staffing holes with hiring, reassignments and rescinding the administration’s deferred resignation offer for some employees upon finding mission-critical staffing gaps. 
    • “The decision to forgo layoffs, confirmed by two sources briefed on the matter, marks a significant reversal for an agency that has shed about a quarter of its staff and had earlier this year planned to issue widespread reductions in force.”
  • Per a National Institutes of Health news release,
    • “I [NIH Director Jay Bhattacharya, MD] am pleased to announce the release of NIH’s new plan to promote gold standard science across all agency activities. Building on NIH’s longstanding commitment to scientific integrity, this forward-looking plan incorporates the nine, interlocking tenets of gold standard science adopted by the U.S. Government and aligns with the Department of Health and Human Services’ framework for achieving these principles.”
  • STAT News lets us know,
    • “The Food and Drug Administration announced Friday that it has begun publishing reports of adverse events concerning drugs and biological products on a daily basis. Previously, the database of the reports, called the FDA Adverse Event Reporting System, was updated quarterly. 
    • “People who navigate the government’s clunky adverse event reporting websites should not have to wait months for that information to become public,” FDA Commissioner Marty Makary said in a statement. “We’re closing that waiting period and will continue to streamline the process from start to finish.”

From the judicial front,

  • Modern Healthcare reports,
    • “A federal court in Maryland has blocked [Dropbox link to opinion] several parts of a health insurance exchange enrollment and eligibility rule days before they were set to take effect.
    • “The U.S. District Court for the District of Maryland temporarily stayed seven provisions from a Centers for Medicare and Medicaid Services rule issued June 20 and set to go live Monday.
    • “Judge Brendan Herson’s Friday ruling temporarily blocks a $5 premium penalty on auto-reenrollments, along with a policy disqualifying people for advance payment of subsidies if they didn’t file income taxes and failed to reconcile their tax credits in a previous year. 
    • “It also stops regulators from eliminating guaranteed insurance coverage for individuals with past-due premiums and pauses a requirement that exchanges verify certain household income data.
    • “Also on pause are policies to require pre-enrollment eligibility checks ahead of a special enrollment period and a change to the formula used to calculate plan tiers. 
    • “The ruling allows CMS’ methodology for calculating premium adjustments, along with its elimination of a 60-day window for enrollees to resolve household income data, to go forward. 
    • “The court did not weigh in on other provisions in the regulation, such as the shorter open enrollment period. Plaintiffs are not contesting the changes to the low-income enrollee signup period.”

From the public health and medical research front,

  • The Centers for Disease Prevention and Prevention announced today.
    • “COVID-19 activity is increasing in many areas of the country. Seasonal influenza activity is low, and RSV activity is very low.
    • “COVID-19
      • “The percentage of COVID-19 laboratory tests that are positive is going up across the country. Emergency department visits for COVID-19 are increasing among all ages and highest in young children. COVID-19 model-based epidemic trends (Rt) indicate that COVID-19 infections are growing or likely growing in most states.
    • “Influenza
    • “RSV
      • “RSV activity is very low.
    • “Vaccination
      • “Research finding: An MMWR report released August 21, 2025, found that in the first RSV season (2023–24) where RSV prevention products were available, 29% of infants born during October 2023–March 2024 were immunized against RSV through receipt of nirsevimab (a monoclonal antibody) or maternal RSV vaccination during pregnancy. The report used data from immunization information systems representing 33 states and the District of Columbia. State-specific immunization coverage ranged from 11% to 53%. Preliminary data from the 2024–25 season suggested that RSV immunization coverage increased nationally.
      • “The recent FDA approval and CDC recommendation for an additional monoclonal antibody, clesrovimab, could further increase access and immunization coverage for infants in the 2025–26 respiratory virus season. RSV immunization products will be available beginning in September for most of the continental United States.”
  • The University of Minnesota’s CIDRAP adds,
    • “Emergency department (ED) visits for COVID, still at low levels, also rose, up 15.2% compared to the previous week. Levels are higher in the South, Southeast, and West compared with other parts of the country. The CDC said ED visits are rising for all age groups and are highest in young children.
    • “Hospitalization rates have shown a slight upward trend since July, and the rate of deaths from COVID remains low with no change reported compared with the previous week. 
    • “Due to technical issues, the CDC did not report wastewater data for COVID, influenza A, or respiratory syncytial virus (RSV) today and said it would resume updates as soon as possible. Last week, it said the overall detection level was low and highest in the West.”
  • and
    • “The Kansas Department of Health and Environment (KDHE) yesterday announced the end of a large measles outbreak in the southwestern part of the state, after two incubation periods passed with no new cases.” * * *
    • “Elsewhere, the Wisconsin Department of Health Services and Oconto County Public Health have identified five more measles infections linked to nine earlier cases reported from Oconto County in early August, bringing the total to 14. 
    • “Officials said the ongoing investigation indicates that measles is spreading locally. Oconto County is located in northeastern Wisconsin and is part of the Green Bay area.
    • “In other measles developments, the Pennsylvania Department of Health yesterday issued an alert about potential measles exposures in four counties after an out-of-state traveler visited the state while contagious. The exposures occurred in Adams, Clearfield, Lancaster, and York counties. Locations included two Mennonite facilities, along with a travel center, a restaurant, and an entertainment venue.”
  • Genetic Engineering and Biotechnology tells us,
    • In neurodegenerative diseases such as amyotrophic lateral sclerosis (ALS), Parkinson’s, and Alzheimer’s, healthy brain cells are damaged by aberrant reactive oxygen species (ROS). A potential treatment involves neutralizing ROS using antioxidant drugs. But these approaches failed to penetrate the brain effectively or proved unstable or indiscriminately damaged healthy cells. 
    • Now, a new study led by scientists at the Institute for Basic Science (IBS) in Daejeon, South Korea explores how the brain defends itself against hydrogen peroxide, a particularly harmful ROS. Using advanced imaging and molecular analysis, they discovered that hemoglobin exists in the nucleolus of astrocytes, where it acts as a “pseudoperoxidase” that breaks down H₂O₂ into harmless water. Full details are published in a new Signal Transduction and Targeted Therapy paper titled “Hemoglobin as a pseudoperoxidase and drug target for oxidative stress-related diseases.”
    • “The key was to uncover hemoglobin’s antioxidant potential in the brain and design a ‘first-in-class’ compound that could selectively enhance it,” said Won Woojin, PhD, first author on the study. “By boosting a natural defense mechanism rather than introducing an external antioxidant, we achieved strong and lasting protection across multiple disease models associated with oxidative stress.” 

From the U.S. healthcare business front,

  • Fierce Healthcare reports,
    • “Pittsburgh-based insurer Highmark brought in $16.5 billion in revenue for the first half of 2025, leaning on its health system and other diversified businesses as headwinds batter its payer unit.
    • “That includes $121 million in operating income and $329 million in net income for the first six months of the year. As of June 30, the company had $10.3 billion in net assets.
    • “The midyear financial results reflect an ongoing rebound at Allegheny Health Network, Highmark’s health system. The AHN posted $2.8 billion in revenue and $72 million in operating income for the first half of the year, bolstered by significant improvements to volumes across multiple categories.
    • “In the first half of the year, inpatient discharges and observations were up by 4% and outpatient registrations were up by 5% compared to the first six months of 2024. The AHN also saw a 7% increase in physician visits and a 4% increase in emergency room visits year over year.”
  • Beckers Hospital Review points out,
    • “Boston-based New England Baptist Hospital has the lowest hospital wide readmission rate, while Oroville (Calif.) Hospital has the highest, according to CMS’ Unplanned Hospital Visits database.
    • “The data, released Aug. 6, is based on provider data for hospital return days, including unplanned readmission measures and measures of unplanned hospital visits after outpatient procedures. The data was collected between July 1, 2023, and June 30, 2024.
    • “The article identifies] the 10 hospitals with the highest and lowest hospital wide readmission rates, along with their respective scores.
  • Medical Economics relates,
    • “For decades, referrals and word-of-mouth were the main routes to finding a new physician. Now, according to rater8’s 2025 report, “The Next Evolution of Patient Choice: The Rise of AI in Healthcare Search,” patients are increasingly relying on artificial intelligence (AI), online reviews and social media when deciding where they should seek care.
    • “The survey of more than 1,000 U.S. adults found that 70% are open to — or are already using — AI tools to research physicians. Among patients, 26% said AI recommendations directly influenced their decision — nearly equal to primary care referrals (28%) and health care review sites (29%).”
  • MedTech Dive calls attention to the fact that the “robotic surgery market battle is heating up. After a busy summer of surgical robotics news, check out MedTech Dive’s roundup of coverage in the space.”