FEHBlog

Monday Roundup

David Ermer–AHRQ, CMS, Congress, COVID-19, FDA, Federal employment benefits, OPM, Patient safety, Rx coverage, U.S. Healthcare–
Photo by Sven Read on Unsplash

From our Nation’s capital, OPM released its Fiscal Year 2024 Congressional Budget Justification document, which is part of the federal budget process. Of interest to the FEHBlog is this OPM goal:

Improve customer experience by making it easier for Federal employees, annuitants, and other eligible persons to make a more informed health insurance plan selection. 

By September 30, 2023, complete user-centered design and develop a minimum viable product for a new, state-of-the-art Decision Support Tool that will give eligible individuals the necessary information to compare plan benefits, provider networks, prescription costs, and other health information important to them and their families.

Federal News Network tells us about a related Office of Management and Budget analytical perspective on federal workforce issues.

The Office of Management and Budget, in one of its analytical perspectives supplementing the Biden administration’s 2024 budget request, said federal workers’ pay is “increasingly hamstrung” by statutory requirements “that curb the ability of agencies to reward talent, including for specialized occupations, in a national competitive job environment.”

From the Rx coverage front —

The Wall Street Street Journal reports

Eisai Co.’s new Alzheimer’s disease drug Leqembi will be covered by the U.S. Department of Veterans Affairs, the first major insurer to agree to pay for the drug since its approval by U.S. regulators earlier this year. 

Eisai said Monday veterans with the early stages of Alzheimer’s would get the drug covered under criteria set by the VA.

An estimated 167,954 veterans receiving care through the VA have Alzheimer’s dementia, according to government estimates. To qualify for Leqembi, patients must be over 65, have early-stage symptoms and elevated brain amyloid, sticky protein fragments, which the drug is designed to remove.

STAT News describes the VA’s step as “unexpected,” which is an understatement because CMS does not plan to issue a Medicare national coverage decision until mid-year. STAT News adds

The [VA] published a guide on its formulary saying coverage will extend to any veteran who meets specified criteria, including an MRI scan within the previous year, amyloid PET imaging consistent with Alzheimer’s and a staging test indicating mild Alzheimer’s dementia. There is also a long list of criteria that would exclude veterans.

The agency can negotiate prices for drugs, but the price it will pay for Leqembi was not listed and the Eisai spokesperson did not offer a cost. Leqembi has an annual wholesale price of $26,500, although the Institute for Clinical and Economic Review recently said the treatment should cost between $8,900 and $21,500 per year to be considered cost effective.

Under federal law, the VA can bill other health plans (including FEHB but not Medicare) for non-service related care such as this drug. For this reason, this VA action opens the back door to FEHB coverage of Leqembi.

From the end of the public health emergency front —

The Society for Human Resource Management offers its take on how employers should prepare for the end of the PHE, now less than two months away.

The American Hospital Association points out

The Food and Drug Administration will end 22 COVID-19-related policies when the public health emergency ends May 11 and allow 22 to continue for 180 days, including temporary policies for outsourcing facilities compounding certain drugs for hospitalized patients and non-standard personal protective equipment practices for sterile compounders not registered as outsourcing facilities, the agency announced. FDA plans to retain 24 COVID-19-related policies with “appropriate changes” and four whose duration is not tied to the PHE, including its recently revised policy for COVID-19 tests. 

From the Rx business front —

BioPharma Dive informs us

Pfizer has agreed to buy Seattle-based Seagen for $43 billion in a blockbuster deal that would unite the pharmaceutical giant with a biotechnology company that pioneered a new type of tumor-killing medicine.

The acquisition is the largest Pfizer has attempted since its 2009 purchase of Wyeth, and is the most sizable in the drug industry by value since AbbVie’s $63 billion buyout of Allergan in 2019.

Acquiring Seagen gives Pfizer control of the top-selling lymphoma medicine Adcetris as well as a pipeline of cancer treatments that’s yielded three new drug approvals in the past three years. Seagen specializes in a type of cancer therapy known as an antibody-drug conjugate, and has steadily improved on the technology since its founding in 1997.

STAT News relates

Sanofi said Monday that it is acquiring Provention Bio, makers of a diabetes treatment, for $2.9 billion.

The Provention drug at the centerpiece of the deal, called TZield, was approved in the U.S. last November as the first and only treatment to prevent the onset of symptomatic Type 1 diabetes. Sanofi was already co-marketing the drug under a prior licensing deal signed between the two companies.

The French pharma giant will now own TZield outright, paying $25 per share to acquire Provention — a 273% premium over Friday’s closing stock price.

In recognition of Patient Safety Awareness Week

  • The HHS Agency for Healthcare Quality and Research’s Director Robert O. Valdez, Ph.D., M.H.S.A. explains how AHRQ is sharpening its focus on diagnostic safety.
  • Beckers Hospital Review reports
    • The pediatric mental health crisis is the most pressing patient safety concern in 2023, the Emergency Care Research Institute said on March 13. 
    • The ECRI, which conducts independent medical device evaluations, annually compiles scientific literature and patient safety events, concerns reported to or investigated by the organization, and other data sources to create its top 10 list.
    • Here are the 10 patient safety concerns for 2023, according to the report: 
      • 1. The pediatric mental health crisis
      • 2. Physical and verbal violence against healthcare staff
      • 3. Clinician needs in times of uncertainty surrounding maternal-fetal medicine
      • 4. Impact on clinicians expected to work outside their scope of practice and competencies
      • 5. Delayed identification and treatment of sepsis
      • 6. Consequences of poor care coordination for patients with complex medical conditions
      • 7. Risks of not looking beyond the “five rights” to achieve medication safety
      • 8. Medication errors resulting from inaccurate patient medication lists
      • 9. Accidental administration of neuromuscular blocking agents
      • 10. Preventable harm due to omitted care or treatment
  • The U.S. Department of Labor announced on March 10
    • the launch of a series of online dialogues to gather ideas and other public input on how health policies can support workers’ mental health most effectively.
    • The crowdsourcing will focus on four areas of concern for people with mental health conditions, including benefits policies that meet their needs, access to workplace care and supports, the reduction of related social stigmas, disparities faced by people in underserved communities, shortages of behavioral health professionals, and the establishment of state resource systems.
    • Part of the department’s ePolicyWorks initiative, the dialogues will remain open until April 3. Input received will inform the next meeting of the Mental Health Matters: National Task Force on Workforce Mental Health Policy
  • Healthexec calls attention to FDA recalls of certain eyedrops.

From the value-based care front, Health Payer Intelligence notes

CareFirst BlueCross BlueShield (CareFirst) has formed a strategic alliance with Aledade, Inc. (Aledade), offering independent primary care physicians tools and resources to improve healthcare affordability and effectiveness, supporting CareFirst member physicians in achieving value-based care goals.

Through this value-based relationship, CareFirst member physicians can leverage specialists, including onsite business support for physician practices, a technology platform that works with more than 100 different EHRs, and healthcare regulatory and policy expertise.

From the medical debt front, Healthcare Dive reports

  • Hospitals are a prime source of medical debt in America that hits underserved populations hardest, despite charity care programs and financial assistance policies, according to a new analysis from the Robert Wood Johnson Foundation.
  • Of the 15% of U.S. adults with past-due medical debt, almost two-thirds owe some or all of that debt to hospitals, according to research from the Urban Institute. That medical debt disproportionately affects underserved populations, such as low-income individuals and people with disabilities, researchers found.
  • While medical debt remains a persistent financial burden in the U.S., a new analysis from the Urban Institute highlights how targeting hospital billing could ameliorate the problem.

Weekend update

David Ermer–Congress, Rx coverage, U.S. Healthcare–
Bluebonnets — The Texas State Flower

The House of Representatives and the Senate will be in session this week for Committee business and floor voting.

HHS’s Agency for Healthcare Quality and Research reminds us that we observe Patient Safety Awareness Week from March 12 through March 18.

HR Dive reminds us that March 2023 marks the thirtieth anniversary of Congress enacting the Family and Medical Leave Act.

From the public health front —

  • The American Medicare Association explains what doctors wish patients knew about falling U.S. health expectancy and identifies steps patients can take to lower high blood pressure.
  • Fortune Well informs us, “Researchers have found long-term evidence that actively monitoring localized prostate cancer is a safe alternative to immediate surgery or radiation.”
  • A Fortune Well reporter shares lessons learned from wearing a continuous glucose monitor for a decade.

From the Rx coverage front, STAT News reports

The emergence of highly effective obesity drugs has spurred renewed efforts to get Medicare to pay for weight loss medications, but a group of health policy experts is sounding caution.

Even a small amount of uptake would create significant costs for Medicare, likely leading the federal insurer to raise premiums in the long run, the researchers said in a perspective piece Saturday in the New England Journal of Medicine.

The chronic medications may also have fewer benefits and more risks for older people — the population that Medicare serves, they wrote.

OPM advised FEHB carriers in a January 2023 carrier letter

FEHB Carriers must have adequate coverage of FDA approved anti-obesity medications on the formulary to meet patient needs and must make available their exception process to members. Carriers must cover at least one anti-obesity drug from the GLP-1 class for weight loss and cover at least 2 additional oral anti-obesity drug options. As new anti-obesity drugs are approved by the FDA, OPM expects Carriers to evaluate and update their coverage of anti-obesity drugs. Carriers should provide access to a range of obesity drugs on the formulary in order to satisfy OPM’s requirement in Carrier Letter 2022-02 that Carriers must ensure non-discriminatory access to safe, clinically appropriate drug therapy for members with chronic conditions. This includes drug therapies indicated for adolescents age 12 years and older.

In cases where utilization management edits are applied, the process and evidence-based criteria for coverage must be transparent, readily accessible, and follow OPM required turnaround timelines for standard and expedited reviews. We recognize the progress made in covering anti-obesity medications; our goal is to have all Carriers offer adequate coverage.

From the medicare practice front —

  • RevCycle Intelligence relates, “Providers are Increasingly Billing Outpatient Visits at Higher Levels; The share of outpatient visits billed at the two highest complexity levels increased from 24 percent in 2004 to 43 percent in 2021,” and “A study finds that outpatient surgery rates for 4 common procedures rose significantly during the pandemic, while barriers prevent greater uptake for other surgical operations.
  • In an intriguing contrast of news —
    • RevCycle Intelligence highlights, “New data shows that 46% of patients rely on online provider reviews for provider selection. With loyalty on the back burner, a poor patient experience could prompt consumers to look elsewhere.”
    • Meanwhile, the Wall Street Journal reports
      • “Doctor-rating websites regularly fail to mention such black marks on physicians’ records, according to research published in November in the Journal of Empirical Legal Studies. 
      • “The researchers compared two groups of online reviews. One group consisted of ratings for 221 doctors in Illinois and Indiana who had paid medical-malpractice claims and had disciplinary actions against them. The other group had ratings for 221 doctors in the same two states with clean records. Based on their findings across five online rating services—Healthgrades.com, RateMDs.com, Vitals.com, WebMD and Yelp.com—the researchers reported no significant difference in the two groups’ ratings. 
      • “If you have a physician with both discipline and medical-malpractice claims, you should probably be looking for someone else, but that information is not easy to find,” says David Hyman, an author of the study and a health-law and policy professor at Georgetown University Law Center. 
      • “Of the five websites in the study, only Healthgrades reports medical-malpractice claims and disciplinary actions, but it misses 90% of those claims and actions, according to the study authors.”

Cybersecurity Saturday

David Ermer–Cybersecurity–

From Capitol Hill, the Senate Homeland Security and Governmental Affairs Committee will hold a full Committee hearing to examine cybersecurity risks to the healthcare sector. The hearing will occur on Thursday, March 16, 2023, at 10 am.

Among the topics at the hearing will be a serious cybersecurity breach at DC Health Link which runs the DC health marketplace under the Affordable Care Act (“Act”). In the Affordable Care Act (“ACA”) Congress shifted its health benefits coverage for its members and senior staffers from FEHB to the ACA marketplace. Of note, Congress was directly hit in the OPM breach and this new one.

Axios explains

A hacker who uses the pseudonym “Denfur” is selling a database they claim includes stolen sensitive data from at least 55,000 customers of D.C.’s health insurance marketplace, including members of Congress and their staffs.

Driving the news: Congressional leaders started warning lawmakers on Wednesday about the breach at DC Health Link and suggested they freeze their credit while an investigation continues.

  • DC Health Link, which confirmed the breach and dark web leaks in a statement, helps all city residents purchase health insurance, not just members of Congress.

What’s happening: Researchers at Check Point Research told Axios Thursday that a malicious hacker had posted the database for sale on the “biggest English-speaking dark web hacking forum.” The member claims the database includes sensitive data from thousands of customers, including Social Security numbers, birthdates and home addresses.

  • Denfur is now selling the stolen database for just “a few dollars,” researchers noted. Denfur signed off the post with “Glory to Russia!”
  • CyberScoop reports that a sample of the stolen data includes information about former defense officials and lobbyists, and the Associated Press reported it was able to authenticate data belonging to two victims in the set.
  • Axios has seen the dark web post, which was still live as of Friday morning.

Cyberscoop adds,

A person using the moniker “IntelBroker” first posted the stolen data on March 6 to an online forum, where data breaches are publicized and data is either published for download or offered for sale. That post was subsequently pulled down, and “IntelBroker” is now listed permanently banned. 

Three days later, on March 9, a second user going by the name “Denfur” — whose signature on the site reads “Glory to Russia!” — posted what they claimed was the full database, along with a sample that includes 200 entries. The full dataset includes 67,565 unique entries and about 55,000 “unique people,” Denfur claimed. 

At about midday Thursday Denfur also claimed that “the intended target WAS U.S. Politicians and members of U.S. Government.” The quote appeared alongside a link to a news story about the incident quoting House of Representatives Chief Administrative Officer Catherine Szpindor as saying that the members of Congress were not the specific target of the attack.

From the cybersecurity risks / vulnerabilities front —

Tech Republic tells us,

CrowdStrike, a cybersecurity firm that tracks the activities of global threat actors, reported the largest increase in adversaries it has ever observed in one year —  identifying 33 new threat actors and a 95% increase in attacks on cloud architectures. Cases involving “cloud-conscious” actors nearly tripled from 2021.

“This growth indicates a larger trend of e-crime and nation-state actors adopting knowledge and tradecraft to increasingly exploit cloud environments,” said CrowdStrike in its 2023 Global Threat Report.

Besides the raft of new threat actors in the wilds that it pinpointed, CrowdStrike’s report also identified a surge in identity-based threats, cloud exploitations, nation-state espionage and attacks that re-weaponized previously patched vulnerabilities. * * *

Last week’s revelation of an attack on password manager LastPass, with 25 million users, says a lot about the difficulty of defending against data thieves entering either by social engineering or vulnerabilities not usually targeted by malware. The insurgency, the second attack against LastPass by the same actor, was possible because the attack targeted a vulnerability in media software on an employee’s home computer, releasing to the attackers a trove of unencrypted customer data.

The Cybersecurity and Infrastructure Security Agency (CISA) added three known exploited vulnerabilities to its catalog on March 7, 2023, and two more on March 10. Bleeping Computer provides its perspective here.

Tech Republic also highlights a cybersecurity report from the World Econonic Forum that is worth a gander.

From the ransomware front

Tech Republic informs us based on the CrowdStrike report that cybercriminals are shifting tactics from ransomware to data exfiltration and extortion like what happened at DC Health Link. “There was a 20% increase in the number of adversaries conducting data theft and extortion last year, by CrowdStrike’s reckoning.”

HHS’s Healthcare Sector Cybersecurity issued a threat alert on data exfiltration trends in the healthcare sector on March 9.

Here’s a link to Bleeping Computer’s The Week in Ransomware.

From the cybersecurity defenses front —

Health IT Security reports

HHS, through the Administration for Strategic Preparedness and Response (ASPR), and the Health Sector Coordinating Council (HSCC) Cybersecurity Working Group released the Cybersecurity Framework Implementation Guide to help the healthcare sector manage cybersecurity risks amid an increasingly sophisticated threat landscape.

The guide aims to help healthcare organizations align their cyber programs with the National Institute for Standards and Technology (NIST) Cybersecurity Framework (CSF). * * *

The publication is not intended to replace other cybersecurity programs or provide a roadmap to compliance, the guide states. Rather, the voluntary guidance can help healthcare organizations bolster their existing programs and ideally reduce risk by aligning the healthcare sector with NIST’s robust framework.  

Bank Info Security points out that “In addition to the new joint NIST cybersecurity framework toolkit, the Health Sector Coordinating Council and HHS are also close to completing an update of a joint 2019 publication, Health Industry Cybersecurity Practices.”

Director Ahuja appears before Congress

David Ermer–Congress, COVID-19, OPM–
Photo by Michele Orallo on Unsplash

On Thursday, OPM Director Kiran Ahuja appeared at a hearing before the House Oversight and Accountability Committee for around three hours of questioning. Federal News Network tells us

This week, the Oversight and Accountability Committee held seven hearings in the span of just two days. Members are probing fraudulent payments of pandemic relief programs, advances in artificial intelligence (AI) and inflation, to name just a handful.

The FEHBlog listened to the hearing. Much of the questioning at the hearing stems from OPM’s struggles with federal retirement program administration. OPM must deal with an unnecessarily complicated retirement system that Congress created. Congress could solve OPM’s administration/customer service problem by simplifying federal employee retirement laws.

In FEHB news, Ms. Ahuja announced

  • OPM will issue the Postal Service Health Benefits Program (“PSHBP”) interim final implementation rule in April 2023. Bear in mind that the statutory deadline is April 6, 2023.
  • OPM expects to solve its FEHB eligibility issues by ending the current decentralized approach to FEHB enrollment under which federal agencies hold primary responsibility. Remember that half of the enrollment, the annuitants, already are centralized in the OPM annuitant payroll office. Nevertheless, OPM plans to roll out its new 100% centralized approach with the PSHBP for 2025 and subsequently extend it to legacy FEHB.
  • OPM works “hand in glove” with the Postal Service to implement the PSHBP.
  • Like FedWeek (as discussed in FEHBlog posts earlier this week), Congress does not understand the FEHB’s hardcore transparent prescription drug pricing program for experience-rated carriers. Director Ahuja did not trumpet OPM’s game-changing decision to allow integrated Medicare Part D EGWPs for 2024.

It’s worth adding that the Federal Times has recognized that OPM has improved FEHB infertility treatment benefits for 2024 and that Govexec.com includes an article about the OPM call letter for 2024 benefit and rate proposals, which includes a misunderstanding of Medicare programs being integrated into FEHB for greater savings.

OPM is encouraging FEHB carriers to offer Medicare Advantage Prescription Drug Employer Group Waiver Plans, which are designed to maximize value to enrolled individuals under FEHB and Medicare. These are special plans more generous than standard Medicare Advantage plans.

In recent years, a growing number of FEHB carriers have offered such plans. They must provide benefits that are at least the same as those offered by other Medicare plans.

Over the past decade, FEHB plans have been integrating Medicare Advantage / Prescription Drug Plans. These are known as MAPDs. Annuitants with Medicare Part A and B coverage can opt into these MAPD plans and receive a Part B premium subsidy, among other benefits.

In a January 2023 carrier letter and the February 2023 call letter, OPM informed carriers of a new opportunity to offer Medicare Part D EGWPs. These “new to FEHB” Part D prescription drug plans, which can be integrated with FEHB Rx benefits, are open to all Medicare prime annuitants, including Medicare Part A only members.

With the current integrated MAPD plans, opting-in annuitant members must pay the Medicare Part B premium adjusted for the Plan subsidy. With the Part D PDPs / EGWPs, the Plan covers the Part D premiums for the participating members.

In regular Friday post news, here are links to the CDC’s Covid Data Tracker, which continues to show downward trends in new cases, hospitalizations and deaths, and the CDC’s weekly Fluview, which indicates, as folks know, that the flu epidemic is over.

The FEHBlog also suggests that readers listen to the 15-minute long, eye-opening Wall Street Journal podcast on fentanyl test strips.

Thursday Miscellany

David Ermer–CDC, Congress, COVID-19, FDA, Medicare, OPM, Rx coverage, SDOH, U.S. Healthcare–
    Photo by Josh Mills on Unsplash

    From our Nation’s capital, the President presented his Fiscal Year 2024 budget to Congress today. Roll Call informs us

    While spending would increase by $1.9 trillion over a decade, revenue would increase by $4.7 trillion, for over $2.8 trillion in a 10-year deficit reduction. But according to the Office of Management and Budget’s numbers, the budget shortfall would still total more than $17 trillion over the next decade even if Biden’s plans were fully implemented, which seems unlikely.

    The Wall Street Journal adds, “Biden’s budget shows the rising cost of leaving Medicare and Social Security untouched. In the President’s blueprint, the two programs plus interest consume a sharply growing share of economic output.

    and

    The President’s proposed spending and tax increases will face an unfriendly reception among Republicans in Congress, as lawmakers gear up for a fight over the debt ceiling that could come before the Sept. 30 end of the fiscal year. GOP leaders in the House have called for unspecified spending cuts as a condition of raising the federal debt limit. But the president has said he won’t negotiate over raising the debt ceiling.

    Republicans plan to release their own budget proposal in the coming months, though they haven’t agreed on a plan.

    The President will make public more budget details over the next few days. Until then, it’s worth noting that the budget includes the following healthcare proposal

    The budget proposes $11 billion for a five-year effort the White House hopes will eliminate hepatitis C in the U.S., said Dr. Francis Collins, the former National Institutes of Health director who is spearheading the initiative. Drugs to treat the disease have been on the market since 2013, but normally retail for about $24,000 per patient. 

    In related news, the American Hospital Association tells us,

    “The Centers for Disease Control and Prevention [CDC] today recommended screening all U.S. adults at least once in their lifetime for hepatitis B using three laboratory tests. It also expanded risk-based testing recommendations to certain populations and activities with increased risk for the hepatitis B virus.”

    The FEHBlog is unsure how this meshes with the ACA’s preventive services mandate because the current US Preventive Services Task Force recommendation is Grade B for “screening for hepatitis B virus (HBV) infection in adolescents and adults at increased risk for infection.” The CDC’s new recommendation is significantly broader.

    The Office of Personnel Management released on March 7 “a new memorandum today detailing a vision for the future of the workforce: a Federal government with a workforce that is inclusive, agile and engaged, with the right skills to enable mission delivery.”

    From the public health front —

    • The Kaiser Family Foundation notes ten numbers to mark the third anniversary of the Covid pandemic
    • The Dana Farber Cancer Institute highlights a comprehensive article about colon cancer in young adults.
    • The Food and Drug Administration “published updates to the mammography regulations to, among other things, require mammography facilities to notify patients about the density of their breasts, strengthen the FDA’s oversight and enforcement of facilities and help interpreting physicians better categorize and assess mammograms.
    • The New York Times reports, “A review of poisonings among children 5 and younger found that opioids contributed to nearly half of the deaths from 2005 to 2018, largely from accidental overdoses, according to new research. * * * The study, published on Wednesday in the journal Pediatrics, analyzed 731 poisoning-related deaths that occurred from 2005 to 2018 across 40 states.”

    From weight loss drugs front —

    • STAT News continues its reporting on obesity drugs. The latest article concerns “‘Emotional hunger’ vs. ‘hungry gut’: The attempt to subtype obesity and tailor treatments.”
    • Medscape provides the account of a physician who took the new obesity drugs, specifically Ozempic. This article is particularly worth a gander.

    From the SDOH front, Mercer Consulting lays out its latest “Must-Do Strategy: Lean in on Benefits Strategy to Support DEI Goals.”

    From the miscellany department

    • Cigna offers its insights on how to choose among virtual care, urgent care centers, and emergency rooms.
    • Beckers Hospital Review notes
      • “In a March 8 Twitter thread, the FDA acknowledged it’s aware of a potential drug supply disruption after Gurnee, Ill.-based Akorn Operating Co. closed in late February. 
      • “The FDA clarified that the ongoing shortage is of a specific albuterol inhalation solution used in nebulizers, typically in hospitals, for patients having trouble breathing, not in inhalers at the consumer level. The agency said it is working with manufacturers to ease the shortage and “reiterated that outsourcing facilities may compound the specific product.”

    Finally, following up on the FEHBlog’s message to Congress about FEHB prescription drug costs, OPM stated its position against carving out prescription drug coverage from FEHB carrier responsibilities in the agency’s FY 2018 annual financial report on page 123:

    OPM does not concur with OIG’s suggestion that OPM continue to pursue efforts towards a prescription carve-out program. The Federal Employees Health Benefits (FEHB) Program is a market-based program that provides complete health benefits within each FEHB plan. The FEHB Program is not a self-funded plan and its statutory framework does not contemplate it to be the direct payer of benefits. Each FEHB Program plan offers comprehensive medical services including services provided by physicians and other health care professionals, hospital services, surgical services, prescription medications, medical supplies and devices, and mental health services. FEHB Program plans compete to offer all of these benefits in a high quality manner at the most competitive price possible.

    Carving out pharmacy benefits or any of the other services normally covered under an FEHB Program contract and administering the benefit as a separate contract or program, could undermine the fundamental market-based nature ofthe FEHB Program. It would be disruptive and could lead to a reduction in plan participation, and limit the ability of FEHB carriers to focus on comprehensively improving the health of the population. There would likely be less effective

    coordination of medical and pharmacy claims, and potentially less effective, one-size-fits-all pharmacy utilization and disease management programs. OPM is now assessing carrier performance on the basis of clinical quality measures that require tight coordination between medical and pharmacy benefits. A carved out pharmacy benefit is not consistent with or supportive of plan performance assessment, and may impair achievement of OPM’s long-term population health goals. As an example, carriers being held accountable for controlling diabetes and hypertension in the population they serve cannot do so readily if they do not have control over pharmacy benefit design and real time access to adherence data.

    To control the cost of prescription drugs, OPM works with carriers to better manage pharmacy networks, focus on drug utilization techniques, coordinate coverage of specialty drugs between the medical and pharmacy benefit, optimize the prescription drug benefit via formulary design, and implement effective cost comparison tools for members and prospective enrollees. Additionally, OPM notes that the most recent drug trend reported by FEHB carriers showed a significantly slower rate of growth compared with previous years, in line with industry trends.

    This statement continues to warm the FEHBlog’s heart.

    Happy International Women’s Day

    David Ermer–CDC, FDA, Federal employment benefits, Medicare, Mental health care, No Surprises Act, OPM, Rx coverage, SDOH, U.S. Healthcare–
    Photo by Hannah Busing on Unsplash

    The Wall Street Journal reports

    American women are staging a return to the workforce that is helping propel the economy in the face of high inflation and rising interest rates.

    Women have gained more jobs than men for four straight months, including in January’s hiring surge, pushing them to hold more than 49.8% of all nonfarm jobs. Female workers last edged higher than men on U.S. payrolls in late 2019, before the pandemic sent nearly 12 million women out of jobs, compared with 10 million men. 

    The Society for Human Resource Management offers five ways employers can reduce gender disparities at work.

    Following up on recent posts —

    • The Wall Street Journal brings us up to date on Lilly’s decision to offer its insulin products on the commercial market with a $35 copayment.
      • “Lilly comes out the winner of this saga, for now. It dealt PBMs a blow, avoided paying Medicaid rebates that were going to rise next year if its insulin products remained highly-priced, and received plaudits from President Biden. The move also complicates matters for upstarts such as Civica. But Allan Coukell, Civica’s senior vice president of public policy, says plans to introduce low-cost insulin as soon as next year are unchanged.”
    • Bloomberg offers an article on biological age testing that mentions Elysium Health, whose CEO spoke at the WSJ Health Forum on Monday.
    • Beckers Hospital Review tells us that the Amoxicillin shortage is continuing. Because Amoxicillin is one of several drug shortages, Pharma News Intelligence offers short-term and long-term management strategies to deal with them.
    • STAT News reports
      • Last week, the Food and Drug Administration issued an emergency authorization for the first at-home Covid-19 and flu combination test. The news came just days after the test’s maker, Lucira, filed for bankruptcy, blaming the FDA’s “protracted” approval process for its financial problems.
      • “Now the FDA has released a rare comment clarifying what happened during its authorization process. The new details are raising hopes among other home-test manufacturers that the FDA is becoming more flexible about its requirements for approving at-home flu test kits.”
    • Beckers Payer Issues informs us,” Providers join payers in urging CMS to halt proposed 2024 Medicare Advantage rates.” Good news for AHIP. Healthcare Dive reviews insurer and trade association comments to CMS on this topic.
    • The Wall Street Journal highlights the growing backlog of No Surprises Act arbitrations. The silver lining in this cloud is that the litigation-related backup does not impact the law’s Open Negotiation Process. Providers and payers should work to resolve qualifying payment disputes through that effective process.

    In other news

    • JAMA points out a recent CDC report documenting disparities in mental health-related emergency department care.
    • The Drug Channels blog lists the 15 largest U.S. pharmacies. (Trigger warning the link is principally a sales pitch for Drug Channels, but the information is useful.)
    • MedTech Dive informs us
      • “Abbott received U.S. Food and Drug Administration clearance for what it said will be the first commercially available laboratory blood test to help evaluate traumatic brain injury (TBI), also known as concussion.
      • “The test offers a result in 18 minutes, allowing clinicians to quickly assess patients with concussion and triage them, the company said Tuesday. A negative test result can rule out the need for a CT scan, eliminating wait time at the hospital.
      • “The test runs on Abbott’s Alinity i laboratory instrument, making it widely available to U.S. hospitals, the Chicago area-based company said.”
    • NPR discusses efforts to right various healthcare debt collection wrongs:
      • “Dozens of advocates for patients and consumers, citing widespread harm caused by medical debt, are pushing the Biden administration to take more aggressive steps to protect Americans from medical bills and debt collectors.
      • “In letters to the IRS and the Consumer Financial Protection Bureau, the groups call for new federal rules that, among other things, would prohibit debt for medically necessary care from appearing on consumer credit reports.
      • “Advocates also want the federal government to bar nonprofit hospitals from selling patient debt or denying medical care to people with past-due bills, practices that remain widespread across the U.S., KHN found.
      • “And the groups are pressing the IRS to crack down on nonprofit hospital systems that withhold financial assistance from low-income patients or make getting aid cumbersome, another common obstacle KHN documented.”

    FEHBlog message to Congress

    • FEDWeek reports
      • The House Oversight and Accountability Committee has started an investigation into the role of “pharmacy benefit managers” (PBMs), which act as a middleman between insurance carriers and pharmaceutical companies in healthcare programs, including the FEHB.
      • “Greater transparency in the PBM industry is vital to determine the impact PBM tactics are having on patients and the pharmaceutical market,” chairman Rep. James Comer, R-Ky., wrote to OPM. He asked for copies of the PBM contracts in the program and information on how they are carried out, as well as for information on the rebates, fees, or other similar charges received by PBMs and any efforts the agency has made to recoup overpayments to them.”
      • “The use of pharmacy benefit managers has been a long-running issue in the FEHB, with prior proposals—mainly sponsored by Democrats, unsuccessfully—to limit their role or even have OPM negotiate with pharmaceutical companies directly on a program-wide basis.
      • “The inspector general’s office at OPM also has raised that issue, in a recent report saying that “the discounts and other financial terms differed significantly among carriers, with those that have higher enrollments receiving the best deals, reducing the likelihood that the FEHB is maximizing prescription drug savings.” 
      • “That report recommended that OPM conduct a study on options to hold down prescription drug costs, which account for a quarter of all spending in the FEHB. OPM agreed in principle, although it said it does not have the needed funds to conduct such a study.”
    • OPM should inform Rep. Comer that
      • The FEHB Program’s experience-rated carriers, who cover 80% of the FEHB enrollment, are subject to the country’s strictest PBM price transparency arrangement, as far as the FEHBlog knows. Congress should evaluate that system to help the legislative body decide whether transparency should be expanded to ERISA and ACA marketplace plans.
      • In the late 2010s, OPM announced in a management report that the agency agreed with carriers that the FEHB Program saves money by allowing carriers to manage medical and pharmacy benefits under OPM’s oversight. FEHB plan carrier HealthPartners offers a useful examination of carve-in vs. carve-out Rx program management topics.
      • OPM has authorized FEHB carriers to offer prescription drug plans integrated with Medicare Part D beginning in 2024. This change will rapidly reduce the FEHB Program’s prescription drug spend to commercial plan levels. It’s not magic.
      • In sum, the FEHB Program remains a model employer-sponsored health program.

    Tuesday’s Tidbits

    David Ermer–Congress, FDA, Mental health care, NIH, No Surprises Act, OPM, Rx coverage, U.S. Healthcare–
    Photo by Patrick Fore on Unsplash

    From our Nation’s Capital, Roll Call fills us in on the debt ceiling negotiations. Significantly,

    ​Economists at Moody’s Analytics estimate that the Treasury Department will run out of borrowing room by mid-August if Congress doesn’t act to raise or suspend the statutory debt limit by then.

    The “x date” after which Treasury may not be able to pay all of the federal government’s bills appears to be Aug. 18, specifically, according to Moody’s economists Mark Zandi, Christian deRitis and Bernard Yaros. 

    The trio laid out various scenarios and potential consequences of failure to lift the $31.4 trillion debt ceiling in a new paper this week, on a topic that was examined more closely Tuesday afternoon in a Senate Banking subcommittee hearing led by Sen. Elizabeth Warren, D-Mass. Zandi is among those slated to testify.

    The propspect of a mid-August explosion may encourage Congress to suspend the debt ceiling suspension until the end of the federal fiscal year, September 30, and focus on negotiating the interrelated 2024 appropriations and the debt ceiling topics.

    The President provided highlights of the Medicare proposals in his 2024 fiscal year budget. The American Hospital Association explains

    The president’s fiscal year 2024 budget will propose policies to keep Medicare’s Hospital Insurance Trust Fund solvent for at least an additional 25 years by directing additional Medicare taxes and savings from prescription drug reforms to the HI Trust Fund, the White House announced today. According to the latest annual report by the Medicare Trustees, the fund currently has sufficient funds to pay full benefits until 2028. 

    Among other Medicare provisions, the president’s budget will propose to eliminate cost-sharing for three behavioral health visits per year; require parity between physical health and mental health coverage; lower out-of-pocket costs for drugs subject to price negotiation; and cap Part D cost-sharing for certain generic drugs, the White House said.

    The president’s FY 2024 budget is expected to be publicly released on March 9, with additional detail on March 13. AHA members will receive additional information on the president’s budget as those details are released.

    Congress shared the budget with the Congressional Budget Office to analyze whether this plan will work.

    Federal News Network reports on a recent GAO report about OPM.

    The Office of Personnel Management is at “significant risk” of being unable to help agencies address governmentwide skills gaps, if it can’t first do a better job of addressing its internal skills gaps, GAO said in a report published last week.

    Persistent internal skills gaps “could compromise OPM’s ability to implement its strategic objectives related to closing governmentwide skills gaps,” GAO said in the Feb. 27 report.

    Although OPM has made progress in some areas of workforce management, such as creating an internal committee to hire and train new staff members, the agency is struggling to clearly identify and address several skills gaps within its own staff. * * *

    Ron Sanders, former chairman of the Federal Salary Council and former associate director for HR policy at OPM, said the results of the GAO report were “unsurprising,” but that the reason behind the challenges may be difficult to measure.

    “I think the skills gaps and have more to do with intangibles than they do with specific functional specializations,” Sanders, current president and CEO of Publica Virtu LLC, said in an interview with Federal News Network. 

    Hang in there, OPM, which has a lot on its plate, as we all do.

    Healthcare Dive tells us

    • The Federal Trade Commission will give the public an additional 30 days to comment on a sweeping proposal to ban employers from imposing noncompete contracts on their workers. 
    • The agency said interested parties have requested an extension, though acknowledged others oppose the delay. The public now has until April 19 to comment on the proposed rule, the FTC said on Monday.  
    • FTC Commissioner Christine Wilson said in a separate statement that she would have supported an even longer extension since the proposal is “a departure from hundreds of years of precedent.” 

    MedCity News writes about the state of No Surprises Act rulemaking. Of note,

    What the industry really needs from the government agencies at this point is a road map, or, as the Workgroup for Electronic Data and Interchange (WEDI) said in a recent letter to the secretary of HHS, a “glide path” that explains how the industry and the government will develop standards and operating rules together. In the letter, WEDI asked for the government’s expectations on vetting and testing standards and an estimate on timelines for implementing NSA regulations.

    The FEHBlog heartily agrees with WEDI. Congress should consider amending certain provisions, particularly the good faith estimate and advance explanation of benefit provisions which should be amendments to the HIPAA electronic transaction standards and narrowed in scope.

    From the Food and Drug Administration front —

    • STAT News provides an interview with Food and Drug Commissioner Dr. Robert Califf. For example

    FDA Commissioner Robert Califf said on Monday that it “bothers” him that Novo Nordisk, which makes an obesity medication, funded the development of obesity coursework for medical schools. But he also said he saw it as an example of a drug company filling the void left by health systems that aren’t teaching doctors and trainees how to use new medicines.

    “I think it’s a shame that you would need to depend on a pharmaceutical company for an educational program about something that’s affecting half of Americans,” Califf said during a meeting with STAT reporters and editors.

    But, he said, “we also live in a practical real world. You might argue that if health systems did their jobs, you would have no need for educational programs from drug companies. But talk to people who practice medicine who are part of these big health systems and ask them how much help they get and guidance on what to do from the health systems they work for. I say this being a card-carrying lover of academic health systems, but that’s not where the money goes in academic health systems.”

    • Beckers Hospital Review informs us,

    The FDA is set to decide whether to fully approve Leqembi, Eisai and Biogen’s Alzheimer’s treatment by July 6, CNBC reported March 6.

    Leqembi is an antibody treatment that targets brain plaque associated with Alzheimer’s. The drug is administered intravenously twice a month and in clinical trials has shown it can slow early Alzheimer’s disease by 27 percent; however, the deaths of three trial participants may be tied to brain swelling caused by the drug.

    The FDA approved the drug on an expedited basis in January, but CMS has made it accessible to patients only in clinical trials. CMS plans to provide broader coverage if Leqembi is fully approved, according to CNBC.

    Covis Pharma Group said it will stop selling its drug to prevent preterm births, after a study couldn’t confirm the medicine worked and U.S. health regulators were taking steps that could have it pulled.

    Makena was the only drug approved by the Food and Drug Administration to reduce the risk of preterm birth in women with a history of early deliveries.

    Covis said Tuesday it wants to work with the FDA to set a wind-down period for the drug so that patients aren’t abruptly taken off of it. The company said it was acting after experts advising the agency recommended it pursue Makena’s withdrawal from the market.

    Eli Lilly and Company (NYSE: LLY) today [March 3] announced that the U.S. Food and Drug Administration (FDA) approved an expanded indication for Verzenio® (abemaciclib), in combination with endocrine therapy (ET), for the adjuvant treatment of adult patients with hormone receptor-positive (HR+), human epidermal growth factor receptor 2-negative (HER2-), node-positive, early breast cancer (EBC) at a high risk of recurrence. High risk patients eligible for Verzenio can now be identified solely based on nodal status, tumor size, and tumor grade (4+ positive nodes, or 1-3 positive nodes and at least one of the following: tumors that are ≥5 cm or Grade 3).1 This expanded adjuvant indication removes the Ki-67 score requirement for patient selection.

    From the U.S. Healthcare business front —

    • Beckers Hospital Review tells us,
      • “The first hospitals seeking CMS’ new rural emergency hospital designation have submitted their applications, Kaiser Health News reported March 6. 
      • “Hospitals that convert receive a 5 percent increase in Medicare payments as well an average annual facility fee payment of about $3.2 million, according to the report. In return, the hospitals must close their inpatient beds and focus solely on outpatient and emergency care.”
    • Healthcare Dive informs us
      • “Regional health system Atrium Health [headquartered in Charlotte, NC] is partnering with tech retailer Best Buy to co-design hospital-at-home programming, bolster Atrium’s existing hospital-at-home program and sell to other hospital clients down the line.
      • The partnership, announced Tuesday, aims to combine Atrium’s hospital-at-home program and existing telemedicine infrastructure with Best Buy Health, the retailer’s healthcare vertical that includes care-at-home business Current Health, along with its home installation and supply chain capabilities.
      • “The Atrium and Best Buy partnership seeks to improve some aspects of hospital-at-home programs that can be particularly tricky for operators, like patient education and technology installation in the home.
    • Beckers Hospital Review tells us, “Mark Cuban Cost Plus Drug Co. has entered into an agreement with IBSA Pharma to sell Tirosint, a medication for hypothyroidism. It will be the first brand-name drug offered by Mr. Cuban’s pharmacy.”

    From the medical and pharmaceutical research and studies front —

    • The Wall Street Journal relates
      • “Some doctors are urging patients to cut back their consumption of sugar substitutes as questions mount about their health effects. 
      • “In the latest study, published February in the journal Nature Medicine, Cleveland Clinic researchers found that the commonly used zero-calorie sweetener erythritol was associated with an increased risk of heart attacks, strokes and death within three years.
      • “Erythritol, a sugar alcohol produced naturally in the body, is used as a sugar substitute in low-calorie and low-carb products, often in those marketed as keto-friendly, such as ice cream, baked goods and condiments. It is also often mixed with other sweeteners. 
      • “As low-carb and ketogenic diets have grown popular, people have turned to nonsugar-sweetened products for a hit of sweetness with less sugar and carbs. Yet, researchers are warning that sugar substitutes might pose their own health concerns.”
    • Medscape considers whether Vitamin D is a viable prevention strategy for dementia.
    • The NIH Director’s Blog discusses the importance of dental/oral health care to overall health and well-being.
    • Securian Financial announced
      • “Fully 73% of Generation Z employees and 74% of Millennial employees have utilized mental health benefits offered by their employers, while 58% of Generation X employees and 49% of Baby Boomer employees have used the benefits.
      • Additionally, while 65% of Generation Z and 60% of Millennial workers say it’s “very important” for their employers to provide mental wellness benefits, just 49% of Generation X and 45% of Baby Boomer workers say the same.”
    • BioPharma Dive points out
      • “An experimental medicine for a rare blood vessel disorder [pulmonary arterial hypertension, or PAH, which is caused by a thickening of the blood vessels around the lungs] improved patients’ exercise capacity and potentially slowed the disease’s progression, according to detailed results from a late-stage clinical trial that were revealed on Monday.
      • “The drug, called sotatercept and owned by Merck & Co., was the principal prize of an $11.5 billion acquisition the pharmaceutical company negotiated more than a year ago.
      • “Data from the trial were presented at a medical conference and published in The New England Journal of Medicine. They have been highly anticipated since October when Merck said the study, dubbed STELLAR, was a success.”
    • The National Institutes of Health (NIH) announced
      • “Researchers at the National Institutes of Health show the benefits of screening adult patients in remission from acute myeloid leukemia (AML) for the residual disease before receiving a bone marrow transplant. The findings, published in JAMA(link is external), support ongoing research aimed at developing precision medicine and personalized post-transplant care for these patients.
      • About 20,000 adults in the United States are diagnosed each year with AML, a deadly blood cancer, and about one in three live past five years. A bone marrow transplant, which replaces unhealthy blood-forming cells with healthy cells from a donor, often improves these chances. However, research has shown that lingering traces of leukemia can make a transplant less effective. 
      • “Researchers in the current study wanted to show that screening patients in remission for evidence of low levels of leukemia using standardized genetic testing could better predict their three-year risks for relapse and survival. To do that, they used ultra-deep DNA sequencing technology to screen blood samples from 1,075 adults in remission from AML. All were preparing to have a bone marrow transplant. The study samples were provided through donations to the Center for International Blood and Marrow Transplant Research.

    Monday Roundup

    David Ermer–Rx coverage, U.S. Healthcare–
    Photo by Sven Read on Unsplash

    As a loyal Wall Street Journal subscriber, I was invited to attend the Wall Street Journal’s Health Forum today gratis. I did so virtually.

    Journal reports interviewed health experts, such as Chelsea Clinton and Food and Drug Commissioner Dr. Robert Califf, as well as the chief executive officers of Moderna, Biogen, One Medical, and Mass General Brigham, among others

    One session concerned aging. A reporter interviewed three experts, who argued among themselves. Death and taxes, right?

    The FEHBlog enjoyed the opportunity to listen to the Health Forum. He continues to think that FEHBP plans who don’t try to connect their members with in-network primary care providers are missing the boat.

    Also, from the public health front, the Washington Post reports

    Diabetes and obesity are rising among young adults in the United States, an alarming development that puts them at higher risk for heart disease, according to a study of 13,000 people between 20 and 44 years old.

    The authors of the study, published Sunday in a major medical journal, warn the trends could have major public health implications: a rising generation dying prematurely of heart attacks, strokes and other complications. And Black and Hispanic people, particularly Mexican Americans, would bear the brunt.

    “We’re witnessing a smoldering public health crisis,” Rishi K. Wadhera, assistant professor of medicine at Harvard Medical School and one of the study authors, wrote in an email.

    The Wall Street Journal adds

    WW International Inc., known as WeightWatchers, is buying digital health company Sequence, marking the diet company’s move into the hot market for diabetes and obesity drugs including Ozempic and Wegovy.

    Sequence is a subscription service that offers telehealth visits with doctors who can prescribe the drugs. WeightWatchers, which has long promised to help customers lose weight through food-tracking and lifestyle changes, is moving to also offer customers a medical weight-loss approach. 

    STAT News notes

    The obesity revolution is just getting started. Long framed as a failure of willpower and the price of poor lifestyle decisions, obesity is now more often viewed as a biological disease — one that new drugs can treat. But as people clamor for Ozempic and Mounjaro, conceived to treat diabetes, concern is rising that in the rush to prescribe them, the root causes of obesity may be overlooked, including environmental factors. And eating-disorder experts worry people’s body images could be further stigmatized.

    This is a moment reminiscent of other pharma turning points, such as when Valium and Prozac changed how people perceived anxiety and depression. But both the social media buzz and pharma’s marketing — including attempts to shape medical school curricula, STAT has learned — raise fears that treating obesity could be taken too far, draining health care dollars along the way. Read more from STAT’s Elaine Chen and Matthew Herper in the first of a series. 

    and

    Lilly decided to reduce its insulin prices to avoid Inflation Reduction Act penalties.

    Eli Lilly would’ve had to pay Medicaid about $150 for each vial of insulin used in the program if it hadn’t dramatically cut the list prices for some of its older products this week.

    The company was about to run into a Medicaid penalty for hiking the price of its drugs faster than the rate of inflation. Now that it plans to lower the list price of the insulin Humalog 70%, it won’t trigger that penalty. Lilly also is lowering the price of Lispro, a biosimilar of Humalog, to $25 a vial.

    In other Rx coverage news, USA Today tells us

    More than a quarter of Americans over 40 take medications to lower their cholesterol, most of them statins. But not everyone can tolerate statins or wants to. 

    Now a new study confirms that bempedoic acid, approved in 2020, not only lowers cholesterol but also reduces the risk for heart attack and stroke.

    Statins will remain the first therapy patients are given to lower cholesterol. But the news means more people will likely be prescribed a once-daily pill of bempedoic acid.

    Bempedoic acid is sold under the brand name Nexletol from Esperion Therapeutics of Ann Arbor, Michigan. It is sold with another drug, ezetimibe as Nexlizet.

    From the U.S. healthcare business front, Healthcare Dive informs us

    • Transcarent, a healthcare platform for self-insured employers, has agreed to acquire the majority of on-demand virtual care platform 98point6, including its almost 100-clinician physician group, in a deal worth up to $100 million.
    • Transcarent will get 98point6’s self-insured employer business, affiliated physician group and a software license, while the remaining 98point6 will rebrand as 98point6 Technologies and focus on licensing its software to third-party providers.
    • Seattle-based 98point6 bills itself as an artificial intelligence-enabled chatbot that collects patient information and summarizes it for a physician, who continues the conversation. The transaction is expected to close by the end of March.

    Weekend update

    David Ermer–Congress, HSA, Rx coverage–
    Bluebonnets — The Texas State Flower– already starting to bloom in Austin

    From Capitol Hill, the House of Representatives and the Senate will be in session for Committee business and floor voting this week.

    From the public health front —

    • McKinsey & Co. offers “insights to discover why it’s impossible to experience good health alone, and what shifts you can make now to strengthen your social world” in order to combat loneliness.
    • Fortune Well discusses “[a] ‘super strain’ of an antibiotic-resistant stomach bug [XBR Shingella] that is on the rise in the U.S.” Fortunately, the CDC offers ways to prevent a Shingella infection:
      • Carefully washing your hands with soap and water before sexual activity, eating or preparing food, and after going to the bathroom, changing a diaper, or cleaning up after someone who went to the bathroom;
      • Throwing away diapers in a covered, lined garbage can;
      • Cleaning up mess from diapers thoroughly and promptly;
      • Avoid swallowing water from lakes, ponds, and swimming pools and
      • Refraining from sex when you have diarrhea, and for two weeks after diarrhea resolves.

    From the Rx coverage front —

    • The Wall Street Journal reports
      • The way doctors treat diabetes is changing.
      • For years, people with Type 2 diabetes who needed to take drugs to lower their blood-sugar levels started with an old medicine called metformin. New guidelines now recommend patients can start with one of the newer diabetes medicines, which can also reduce weight and protect the heart and kidney.
      • These newer diabetes drugs belong to two classes known by the acronyms SGLT-2 and GLP-1 for how they work.
      • The goal of the changes was to make treatment more specific to the patient rather than focused on the drug, said Dr. Nuha Ali El Sayed, an endocrinologist at the Joslin Diabetes Center in Boston who is vice president of healthcare improvement at the American Diabetes Association.
    • MedPage Today offers doctors ways to handle the current Adderall shortage.

    From the worldwide healthcare front (and many FEHB plans (particularly nationwide plans) offer worldwide coverage), Beckers Hospital Review discusses  “Newsweek‘s 2023 list of top 250 global hospitals.”

    From the plan design front, Financial Advisor points out an EBRI report on health savings accounts.

    The New York Times Morning Column considers a renewed interest in workplace personality tests.

    “Covid has opened our eyes to the fact that there are different ways in which we can work,” said David Noel, a human resources executive at Scotiabank, a Toronto-based bank with 90,000 employees. Partly for that reason, Scotiabank has begun to put more weight on personality tests, and less weight on résumés, when it makes hiring decisions.

    In the post-pandemic era, personality tests seem to have a new relevance. They can help determine who will thrive in which work arrangements and what personality mix can maximize a team’s chance of success. Some advocates of the tests argue that they can also increase the diversity of a company’s work force by reducing the focus on standards that have traditionally benefited white men. Since Scotiabank began using personality tests more heavily in its campus hiring program, the share of its new employees who are Black has risen to 6 percent, from 1 percent.

    Cybersecurity Saturday

    David Ermer–Cybersecurity–

    From the cybersecurity policy front —

    The Wall Street Journal reports

    The Biden administration said it would pursue laws to establish liability for software companies that sell technology that lacks cybersecurity protections, concluding that market forces alone aren’t sufficient to guard consumers and the nation.

    Free markets and a reliance on voluntary security frameworks have imposed “inadequate costs” on companies that offer insecure products or services, according to a national cybersecurity strategy released Thursday. It says the administration would work with Congress and the private sector to create liability for software vendors, sketching out in broad terms what such legislation should entail. * * *

    In addition to making a forceful call for expanded liability, the plan reiterates several top priorities that have frequently been listed by various senior cybersecurity officials in recent years, such as urging more collaboration and threat-intelligence sharing with the private sector, forging international partnerships to develop cyber norms, and modernizing federal technology. While much of it is consistent with the goals of past administrations, the focus on liability and mandates on critical infrastructure largely depart from President Biden’s predecessors.

    The strategy also emphasizes the need for persistent use of offensive cyber capabilities, such as those housed at the U.S. Cyber Command, to disrupt and dismantle cyber threats to the U.S. The strategy’s language effectively endorses steps taken during the Trump administration to allow the military to be more active with offensive cyber weapons. Mr. Biden’s strategy replaces one issued by former President Donald Trump in 2018.

    Security experts and former officials said establishing liability for software manufacturers was the most significant—if hardest to achieve—element of the strategy.

    Security Week offers insider observations on the new strategy.

    Here are links to the White House’s fact sheet and an informative report from Health IT Security.

    The document is divided into five pillars, representing key focus areas: defend critical infrastructure, disrupt and dismantle threat actors, shape market forces to drive security and resilience, invest in a resilient future, and forge international partnerships to pursue shared goals.

    Each pillar has significant implications for critical infrastructure entities, including those in the healthcare sector. Namely, the National Cybersecurity Strategy highlights the need to further prioritize Internet of Things (IoT) device security and to transfer some cyber responsibilities away from software users and onto vendors.

    “We must make fundamental changes to the underlying dynamics of the digital ecosystem, shifting the advantage to its defenders and perpetually frustrating the forces that would threaten it,” the document states.

    “Our goal is a defensible, resilient digital ecosystem where it is costlier to attack systems than defend them, where sensitive or private information is secure and protected, and where neither incidents nor errors cascade into catastrophic, systemic consequences.”

    Cybersecurity Dive discusses the path to implementing this strategy.

    From the cyber breaches front, Security Week points out four recent healthcare sector data breaches.

    From the cyber vulnerabilities front —

    Cybersecurity Dive informs us

    • Nearly one-third of companies lost money following a phishing attack in 2022, Proofpoint research found. 
    • The 76% year-over-year increase in phishing attacks resulting in a wire transfer or invoice fraud reflects threat actors’ resolve to narrow their scope and steal money more quickly, according to Proofpoint’s annual State of the Phish report released Tuesday.
    • “We saw a significant jump in the direct financial loss,” said Sara Pan, team manager of product marketing at Proofpoint. “What that really implies is that we’re seeing attackers being more impatient and really wanting to claim their trophy right after a successful phishing attack.”
    • The Cybersecurity and Infrastructure Agency (CISA) added one more known exploited vulnerability to its catalog.

    From the ransomware front —

    • Bank Info Security reports on an FBI report on ransomware attacks against critical infrastructure in 2022.
    • Bank Info Security adds,
      • Based on known ransomware attacks, security researchers say the volume of such attacks seems to have remained constant in recent years. Ransomware incident response firm Coveware and cryptocurrency intelligence firm Chainalysis last month reported that blockchain analysis revealed a notable decline of 40% in the dollar volume of ransom being paid to criminals.
      • Coveware ascribed the decline directly to the FBI, which has “subtly but effectively shifted strategy from pursuing just arrests to putting a focus on helping victims, and imposing costs to the economic levers that make cybercrime so profitable.” Making a particular impact, Coveware says, is FBI agents quickly landing on-site to assist, including by helping senior executives and boards of directors understand their options.
    • The FBI and CISA issued an alert on Royal Ransomware.
      • Today [March 2, 2023], the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) released joint Cybersecurity Advisory (CSA) #StopRansomware: Royal Ransomware to provide network defenders tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with Royal ransomware variants. FBI investigations identified these TTPs and IOCs as recently as January 2023.
      • Royal ransomware attacks have spread across numerous critical infrastructure sectors including, but not limited to, manufacturing, communications, healthcare and public healthcare (HPH), and education.
      • CISA encourages network defenders to review the CSA and to apply the included mitigations. See StopRansomware.gov for additional guidance on ransomware protection, detection, and response.
    • The Bleeping Computer’s Week in Ransomware is back!

    From the cyber defense front —

    CISA announced

    Today [February 28, 2023], CISA released a Cybersecurity Advisory, CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks. This advisory describes a red team assessment of a large critical infrastructure organization with a mature cyber posture. CISA is releasing this Cybersecurity Advisory (CSA) detailing the red team’s tactics, techniques, and procedures (TTPs) and key findings to provide network defenders proactive steps to reduce the threat of similar activity from malicious cyber actors. 
      
    As detailed in the advisory, the CISA red team obtained persistent access to the organization’s network, moved laterally across multiple geographically separated sites, and gained access to systems adjacent to the organization’s sensitive business systems. This cybersecurity advisory highlights the importance of early detection and continual monitoring of cyber assets.  
      
    CISA encourages critical infrastructure organizations to apply the recommendations in the Mitigations section of this CSA to ensure security processes and procedures are up to date, effective, and enable timely detection and early mitigation of malicious activity.

    Cybersecurity Dive observes

    • The Cybersecurity and Infrastructure Security Agency is urging critical infrastructure providers to harden their defenses and enable phishing resistant multifactor authentication, after conducting a red team assessment of a large organization over a three-month period in 2022.
    • During the voluntary assessment, a CISA red team was able to gain access to workstations at separate geographic locations using spearphishing emails. The red team leveraged that access to move laterally around the network, gaining root access to multiple workstations adjacent to specialized servers. 
    • The organization largely failed to detect multiple actions by the red team, including lateral movement, persistence and command and control activity. However, the use of strong service account passwords and MFA prevented the red team from accessing a sensitive business system.

    The American Hospital Association adds,

    “This highly detailed and technical report is an excellent guide to help implement specific cybersecurity tools that will help detect a cyberattack in the early stages and significantly reduce its spread and impact,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “The ‘red team’ or penetration test used a common combination of voice and email social engineering techniques to gain trust of the end users and compromise their credentials, which reaffirms government and AHA cybersecurity guidance that relatively low-cost basics such as establishing phishing-resistant multi-factor authentication are essential to reduce cyber risk. I would strongly encourage hospitals and health systems to explore the possibility of leveraging CISA’s authority and capacity to provide free technical assistance, including red team penetration testing.” 

    Also, an ISACA expert explains why “LastPass Hack Highlights Importance of Applicable Acceptable Use Policies.”