Weekend Update

Agentic & Generative AI

Weekend Update

David Ermer–Agentic & Generative AI, CMS, Congress, Federal employment benefits, Medicare, OPM, U.S. Healthcare–

“Simplicity is a great virtue but it requires hard work to achieve it and education to appreciate it. And to make matters worse: complexity sells better.”
– Edsger W. Dijkstra

From Washington, DC

  • Roll Call discusses what is likely to happen on Capitol Hill this week.
  • The Federal Benefits Open Season begins at noon (ET) tomorrow. OPM adds,
    • “The Federal Benefits Open Season ends at 11:59 pm Eastern Time on Monday December 14, 2026 for the Federal Employees Dental and Vision Insurance Program (FEDVIP) and the Federal Flexible Spending Account Program (FSAFEDS). Open Season for the Federal Employees Health Benefits Program (FEHB) and Postal Service Health Benefits Program (PSHB) ends at 11:59 pm, per the location of your electronic enrollment system, on Monday December 14, 2026.”
  • Beckers ASC Review reports,
    • “Physician leaders warn that CMS’ 2027 Medicare physician fee schedule final rule will put more strain on independent practices and make it harder for patients to get care.
    • “The final rule, released Nov. 4, cuts the conversion factor 2.31% to $32.63 for physicians who aren’t qualifying participants in an advanced alternative payment model. CMS had proposed a 1.68% cut in July. Much of the drop comes from the expiration of a temporary 2.5% payment increase for 2026. The rule also finalizes a 20% payment reduction for certain evaluation and management services billed with modifier 25 on the same day as a zero-day global procedure.”
  • Contemporary OB/GYN tells us,
    • “The Centers for Medicare & Medicaid Services (CMS) has included the American Medical Association’s (AMA) new obstetric billing codes in the final 2027 Medicare Physician Fee Schedule, according to a statement from Camille A. Clare, MD, MPH, CPE, FACOG, president, American College of Obstetricians and Gynecologists.1 
    • “ACOG is deeply grateful to CMS for including AMA’s new obstetric codes in the final 2027 Medicare Physician Fee Schedule, and we look forward to ushering in a new system that will contribute to improved maternal health outcomes,” Clare said in part. “This change follows years of ACOG advocacy and will address several challenges related to the current method of billing for prenatal care services.” 
  • The FEHBlog guessed last Sunday that CMS would announce the Medicare Part B and D premiums after the national election day on November 3. We are now three business days past election pay with no announcement. Perhaps the announcement will be made this week.

From the public health and medical / Rx research front,

  • The New York Times reports,
    • Nutrient deficiencies are rare in the United States, thanks in part to advances in food fortification in the 1900s. But many people, especially those in certain high-risk groups, are still not meeting daily recommendations for some nutrients, said Teresa Fung, a nutrition professor at Simmons University in Boston.
    • Nutrient inadequacies typically don’t cause the obvious symptoms that severe nutrient deficiencies do, Dr. Fung said. But they sometimes cause more vague symptoms that can affect quality of life and increase the risk of certain health conditions.
    • [The article identifies] “five, commonly under-consumed nutrients in the United States, according to experts — and the signs you may be falling short.”
  • and
    • “Cardiologists have been on edge for months, waiting for the details surrounding recent reports of the stunning failures of two new heart drugs.
    • The drugs — pelacarsen and ziltivekimab — were widely expected to usher in a new era in preventing heart disease. Companies, betting on the drugs’ promise, made huge investments in developing them.
    • So when doctors saw preliminary announcements that the drugs were not helping patients in large clinical trials, many felt blindsided, although still hopeful that there was more to the story than they knew.
    • “The whole cardiovascular community was gobsmacked,” said Dr. Karol Watson, a director of UCLA’s preventive cardiology program.”
    • Were the drugs close to succeeding, just barely missing a statistically significant benefit? Or were there at least subgroups of patients who were helped?
    • “Now the answers are in. There was not a shred of evidence that the drugs helped anyone. By every measure, they were no better than placebos.
    • “The results, Dr. Watson noted, “are about as neutral as they can be.” The full data were presented on Saturday morning at the annual meeting of the American Heart Association and in simultaneous publications in The New England Journal of Medicine.”
  • The Washington Post relates,
    • “The humble flu shot may have a hidden talent: fighting cancer.
    • “In a small clinical trial in Ohio, doctors injected an ordinary flu vaccine straight into patients’ skin tumors, hoping to fool the immune system into mistaking the cancer for an infection.
    • The ruse seemed to take. Immune cells flooded into most of the injected tumors. By the time surgeons cut the cancers out, more than a third of patients showed signs that their tumors were in retreat. In a few, no trace of cancer remained.
    • “The trial involved just 18 patients and lacked a comparison group, so the findings are far from proof that the approach works. But they hint at a possibly inexpensive, off-the-shelf way to help cancer patients and offer an alternative to cancer vaccines, a field that has lately centered on bespoke, highly expensive shots built to match the mutations in each patient’s tumor. The findings were presented last week at the Society for Immunotherapy of Cancer’s annual meeting in Phoenix.”
  • Cardiovascular Business tells us,
    • “The Society for Cardiovascular Angiography and Interventions (SCAI) released updated cardiogenic shock classifications to help clinicians better identify patients at risk, assess disease severity, and determine whether treatments are restoring adequate organ perfusion.
    • “The 2026 SCAI SHOCK Classification Expert Consensus Update, published in the Journal of the SCAI (JSCAI) in conjunction with the 2026 American Heart Association (AHA) Scientific Sessions, represents the third iteration of the classification system first introduced in 2019.[1] The framework has become widely adopted in clinical care, research and regulatory settings as a common language for communicating cardiogenic shock severity.
    • “Srihari Naidu, MD, FACC, FAHA, MSCAI, immediate-past SCAI president and director of the catheterization laboratories at Westchester Medical Center, was a co-chair of the consensus writing group. He said the update retains the familiar five-stage classification, A through E, while refining how clinicians identify patients at risk of deterioration and evaluate their response to treatment. Originally issued in 2019 and revised in 2022, this new iteration incorporates additional data from the past few years.
    • “We were happy that most of the data that had supported the shock classification and showed that really it was instrumental in improving shock care and really tracking with mortality. This is the third iteration of the shock classification, and I think people will agree that this has been a major step forward,” he said.
    • “One of the most important clarifications is the emphasis on tissue hypoperfusion rather than blood pressure alone when determining shock severity.”
  • Genetic Engineering and Biotechnology News informs us,
    • “Right now, there is no pharmaceutical treatment for obstructive sleep apnea, a condition that is estimated to affect more than one billion people globally and approximately 30 million Americans. Multiple studies (notably in 20101 and 20172) report that as many of half those prescribed continuous positive airway pressure (CPAP)—the gold standard apnea therapy—reject it outright, and between 12% and 25% of those who begin those treatments abandon CPAP within three years.
    • “The reason for such high non-compliance is that CPAP is uncomfortable and socially awkward, Joel Latham, president and CEO, Incannex Healthcare, says. His company aims to be the first to potentially market an oral pharmaceutical therapy for obstructive sleep apnea.
    • “Latham says Incannex Healthcare’s mission is “targeting indications that have limited or no treatment options available.” So, while a therapy for obstructive sleep apnea, known as IHL-42X, is its lead therapeutic, the company’s pipeline also includes therapeutics based on distinctly different therapeutic platform to treat generalized anxiety disorder and rheumatoid arthritis.”

From the U.S. healthcare business and artificial intelligence front,

  • Beckers Hospital Review reports,
    • “Hospital sales are picking up steam as various health systems under financial pressure look to trim underperforming assets, exit noncore markets and redirect capital toward strategic priorities. 
    • “Recent hospital divestitures have come from nonprofit giants carrying hundreds of millions of dollars in operating losses, for-profit operators completing full-state exits and other systems shedding community hospital portfolios they no longer consider core to their portfolios. 
    • [The article identifies] “10 large health systems that have sold or announced plans to sell hospitals this year.”
  • Healthcare Dive adds,
    • “It was a busy Thursday morning at the strip mall in White Hall, West Virginia. Once the sprawling grounds of Middletown Mall, the state’s first shopping mall before it shuttered in 2017, customers shuffled under a searing August sun between stores like Michaels, Five Below, Ace Hardware and Tractor Supply.
    • “You’d be forgiven for overlooking the catty-cornered building sandwiched between the Department of Motor Vehicles and across the two-lane road from the Italian pizzeria. 
    • “The bright red “Emergency” sign over the front entrance might get your attention though. Or the Marion County ambulances with their engines idling around back.
    • The building, containing just two hallways, is Mon Marion Neighborhood Hospital, part of a burgeoning trend of small acute care hospitals dubbed “micro-hospitals” or “neighborhood hospitals” that can hold anywhere from eight to 25 inpatient beds.
    • The micro-hospitals are popping up nationwide — from Pennsylvania to Arizona, Colorado to Texas — as lower-cost alternatives to traditional hospitals, including in semi-urban and rural areas where care access is strained.
    • “It’s been well received by the community,” said David Goldberg, the former CEO of Mon Health System, owner of Mon Marion. “Very busy, very widely accepted.”
    • “Micro-hospitals differ from freestanding emergency rooms or urgent care, two types of care sites that are offered as solutions to the rural care crisis because they have inpatient care capabilities. Though diminutive, the facilities are certified as hospitals according to federal standards set by the CMS.”
  • Fierce Healthcare relates,
    • “Omada Health saw its “strongest quarter ever” in the third quarter of 2026, CEO and co-founder Sean Duffy told investors and analysts during a Thursday evening earnings call.
    • “We delivered our highest quarterly revenue, gross margin progression, and our most profitable quarter to date,” Duffy said.
    • “The virtual chronic care provider, which went public last June, brought in $91 million in revenue—up 34% year-over-year—and reported gross margin of 76% on a GAAP basis and 78% on a non-GAAP basis, according to Duffy. Omada reported net income of $7 million in the third quarter, compared with a net loss of $3 million in Q3 2025.
    • “The company also reported adjusted EBITDA of $12 million, compared to $2 million the year prior. 
    • “It beat Wall Street analysts’ estimates for revenue, though slightly trailed behind projections for total membership.
    • “Total members reached 1.1 million, up 36% year-over-year, with trailing 12-month revenue per total member increasing 5% year-over-year to $294, according to financial results publishedThursday. Average member tenure also grew 10% compared to the year prior, to approximately two years and four months. Member retention has improved to 58%, up from 43% in Q4 of 2024, executives said.”
  • Beckers Payer Issues tells us,
    • “Aetna left the ACA market at the beginning of 2026, citing underperformance. Other insurers have also been navigating a rocky ACA landscape, marked by the expiration of enhanced premium subsidies and shifting risk-pool dynamics.
    • “CVS Health previously recorded a $448 million premium deficiency reserve in the first quarter of 2025 for its individual exchange business related to expected losses that year. During that quarter’s earnings call, former CFO Tom Cowhey had projected losses for the individual exchange business between $350 million and $400 million for full-year 2025.
    • “Aetna CFO Andreana Santangelo recently joined the Becker’s 5th Annual Fall Payer Issues Roundtable and shared more about the decision. 
    • “Very early on, you could see that we just didn’t have the right cost structure for our ACA business,” she said. 
    • “Citing her experience at a Blues plan and at Cigna, Ms. Santangelo said considerations around scale and cost structure are especially important for that business line. 
    • “While addressing how scale can be about more than sheer numbers, Ms. Santangelo said that “scale is also about having the right kind of risk pool” and attracting the right people who will find value in the product.”
  • Fierce Healthcare informs us,
    • “Equiti is acquiring Lexi AI to build a hybrid language-access model that combines AI language support with human medical interpreters. 
    • “Equiti, which sells medical interpretation services to hospitals and health systems through its Martti business, provides 24/7 access to qualified medical interpreters across more than 250 languages and dialects. Lexi provides multilingual, AI-powered medical interpretation. The acquisition deal merges Lexi’s immediate AI language support, covering over 35 languages and dialects, with Martti and its network of qualified medical interpreters to help healthcare organizations expand language access.
    • “The acquisition was announced October 28. Financial details of the deal were not disclosed.”

Cybersecurity Saturday

David Ermer–Agentic & Generative AI, Congress, Cybersecurity, HIPAA Privacy and Security Rules–

From the frontier AI front,

  • Cyberscoop reports,
    • “OpenAI announced a new cybersecurity-focused model Thursday [November 4], citing internal benchmark testing that shows improvements in vulnerability discovery, patch development and adherence to safety guardrails meant to block out-of-scope work.
    • GPT-6 Cyber will first be available to a limited number of customers in OpenAI’s Daybreak Red program, which uses more advanced or nonpublic cybersecurity models for offensive red teaming.
    • “As a preview of the model’s capabilities, OpenAI officials said GPT-6 has found at least 81 “novel” vulnerabilities in the Firefox web browser, developed exploits for 948 Linux kernel vulnerabilities and was able to develop and validate a critical remote code execution vulnerability in Brotli, a popular open-source data compression tool. All the vulnerabilities were reported to owners and patched. 
    • “OpenAI officials told reporters Wednesday that the new safeguards include additional identity and account security requirements, more frequent check-ins from the model to OpenAI when a request is made to perform high-risk behaviors, and additional monitoring for “misalignment” or rule-breaking.”
  • The Wall Street Journal asks
    • “What if the mathematical locks and keys that secure our bank accounts, email inboxes and everything else on the internet turn out to be a lot less secure than we thought? What if the password-protected internet we rely on every day collapses?
    • “Quantum computers have long threatened such an apocalypse. For decades, engineers have been preparing for their arrival—and their inevitable abuse by well-heeled bad guys.
    • The result is known as “postquantum cryptography.” According to leading mathematics experts, an orderly transition of the world’s digital systems to this new paradigm should avert an event that could otherwise send us back a century, technology-wise.
    • “But now there is a potentially more pressing issue: AI’s impressive math skills.
    • Artificial intelligence is pushing advances in various mathematics fields at an unprecedented rate, conquering problems that our puny human minds have wrestled with for centuries. The fear is that this could include new solutions to the math problems that keep our encrypted communications encrypted.”
  • Cybersecurity Hub, writing in LinkedIn, adds,
    • “The US National Institute of Standards and Technology (NIST) has published its final roadmap for transitioning to post-quantum cryptography, marking a significant step towards replacing the cryptographic technologies that underpin digital communications, authentication and data protection.
    • “NIST IR 8547, Transition to Post-Quantum Cryptography Standards, identifies the existing standards vulnerable to future quantum computers and the quantum-resistant alternatives organisations will need to adopt. The publication moves the discussion beyond algorithm selection towards the practical challenge of coordinating migration across products, services and interconnected systems.
    • “For security leaders, the significance extends beyond choosing new encryption software. The transition will require visibility into cryptographic dependencies, cooperation with suppliers and decisions about which information and systems need protection first.”
  • CISA announced,
    • “CISA, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and the National Security Agency (NSA) released joint guidance and an accompanying quick-reference list to help organizations assess vendor readiness for transitioning to post-quantum cryptography (PQC). As quantum computing advances, widely used public-key cryptography will become vulnerable to compromise from cryptographically relevant quantum computers (CRQCs). To protect their systems and data, organizations must plan for and transition to PQC—which includes algorithms capable of withstanding both classical computing and quantum-enabled threats—before CRQCs become available. 
    • “Many organizations rely on third-party vendors for managed services, cloud capabilities, and other cryptography-dependent products and services. Cryptography is also embedded in systems and devices that are difficult to update, tied to long asset lifecycles, and require vendor support or replacement—such as industrial control systems and Internet of Things (IoT) devices. Reliance on vendors means that effective PQC transition depends on vendor readiness, and early, structured engagement with these vendors is critical to planning efforts. 
    • Organizations can use the vendor-neutral questions outlined in this guidance to determine whether a vendor understands quantum-related risks, maintains transparency over its cryptographic implementations, and supports a secure, cost-effective and timely transition to PQC. 
    • “Visit CISA’s PQC Initiative page for additional resources.”
  • McKinsey and Co. advises
    • “As AI makes it easier and faster for cyberattackers to discover and exploit vulnerabilities in software, companies must change their approach to safeguarding their digital assets and infrastructure.”

From the cybersecurity policy and law enforcement front,

  • Cybersecurity Dive reports,
    • “Democrats’ big wins in the midterm elections are poised to transform cybersecurity policymaking and oversight on Capitol Hill, with potentially big implications for critical infrastructure operators and other businesses that work with the government.
    • “After Democrats take control of the Senate and the House of Representatives in January, they likely will ramp up scrutiny of the Cybersecurity and Infrastructure Security Agency (CISA), accelerate efforts to solve AI security challenges and revive cybersecurity grants for struggling local utilities, experts told Cybersecurity Dive. Republican lawmakers have largely ignored those subjects, in part to avoid angering or embarrassing President Donald Trump’s administration, but Democrats — newly energized by unexpectedly sweeping gains on Tuesday — are expected to take a far more assertive approach to cybersecurity hearings, investigations and legislation.
    • “Key figures in Congress’s new Democratic majority told Cybersecurity Dive that they viewed digital security as a top priority.”
  • and
    • “Three dozen business groups, including organizations representing critical infrastructure sectors, are pressing Congress to renew a major cybersecurity information sharing law before its expiration next month.
    • “The 2015 Cybersecurity Information Sharing Act “has become a foundational component of the nation’s cybersecurity,” the groups wrote on Sunday to the chairs and ranking members of the congressional armed-services committees.”
  • Cyberscoop adds,
    • “Republicans have talked about wanting to get the fiscal 2027 National Defense Authorization Act done in the lame duck. Besides the possibilities of CISA 2015 being included in the bill, Nicholas Leiserson, senior vice president for policy at the Institute for Security and Technology, said the Senate version of the legislation has a pair of very noteworthy cyber provisions: a “very broad” authorization for contractor-owned, contractor-operated offensive cyber operations, and a requirement that every artificial intelligence product sold to the Defense Department have an AI bill of materials.”
  • CISA announced,
    • “The Cybersecurity and Infrastructure Security Agency (CISA) kicks off Critical Infrastructure and Resilience Month today [November 2], recognizing the systems and assets that keep the country running as well as the people who operate them. This year’s Critical Infrastructure Security and Resilience Month aligns with President Trump’s National Resilience Strategy and comes as we continue to see new and evolving threats, including those driven by rapid advances in technology like super intelligence. Through it all, we rely on frontline operators who keep essential services moving even when things are disrupted.
    • “Our work depends on people who understand their systems and stay prepared,” said Acting CISA Director Nick Andersen. “Resilience comes from knowing what matters most and having a plan you can actually use when something goes wrong.”
  • Federal News Network notes,
    • “The Cybersecurity and Infrastructure Security Agency is turning to a former Department of Health and Human Services official to head up CISA’s infrastructure security division.
    • “Brian Mazanec is now serving as acting executive assistant director for infrastructure security at CISA. He was sworn in Monday, according to CISA.
    • “Mazanec previously served as deputy assistant secretary and director of the Center for Preparedness within HHS’s Administration for Strategic Preparedness and Response (ASPR). He stepped down from ASPR last week after serving there since January 2023.
    • “During his time at HHS, Mazanec helped spearhead the department’s response to significant events like the Change Healthcare ransomware attack.“
  • Cyberscoop tells us,
    • “Delaware-based defense and aerospace company has settled a case with U.S. agencies over government allegations that the firm neglected its cybersecurity obligations in its contracts.
    • ILC — the name the government uses to collectively refer to ILC Dover and ILC Astrospace — agreed to pay $13 million to resolve the False Claims Act allegations involving its contracts with the Department of the Army, Missile Defense Agency and National Aeronautics and Space Administration.
    • “ILC, according to the government, submitted false or fraudulent claims for payment on contracts with the agencies because it knew it hadn’t complied with the contracts’ cybersecurity requirements over a period between 2018 and 2024.
    • “For instance, ILC allegedly used a third-party company to store sensitive data in the cloud without proper safeguards, and didn’t develop and update mandated security plans for each of its covered information systems.
    • “The best response to cyberattacks is to prevent them from happening in the first place,” Benjamin Wallace, U.S. Attorney for the District of Delaware, said in a news release Tuesday. “The obligations that ILC violated exist to prevent bad actors from taking advantage of the United States’ technical innovation.” 

From the cybersecurity breaches and vulnerabilities front,

  • On November 3, 2026, Binance shared on LinkedIn “29 October Binance Security Incident: Initial Findings and Response Update.”
    • “This is our initial report. It covers what we know today and what we have already improved. “The investigation remains ongoing and our findings will be subject to further independent review. Some technical details will remain confidential to prevent malicious actors from using them to plan attacks. We are engaging independent security firms for further review.
    • “The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.
    • “We are sharing this initial report because security improves when the industry learns together.”
  • HIPAA Journal tells us,
    • “Data breaches have been announced by HCA Healthcare, Blossom Health, El Camino Health, and University of Mississippi Medical Center.”
  • and
    • “Cleveland-based University Hospitals is working on restoring systems after an October 22 cyberattack. Cybersecurity incidents have also been announced by EyeMed Vision Care and Facial Surgery Group.”
  • Cybersecurity Dive reports,
    • “Authorities are investigating a cyberattack targeting a refrigeration-equipment supplier for the French Blood Establishment (EFS), which oversees France’s civilian blood supply.
    • “An unknown hacker was able to manipulate temperature controls at cold storage rooms for three EFS sites, according to the agency. Temperatures and defrosting thresholds were raised to very high levels. 
    • “EFS monitoring systems and alarms detected the activity, and staff were able to regain control. The supplies were transferred to other facilities, the agency said, and the integrity of those blood supplies was not compromised.” 
  • The American Hospital Association News adds,
    • “Federal agencies Nov. 5 issued a bulletin saying that they are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally, including systems used within the healthcare sector. The agencies warned that threat actors may exploit unpatched or internet-accessible refrigeration controllers to remotely alter temperature settings, trigger extended defrost or heating cycles, cause inventory loss, create equipment hazards and disrupt temperature monitoring capabilities. The agencies are urging organizations to identify internet-exposed systems, remove unnecessary remote access, apply available patches and firmware updates, implement strong authentication controls, segment operational technology networks and review alerting and monitoring capabilities.”
  • Cybersecurity Dive relates,
    • “Hackers are using Artex and other agentic AI-based frameworks to scan public GitHub repositories for exposed credentials and API keys, according to a report Thursday from Microsoft Threat Intelligence.
    • “The credentials are then deployed in downstream attacks against targeted organizations. Starting Oct. 28, researchers found a single IP address using compromised but still-valid application credentials to sign into downstream tenants. 
    • “In one case, hackers were able to steal credentials and exfiltrate data from Azure Key Vaults and Storage Accounts, as well as abuse Azure AI services. Researchers also saw hackers using embedded shell commands in a user agent to exploit vulnerabilities as well as attempts to steal App Service authentication tokens.
    • “Microsoft researchers said the threat activity overlaps with a campaign using the same IP address, as outlined in research released Wednesday by Todyl. That report showed how hackers with stolen secrets for Entra ID signed into Microsoft 365 and Azure environments at various managed service providers.” 
       
  • Bleeping Computer informs us,
    • “Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers.
    • “Chainalysis provides blockchain analysis tools to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware, and money laundering. Its customer list includes law enforcement, government agencies, financial institutions, insurance companies, and cryptocurrency businesses worldwide.
    • “This follows the company’s disclosure last Friday that attackers using AI tools accessed customers’ names, email addresses, user IDs, and organizational role labels using what it described as “offensive agentic techniques.”
  • Computer Weekly lets us know,
    • “Two-thirds of the vulnerabilities Palo Alto Networks has uncovered using frontier artificial intelligence (AI) models had never been disclosed as Common Vulnerabilities and Exposures (CVEs), according to the security supplier’s CIO, Meerah Rajavel.
    • “Speaking to Computer Weekly on the sidelines of Singapore International Cyber Week last month, Rajavel said the sheer number of undisclosed vulnerabilities means organisations can no longer simply prioritise which known flaws to patch first.
    • “Palo Alto Networks has had an early look at what frontier AI can do. It was among the launch partners of Anthropic’s Project Glasswing, which gave a select group of organisations access to the unreleased Claude Mythos Preview model to find and fix flaws in critical software.
    • “The model’s knack for finding vulnerabilities made headlines, but that was not what surprised the company. “The thing that shocked us was how good it was in devising attack paths,” said Rajavel, referring to the model’s ability to chain vulnerabilities in novel ways.” * * *
    • Organisations cannot patch some systems at all, she said, especially those that run business-critical processes or rely on older technology that cannot take rolling updates.
    • “That makes virtual patching critical, said Rajavel, as it blocks exploit attempts at the network level until a fix is applied. She added that a good zero-trust architecture and attack surface management can help eliminate attack paths to a large part of an organisation’s infrastructure.”

From the ransomware front,

  • Spectrum News reports,
    • “A ransomware attack has disrupted services across the Queens Public Library system.
    • “The library system first reported a systemwide network outage on Wednesday, saying it was affecting its website and app, as well as checkout and return machines, renewals, on-site computers and free Wi-Fi access at all 66 branches.  
    • “As of Thursday morning, those services were still unavailable, Queens Public Library president and CEO Dennis Walcott said in a statement.
    • “All library locations are currently open as scheduled, but some virtual and in-person programs may be impacted, Queens Public Library said on social media.”
  • The Recorded Future News relates,
    • “Michigan State University officials said recent claims by a ransomware gang were tied to an incident last month that forced password resets for all student and employee accounts.  
    • “On Sunday evening [November 1], the BYOD ransomware gang added the university to its leak site — claiming to have stolen personal information on 1.3 million current and former students. Last week, BYOD caused outrage after attacking The University of New Mexico and shutting down its hospital.  
    • A spokesperson for Michigan State told Recorded Future News that the university “became aware of suspicious cyber activity and immediately began investigating the matter,” in early October.  
  • Tech Radar points out,
    • “Synology, a major network-attached storage (NAS) manufacturer, is warning users about ongoing ransomware attacks targeting devices running outdated software. It urged all users to apply provided patches and secure their devices without delay.
    • “In a brief announcement, Synology said it “identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.” The goal of the attacks seem to be data encryption and a ransom demand.
    • “Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems. Synology also recommends enabling automatic updates to keep DSM up to date at all times.” * * *
    • “The company also did not say who the threat actors are, but according to BleepingComputer, there has been a “massive wave of reports” from Synology customers whose data was apparently locked down by the “C3rb3r” encryptor. These customers were asked to pay “thousands of dollars” in ransom, in exchange for the decryption key. The publication says the first reports started surfacing more than two weeks ago.”
  • Huntress offers guidance on how to protect against ransomware before it encrypts data,
    • “Phishing is one of the most common ways in, but not the only way. Exposed remote access, unpatched internet-facing systems, and stolen credentials work just as well for attackers.
    • “Backups are crucial to your security plan. Keep at least one copy offline or isolated, and test restores before you need them.”
    • “Ransomware usually leaves footprints. Catch the behavior early, and you can stop the attack before the ransom note shows up.”

From the cybersecurity business and defenses front,

  • The New York Times reports,
    • “Anthropic Is Racing to Obtain the A.I. Boom’s Most Vital Resource
      • “The company went on a deal spree with tech giants, former crypto miners and others to gain computing power to further its artificial intelligence ambitions.”
  • Cybersecurity Dive relates,
    • “Companies are struggling to oversee their AI agents because they don’t know what those agents’ normal behavior looks like, according to a new report.
    • “Nearly half (46%) of security professionals say they’re unable to establish safe baselines for agentic AI activity, the security firm Abnormal AI said in a report published on Thursday [November 4].
    • “The report highlights security gaps in AI oversight that businesses should prioritize as they increase their AI deployments.”
  • Security explains “Frontier AI Is Changing Cyber Defense: 15 Moves CISOs Should Make Now.”
  • Dark Reading offers,
    • “9 Cyber Awareness Tips That Actually Match Today’s Maze of Threats
      • “Practical guidance on safer search, stronger login security, better executive protection, and other habits can reduce enterprise risk.
  • Security points out,
    • “Companies are getting faster at disclosing cyberattacks and slower at explaining what those attacks actually cost. Since the SEC’s cyber disclosure rule took effect, a public company has four business days to file an 8-K once it determines an incident is material, often before it knows the full scope. The filing says some version of the same thing: Systems are affected, operations are disrupted, and whether the impact will be material has not yet been determined.
    • “Increasingly, these incidents get discussed as one problem, with cybersecurity, business continuity, and enterprise resilience collapsed together, when each does something different. Cyberattacks are hitting more often and doing more damage when they land, which makes the distinction matter more. Cybersecurity focuses on detecting and stopping the attack itself. “Business continuity and enterprise resilience determine how the organization keeps operating once that happens. Detection and containment alone aren’t enough. When disruption hits, the business continuity function must be able to answer what is impacted, what happens next, what is the financial exposure, and what should be prioritized.”
  • NIST announced
    • “A new NIST guide can help solo business owners — also called “solopreneurs” — grasp the basics of cybersecurity and craft a strategy that can help reduce their cybersecurity risk.
    • “The guide is designed to help solopreneurs prioritize and implement a selection of actions from the NIST Cybersecurity Framework that would best help their businesses.
    • “The publication is written in lay language and assumes no prior cybersecurity knowledge.”
  • FEHBlog note — This guide also may improve guidance for work at home staff.
  • Here’s a link to Dark Reading’s CISO Corner

Tuesday report

David Ermer–Agentic & Generative AI, CDC, COVID-19, FDA, Medical / Rx research, Medicare, Rx coverage, U.S. Healthcare–

“Simplicity is a great virtue but it requires hard work to achieve it and education to appreciate it. And to make matters worse: complexity sells better.”
– Edsger W. Dijkstra

From Washington, DC

  • It’s a national election day. More tomorrow.
  • Beckers Payer Issues reports,
    • “Medicare beneficiaries in 193 counties across 16 states will have no Medicare Advantage prescription drug plans available for general enrollment in 2027, up from 123 counties in 2026, according to an Oct. 9 KFF analysis of CMS plan landscape data.” 
  • The American Hospital Association News relates,
    • “The Administration for Strategic Preparedness and Response announced Nov. 3 that it will partner with the Bureau of Industry and Security and the Assistant Secretary of Defense for Health Affairs on an assessment of U.S. pharmaceutical key starting materials in an effort to identify supply chain vulnerabilities and strategies to improve domestic manufacturing capabilities. The assessment would examine supply chain elements of U.S. pharmaceutical manufacturing efforts, including domestic production capacity and the country’s reliance on foreign or single sources of critical materials.”
  • Bloomberg Law tells us,
    • “A forthcoming proposed rule will expand employers’ ability to help workers pay for health insurance in the individual market, boosting the one major surviving insurance policy from President Donald Trump’s first term.
    • “Trump first created independent coverage health reimbursement arrangements in 2019, and they’ve now been rebranded as custom health option and individual care expense, or CHOICE arrangements. The policy allows employers to contribute money tax-free to pay for health expenses, including insurance premiums in the individual market.
    • “CHOICE is Trump’s least controversial insurance plan with Democrats, in part because it helps strengthen the Affordable Care Act exchanges by increasing enrollment in the individual market — even though most CHOICE plans are purchased off-exchange. Backers say small employers can offer benefits they couldn’t otherwise afford, while critics question whether employees are better off under individual market plans than traditional employer-sponsored plans.”

From the U.S. Food and Drug Administration front,

  • Beckers Hospital Review reports,
    • “Macleods Pharma USA has recalled 3,744 bottles of a combination blood pressure medication nationwide after the product failed dissolution specifications, according to an FDA enforcement report.
    • “The voluntary recall covers olmesartan medoxomil, amlodipine and hydrochlorothiazide tablets, 40 milligrams/10 milligrams/12.5 milligrams, in two lots: 3,528 30-count bottles (NDC 33342-246-07, lot 12251163A) and 216 90-count bottles (NDC 33342-246-10, lot 12251163B), both expiring May 31, 2027. The company, which notified consignees by letter, initiated the recall Oct. 7. The FDA classified it as Class II on Oct. 26, and the recall is ongoing.”
  • and
    • “The FDA has approved Novo Nordisk’s Awiqli as the first once-weekly, long-acting basal insulin for children 10 years and older with Type 2 diabetes.
    • “Awiqli (insulin icodec-abae) injection, 700 units/milliliter, was approved as an adjunct to diet and exercise to improve glycemic control, according to an Oct. 23 news release from Novo Nordisk. The treatment reduces basal insulin injection frequency from seven times per week to one.
    • “The approval was supported by evidence from studies in adults with Type 2 diabetes and a single-dose pharmacokinetic study in pediatric patients ages 10 to 17. Efficacy and safety were also demonstrated in the ONWARDS clinical trial program.
    • “Awiqli is available at more than 70,000 pharmacies nationwide.”
  • BioPharma Dive adds,
    • “Vertex, ahead of FDA decision, calms fears surrounding kidney drug
      • “On a conference call, executives expressed conviction in the coming launch of an IgA nephropathy medicine viewed by Wall Street investors as important to its future.”

From the public health and medical / Rx research front,

  • The New York Times reports,
    • “A 7-month-old, unvaccinated child in New York’s North Country died after contracting measles, the first death in the state from the viral disease in 30 years, officials announced.
    • “Gov. Kathy Hochul said on Monday that the death was a signal that public health protections were eroding as a growing number of families forgo vaccinations.
    • “The child died in Lewis County, which is northeast of Syracuse and has recorded 15 measles cases this year, according to the health authorities, who shared few details about the case. New York is in the midst of a significant measles outbreak. Amish communities, where vaccination rates tend to be lower, have been particularly hard hit.”
  • Per Beckers Hospital Review,
    • “States with heavier chronic disease burdens tend to report somewhat lower rates of skipped checkups, according to a Becker’s analysis of three new KFF datasets. Chronic conditions typically require regular physician visits, which likely keeps patients connected to routine care. 
    • “However, 14 jurisdictions break that pattern: seven with high rates on both measures and seven with low rates on both.
    • “Arkansas, Ohio, Wyoming, Oregon, Wisconsin, Montana and Oklahoma reported above-median rates of chronic disease among working-age adults in 2025 and above-median rates of adults skipping a routine checkup — a sign that preventive care may not be reaching people in states where need is high.”
  • and
    • “Patients who could not tolerate semaglutide or tirzepatide, or who lost little weight on them, lost substantial weight after bariatric surgery, according to a Cleveland Clinic study published Nov. 3 in Annals of Surgery.”
  • Cardiovascular Business relates,
    • “GLP-1 medications such as semaglutide and tirzepatide may outperform metformin in patients with prediabetes, according to new data being presented at the American Heart Association’s Scientific Sessions 2026 in Chicago. 
    • “Metformin is typically the therapy of choice for patients with prediabetes, but GLP-1 drugs appear to be better at preventing type 2 diabetes while also reducing the risk of heart attack and stroke.
    • “The great news with prediabetes is that it’s still possible to reverse the progression of the disease,” co-author Vinicius de Sousa Barzon Serra, MD, a research fellow in the department of cardiovascular medicine at the Mayo Clinic in Scottsdale, Arizona, said in a statement ahead of the conference. “This research may add to the case for considering GLP-1 medications earlier for certain patients, rather than waiting until they develop type 2 diabetes.”
    • “This study included data from more than 250,000 adult patients with prediabetes and obesity. The mean age was 52 years old, and 72% were women. Participants were followed for approximately three years. Overall, approximately half of these patients were on GLP-1 drugs such as semaglutide, tirzepatide, liraglutide or dulaglutide. The remaining patients were taking metformin.”
  • and
    • “Cannabis use is associated with a heightened risk of cardiovascular disease (CVD), according to new data being presented at the American Heart Association’s Scientific Sessions 2026 in Chicago.
    • “Researchers tracked data from more than 440,000 American adults who responded to telephone interview questions about cannabis use. These interviews were conducted as part of the Behavioral Risk Factor Surveillance System. 
    • “Overall, the group found that using cannabis one to five days per month was linked to a 23% higher odds of reporting a history of CVD. These low-frequency users also had a 40% higher odds of experiencing a stroke. Heavy cannabis users, meanwhile, were associated with a 23% higher odds of reporting a history of CVD and a 25% higher odds of experiencing a stroke.
    • “When it came to heart attack risk, on the other hand, the study’s authors did not identify any comparable trends.
    • “We were surprised to find that the link between cannabis use and cardiovascular disease was not straightforward,” study co-author Aabha Divya, MBBS, MCh, an assistant professor of cardiothoracic surgery at the Tulane University School of Medicine, said in a statement ahead of the conference. “We expected that the chances of heart disease would gradually rise as people used cannabis more often, but that wasn’t the case. Both low-use and heavy-use groups had higher odds of developing heart disease.”
  • Per a Census Bureau news release,
    • “As the U.S. population age 65 and older grew from 2008 to 2025, so did the number of older adults with a disability.
    • “But while the number of older Americans with a disability climbed 38.0% to 21.7 million, the overall share actually dipped 7.0 percentage points, from 40.5% to 33.5% during the same period, according to newly released 2025 American Community Survey (ACS) 1-year estimates.
    • “The decline was particularly pronounced among women and adults with less than a high school education.
    • “The drop in the percentage of older adults with a disability is a promising public health trend. But the increase (66.9%) in the share of the total population 65 and over presents care challenges for families, hospitals and public support programs, particularly for those with chronic health issues and disabilities.”
  • Bloomberg Law tells us,
    • “People whose long Covid affects multiple body systems are far less likely to improve than overall recovery estimates suggest, with fewer than one in five experiencing sustained improvement within three years of infection, according to a US study.
    • “Researchers followed 1,019 adults who still had probable long Covid a year after their initial infection. About half experienced sustained symptom improvement over the following three years, while roughly a quarter had complete symptom remission, the study, published Monday in Annals of Internal Medicine , found.
    • “But outcomes differed dramatically depending on the pattern of illness. About 60% of people whose long Covid was dominated by changes in smell or taste had improved by three years, compared with less than 19% of those with symptoms affecting multiple body systems.”
  • Health Day informs us,
    • “E-bike crashes involving kids are soaring — and the injuries are getting more serious, according to a new study.
    • “We’ve been seeing more and more kids on e-bikes, both on the street and in the hospital,” said co-author Dr. Stephanie Chao of the Stanford University School of Medicine.
    • “Researchers examined more than 13,000 injury cases at six children’s hospitals across the country.
    • “They found e-bike injuries jumped 33% per quarter from early 2023 through March 2026.
    • “E-scooter injuries rose 15% per quarter. In all, 8% of e-bike injuries were classified as severe — double the rate for traditional bikes.
  • and
    • “Parental autoimmune diseases were associated with a higher risk of type 1 diabetes in offspring.
    • “Risk grew substantially when either mothers or fathers had type 1 diabetes.
    • “The study did not account for disease severity, autoantibody levels, disease activity during pregnancy, or medication use.”
  • Medscape points out,
    • “A year after completing treatment for obesity, adolescents trained in regulating their emotions were significantly more likely to sustain their weight loss than peers who received standard behavioral therapy alone, according to a randomized clinical trial published in JAMA Network Open.
    • “Those who learned the add-on skills also reported significantly less emotional eating at follow-up compared with those who went through just the diet and exercise program.
    • “Emotional eating is one of the triggers for overeating and binge eating for many — over time, the goal is for teens to see food as one of many ways to feel better, but not the only one,” said Kerri Boutelle, PhD, professor of pediatrics and psychiatry at the Herbert Wertheim School of Public Health and Human Longevity Science at the University of California, San Diego, who led the study.”
  • Healio adds,
    • “A low-carbohydrate, ketogenic diet was found to have the most benefits for liver health vs. other diets.
    • “The keto diet also appeared to be most effective at improving blood sugar control.”
  • Per an Institute for Clinical and Economic Review news release,
    • “The Institute for Clinical and Economic Review (ICER) today released a Final Evidence Report assessing the comparative clinical effectiveness and value of tavapadon (JuvmoTM, AbbVie Inc.) for Parkinson’s disease.
    • “ICER’s report on this therapy was the subject of the October 2026 public meeting of the CTAF, one of ICER’s three independent evidence appraisal committees that discusses and votes on ICER’s report findings. Currently available evidence indicates that tavapadon provides some relief from key symptoms. Benefits from tavapadon appear to be similar to those of older, generic drugs, however, and discontinuation from tavapadon due to adverse events was relatively high.
    • “Downloads: Final Evidence Report | Report-at-a-Glance | Policy Recommendations 
    • “Tavapadon provides a net health benefit over no additional pharmacological treatment, but there are open questions about its benefits compare to other available symptomatic treatments,” said ICER’s Chief Scientific Officer and Director of Health Technology Assessment Methods and Engagement, Dan Ollendorf, PhD, MPH. “Unfortunately, the manufacturer chose a price for tavapadon far above any reasonable estimate of a value-based price. This may lead payers to implement formulary restrictions to limit provider and patient access to this new treatment.”

From the U.S. healthcare business front,

  • The Wall Street Journal reports,
    • “CVS Health will split into two companies, dividing its retail pharmacies from its insurance and pharmacy-benefit operations in a move that will reverse one of the signature deals defining an era of health-industry gigantism, the company said.
    • “The breakup is set to occur in the first half of 2028, a decade after the transformative nearly-$70 billion acquisition that knit together insurance giant Aetna with CVS’s namesake drugstores, its pharmacy-benefit manager Caremark and other assets. 
    • “The two resulting companies will both be publicly traded, and current CVS shareholders will own shares in both. The Financial Times earlier on Tuesday reported the breakup.
    • “One of the two new firms will keep the CVS Health name, and will be run by David Joyner, who is chief executive of today’s CVS, the company said. 
    • “In addition to the insurance and PBM assets, that company will include senior-focused clinics business Oak Street Health, the home-visit provider Signify Health, and CVS’s specialty-drug business, a key growth lever.”
  • and
    • “Pfizer boosted its guidance for the year, as momentum in new products helped it offset declining sales for its Covid-19 vaccine and treatments.
    • “The New York company said Tuesday that sales for its recently launched and acquired products—which include cancer treatments Padcev and Lorbrena—gained 32% in the latest quarter. Higher sales for other products, like blood thinner Eliquis and heart-disease treatment Vyndaqel, also boosted the company’s top line.
    • “Sales of Covid products like Paxlovid and Comirnaty, meanwhile, continued to slide.”
  • Fierce Healthcare relates,
    • “Hinge Health is seeing early traction with its migraine and gastrointestinal care programs as it pushes beyond musculoskeletal care and builds a broader, multi-condition platform.
    • “But the company’s core MSK business remains the engine fueling its robust growth. 
    • “Our vision has always been to automate the delivery of care using technology to close the gap between the care people need and the care they actually receive. We’re now applying that same approach and the same trusted relationships with employers and partners in neurology and gastrointestinal care,” Daniel Perez, Hinge Health co-founder and CEO, told analysts and investors on the third-quarter earnings call Monday. “We’re not starting from scratch in each new category. We’re extending a platform that’s already proven into conditions that are often connected to the ones we already treat. We believe that’s a fundamentally different and more powerful way to expand than what other companies in our space are attempting.”
  • and
    • “Humana and athenahealth are expanding electronic prior authorizations nationwide in a newly announced collaboration. 
    • “Through athenaPayer, Humana is able to connect with over 180,000 providers across the athenaOne network, which the partners said will create a more connected experience between the health plan and clinicians.” 
  • Beckers Clinical Leadership tells us,
    • “As AI races into exam rooms and onto patients’ phones, the physician’s role is more important than ever — not because doctors must police the technology, but because chatbots cannot replace trust, judgment and the patient-physician relationship, according to Jan Carney, MD.
    • “Dr. Carney, 2026-2027 president of the American College of Physicians, published a statement Nov. 3 about AI hype. Dr. Carney is associate dean for public health and health policy and chief of the division of public health at the University of Vermont’s medical college in Burlington, Vt.
    • “Her message follows a September MAHA summit wherein HHS Secretary Robert F. Kennedy Jr. said AI can offer “a second opinion that is much better informed than any doctor in the country” — a claim six physician organizations, including ACP, publicly refuted. Those groups said physicians must “help lead the responsible development and use of AI in medicine.”
  • Beckers Health IT adds,
    • “Health systems have spent the past few years building the case for AI one use case at a time. Less clear is what AI will do to the nation’s healthcare bill.
    • “It came up during the opening keynote at Becker’s 11th Annual IT + Revenue Cycle Conference in Chicago, where Bobbie Byrne, MD, executive vice president and CIO of Charlotte, N.C.-based Advocate Health, gave an answer that rarely shows up in an AI vendor’s pitch deck.
    • “I do think … AI in general is going to raise the cost of healthcare, not for our organization, but in total,” Dr. Byrne said at the September event. “We’ve talked about how we’re using AI to improve care. Well, care is what? Cost.”
    • “The research cuts both ways. A 2023 National Bureau of Economic Research working paper estimated that wider AI adoption could save 5% to 10% of U.S. healthcare spending. A September Blue Cross Blue Shield Association white paper pegged the cost of rising hospital coding intensity at about $942 million over two years and linked it to the spread of AI-assisted billing tools, findings the American Hospital Association challenged in October. Health system CIOs are also working to rein in usage-based AI token costs that grow as adoption does.”
  • MedTech Dive informs us,
    • “Bracco is investing $230 million to construct its first U.S. manufacturing facility for injectable contrast media, the company said last week. 
    • “Bracco will build the facility in Sanford, North Carolina. The company expects to create 200 jobs and could receive a $2.9 million grant over 12 years. 
    • “Adding U.S. production capacity could enhance the resilience of the supply chain, which failed to meet demand for iodinated contrast media during a pandemic-related lockdown in 2022.” 

Cybersecurity Saturday

David Ermer–Agentic & Generative AI, Cybersecurity–

From the frontier AI front,

  • Cybersecurity Dive reports,
    • “A suspected China-nexus actor chained flaws in PHP2Shell with a privilege escalation bug in the Linux kernel to gain root access to Palo Alto Networks firewalls, according to researchers at Dream and PAN Unit 42. The attacks reached more than two dozen targets, including multiple servers linked to the U.S. government. 
    • “The chained critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109169, along with a high-severity flaw in Fragnesia, tracked as CVE-2026-46300. The threat actor, assisted by AI, gained root access to 25 PAN-OS firewall and management servers in the U.S., Japan, Taiwan and South Korea. 
    • “After gaining access to the firewalls, the hacker targeted Microsoft Active Directory. Researchers confirmed the attacks led to directory enumeration and credentials theft. 
    • “The attacks impacted a cloud environment that researchers confirmed is linked to the U.S. government.”
  • and
    • “The insurance industry is closely monitoring PHP2Shell amid concerns of a systemic event that could overwhelm the sector with billions in cybersecurity risk claims. 
    • “PHP Foundation and multiple government authorities last week warned about two critical vulnerabilities in the scripting language used in more than 70% of websites. If successfully exploited, those vulnerabilities could enable an attacker to achieve remote code execution. 
    • ‘The insurance sector has long feared that a systemic cybersecurity event could lead to billions of dollars in claims that extend well beyond any existing risk models.” 
  • Tech Crunch lets us know in a detailed article,
    • “PHP2Shell explained: Timeline of the global vulnerability crisis.”
      • “PHP powers most of the web, making PHP2Shell a major risk. Here’s a timeline of what happened, who was affected and how to secure your systems now.”
  • Federal News Network adds,
    • “A top Cybersecurity and Infrastructure Security Agency official has called a security vendor’s decision to break the embargo on the recently disclosed PHP vulnerabilities “dangerous” and “inappropriate,” as cyber professionals grapple with how artificial intelligence is accelerating vulnerability timelines.
    • “The company in question, Chainguard, released patches for the PHP bugs more than six hours ahead of the planned, coordinated release last week, according to the PHP Foundation.
    • “Under coordinated disclosure processes, security firms like Chainguard receive vulnerability information in advance so they can develop patches and their users can immediately update their systems upon disclosure.
    • “Chainguard’s decision has been criticized for putting others at risk, allowing hackers to study the PHP vulnerabilities before other organizations were ready to release patches.”
  • Ars Technica tells us,
    • “It’s almost like Google’s got something to prove after taking a break from releasing new frontier AI models earlier this year. Just two weeks after rolling out Gemini 4 Argon, Google has announced Gemini 4 Carbon. This isn’t the Flash model equivalent we’ve been waiting for but, rather, is an improvement on Argon, and like that model, Google is working on a staged release that could take a while.
    • “Stop me if you’ve heard this one before: Google says its latest AI model reaches a new threshold in coding, agentic tasks, and scientific analysis. It’s so capable, in fact, that Google can’t let you use it just yet.
    • “Gemini 4 Carbon reportedly makes big gains in cybersecurity applications. Google says the model shows a “significant leap” in vulnerability detection, validation, and remediation. Carbon is also apparently twice as likely to generate code that is free of vulnerabilities versus Argon. Meanwhile, the Chrome team claims that Carbon is 10 times better at generating “high-quality” patches compared to non-Google models. Google also notes that Carbon has increased its score by 89 points on WebDev Arena, now ranking at number four on the leaderboard.”
  • Anthropic informs us,
    • Anthropic’s life sciences team is working to accelerate curing disease. Over the past several months, our scientists have engaged in deep research partnerships with six organizations developing new medicines: BigHat Biosciences, Bristol Myers Squibb, Divergence Labs, Enveda, Generate Biomedicines, and The Column Group. We’ve also begun drug discovery efforts of our own. In doing so, we’ve learned a lot about how Claude can support drug development, and how we’ll need to improve Claude further to realize AI’s potential in medicine. We plan to scale this work up substantially from here.
  • Silicon Angle adds,
    • “Anthropic PBC today [October 6] expanded its Cyber Verification Program into three tiers of access for vetted security teams, with fewer blocks on cybersecurity work at each step up.
    • “The overhaul is aimed at a restriction Anthropic built into its own products. Because the company treats cybersecurity as dual-use, its generally available models carry conservative classifiers that block most cyber work. When Claude Opus 5.5 launched Sept. 22, most security tasks sent to it were routed to the older Opus 4.8.
    • “Anthropic is folding Project Glasswing into the program at the same time. Since April, Glasswing has given Claude Mythos access to organizations that secure critical software, and Anthropic widened it to 150 more organizations in June. Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1 are available at every tier of the new structure, and later models will be added as they ship.” * * *
    • “The program is available through the Claude Platform, Google LLC’s Vertex AI and Microsoft Corp.’s Foundry service. On Amazon Web Services Inc.’s Bedrock, it is limited to customers eligible for Enterprise Frontier Safeguards.”

From the cybersecurity policy and law enforcement front,

  • Per a Cybersecurity and Infrastructure Security Agency (CISA) news release,
    • “The Cybersecurity and Infrastructure Security Agency (CISA) today [October 26] released its new strategy, CISA 2030: Defend, Harden, Prevail, which advances President Trump’s Cyber Strategy for America and National Resilience Strategy while strengthening the security and resilience of the nation’s critical infrastructure.
    • “The strategy addresses an increasingly complex threat environment, strengthens national cyber defense, and prioritizes the infrastructure most essential to America’s national security, economy, public health, and safety.
    • “The threat landscape is evolving at an unprecedented pace. Nation-state actors and other malicious adversaries are becoming increasingly sophisticated in their attempts to compromise U.S. networks. CISA is strengthening national cyber defense through decisive, proactive action to identify, disrupt, and eliminate adversarial access while hardening critical infrastructure against emerging threats.
    • “I call on every company and organization in the critical infrastructure community—from owners and operators to vendors and technology manufacturers—to act now,” said CISA Acting Director Nick Andersen. “CISA 2030 provides a focused roadmap to strengthen defenses, eliminate adversarial footholds, and deny them any advantage that could endanger the nation’s security, economy, or public health.”
  • Federal News Network adds,
    • “Agency chief information security officers are working together through an unofficial “CISO working group” to help accelerate the migration to post-quantum cryptography.
    • “Bill Newhouse, cybersecurity engineer and project lead at the National Institute of Standards and Technology’s National Cybersecurity Center of Excellence, said Wednesday that the June executive order and corresponding Office of Management and Budget memo gave leaders a push to collaborate more. Newhouse added that the White House’s guidance allowed for more conversations to help agencies identify what gaps remain in the migration process.
    • “We need to think about what tools do we have in common and how do you leverage those to gain information about cryptographic use and functions so that we can take advantage of what the [content delivery network] program has accomplished and is still trying to accomplish,” Newhouse said at Red Hat’s Government Symposium.
  • Cybersecurity Dive tells us,
    • “Small and rural healthcare organizations are among the most vulnerable critical infrastructure organizations in the nation.
    • “The U.S. government will help protect rural hospitals from cybersecurity threats as part of a new pilot program that could generate lessons for how to secure healthcare infrastructure nationwide.
    • “The White House’s Office of the National Cyber Director (ONCD) and the Department of Health and Human Services (HHS) on Monday launched Project Lifeline 250, a six-month program through which technology and cybersecurity firms will offer free hardware and services to rural hospitals. Partner companies, including Cisco, Cyera, Microsoft, Trellix and Zscaler, will upgrade hospitals’ basic defenses, provide them with backup hard drives in case of outages and help them identify and replace insecure legacy technology.
    • “The order requires agencies to transition “high value assets” and “high impact systems” to post-quantum cryptographic keys by Dec. 31, 2030, and PQC digital signatures by the end of 2031.”
  • Per an HHS news release,
    • “The United States Department of Health and Human Services (HHS) Office for Civil Rights (OCR) today [October 29] announced a settlement with Lehigh Valley Health Network (LVHN) and its affiliated covered entities concerning potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules. Under the terms of the resolution agreement, LVHN agreed to a three-year corrective action plan, and paid $800,000 to OCR.
    • On May 15, 2023, LVHN, a health system in Pennsylvania, filed a breach report stating that on February 4, 2023, LVHN discovered suspicious activity in their IT system that was subsequently determined to be ransomware. As a result of this ransomware attack, protected health information (PHI) was exfiltrated and posted on the dark web. The attack affected the PHI of 248,359 individuals and included sensitive photographs of cancer patients receiving radiation oncology treatment, names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial information, diagnoses and conditions, lab results, medications, and treatment information.” * * *
    • “The resolution agreement and corrective action plan may be found here [PDF, 337 KB].”
  • Cyberscoop reports,
    • “Authorities seized the domain of Virtualine, a bulletproof hosting provider that cybercriminals used to commit a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, the Justice Department said Tuesday. 
    • “Virtualine facilitated prolific criminal activity, including the distribution of child sexual abuse material (CSAM), the Justice Department said. The Russian-speaking bulletproof hosting provider was among the most active this year in crypto-related crime in particular, researchers said. 
    • “The site and its associated infrastructure stands out among the dozens of bulletproof hosting providers currently tracked by TRM Labs. “It was not among the largest by total inflows, but it received the most illicit-attributed value in 2026 to date,” the blockchain and cryptocrime research firm wrote in a blog post.”
  • and
    • “A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the Justice Department said Wednesday. 
    • “John Allen Kurrle Jr. participated in a short-lived but prolific conspiracy that spanned at least 88 job applications at U.S.-based companies, resulting in nine job offers, according to court records.
    • “The 62-year-old allowed co-conspirators to use his identity and government clearance for prospective sensitive work, often with U.S. government contractors. The nine job offers Kurrle’s co-conspirators received between June and October 2025 had annual salary ranges of $120,000 to $190,000.
    • “The scheme had a limited success rate. The longest and most lucrative job a co-conspirator landed under Kurrle’s identity lasted about three weeks, netting a total pay of $4,800.”

From the cybersecurity breaches and vulnerabilities front,

  • This bullet is astounding. The Wall Street Journal reports,
    • “Last week, the founder of the world’s largest crypto exchange delivered a chilling warning that read more like a tagline to a horror movie than a reminder to be vigilant on cybersecurity.    
    • “No crypto wallet is 100% safe,” Binance’s Changpeng Zhao wrote on X, the social-media platform. “No tech is 100% secure.”  
    • “Binance’s own users were soon caught in a whirlwind of recent software hacks, widespread panic and bitter recriminations. In the latest, and biggest, cyberattack that has buffeted the world this “Black October,” North Korean hackers ransacked Binance on Thursday afternoon [October 29]. In 20 minutes, they had made off with at least $6.3 billion.
    • “The speed, scale and sophistication of the heist has left the crypto industry reeling, and renewed questions about the digital-asset markets and whether they will ever fulfill their promise as a viable alternative to the traditional financial system or even a safe place to store money. The momentum that had lifted bitcoin and other cryptocurrencies to record highs last year had already stalled. But the recent spate of attacks, punctuated by Binance’s hit, threatens to deal a more serious blow.
    • “It’s a really tough moment for the crypto industry,” said Ari Redbord, global head of policy at crypto intelligence firm TRM Labs.” * * *
    • “At 10:30 p.m., The Wall Street Journal reported findings from cybersecurity research firms TRM Labs and Pangolin Intelligence that the attack was linked to North Korea’s state-sponsored TraderTraitor hacking unit. The same group has been behind many of the largest crypto attacks, including the $1.5 billion ByBit attack in 2025, previously the largest hack in crypto history.”
  • Cyberscoop relates,
    • “A company working on behalf of the Department of Homeland Security sought to cut off online access to information on more than 41,000 employees that hacktivists said they obtained from a database breached at DHS.
    • “A search tool for the database, named Icepick, went offline for a spell before coming online again Thursday [October 29] under a different registrar.
    • “Icelandic hosting company FlokiNET said Thursday that it received a request from DHS contractor ZeroFox to remove the data, which it refused.
    • “By mid-morning, icepi.cx no longer resolved. Its registrar, CentralNic, had placed the domain on serverHold,” FlokiNET said in a blog post. “Our refusal kept nothing online. The request that decided the outcome to take the site down was not the one sent to us. A registrar reached the opposite conclusion the same morning, published nothing, and a global audience lost access to the site. In the meantime the site is online again under a domain from a different registrar.”
  • and
    • “China state-backed threat group is using ARTEX, the automated agentic AI penetration testing framework, to achieve remarkable speed, scale and success in a campaign that already compromised about 140 sensitive targets in 11 days, according to CrowdStrike. 
    • “The threat group, which CrowdStrike tracks as Vapor Panda, targeted more than 200 organizations in at least 14 countries since Oct. 17, the security company said in a threat report Thursday. Targets and confirmed victims include foreign ministries, a European country’s presidency and prime minister’s office, defense and intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors; and telecom providers in the United States, Belgium and the Philippines. 
    • “CrowdStrike told CyberScoop about 70% of Vapor Panda’s targets were confirmed compromised or had evidence indicating moderate confidence of a successful intrusion. 
    • “Vapor Panda’s use of ARTEX, paired with DeepSeek, allowed it to accomplish more tasks with shocking speed — requests occurring as often as every 10 seconds — and pursue multiple attack paths concurrently. 
    • “This is the first time that we’re seeing an agentic adversary nation-state threat actor at this scale, and I think that this is probably, unfortunately, something we’ll see more of,” Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told CyberScoop.”
  • Cybersecurity Dive tells us,
    • “Hackers are increasingly targeting internet of things devices, including on home networks, in attacks that can serve as launching pads for campaigns against enterprises, security firm Bitdefender and networking vendor Netgear said in a report on Wednesday [October 28].
    • “As enterprises get better at protecting their digital infrastructure, cybercriminals are turning to connected home devices,” the report said, describing home IoT devices as “an ideal foothold,” because they are “always on, reliable, and rarely monitored.”
    • “While the report focuses on home networks, it has implications for businesses that run similar devices on enterprise networks, as well as for companies whose executives are vulnerable to compromise at home.”
  • HIPAA Journal informs us,
    • “An analysis of data breaches affecting 500 or more individuals reported to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) in August 2026 shows a considerable improvement from the previous month. Data breaches are down 34% month-over-month, with August’s total of 52 data breaches, the second-lowest monthly total in the past 12 months, well below the 12-month average of 66 data breaches per month.
    • “While August was a relatively good month for healthcare data breaches, the year-to-date figures show that 2026 is turning out to be another bad year for healthcare data breaches. Last year was the worst-ever year for healthcare data breaches, with 807 incidents reported. So far this year, 593 large healthcare data breaches have been reported to OCR. At this time last year, the total stood at 556 data breaches. That’s a 6.7% year-over-year increase.”
  • and
    • “Blueberry Pediatrics, a telemedicine service provider that offers subscribers access to board-certified pediatricians, has been affected by a data security incident involving a third-party tool called Metabase. The incident resulted in the theft of the sensitive data of 340,915 individuals.
    • “Metabase, a business intelligence and data visualization platform used by more than 100,000 organizations, was found to contain a critical vulnerability. On August 22, 2026, Blueberry Pediatrics learned that the vulnerability had been exploited by a hacker who obtained a copy of patient data. Metabase was also used by Photon, a prescription service provider used by Blueberry Pediatrics, that exposed a subset of the same information. On August 24, 2026, Photon advised Blueberry Pediatrics that the vulnerability had also been exploited by a different threat actor, who also obtained a copy of patient data.”
  • CISA added ten known exploited vulnerabilities to its catalog this week.
    • October 26, 2026
      • CVE-2026-109618 – PHP Memory Corruption Vulnerability 
      • CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability 
        • See the frontier AI discussion above.
    • October 27, 2026
      • CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
      • CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability
        • The Hacker News discusses these KVEs here.
    • October 28, 2026
      • CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability
      • CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability
        • Security Affairs discusses these KVEs here.
    • October 29, 2026
      • CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability
      • CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
        • The Hacker News discusses these KVEs here.
    • October 30, 2026
      • CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
      • CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
        • The Hacker News discusses these KVEs here.

From the ransomware front,

  • HIPAA Journal reports,
    • The University of New Mexico Health System (UNM Health) has experienced a cyberattack that has prevented access to critical electronic systems. The incident was detected on October 26, 2026, and as a precaution to ensure patient safety, all ambulance traffic was temporarily diverted to alternative hospitals. A decision was made to cancel all appointments at UNM Health facilities on October 26. UNM Health explained in a 2:30 p.m. update on October 26 that it was also temporarily limiting the acceptance of new patients while efforts continued to restore access to key systems.” * * *
    • “Law enforcement has been notified, and the incident is under criminal investigation, so limited information about the nature of the attack can be disclosed at this time. It is naturally too early to determine the extent to which patient data was involved. While UNM Health has not disclosed details about the nature of the attack, this appears to have been an attempted ransomware attack. A new ransomware group called Byod has claimed it was responsible. The group’s data leak site currently lists 10 victims.
    • “The group’s post about the attack suggests that 36,000 systems at the UNM main campus and UNM Health were compromised, and that patient, student, and employee data was exfiltrated, along with payroll information, internal emails, and Cerner EHR rosters. The group later backtracked to a degree, adding a further post stating it was unaware that “[UNM Health] was running machines related to assisting patients in real-time,” and offered to provide certain decryption keys for free. “(we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only… To any patient that was affected, we will pay you up to $2,500 each for the inconvenience. We are sorry once again. We have morals, and we have a heart, we are not villains, but we will still hold companies responsible for bad security leading to compromise of any customer data.”
  • The Hacker News relates,
    • “Cybersecurity researchers are calling attention to what they say is a “recurring social engineering pattern” across hundreds of cases in which threat actors use Microsoft Teams’ external chat creation feature to conduct impersonation scams or to deliver malware.
    • “A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same ‘IT Support (Internal)’ display names, the same remote-access tools, and increasingly, the same payload domains,” Arctic Wolf Labs said in a report shared with The Hacker News.
    • “The attacks consistently employ IT-themed display names or friendly-sounding first names to subvert external-user warnings in Teams. These messages originate from Teams identities established through newly created or acquired Microsoft 365 tenants.”
  • Info Security Magazine tells us,
    • “Cybersecurity leaders can now use a new framework to find and address weaknesses that could leave their AI systems vulnerable to ransomware attacks.
    • “The tool is the Ransomware Assessment and Incident Defense Framework for AI Systems (RAID-AI) and is fully available for anyone to use online for free.
    • “Behnaz Karimi, co-lead of the Open Worldwide Application Security Project’s (OWASP) AI Bill of Materials (AIBOM) initiative, developed RAID-AI over the past two years with the help of Yuvaraj Govindarajulu, also co-lead at OWASP AIBOM.” * * *
    • “Speaking to Infosecurity, Karimi said RAID AI focuses on ransomware attacks against AI systems, whether or not an attacker uses AI. The framework’s approach is hands-on, asking security teams to assess their own controls rather than connecting to or scanning their systems.
    • “Right now, we are slowly seeing that ransomware attacks targeting AI systems are happening,” Karimi said.
    • “She highlighted a April 2025, a report by Zoran, Mitrovic head of engineering at Kintra Health, which detailed how ransomware actors used data poisoning techniques, as well as an alleged cyber-attack on Novo Nordisk in June 2026, where hackers claimed to have stolen AI models used by the pharmaceutical company.”
  • Bloomberg adds,
    • “When hackers crippled the computer network of a Canadian retailer, its owners asked Surefire Cyber Inc. to bargain with the cybercriminals on their behalf. Negotiator Joe Tarraf knew a few things about his opponents: The Russian-speaking hackers respond badly to low-ball counters. Keep them waiting too long, and you risk infuriating them. And when they offer to “split the difference,” there may still be room to bargain.
    • “But Tarraf, 41, also had some extra help. Hackers, like everyone else, have habits — and few are better positioned to learn them than artificial intelligence technology that can analyze hundreds of negotiations at once. Earlier this year, Surefire had introduced an AI tool for just that, using it internally to help its staff tailor their tactics based on lessons drawn from past negotiations with various cybercrime crews.”

From the cybersecurity business and defenses front,

  • The Harvard Business Review lets us know,
    • “To build cyber resilience, organizations need to think about fostering internal relationships instead of just compliance. Social capital—the relationships, trust, and shared understanding that support cooperation—is an integral feature of how business units interact, cooperate, and pursue shared organizational goals, and in this cybersecurity is no different than anything else. Yet it is often overlooked in how companies address cyber risk. New research offers three important findings for leaders:
      • 1) security benefits from compliance activities have a ceiling,
      • 2) shared social capital effectively increases AI and cybersecurity, and
      • 3) large, complex organizations see bigger payoffs from social capital.
    • Taking a social capital approach to drive increased AI and cybersecurity is more a mindset than a process redesign, but leaders can take several concrete steps to invest in building it.
  • NTT Data adds,
    • “Artificial intelligence is reducing the cost and complexity of cybercrime, helping attackers automate reconnaissance, improve phishing, adapt campaigns and analyze vulnerabilities more quickly. At the same time, many organizations still rely on decision-making processes, governance layers, patching cycles and manual controls designed for a slower environment.
    • “That creates a growing asymmetry.
    • “For business leaders, the question is no longer simply whether the organization has the right security technologies in place. It is whether it can recognize risk, make decisions and act quickly enough when the environment changes.
    • ‘The goal therefore cannot be perfect prevention. It has to be resilience: knowing what matters most, detecting threats early, containing disruption and recovering quickly enough to keep the business operating.”
  • The Cybersecurity Hub, writing in LinkedIn, reports,
    • “Microsoft is preparing to add an artificial intelligence-powered security feature to Teams that examines conversation context for signs of phishing, impersonation and social engineering.
    • “The update addresses a weakness in workplace messaging security: an attacker does not necessarily need to send malware or a suspicious website to begin compromising an organisation. A convincing introduction from someone claiming to represent IT support can be enough to persuade an employee to share information or grant access to a device.
    • “Microsoft plans to begin a targeted release in early November 2026 and complete that phase by mid-November. Worldwide general availability is expected between early and mid-December. Administrators will not need to take action to enable the protection, according to the announcement. These remain planned rollout dates.”
  • Cyberscoop points out,
    • “Fresh off the PHP2Shell advisory, former DHS CISO and acting deputy CIO Hemant Baidwan — now executive CISO at Knox Systems, the largest federal managed cloud — joins Safe Mode to break down what actually happens in the hours after a high-severity vulnerability drops. He walks through why “patch it and move on” gives teams a false sense of security, how to map internet reachability in environments that change by the hour, and what a CISA KEV listing really signals to defenders. Baidwan also reflects on writing DHS’s first-ever AI cybersecurity guidance, what he’d add to that playbook today — starting with AI agent identity — and why he thinks compliance has drifted into security theater.”
  • Here’s a link to Dark Reading’s CISO Corner.

Thursday report

David Ermer–Agentic & Generative AI, CDC, CMS, COVID-19, FDA, Federal employment benefits, Medical / Rx research, Medicare, OPM, Rx coverage, U.S. Healthcare–

Simplicity is a virtue

From Washington, DC

  • Per a Department of Labor news release,
    • “The U.S. Department of Labor’s Employee Benefits Security Administration today finalized a landmark rule that will require pharmacy benefit managers and their affiliated brokers and consultants to disclose their fees and compensation to large employers’ self-insured group health plans. 
    • “In finalizing this rule, the Department has ensured that employers can see how much drug manufacturers, pharmacies, and others pay pharmacy benefit managers for the first time. Employers can use that information to negotiate contracts and seek lower prescription drug costs for workers and their families.” * * *
    • Issued under ERISA’s statutory service provider prohibited transaction exemption, the final rule requires PBMs to disclose the following information for the first time:
      • Rebates and other payments from drug manufacturers.
      • Compensation received when the price paid by the plan for a prescription drug exceeds the amount reimbursed to the pharmacy. 
      • Payments recouped from pharmacies in connection with prescription drugs dispensed to plan participants.   
    • “The final rule also allows plan fiduciaries to audit the accuracy of PBM disclosures and provides additional relief for plan fiduciaries if a PBM fails to meet its obligations.
    • This final rule is applicable to plan years beginning on or after July 1, 2027.
    • “Read the notice of the final rule on pharmacy benefit manager disclosures.”
  • The American Hospital Association News relates,
    • “A coalition of healthcare organizations, including the AHA, sent a letter Oct. 27 to the Center for Medicare and Medicaid Innovation recommending changes to its Ambulatory Specialty Model. The mandatory payment model, set to begin Jan. 1, 2027, focuses on specialty care for beneficiaries with heart failure or low back pain. The organizations recommended delaying the launch of the model and holding participants harmless from downside risk in the first year if the launch is not delayed. They also requested CMMI to maintain ongoing communications and support, including timely data, operational guidance, technical support and a single, consolidated help desk. Additionally, the organizations urged CMMI to share prospective performance thresholds for cost and quality performance categories prior to the model’s start date. CMMI was also asked to allow practice-level reporting of quality measures to align with other Centers for Medicare & Medicaid Services models and programs and minimize participant burden.”
  •  and
    • “Extending Medicaid coverage by 12 months following childbirth increased use of postpartum care among mothers with pregnancy complications such as diabetes and hypertension, according to a study published Oct. 14 by the Columbia University Mailman School of Public Health. The study analyzed Medicaid claims data on births from 2019-2023 in New York and Texas. Researchers found postpartum outpatient visits rose 28% for those with diabetes and 19% for those with hypertension in New York, and 58% and 51% in Texas, where baseline postpartum care rates were lower. Diabetes screening increased 5 percentage points in New York and 12 in Texas. Diabetes screening then declined in Texas after coverage ended during the unwinding of the continuous enrollment provision of the COVID-19 public health emergency.”
  • Modern Healthcare tells us,
    • “The Centers for Medicare and Medicaid Services is offering states mitigation strategies as they hustle to implement Medicaid work requirements by the Jan. 1 deadline. 
    • “CMS has created checklists of mitigation strategies states can choose to implement as they race to complete their work requirement verification systems. Starting next year, most working-age adults without disabilities must prove they work, volunteer or go to school for at least 80 hours a month to qualify for Medicaid.
    • “States seeking flexibility from CMS will need to identify actions that may not be complete before the deadline, explain how they intend to resolve those problems and offer alternative implementation timeframes, according to the memo CMS sent to states. CMS will conduct its own analyses and approve flexibilities or offer enforcement discretion.” 
  • Healthcare Dive discusses “Prior authorization in the real world: Takeaways from Epic ahead of looming API deadline.”
    • “As a Jan. 1 deadline looms for payers to adopt new prior authorization tech, Epic’s Vice President of Value-Based Care Ryan Bohochik breaks down the industry’s progress so far.”
    • “CMS-regulated payers, such as Medicare Advantage, Medicaid and marketplace insurers, are now confronting a Jan. 1 deadline to implement the three prior authorization application programming interfaces — sets of rules that enable computer programs to communicate directly with one another —  under a federal interoperability rule that was finalized in 2024.”

From the U.S. Office of Personnel Management front,

  • Fedweek reports,
    • “OPM has stressed to agencies the legal protections for federal supervisors and managers who take disciplinary actions against their subordinates and for federal employees who report issues with performance or conduct that can lead to such actions.
    • “OPM has received reports from some agencies that employees are reluctant to report a colleague’s misconduct or to serve as a witness — and supervisors and managers are reluctant to recommend or propose discipline — because they fear the subject of the report will respond with an equal employment opportunity (EEO) complaint, a grievance, an Inspector General (IG) complaint, or some other proceeding naming them personally,” says a memo.
    • “Some of the reluctance reported to OPM rests on an understandable but mistaken premise: that an EEO complaint, grievance, or appeal filed by the subject of a report is a proceeding against the official who made it. It is not,” it adds.”
  • FedSmith discusses “When an HDHP and HSA Make Sense—and When They Don’t.”
    • “Learn how FEHB High-Deductible Health Plans with HSAs can lower premiums, offer tax advantages, and build long-term healthcare savings.”
  • and points out
    • “Before federal managers call employees resistant to AI, they should find out what employees are resisting. The same hesitation may reflect fear of job loss, uncertainty about approved tools or a legitimate concern that AI-generated information could be wrong. The overhaul of federal employee surveys gives agencies an opportunity to ask.”
  • Tammy Flanagan, writing in Govexec, answers “more Medicare questions? Here’s what federal retirees need to know.”
    • “Got questions about HSA contributions, TRICARE For Life or keeping FEHB or PSHB when you enroll in Medicare? Here are answers to help you navigate the details of your federal health benefits.”

From the U.S. Food and Drug Administration front,

  • Bloomberg Law reports,
    • “Infant formula manufacturers face new requirements to change the amount of four nutrients they must include in products designed to replace or supplement breast milk under a proposed rule the FDA released Thursday. 
    • “A baby formula product’s level of iodine, Vitamin A, Vitamin D, and manganese would have to change under the Food and Drug Administration’s proposal, which estimates implementing the changes by reformulating and relabeling products will cost manufacturers between $8.4 million to $31.7 million annually. 
    • “The agency’s proposal comes after the Trump administration in 2025 launched the first comprehensive review in decades of nutrients FDA regulations require in baby formula products.” 
  • A Department of Health and Human Services news release adds, “While that process moves forward, the FDA is taking action now — releasing new chemical contaminant testing data showing that most infant formula samples had low or non-detectable levels of contaminants.”
  • The Pharmaletter relates,
    • “German drugmaker Stada said Thursday that the US regulator has approved Lucamzi (ranibizumab-blrz), a biosimilar to Lucentis (ranibizumab), providing another treatment option for wet age-related macular degeneration (wAMD) and other serious eye conditions.
    • “The company and its partners are finalizing preparations for a US commercial launch. Stada did not disclose a launch date or price in its announcement, although it said the product would offer a lower-cost option and help improve patient access.”
  • Reuters tells us,
    • “The US Food and Drug Administration on Thursday warned of safety ​risks associated with Medline (MDLN.O), opens new tab beds and accessories after ‌the company reported two deaths and 16 serious injuries linked to fire, entrapment and asphyxiation hazards.
    • “According to the regulator, Medline has ​told customers it is discontinuing and exiting the ​market for all Medline-branded beds and associated products, ⁠including homecare, bariatric and long-term care beds, as ​well as pendants, accessories and replacement parts.”
  • Cardiovascular Business tells us,
    • The U.S. Food and Drug Administration (FDA) has shared an update about an alert the agency first published in September about certain Automated Impella Controllers (AICs) from Johnson & Johnson MedTech. 
    • At the time, the FDA said these devices should be removed from where they are used or sold, but it was still investigating the issue to learn more. Now, with its investigation complete, the agency has officially ruled that this is a Class I recall, which means using the devices could cause “serious adverse health consequences or death.”
  • and
    • “Medtronic is recalling its CareLink SmartSync device manager due to a risk of inaccurate longevity estimates being displayed for the Micra AV2 leadless pacemaker or Micra VR2 leadless pacemaker. Unlike many recalls, no devices need to be returned to the manufacturer. Instead, customers can download a software update to resolve the issue going forward.
    • “The U.S. Food and Drug Administration (FDA) has ruled this a Class II recall, which means using the technology without a software update could cause “temporary or medically reversible adverse health consequences.” No adverse events have been reported at this time.
    • “Click here for additional details from the FDA.”

From the public health and medical / Rx research front,

  • Reuters reports,
    • “With wildfires becoming larger and more prevalent, ​today we report on a study that suggests a link between exposure during pregnancy to harmful particles in smoke from the ‌infernos and autism in the women’s children. Speaking of harmful particles, we also feature a study that may have discovered one way in which microplastics in our systems are causing health problems.”
  • Beckers Clinical Leadership adds,
    • “A PNAS analysis led by Stanford researchers suggests earlier estimates of long COVID’s effects may have been inflated by how studies selected their comparison groups, though the authors said the findings do not mean long-term symptoms are not real.”
  • Health Day relates,
    • “More people in the United States are vaping and at a higher frequency since 2013, according to a study published online Oct. 20 in Tobacco Control.
    • “Makenna N. Gomes, from the University of Waterloo in Ontario, Canada, and colleagues examined population-level patterns of e-cigarette use between 2013-2014 and 2022-2023 in both youth (aged 12 to 17 years) and adults. The total number of vaping days was determined using data from the Population Assessment of Tobacco and Health study.
    • “The researchers observed increases in total vaping days (+183 percent), past 30-day vaping (+45 percent), and daily vaping (+230 percent) over time. Among those under the minimum legal age of 21 years and those who vaped in the past 30 days, vaping days more than quadrupled (+337 percent) and accounted for 16 percent of all vaping days in the 2022-2023 wave. Since the pandemic, adult vaping days continued to increase due to increases in vaping frequency and population growth.”
  • and
    • “Suicidal thoughts and actions spiked among middle-aged and senior Americans in the years following the COVID-19 pandemic, a new study says.
    • “Suicidal thoughts increased by nearly 43% among Americans 50 and older, according to findings recently published in the Journal of Affective Disorders.
    • “Meanwhile, suicide planning and suicide attempts more than tripled, researchers found.
    • “These increases were concentrated among people without traditional risk factors for suicide, such as major depression or alcohol use disorder, researchers said.
    • “These findings suggest that many older adults who are struggling are not the ones our current screening approaches are designed to catch,” noted lead researcher Dr. Kevin Yang, a research fellow in psychiatry at the UCLA National Clinician Scholars Program.
    • “If a growing share of suicidal thoughts and plans is showing up in people without a depression diagnosis or recent substance use, we need to rethink how we identify risk and reach older adults before a crisis occurs,” Yang said in a university news release.”
  • STAT News tells us,
    • “For years, scientists have struggled to elucidate key biological differences between early onset colorectal cancer, typically in patients under the age of 50, and older patients. They’ve long believed that these cancers must be biologically distinct, since younger patients tend to be far more difficult to treat. They’re often diagnosed at later stages with tumors with more aggressive features.” * * *
    • On Thursday, Kimmie Ng, a colorectal cancer researcher and director of the Dana-Farber Cancer Institute Young-Onset Colorectal Cancer Center published a new study in Nature Medicine that may help illuminate critical differences between older and younger colorectal cancer patients. With 189 tumors, it’s the largest biological database — what researchers call a single cell atlas — of colorectal cancer tumors in patients ranging from their 20s to their 90s. The atlas, along with the technology Ng and her colleagues used, should help researchers control for variables that confounded studies in the past.
    • “It has the largest number of young onset tumors, 54 of them,” Ng said. “We intentionally designed our study to try to overcome these prior limitations in the published literature.”
    • “The atlas has enabled Ng and her team to see some characteristics  that may set early onset colorectal cancers apart. In particular, their analysis suggested that tumors in younger patients seem to be surrounded by a different cell environment that may make it more difficult for chemotherapies and immunotherapies to attack them. They also seem to have genetic differences that are associated with more aggressive and metastatic behavior.”
    • The article includes an interview with Dr. Ng.
  • Beckers Hospital Review informs us,
    • “A case report from researchers at the University of Colorado Anschutz Medical Campus in Aurora links tirzepatide, sold as Zepbound, to lithium toxicity in a 50-year-old woman with bipolar disorder. It is the fourth reported case of tirzepatide-associated lithium toxicity, MedPage Todayreported Oct. 26.
    • “Jay Davis, MD, and colleagues published the case in the Journal of Clinical Psychopharmacology. The patient’s serum lithium level was 0.7 mmol/L before she started weekly 2.5-milligram tirzepatide injections for weight management.
    • “Three weeks later, she arrived at a psychiatry appointment with a tremor in both hands, slurred speech and blurred vision. Her lithium level had climbed to 1.2 mmol/L. She had not changed her lithium dose or started other drugs, but said she was eating smaller meals and feeling full sooner.
    • “Her physicians cut her nightly lithium dose from 900 milligrams to 450 milligrams, and her symptoms resolved. Her lithium level measured 0.4 mmol/L 17 days later. She and her physician decided not to restart tirzepatide.
    • ‘Dr. Davis told MedPage that the leading explanation is that eating and drinking less causes the kidneys to reabsorb more lithium. He said incretin drugs will likely be prescribed more often to patients on lithium, and awareness of the interaction still needs to grow.”

From the U.S. healthcare business front,

  • The Wall Street Journal reports on several quarterly financial reports from pharmaceutical manufacturers.
    • “Gilead Sciences raised its full-year product sales guidance to between $31 billion and $31.3 billion.
    • “The company’s third-quarter revenue grew to $8.3 billion, driven by strong sales in its HIV portfolio.
    • “The company’s third-quarter profit came in at $2.43 billion, down from $3.05 billion a year earlier.”
  • and
    • Merck’s third-quarter sales rose 5% to $18.09 billion, beating Wall Street expectations.
    • The cancer drug Keytruda generated $8.6 billion in sales, representing nearly half of Merck’s total worldwide sales in the quarter.
    • Merck raised its full-year adjusted earnings forecast to a range of $2.77 to $2.82 per share.
  • and
    • “Eli Lilly’s third-quarter revenue rose 39% to $24.4 billion, driven by high demand for its diabetes and obesity drugs Mounjaro and Zepbound.
    • “The pharmaceutical company raised its full-year revenue guidance to a range of $91 billion to $92 billion.
    • “Eli Lilly executives said a majority of new patients in Medicare’s Bridge coverage expansion program started on one of the company’s medicines.”
  • and
    • “Bristol Myers Squibb raised its full-year revenue outlook after third-quarter revenue increased 7% to $13.1 billion.
    • “The company’s third-quarter net income was $2.2 billion, or $1.05 a share, compared with $2.2 billion, or $1.08 a share, a year earlier.
    • “Bristol Myers Squibb cut its full-year adjusted earnings view to $6.35 to $6.55 a share due to charges and licensing impacts.”
  • Fierce Healthcare relates,
    • “Strong performance across its hospital and ambulatory businesses during the third quarter led Tenet Healthcare to raise its 2026 earnings guidance by 4%, with executives asserting that the core strength of operations will yield continued earnings growth in 2027 despite policy headwinds. 
    • “The for-profit this week reported $5.63 billion in net operating revenues for the quarter, not counting $646 million in contract termination revenue tied to its divorce with CommonSpirit Health that was recognized during the quarter. The tally was 6.5% above the same period last year and above the $5.47 billion consensus estimate, per Zacks Investment Research. 
    • The bigger standouts were its $6.64 adjusted earnings per share, well above the prior year’s $3.70 earnings per share and more than 40% above the consensus estimate of $4.60 per share. “Further, executives highlighted third-quarter adjusted EBITDA of $1.36 billion (about 16% above the street, per Stephens), about 10% year-over-year growth when excluding $147 million in one-time items stemming from the shifting timing of its CommonSpirit contract winddown.”
  • Beckers Hospital Review tells us,
    • “Seattle-based Fred Hutchinson Cancer Center recorded operating income of $25.7 million (1% margin) for fiscal year 2026, down from operating income of $82.8 million (3.3% margin) in fiscal 2025, according to its audited financial statements for the 12 months ended June 30. 
    • “Fred Hutch reported total revenue of $2.7 billion in fiscal 2026, a 6.4% increase year over year. Patient service revenue rose 17% to $1.9 billion, while research grants and contracts revenue decreased 1.4% to $493 million. Contributions decreased 27.1% to $141.8 million, and investment income and realized gains fell 44.3% to $76.9 million.
    • “Total expenses were $2.6 billion for fiscal 2026, a 9% increase year over year. Supplies and pharmaceuticals rose 21.7% to $891.1 million. Salaries, wages and benefits increased 5.4% to $902.7 million, and purchased services were flat at $349.2 million.”
  • and
    • “Salisbury, Md.-based TidalHealth reported a $49.1 million operating loss (-3.8% margin) in the fiscal year ending June 30, 2026, compared to a $33.9 million operating loss (-3.4% margin) in 2025, according to financial documents posted Oct. 28.”
  • Beckers Behavioral Health informs us
    • “Houston-based PsychPlus has acquired Precision Psychiatric Services, a California psychiatric group, adding more than 100 psychiatrists to its clinical network. PsychPlus announced the deal Oct. 23. Financial terms were not disclosed.
    • Precision, founded in 2018, is a physician-led organization with hospital partnerships across California. It provides psychiatric care in emergency departments, inpatient behavioral health facilities, medical-surgical units, outpatient clinics and addiction treatment settings. Its hybrid model pairs in-person psychiatry with telepsychiatry.
    • “PsychPlus plans to use the combined network to help hospitals and health systems manage psychiatric workforce shortages, expand clinical coverage and improve patient throughput.
    • “Precision has built an exceptional psychiatric organization with deep clinical expertise and strong hospital relationships throughout California,” said Faisal Tai, MD, founder and CEO of PsychPlus.”
  • Fierce Healthcare points out.
    • “Optum Rx is launching a new program that aims to integrate specialized care for women navigating menopause into the pharmacy benefit.
    • “The program is a virtual-first offering that connects eligible women with clinicians that have been certified with the Menopause Society. Through the program, they can access both hormonal and nonhormonal therapies, symptom tracking, education and one-on-one patient coaching.
    • “Tracy Spencer, senior vice president for product and strategy at Optum Rx, told Fierce Healthcare that 50 million women are currently experiencing symptoms related to either perimenopause, menopause and post-menopause. And 40% of those women say those symptoms impact their work performance.
    • “This is an area that remains one of the most underserved in healthcare, which is why we’re here today, because closing that gap for women’s health is really important,” Spencer said.”
  • and
    • “Blue Cross Blue Shield of Massachusetts is teaming up with precision medicine company Medzown to make it easier for members with complex conditions to participate in clinical trials.
    • “In the partnership, Medzown’s tech stack will identify the members that are most likely to benefit from a novel therapy for their condition and then match them with potential clinical trials. The company will then deploy a team of scientists, clinical trial experts and care navigators to work alongside the patient and their care team through the process.
    • “Jennifer Levin Carter, M.D., the CEO of Medzown, told Fierce Healthcare that there’s no shortage of new drugs and therapies coming through the pipeline for complex diseases like cancer, but access is a significant challenge.
    • “The next frontier for precision medicine is making sure that the right patient can actually get access,” Carter said.”
  • Healthcare Dive notes,
    • “When nine widely used AI models were prompted with questions about medication dosing, about 19.5 per 1,000 answers contained an error that was serious or potentially lethal, according to new research from health tech company Doximity.
    • “Doximity’s research, which was launched in tandem with the company’s new dose verification tool, claims other popular AI models got doses wrong in at least 2.3% of answers.
    • “It’s the company’s latest attempt to differentiate itself from major AI companies like OpenAI and Anthropic that are expanding their presence in healthcare.”

Monday report

David Ermer–Agentic & Generative AI, CDC, CMS, FDA, Federal employment benefits, Medical / Rx research, Obesity, OPM, Rx coverage, U.S. Healthcare–

Simplicity is a virtue.

From Washington, DC,

  • Beckers Health IT reports,
    • “The Department of Health and Human Services finalized a rule Oct. 26 eliminating 14 federal health IT certification criteria and scaling back AI transparency requirements, with the agency projecting more than $1.5 billion in regulatory cost savings.
    • “The final rule, known as Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity, or HTI-5, reduces compliance requirements for developers participating in the Office of the National Coordinator for Health Information Technology’s certification program.
    • “HHS initially proposed eliminating 34 of the program’s 60 certification criteria in December 2025. The final rule takes a narrower approach, removing 14 criteria and revising seven while leaving 39 unchanged.
    • “Among the changes is the elimination of AI model-card requirements within the decision support interventions certification criterion. Those requirements, established under the HTI-1 rule, were intended to give healthcare organizations information about predictive algorithms and other decision-support tools incorporated into certified health IT.
    • “The rule also removes or revises requirements involving care coordination, patient engagement and certain health data exchange capabilities, and formally removes a clinical decision support criterion that expired Jan. 1, 2025.”
  • More is information about the final rule can be found at healthit.gov/hti5, on LinkedIn, or by following @ONC_HealthIT on X.
  • Healthcare Dive adds,
    • “The healthcare industry is slowly but surely moving away from the old, fragmented and manual way of handling prior authorization toward a modernized electronic system.
    • “CMS-regulated payers, such as Medicare Advantage, Medicaid and marketplace insurers, are now confronting a Jan. 1 deadline to implement the three prior authorization application programming interfaces — sets of rules that enable computer programs to communicate directly with one another —  under a federal interoperability rule that was finalized in 2024.
  • Beckers Hospital Review considers five big questions as the 340B drug rebate pilot nears launch on January 1, 2027.
  • Beckers Payer Issues relates,
    • “Ghost networks have long been a point of frustration, with health plan members sometimes left scrambling to check if a provider is in network — or available at all.
    • “Several health insurers — including Elevance Health and Blue Shield of California, in recent months — have faced lawsuits concerning the accuracy of their provider directories. Some of these complaints said that seemingly bigger networks draw more customers, even if that appearance is ultimately misleading.
    • “But more recent developments have pointed to ongoing issues. One study published in October found more than half of secret-shopper calls made to psychiatrists and psychologists across six Blue Cross Blue Shield plans’ directories indicated errors. Separately, this fall, UnitedHealthcare mistakenly told members that eight clinicians had died before correcting the issue. 
    • “While the No Surprises Act, state laws and CMS rules have targeted ghost networks and network adequacy before, there has been a renewed focus on getting directories right.
    • “On Oct. 13, DataSpring, powered by CAQH, rolled out a new standard to measure provider directory data quality for individual clinicians. DataSpring convened major insurers, the American Medical Association and the National Committee for Quality Assurance to develop a framework rooted in the CMS quality foundation for provider directories.”
  • Per a Department of Health and Human Services news release,
    • “U.S. Department of Health and Human Services (HHS) Secretary Robert F. Kennedy, Jr. brought his “Take Back Your Health Tour” to Texas and Florida last week to advance President Trump’s Make America Healthy Again agenda. Across four days, Secretary Kennedy announced new actions on kidney disease and dementia, promoted stronger nutrition education for future doctors, and worked to expand access to women’s healthcare.
    • “From Tuesday through Friday, Secretary Kennedy met with healthcare providers, patient advocates, medical educators, and pharmaceutical manufacturers in Fort Worth, Texas, and Orange Park, Fort Lauderdale, and Miami, Florida.  At each stop, he advanced concrete actions to prevent chronic disease, improve patient care, and give Americans more information and choices to protect their health.
    • “President Trump has directed us to confront chronic disease and put patients first,” said HHS Secretary Robert F. Kennedy, Jr. “Across Texas and Florida, we put that mission into action — detecting kidney disease earlier, strengthening nutrition education for future doctors, advancing prevention and care for families facing dementia, and expanding access to women’s health treatments. HHS is moving prevention to the center of American health care and giving patients more control over their health.”
  • Bloomberg Law notes,
    • “One of the Department of Labor’s key policy advisers is departing the Employee Benefits Security Administration, following completion of the agency’s recent rulemaking on pharmacy benefit managers and healthcare price transparency.
    • “EBSA Senior Policy Advisor Caitlin Soto announced on LinkedIn that Friday would be her last day, calling her time at the DOL “the honor of my career.”
    • “Leading the Department’s PBM Fee Disclosure rulemaking, after nearly a decade of PBM transparency work, was the highlight,” she wrote in her post. “I’m also proud of our work on behalf of this administration to advance fertility benefits, transparency in coverage, and mental health parity. The list goes on.”
    • “The department is expected to release a rule in the coming days requiring PBMs — which negotiate drug prices for health plans — to disclose detailed compensation information to employers and other health plan sponsors. DOL also recently finalized a rule aimed at strengthening price transparency for medical services.”

From the U.S. Office of Personnel Management front,

  • Federal News Network reports,
    • “More details are emerging on the Trump administration’s revisions to paid administrative leave. Agencies’ ability to pay employees not to work during workforce reduction efforts has been formalized. Paid leave will also be allowed during reduction-in-force notice periods, the Office of Personnel Management said. OPM’s latest guidance comes after it finalized regulations to conform with the rules for the deferred resignation program. OPM is expected to soon update other online resources to reflect the new regulations. — Drew Friedman (Revised administrative leave regulations – Office of Personnel Management)”
  • and
    • “The White House is following a court’s order when it comes to reduction-in-force policies. The Office of Management and Budget and the Office of Personnel Management have formally rescinded two memos calling for reductions in force during shutdowns. The Trump administration agreed to terminate the two memos as part of its settlement in September to end a lawsuit by a coalition of federal employee unions including the American Federation of Government Employees, National Federation of Federal Employees and National Treasury Employees Union. Along with the removing the two memos, the Trump administration agreed to rescind every RIF notice issued during the 2026 shutdown and reinstate employees with back pay from the State Department, General Services Administration and Small Business Administration. Additionally, agencies must remove from their shutdown contingency plans any language authorizing RIFs, or RIF work, during a lapse in appropriations, unless a statute expressly permits it. — Jason Miller (OMB rescinds memo allowing RIFs during shutdowns – Office of Management and Budget)

From the U.S. Food and Drug Administration front,

  • Bloomberg Law reports,
    • “A recently launched FDA initiative targeting rare diseases is a top focus to carry out, the agency’s acting chief said ahead of a public meeting Wednesday to solicit feedback on the framework. 
    • “We’ve got to make sure that that process is in place. We’re working really hard to do it,” Kyle Diamantas, acting commissioner for the Food and Drug Administration, said Monday at the National Organization for Rare Disorders’ breakthrough summit. “It’s a top priority of mine.”
    • “Earlier this month, the agency introduced the Rare Disease Framework Initiative, which seeks to give patients more input and drug companies more transparency in the regulatory process for rare treatments. The initiative aims to develop a fit-for-purpose plan that considers the nuances of each disease and patient needs.”
  • Michigan Engineer relates,
    • “Conventional methods of pulling clots out through the blood vessels can damage fragile vessel walls.
    • “The newly FDA-cleared technology gently pulls on the clot with suction, stretches and thins it with an agitator, and vacuums it out of the body. 
    • “The device was designed by a team of neurosurgeons and engineers at the University of Michigan and is being commercialized by U-M startup Endovascular Engineering.”
  • Per a Pfizer news release,
    • “Pfizer Inc. (NYSE: PFE) today announced that the U.S. Food and Drug Administration (FDA) has expanded approval of TALZENNA® (talazoparib) in combination with XTANDI® (enzalutamide) to the treatment of men with metastatic androgen pathway modulation-naïve or -sensitive (mAPMN/S) prostate cancer (PC) with homologous recombination repair (HRR) gene mutations, including both BRCA and non-BRCA mutations. mAPMN/S is also known as metastatic hormone-sensitive prostate cancer (mHSPC).
    • “This approval makes TALZENNA, an oral poly ADP-ribose polymerase (PARP inhibitor), plus XTANDI, an androgen receptor pathway inhibitor (ARPI), available in an earlier line, providing an opportunity to delay disease progression at a critical stage when more patients may experience greater benefit.”

From the judicial front,

  • Bloomberg Law reports,
    • “Eli Lilly & Co. is forming a new battlefront over a weight loss treatment that has yet to secure FDA approval, intensifying a legal drive to protect its blockbuster obesity franchise.
    • “The pharmaceutical giant has filed at least 11 federal lawsuits against a range of online vendors and wellness clinics making copycat versions of its experimental drug retatrutide, accusing them of illegally selling or facilitating access to a product not approved by any regulator in the world.
    • “The crackdown escalates the company’s broader legal campaign against businesses making copies of its powerful therapies, establishing a new wave of aggressive challenges over a drug predicted to outperform currently marketed weight loss treatments. Retatrutide is still in clinical trials for obesity, type 2 diabetes, and other related conditions.” * * *
    • “Lilly’s endeavor to protect retatrutide is also focusing on the FDA, as it plans to submit an application to the regulator in the first quarter of next year. 
    • “The drugmaker is simultaneously in a legal battle with the regulator after the agency determined a few years ago that retatrutide is a drug and not a biologic — a crucial designation that shapes its market exclusivity and when Medicare can negotiate its price.
    • “A biologic designation would grant retatrutide 12 years of protection from competitors, while small molecule drugs get five. Significant for Lilly, a biologic classification would prohibit compounded versions. 
    • “The FDA earlier this month doubled down on retatrutide’s drug label after a federal court sent the determination back to the agency for review, concluding the product doesn’t meet an amino acid length threshold that would count it as a biologic.
    • “An appeals court is now weighing whether it has jurisdiction to review the battle.”

From the public health and medical / Rx research front,

  • Beckers Clinical Leadership reports,
    • “Nearly 1 in 10 adults hospitalized with respiratory syncytial virus infection died in the hospital or within 30 days of discharge, according to preliminary CDC data.
    • “Researchers analyzed RSV hospitalization data from the CDC’s Respiratory Virus Hospitalization Surveillance Network, which tracks hospitalizations with lab-confirmed influenza, COVID-19 or RSV in 14 states and more than 300 hospitals. The analysis included 18,301 RSV hospitalizations among adults across eight seasons from 2014 to 2024.” 
  • MedPage Today lets us know,
    • “Obesity in young adulthood was associated with significantly increased likelihood of early-onset cancers in an observational study, a risk that persisted into middle age.
    • “Men had a higher cancer risk than women, and abdominal fat further increased cancer risk beyond BMI alone.
    • “Cancer rates were highest for thyroid, endometrial, and ovarian cancers.”
  • STAT News relates,
    • “Women’s hearts are different from men’s. Research from clinical trials that have required female participants only since 1993 have repeatedly drummed home that message, from varying chromosomes in heart muscle cells to different heart attack symptoms and causes. Yet wide gaps remain in heart health care for girls and women across specialties. 
    • “Recognizing that clinical fragmentation and the resulting harm to women’s health, four medical societies — the American Heart Association, American Academy of Pediatrics, Society for Maternal-Fetal Medicine, and the American College of Obstetricians and Gynecologists — have issued a framework intended to unite clinicians and patients over a lifetime of care, all aimed at dethroning cardiovascular disease as the leading cause of death in women. In that spirit, three articles offering guidance across the course of a woman’s life were published Monday in Circulation.
    • “Their message: Because female-specific biology affects girls’ and women’s hearts throughout their lives, it requires connected, holistic care starting in adolescence to reflect transitions not found in the male models that have dominated health care: periods, pregnancy, perimenopause, and menopause.” 
  • Radiology Business points out,
    • “The performance of digital breast tomosynthesis—commonly referred to as 3D mammography—improves steadily with patient age, underlying the effectiveness of screening in an elderly population. 
    • “That’s according to new large-scale research from Massachusetts General Hospital, published Friday in RSNA’s Radiology Imaging Cancer. 
    • Current mammography guidelines remain largely age-based, with the influential U.S. Preventive Services Task Force’s last update in 2024 advocating for screening starting at 40. However, USPSTF claimed current evidence was insufficient to weigh the benefit of screening for women 75 and older. 
    • “Researchers with the Harvard University-affiliated institution recently sought to address this knowledge gap, analyzing data from over 300,000 mammograms. They found screening to be increasingly effective, particularly among the elderly, based on common quality benchmarks. 
    • “Cancer detection and sensitivity increased, false-positive rates declined, and specificity improved, resulting in particularly strong performance among female individuals aged 70 years and older,” lead author Leslie R. Lamb, MD, MSc, with Boston-based Mass General’s Department of Radiology, and colleagues wrote Oct. 23. “These findings provide a contemporary benchmark for screening DBT performance across age groups and contribute to the ongoing reassessment of age-based screening guidelines,” they added later. 
  • Healio notes,
    • “Most U.S. women know physical activity reduces breast cancer risk, but only one-quarter meet recommended levels.
    • “A majority know alcohol raises cancer risk, but two-thirds consume alcohol to some extent.”
  • Health Day adds,
    • Marijuana legalization may be landing more people in the hospital with heart problems, a new study suggests.
    • For the study, researchers analyzed more than 50 million hospital discharge records spanning 2012 to 2018. They compared Western states, where recreational marijuana sales began in 2014, with other U.S. regions.
    • The study — led by Dr. Samuel Slavin, of the Boston University Chobanian & Avedisian School of Medicine — found that hospital admissions for several serious heart conditions rose faster after legalization.
    • For each year of sales, admission rates were nearly 4% higher for heart failure, 3% higher for heart attacks and just over 2% higher for atrial fibrillation — an abnormal heart rhythm.
    • Rates for stroke, deep vein blood clots and tachycardia — a fast heartbeat — were also higher, but not statistically significant.
    • While the study cannot prove cause and effect, researchers said their findings “point to potential adverse effects of recreation legalization on population health.”
  • The Washington Post tells us about “the most important things to do to stay healthy while traveling.
    • “An infectious-diseases doctor shares essential tips to prepare for any health issues while traveling in another country.”
  • Beckers Behavioral Health informs us,
    • “Nearly 1 in 3 young adults in the U.S. reported using generative AI to seek substance-related information, with higher rates of use among Black and male respondents, according to a study published Oct. 19 in JMIR Formative Research.
    • “Researchers at Rutgers, the State University of New Jersey in New Brunswick, surveyed 995 U.S. adults ages 18-29 in April 2026 through the online research platform Prolific. The cross-sectional study examined the prevalence and frequency of, and reasons for, substance-related AI use, along with demographic differences and perceptions of the technology.”
  • and
    • “Researchers have identified evidence supporting a potential subtype of clinical depression, known as “circadian depression,” defined by disrupted sleep-wake patterns and associated with more severe symptoms and poorer responses to commonly prescribed antidepressants, according to a study published Oct. 20 in The British Journal of Psychiatry.
    • “The study, led by researchers from the University of Sydney’s Brain and Mind Centre, analyzed data from 11,380 adults with depression in the Australian Genetics of Depression Study. Researchers classified participants as having a circadian subtype if they met at least three of six criteria related to sleep and circadian disruption: social jetlag, seasonality, delayed sleep midpoint, evening chronotype, morning tiredness and hypersomnia. They compared clinical characteristics, self-reported antidepressant responses and genetic risk profiles between groups.”
  • Physicians’ Weekly informs us,
    • “Compared with patients with normal weight or overweight, the odds of death after emergency general surgery increase 92% for patients with underweight and 59% for patients with frailty, according to findings presented at the American College of Surgeons (ACS) Clinical Congress 2026 in Washington, DC.
    • “Our study shows that patients who are both underweight and frail have the worst outcomes,” said lead study author Ellen Cohn, MD, MPH, of the University of Chicago, in a news release. “We also saw that frailty reduces the positive impact of the obesity paradox — the finding that patients who are overweight, but not at the extremes of obesity, tend to have better outcomes. That protective effect is lost if a patient is frail.”   
  • Per Fierce Pharma,
    • “Fresh off the excitement of Rasonque’s big splash in pancreatic cancer, the oncology community has another impressive clinical win to celebrate. Amgen’s T-cell engager Imdelltra has posted a massive survival benefit in small cell lung cancer, delivering what Chief Medical Officer Paul Burton, M.D., Ph.D., called a “watershed moment” for the field.
    • “When added on top of AstraZeneca’s Imfinzi, Imdelltra reduced the risk of death by 58% as a first-line maintenance therapy for patients with extensive-stage SCLC who had not progressed following initial treatment with Imfinzi and chemotherapy.
    • “The result came from the phase 3 DeLLphi-305 study, which showed that, compared with Imfinzi alone, Imdelltra plus Imfinzi improved median overall survival by 8.4 months to 21.1 months. These data are being presented during a presidential symposium at the European Society for Medical Oncology Congress 2026 and simultaneously published in The New England Journal of Medicine.”
  • and
    • “As a cornerstone of Merck & Co.’s post-Keytruda oncology strategy, sac-TMT has cleared a clinical milestone. In its first global phase 3 win, the TROP2 antibody-drug conjugate delivered results that are “pretty consistent” with earlier China data, according to Marjorie Green, M.D., Merck’s head of oncology clinical development.
    • “Sac-TMT, partnered with China’s Kelun-Biotech, reduced the risk of death by 32%—and the risk of disease progression or death by 41%—compared with chemotherapy in patients with previously treated endometrial cancer. The patients had received prior treatment with platinum-base chemo and PD-(L)1 inhibitor therapy.
    • “Derived from the TroFuse-005 trial and presented at the European Society for Medical Oncology 2026 Congress, the data gave sac-TMT its first positive global phase 3 report out of 18 trials that Merck has launched in one of the industry’s broadest clinical development programs for a single drug.” 
  • and
    • “Novartis lifted the veil on its phase 3 wins in relapsing multiple sclerosis (RMS), announced in early September. 
    • “Not only did the company’s BTK inhibitor Rhapsido reduce relapses and disease progression compared to Aubagio, an older RMS treatment from Sanofi, but it did so without inciting any liver issues, a side effect that has proven to be an ongoing barrier to success of the drug class in this indication. 
    • “Novartis said it plans to seek regulatory approval globally in RMS. Its applications will be backed by data from the Remodel-1 and Remodel-2 trials presented at MSToronto last week and simultaneously published in The Lancet.”
  • BioPharma Dive adds,
    • “An antibody-drug conjugate from BioNTech and DualityBio met its main goal in a Phase 3 study in breast cancer, but may only have a “limited” impact in people with the condition, the companies said Monday.
    • “The treatment, known as trastuzumab pamirtecan, successfully delayed tumor progression in a trial of people whose breast tumors express low, but still detectable levels of the HER2 protein. The improvement on that measure was “modest,” though, and treatment was also associated with higher rates of interstitial lung disease — a potentially deadly kind of lung inflammation — than the companies had seen in earlier testing.” 
  • The Wall Street Journal reports,
    • “Roche Holding ROP said it expects a pill it is developing to become the new standard treatment for an advanced form of lung cancer, and the company’s first shot at an emerging field within the oncology market.
    • “The Swiss drugmaker is working on several drugs that target a driver of cancers that long eluded the industry. A breakthrough in pancreatic cancer from U.S. biotech Revolution Medicines put the field on investors’ radar, and Roche aims to venture into it with lung-cancer medicine divarasib.
    • “In study results presented Sunday at the annual congress of the European Society for Medical Oncology in Madrid, Roche said its drug lowered the risk of death by 44% compared with available treatments from Amgen and Bristol-Myers Squibb. The late-stage clinical trial compared the effects of the drugs on patients with a specific type of lung cancer who had been previously treated.
    • “Fewer participants who took divarasib dropped out of the trial due to side effects than those who received the existing drugs, Roche said.
    • “The data are practice-changing,” Roche’s Deputy Chief Medical Officer, Stefan Frings, said in an interview.”

From the U.S. healthcare business and artificial intelligence front,

  • Fierce Healthcare reports,
    • “Earlier this year, UnitedHealthcare unveiled Avery, a generative AI companion aimed at supporting care coordination for its members.
    • “At the time, the tool was available to about 6.5 million of its members in employer plans and 160,000 people enrolled in Medicare Advantage. Now, the insurer is expanding access to 21 million of its members, growing the tool’s reach at a faster clip than was initially expected.
    • “To date, the company has found that Avery has resolved 90% of its member interactions, and in the remaining 10% of cases, can complete a handoff to a human advocate to offer member support. 
    • “As we’re seeing some of the statistics and some of the feedback that we’re getting from users around the success we’ve had within the early phases of Avery, it’s just making sense to open up that application into more and more of the population,” Craig Kurtzweil, chief data and analytics officer at UnitedHealthcare, told Fierce Healthcare.”
  • and
    • “Building stronger bridges between payers and providers will prove critical in addressing the biggest challenges facing healthcare: affordability and access.
    • “It’s with that backdrop that Aetna is releasing its latest provider survey, a quarterly poll that seeks to better understand providers’ perspective on their insurer counterparts and where there’s room to continue developing trust between the two. In the third quarter survey, provided first to Fierce Healthcare, Aetna found a trust score of 6 out of 10, on par with the 6.1 score seen in Q2.
    • “The tally makes for a significant increase from the first quarter, where the trust score was 5.4.
    • Steve Nelson, president of Aetna, told Fierce that “trust is at an all-time low,” so the insurer has been putting an emphasis on addressing some of the biggest pain points that erode that trust, including administrative burdens like prior authorization and increasing transparency.
    • “It’s not just a hope and a prayer here,” he said. “We’re actually making progress.” 
  • and
    • “Doximity inked a partnership with Wolters Kluwer Health to embed UpToDate’s evidence-based clinical content directly within Doximity Ask, the company’s AI clinical decision support tool.
    • “In the coming weeks, at health systems that use both products, clinicians will see an answer based on UpToDate’s 13,000 clinical topics and best practice guides alongside Doximity Ask’s response, without leaving the Ask workflow.
    • “Doximity is a digital platform for U.S. medical professionals that offers workflow tools such as a telehealth solution, a clinician-to-patient dialer tool and digital faxing capabilities.
    • “The company aims to become a leading AI platform for doctors with plans to scale its clinical AI suite, including its ambient note-taking tool Scribe and clinical AI assistant and medical search engine Ask. A year ago, Doximity acquired clinical AI company Pathway and then integrated Pathway’s datasets and its AI into its free Doximity GPT product to offer DoxGPT (now Ask).”
  • Beckers ASC Review relates,
    • “On Oct. 26, Cincinnati-based Bon Secours Mercy Health agreed to acquire Brentwood, Tenn.-based Surgery Partners through its affiliate HealthSpan Partners in a take-private deal valued at about $5.7 billion including debt. 
    • “The transaction would add more than 200 ASCs, surgical hospitals and physician practices across 30 states, along with about 5,000 affiliated physicians, to a 47-hospital system — making the latest in a growing group of health systems that have shifted ambulatory care from a nice-to-have to a strategic imperative.
    • “It most recently follows St. Louis-based Ascension’s $3.9 billion acquisition of Nashville, Tenn.-based Amsurg, which closed earlier this year, and comes as Dallas-based Tenet Healthcare keeps adding to United Surgical Partners International, its surgical arm and the nation’s largest ASC portfolio.”

Weekend report

David Ermer–Agentic & Generative AI, Congress, FDA, Medical / Rx research, Rx coverage, U.S. Healthcare–

Simplicity is a virtue.

From Washington, DC,

  • Congress remains on the campaign trail this week.
  • Per an October 23, 2024 Department of Health and Human Services news release,
    • “The Trump Administration today announced the America First Seafood Strategy, Restoring American Seafood Competitiveness [PDF], a coordinated federal plan to strengthen American seafood production, modernize infrastructure, expand markets for U.S. fishermen and processors, and combat unfair foreign competition. The strategy advances President Trump’s Executive Order, Restoring American Seafood Competitiveness, and his commitment to rebuild America’s seafood industry, strengthen domestic production, and Make America Healthy Again by expanding access to nutritious, American-caught seafood as part of a healthy diet.” * * *
    • “The draft [FDA] guidance notes that U.S. origin statements should be fully substantiated. Ensuring the integrity of these statements helps protect both consumers and the producers who invest in American sourcing. For more information, visit Seafood.gov.
  • FedSmith reports,
    • “The Social Security Administration (SSA) announced on October 20 that it is including a new insert with Social Security cards mailed to newborns through its Enumeration at Birth program. The insert explains how parents can claim and manage a Trump Account, including how eligible children can receive a one-time $1,000 contribution from the Treasury Department.”
    • “The full announcement is available in SSA’s official release.”

From the U.S. Office of Personnel Management front,

  • FedSmith explains “How Starting an HSA This Open Season Can Cut Costs, Lower Taxes, and Build Savings.”
  • Yahoo Finance adds,
    • “A 62-year-old taking an overnight mail-processing job is choosing a paycheck, but the job works mostly as a health insurance plan. As of January 1, 2025, postal workers left the Federal Employees Health Benefits program for the Postal Service Health Benefits (PSHB) program. A non-career hire can join PSHB after an initial term, and the Postal Service pays most of the premium; after five years of career service and continuous enrollment, that subsidized plan becomes retiree coverage for life.
    • “A 62-year-old taking an overnight mail-processing job is choosing a paycheck, but the job works mostly as a health insurance plan. As of January 1, 2025, postal workers left the Federal Employees Health Benefits program for the Postal Service Health Benefits (PSHB) program. A non-career hire can join PSHB after an initial term, and the Postal Service pays most of the premium; after five years of career service and continuous enrollment, that subsidized plan becomes retiree coverage for life.”

From the public health and medical / Rx research front,

  • STAT News reports,
    • “No surprise, the arena-sized room was packed with ESMO attendees eager to see Georgina Long of the Melanoma Institute Australia present the intismeran INTerpath-001 study results. The unfortunate data leak on Thursday made her talk less dramatic, but at the end, she received extended applause and a limited standing ovation. 
    • Long summarized the intismeran results — a 42% reduction in the risk of disease recurrence and a 38% reduction in the risk of distant metastasis-free survival — as a “new benchmark for adjuvant treatment of melanoma.”
    • “More critically,” she added, “it establishes intismeran as a landmark advance in personalized cancer medicine.” 
    • “The full trial data will be published next month in the New England Journal of Medicine, Long also noted. 
    • “Inge Marie Svane of the University of Copenhagen, the discussant following the data presentation, was positive if not overly enthusiastic about the trial, describing the results as “compelling” and adding that they “mark a crucial moment for personalized cancer vaccines.”
    • “But Svane also pointed to a number of outstanding questions, including whether there would be a survival benefit with intismeran, and what exactly was driving the vaccine’s benefit — was it the specific targeting of the neoantigens, or was it the general immune boost that studies have suggested mRNA vaccines provide?
    • “She also took no position on the best way to treat the approximately 40% of higher risk melanoma patients enrolled in the study — a key debate with commercial implications. If intismeran is approved, it will compete against neoadjuvant immunotherapy, or treating patients before surgery. Svane laid out pros and cons of each approach, leaving the question of which will benefit patients more unanswered.”
  • Healio relates,
    • “A phase 3 clinical trial revealed that the investigational vaccine candidate — known as LB6V — showed more than 70% efficacy against confirmed Lyme disease, according to results presented at IDWeek.
    • “But, in the end, the drug failed to hit its primary endpoint.
    • “LB6V has a “clinically meaningful” efficacy, researcher Paul G. Auwaerter, MD, clinical director of the division of infectious diseases and professor of medicine at Johns Hopkins University School of Medicine, said during the presentation.” * * *
    • “I believe that LB6V is safe and has a favorable side-effect profile,” Auwaerter said.” * * *
    • “Auwaerter did not mention the drug’s potential approval or launch during his presentation.”
  • Genetic Engineering and Biotechnology News adds,
    • “The results of a preclinical study headed by researchers at Johns Hopkins University School of Medicine suggest that the Bacillus Calmette-Guerin (BCG) vaccine, which is widely used to prevent tuberculosis and treat bladder cancer, may also have properties that reduce the risk for dementia. BCG is a live, weakened vaccine made from an altered strain of the bacterium Mycobacterium bovis.
    • “The team found that in mice genetically engineered to develop biological symptoms of dementia (PS19 mice), those animals that received the BCG vaccine were less likely to show hallmark signs of the disease, such as neurofibrillary (tau) tangles (NFTs) in the brain, sustained immune cell activation, and memory loss compared to mice that received no vaccine. BCG-treated mice performed better in a novel object recognition test, and showed improved maintenance of body-weight and survival.
    • “Research lead William Bishai, MD, PhD, co-director of the Johns Hopkins Center for Tuberculosis Research, believes that myeloid cells in the central nervous system and brain are using information from BCG to recognize and help the body respond to the formation of plaques and tangles characteristic of Alzheimer’s disease and related dementias. Bishai said, “We’re hard at work trying to understand the detailed mechanism for how it works, but this research points to early clues that aspects of trained immunity are likely driving this response.”
  • Health Day lets us know,
    • “Jumping rope, stair climbing, power yoga, vigorous cleaning and gardening can all count as at-home cardio
    • “Adults should aim for 150 to 300 minutes of moderate or 75 to 150 minutes of vigorous activity weekly
    • “Short bursts of movement add up, so even climbing a few flights of stairs counts toward your weekly goal.”

From the U.S. healthcare business and artificial intelligence front,

  • pwc consulting informs us,
    • “American healthcare was built by local institutions and independent physicians, yet it is now evaluated on national cost trends, consistent quality, and compliance with standardized payment models, all while still being expected to deliver care locally and personally. That tension, not any single policy or technology, is the throughline behind every challenge in this paper.
    • “The system faces seven distinct but connected challenges, spanning consumer expectations, care coordination, innovation speed, regional divergence, chronic care, national infrastructure, and technology adoption.
    • “Each of these seven structural challenges have a clear historical parallel, from 19th-century public health reform to the rise of AI, showing these are patterns, not new problems.
    • “The real bottleneck isn’t invention, it’s adoption that challenges the conventional norms and barriers that keep proven solutions from reaching scale. Time and again, technology and care models have proven themselves years or decades before the system used them.
    • “The next era won’t be measured by activity, it’ll be measured by impact. The organizations that win will likely be judged by how much healthier people became, not how many visits, procedures, or dollars were logged along the way.”
  • Beckers Hospital Review reports,
    • “Duluth, Minn.-based Essentia Health reported a 1.2% operating margin in fiscal 2026, down from 2.2% a year earlier, as expenses outpaced revenue growth ahead of its proposed merger with Bloomington, Minn.-based HealthPartners.
    • “Essentia reported $42.3 million in operating income for the fiscal year ended June 30, down 41% from $71.6 million in fiscal 2025, according to its Oct. 14 audited financial report. 
    • “Operating revenue increased 6.4% year over year to $3.49 billion, while operating expenses rose 7.5% to $3.45 billion. Patient service revenue grew 7.1% to $3.41 billion, driven primarily by outpatient revenue, which increased from $2.48 billion to $2.67 billion. Inpatient revenue rose from $673 million to $702 million. Salaries, wages and benefits increased 6.3% to $2.02 billion, while supply expenses climbed 11.4% to $809.5 million.
    • “Essentia reported $281.8 million in nonoperating gains, up from $169 million in fiscal 2025, driven largely by investment gains. The system posted a $324 million in net income, compared with $241 million a year earlier.”
  • and
    • “Greensboro, N.C.-based Cone Health plans to acquire three pharmacy businesses in Reidsville, N.C., expanding its retail pharmacy footprint and adding long-term care pharmacy services.
    • “The agreement includes Carolina Apothecary, Belmont Pharmacy and Rx Care, which have served Rockingham County residents for decades. The deal is expected to close in early 2027, pending regulatory approvals and closing conditions.
    • “The businesses will become Cone Health Community Pharmacy locations, offering closer coordination between pharmacists and healthcare providers, competitive medication pricing and onsite vaccinations.’
  • Beckers Payer Issues adds,
    • “AI, new product lines, shrinking broker networks and increasingly self-directed consumers will reshape the health insurance landscape in 2027, according to two reports from Forrester published Oct. 14, which covered the global insurance and healthcare industries broadly.
    • “Here are the firm’s 10 health insurance industry predictions for next year:
      • “Half of the 10 largest payers will launch alternative health plans.
        • “Existing alternative health plan examples include UnitedHealthcare’s Surest and Health Care Service Corporation’s new Easify Edge product’.
      • “More than half of consumers will start their healthcare journey using public AI models (such as ChatGPT or Claude), with 42% of consumers polled by Forrester already using an answer engine for healthcare advice.” 
      • “A third of insurers will integrate agentic AI into customer experience, but most will not let it make binding coverage or claims decisions. Forrester pointed to Allianz’s Project Nemo as an example of how large payers are using agentic AI to automate analysis and orchestrate workflows.”
      • “AI agents, not physicians, will perform 20% of routine care check-ins.”
      • “GLP-1 adoption will reach 20% of Americans, inspiring new drug pathways.”
      • “At-home tests will become a new digital divide and increase healthcare inequities.”
  • Beckers Physicians Leadership tells us,
    • “Median pay for cardiologists 35 and younger fell about 19% in 2025, even as overall cardiology compensation reached a record high, according to an October MedAxiom’s 2026 Cardiovascular Provider Compensation and Production Survey.
    • “Early-career cardiologists earned a median $476,850 in 2025, down from $586,769 in 2024. It was the second straight annual decline for the group. Over the same period, overall median compensation per full-time cardiologist rose nearly 5%, to $727,712 from $694,954, and every cardiology subspecialty posted its highest median pay in the survey’s history. 
    • “MedAxiom described the decline as surprising, given how hard cardiology programs are working to recruit physicians. The report doesn’t collect starting salary data, so it uses physicians 35 and younger as a proxy for early-career pay.”

Cybersecurity Saturday

David Ermer–Agentic & Generative AI, Congress, Cybersecurity–

From the frontier AI front,

  • The American Hospital Association News reports,
    • “Two critical vulnerabilities have been discovered in Hypertext Preprocessor, or PHP, a widely-used open-source scripted language for web development, its creators announced Oct. 21. The vulnerabilities reportedly impact a majority of the world’s websites. The two issues can allow unauthenticated remote code execution. The notice advises all PHP users to download updates immediately, as all PHP installations serving web requests are at risk. The National Security Agency advised organizations to take their systems offline if an immediate update is not feasible, and that the agency will soon issue specific guidance. An AHA Cybersecurity Advisory released Oct. 21 provides additional details and recommendations.”
  • The Wall Street Journal explains why this is a frontier AI story.
    • “First, artificial intelligence heralded the Bugmageddon. Now it is triggering an all-hands-on-deck cyber emergency. 
    • “The creators of PHP, a technology that powers as much as 70% of the world’s websites, disclosed a critical security issue Wednesday that could be leveraged by hackers to take control of any system running its software. That would allow an attacker to steal information or launch a cyberattack on anyone visiting a hacked website.
    • “Security researchers found the vulnerability using AI. Now web administrators are scrambling to protect themselves from the vulnerability, which cutting-edge AI systems could quickly exploit.”
    • “Ryan Austin, a researcher at Calif, uncovered the flaws with help from GPT-5.6 Sol, one of OpenAI’s most advanced models, during an audit of PHP’s source code in August [2026]. OpenAI funded that and other audits, part of an effort by AI companies to help open-source projects address software vulnerabilities now being uncovered by artificial intelligence systems.
    • “The class of bugs had been hiding in PHP’s source code for years. A security researcher had flagged it as a problem area decades earlier, but the flaw had been considered too difficult to exploit and was largely forgotten, Duong said. 
    • “AI found a way. Austin figured out how to control the code that was running in the computer’s memory with as few as a few dozen requests to a server running PHP. On smaller systems, the hack takes just seconds. On more complex ones, it can take hours.” * * *
    • “PHP2Shell is “the most severe AI vulnerability that was ever found,” and one that was likely too complex to have been discovered without AI, said Ami Luttwak, Wiz’s co-founder. 
    • “Duong and the other researchers kept its existence a closely guarded secret while they worked on fixes, for fear that an AI-aided hacker might find and exploit it before they were done. 
    • “The patching effort was massive. There are close to 200 files being fixed and developers wrote over 10,000 lines of code during the process. 
    • “Eventually, a patch date was set: October 22. Then, the inevitable happened. News of the patch leaked out Tuesday, in a post to Hacker News, just under two days before the patch release.
    • “Dusch’s team decided to rush out the patch. On Tuesday, they warned the world to stand by and expect a critical security update on Wednesday [October 21].”
  • Bleeping Computer and Cybersecurity Dive add,
    • [BC] “Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday [October 21]. * * *
    • “According to Amazon, the first exploitation attempts began on Saturday, October 17 (four days before the PHP2Shell patches were released), and attackers deployed multiple proof-of-concept PHP2Shell exploits hours after disclosure from VPN IP addresses.
    • “The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure,” said AWS chief information security officer CJ Moses.
    • “The actual payloads and choices in anonymization infrastructure varied, suggesting these were multiple actors. Technical analysis is ongoing, and it’s unclear if any of these attempts would have succeeded in real-world systems.”
    • “Moses added the PHP2Shell vulnerabilities are “now being broadly exploited in the wild,” though it’s unclear how many attacks are successful, and warned that “defenders should not assume the public disclosure date is the earliest date of exploitation.”
  • and
    • [CD] “Security researchers warn that millions of websites remain at risk as exploitation attempts against two critical flaws in PHP have surged. 
    • “The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can enable an attacker to achieve remote-code execution. Each has a severity score of 9.2 out of 10. 
    • “Exploitation attempts have surged since the vulnerabilities were first disclosed, and researchers have uncovered threat activity from Potassium, a Mirai-derived botnet originally discovered in March. 
    • “Arctic Wolf said it observed an exploitation attempt that combined a “command-execution validation with a second-stage payload delivery.” 
    • “Two malicious binaries were identified within the payload hosting infrastructure, but Arctic Wolf said it did not find enough evidence to show successful downloading or execution. 
    • “Researchers from Sophos also observed threat activity linked to Potassium, but they were able to block an attack. An examination of the sample showed an updated and ‘significantly expanded’ version of the botnet variant, Sophos said.” 
  • Here is a link to the October 23 alert from CISA about the PHP vulernability.
    • “CISA has updated this Alert [originally published October 21] to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance.“
  • Dark Reading offers expert guidance on mitigating the PHP vulnerability.
    • “Fixing the critical PHP flaws is not as simple as clicking “Update.” Here’s how to assess your risk, and what you can do to protect yourself.”
  • The Wall Street Journal observes,
    • “The pace and volume of the AI-powered attacks are starting to overwhelm the incident-response firms that respond to cyber breaches. Pundits are referring to the month as “Black October,” and many in the field are predicting more to come.
    • “We expect that there’s going to be a massive number of compromise disclosures in the coming weeks and months,” said Steven Adair, president of the cybersecurity firm Volexity.
    • “Incident responders such as Adair say that AI tools are now being used by nation-state hackers from China and Russia as well as criminals looking to steal data and install ransomware. 
    • “One of the tools they are using is a Chinese open-source hacking tool called Artex, which uses artificial intelligence to automate the process of breaking into a computer network. 
    • “This week Microsoft said that “threat actors across multiple geographic regions” were using Artex to speed up attacks on hundreds of companies. Earlier this month, a cyberattack used Artex to steal data on about 68,000 people from South Korean banks.
    • “Hackers are using AI for reconnaissance, to analyze vast swaths of data they steal and even to rapidly build exploit code that can be used to break into networks, said Sherri Davidoff, founder of the security consulting firm LMG Security.”

From the cybersecurity and law enforcement front,

  • Cyberscoop reports,
    • “A new bipartisan House bill would charge the federal government with developing formal guidance for defending AI models against distillation attacks.
    • “The AI Cyber Defense Act, shared exclusively with CyberScoop ahead of release, is sponsored by Reps. Pat Harrigan, R-N.C., and George Whitesides, D-Calif. It would direct the National Institute for Standards and Technology to develop voluntary industry standards and best practices for preventing distillation attacks from foreign entities from four countries: Russia, China, Iran and North Korea.
    • “In an interview, Harrigan told CyberScoop it is “incredibly expensive” for the U.S. AI industry to maintain its six-to-12 month lead over other countries, and distillation attacks give other parties an incentive to copy other models while keeping their own spending low.
    • “He said he believes countries such as China are making a strategic choice to hold back on full investment of their own AI industry, instead betting they can drift behind American companies as they perform the arduous and expensive research and development to advance the field.”
  • Beckers Health IT relates,
    • “HHS will keep HIPAA civil monetary penalties at 2025 levels and skip its annual inflation adjustment for 2026, the department said in an Oct. 21 Federal Register notice.
    • “The freeze traces to last year’s federal government shutdown. The Bureau of Labor Statistics did not produce October 2025 consumer price index data during the lapse in appropriations from Oct. 1 to Nov. 12, 2025. Federal agencies need that month’s data to calculate the yearly penalty multiplier, so no 2026 multiplier exists.
    • “The Office of Management and Budget canceled the 2026 adjustments for federal agencies in an April 17 memo. HHS’ notice cites that guidance.” * * *
    • “The current HIPAA ceiling is about 46% higher than the $1.5 million cap set under the 2009 Health Information Technology for Economic and Clinical Health Act.”
  • The Cybersecurity Hub Newsletter, writing in LinkedIn, informs us,
    • “The United States has ordered federal civilian agencies to remove DeepSeek technology from their information systems and exclude the Chinese artificial intelligence developer’s products from future procurement, widening restrictions on its role in government operations.
    • “A Department of Homeland Security notice made public on October 19 covers DeepSeek, affiliated companies and third-party products and services developed using DeepSeek implementations. The measure therefore reaches beyond the company’s chatbot to software supplied by other businesses that incorporates its technology.
    • “The official notice, scheduled for Federal Register publication invokes the Federal Acquisition Supply Chain Security Act of 2018. DHS says the decision followed a review of a Federal Acquisition Security Council recommendation and supporting evidence. Its stated scope concerns federal civilian procurement and information systems; it does not announce a nationwide prohibition on private use.”
  • Tech Target reminds us,
    • “The U.S. government is moving closer to requiring covered critical infrastructure organizations to report significant cyber incidents within 72 hours and ransomware payments within 24 hours. But for operators of industrial control systems, the challenge will extend beyond deadline compliance; they must first determine whether an incident has occurred, establish what was compromised and decide whether the data driving physical processes can still be trusted.”
  • Per Security Week,
    • “Effective and efficient use of complex agentic systems is important for all organizations, but recognizing, preventing and recovering from them going rogue could be an existential necessity.
    • “NIST, the NSA, and CISA recognize the increasing potential for AI agents to behave in an unexpected and potentially harmful manner, and has responded with a list of key practices for both preparing for and responding to such behavior. The report (Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation) uses the term super intelligence (SI) rather than artificial intelligence (AI) in line with presidential executive order 14434.
    • “In the report, the ten key practices are grouped into five stages: prepare, detect, respond, recover, and report. For clarity, the report also includes three useful terminology definitions covering AI agents, AI control incident, and AI control near-miss.”
  • The National Institute of Standards and Technology announced
    • “The initial public draft (ipd) of NIST Special Publication (SP) 800-100r1 (Revision 1), Information Security Handbook: A Guide for Executive Leadership, is now available for comment.” * * *
    • “The draft covers:
      • “An overview of key NIST frameworks and how they relate to one another
      • “Governance, including risk management fundamentals and enterprise risk management
      • “Topics organized under the CSF’s Identify, Protect, and Detect/Respond/Recover functions
      • “Continuous monitoring strategy and roles
    • “A public comment review period is open from October 12 to December 4, 2026. Commenters are encouraged to use the comment template and submit feedback to sp800-100-comments@nist.gov.”

From the cybersecurity breaches and vulnerabilities front,

  • MedTech Dive reports,
    • “Quest Diagnostics is the latest medtech company to disclose that it was hit by a cyberattack.
    • “The testing services company identified unauthorized access to its Quanum Lab Services Manager system on Wednesday [October 21], according to a filing with the Securities and Exchange Commission. Quest’s Quanum LSM system is used by certain clients to place test orders as well as to receive and look up results. Quest paused access to the system upon discovering the incident.
    • “While Quest is still determining the full scope of the attack, it believes that an unauthorized party accessed certain patient records. Quest, in the filing, did not detail what patient records were accessed or how many records were involved.”
  • HIPAA Journal lets us know that “Data breaches have been announced [recently] by UltraMobile Imaging in New York, Artistic Smiles in Colorado, Parkview Health in Indiana, and Cognitive Behavior Therapy Center in Virginia.
  • Federal News Network fills us in about insider cybersecurity threats.
    • “Les Bernys, the executive director of the Department of Defense Cyber Crime Center, said the number of insider cyber incidents reported over the last six months far outpaced any other time in DC3 history.
    • “DC3 says more broadly, critical incident reports, which include insider threats, from defense companies have increased by over 50% in the last fiscal year. DC3 says it can’t give complete figures due to the anonymity of the DIB companies reporting.
    • Bernys said DC3 is seeing two kinds of insider threats.
    • “One type are former DoD employees who did malicious things to the network before they left or still have access to data after they left and were trying to exfiltrate data and, possibly, doing nefarious things with that data,” he said after speaking at the ACT-IAC Cybersecurity Summit on Oct. 14. “The second type of incident are companies are reporting that they have hired individuals who they thought were Americans but were North Korean. These incidents aren’t coming in huge numbers, but the increase is noticeable.”
    • “He added companies are struggling to better verify their applicants.”
  • CISA added eight known exploited vulnerabilities to its catalog this week
    • October 20, 2026
      • CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
      • CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
      • CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
      • CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability  
      • CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
      • CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability
        • The Plex Medica Service KVEs are PHP Shell vulnerabilities discussed in the frontier AI section above. Bleeping Computer also discusses the KVEs here.
        • Cybersecurity News discusses the EG Secure Solutions KVE here.
        • The Hacker News discusses the Siemens KVE here.
    • October 23, 2026
      • CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability
        • Security Week discusses this KVE here.
    • October 23, 2026
      • CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability 
        • GitHub discusses this KVE here.
  • Bleeping Computer points out,
    • “GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.
    • This security issue is tracked as CVE-2026-110264 and was reported by a security researcher using the ‘joaxcar‘ handle through GitLab’s HackerOne bug bounty program.
    • “CVE-2026-110264 stems from an integer overflow weakness in GitLab’s Regular Expression Compiler, a background engine that parses and validates regular expressions in configuration files.
    • “GitLab has fixed the vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, and warned users to patch their instances immediately.
    • “GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression,” the company said.”
  • Cyberscoop tells us,
    • “Microsoft researchers attributed the recent supply-chain attack targeting ConnectWise customers’ Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940.
    • “As early as September 2026, Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries,” Microsoft Security Research wrote in a blog postWednesday. 
    • “The nation-state group, which has been active since 2021, targeted organizations in aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits. 
    • “Storm-0940 initiated a widespread, but ultimately unsuccessful, password-spraying campaign immediately preceding the compromise of ConnectWise’s Cloud Backup service. During a four-day stretch ending Oct. 14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, researchers said.”
  • Cybersecurity Dive informs us,
    • “An Indian company’s serious error in creating high-level encryption certificates has prompted major web browsers to block the certificates before hackers can use them to spoof websites.
    • “The issue involves intermediate certificates created by the Indian firm eMudhra, a company with the authority to issue certificates that are trusted by Google Chrome, Microsoft Edge, Mozilla Firefox and other browsers. Certificate issuers use intermediate certificates to “sign” individual website certificates that assure users of the sites’ legitimacy and security. But eMudhra recently failed to apply the proper procedures when creating eight of its intermediate certificates, producing keys that were shockingly weak.” * * *
    • “Leading web browsers responded by severing their trust relationships with the eight weak intermediate certificates. Google and Mozilla published blog posts detailing their responses to the discovery.
    • “Users should update their browsers and operating systems to the latest versions as soon as possible,” Dennis Jackson, a member of Mozilla’s cryptographic engineering team, wrote on an explainer page about the incident.
    • “There is no evidence that hackers generated any fraudulent website certificates by exploiting the weaknesses in eMudhra’s keys.”
  • and
    • “Threat actors are deploying agentic AI in more sophisticated ways to automate aspects of their hacking campaigns, according to CrowdStrike.
    • “In 2026, CrowdStrike Intelligence has documented several incidents in which threat actors used AI not only to create tooling or artifacts, but to conduct agentic campaigns in which AI agents make decisions and execute commands,” the security firm said in a report published on Wednesday [October 21].

From the ransomware front,

  • The American Hospital Association New reports,
    • “A joint advisory issued Oct. 20 by U.S. and international agencies warns of recent activity by the SafePay Ransomware group. The group has been active since 2024, attacking critical infrastructure organizations, including healthcare, across North America and around the world. The agencies said SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems and using phishing tactics. The actors then gain control of the network by creating new accounts or taking over existing ones and use legitimate system tools to move through the network to identify valuable files and disable security protections. Next, the actors encrypt the victim’s files and leave a ransom note demanding payment in cryptocurrency. The advisory includes recommended security measures to reduce the risk of SafePay ransomware attacks.”
  • Cybersecurity Dive adds,
    • “Palo Alto Networks researchers warned that ransomware operators have stepped up exploitation of a high-severity flaw in the company’s GlobalProtect portal, months after it was first disclosed. 
    • “The authentication bypass vulnerability, tracked as CVE-2026-0257, allows an attacker to establish unauthorized VPN connections to the remote-access product. The flaw has a severity score of 7.8 out of 10. 
    • “Researchers warn that Qilin and INC ransomware groups are exploiting the vulnerability, according to a report by Unit 42, the threat intelligence and incident response arm of Palo Alto Networks. The company tracks those groups under the names Spikey Scorpius and Tarnished Scorpius, respectively.” 
  • Info Security Magazine relates,
    • “Almost 3000 ransomware attacks took place between July and September 2026 and the figure marked a significant increase when compared with the same period last year.
    • “According to an analysis by Nord Security, the 2894 ransomware attacks which took place during the quarter represents a 50% increase when compared with the same period last year.
    • “It also represents a slight increase when compared with the previous quarter of this year, as the July to September period saw an 8.6% rise in ransomware attacks when compared with April to June.
    • “Published on October 21, the Nord Security report suggested that the significant rise in ransomware activity is a result of the impact of law enforcement takedowns on ransomware groups.
    • “Researchers suggested that the action against the likes of  Lockbit, BlackCat and RansomHubhelped to reduce ransomware activity during 2025.
    • “Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware’s new era,” said Vakaris Noreika, VP of product research and development at Nord Security.”
  • Acronis takes “a closer look at a not-so-gentle ransomware-as-a- service operation.”
    • “The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked.”
  • Tech Target offers a tip about
    • “How to tackle a ransomware readiness self-assessment, with template
      • “Ransomware readiness self-assessments are key to spotting vulnerabilities and preparing for third-party assessments. Use this template to evaluate your organization’s preparedness.”

From the cybersecurity business and defenses front,

  • The Wall Street Journal reports,
    • “As businesses and consumers increasingly adopt artificial intelligence agents, 1Password is aiming to position itself to deliver solutions for growing challenges around security, access and trust.
    • “The Canadian late-stage cybersecurity startup has surpassed $500 million in annual recurring revenue, up from $400 million in November 2025, with a free cash flow margin in the double digits, the company said.
    • “The growth has been driven by an explosion in coding assistants and agents in enterprise settings, whose access to company secrets and systems needs to be closely managed, Chief Executive David Faugno said.
    • “The agents can actually take those secrets and do things that are unpredictable,” Faugno said in an interview. “You have to be very, very clear about what access you give it, and how you monitor and maybe even revoke that access, and humans have to stay in control.”
  • Cybersecurity Dive relates,
    • “The size of the cybersecurity insurance market is growing quickly as more businesses try to guard against the damage from a major hacking incident.
    • “Total U.S. domestic cyber direct written business has nearly tripled since 2020, making cyber insurance one of the fastest-expanding segments in insurance,” the National Association of Insurance Commissioners said in a statement Wednesday [October 21] about its new report on the topic.
    • “Chubb, Beazley and St. Paul Travelers are the top three insurers by the value of their direct written premiums, according to the report.”
  • Dark Reading adds,
    • “Cyber Insurance’s New Reality: Underwriting Isn’t Enough
      • “Rising AI, social engineering, and cloud risks are pushing carriers beyond risk transfer and deeper into cybersecurity itself.”
  • Cyberscoop warns,
    • “Encryption isn’t enough to protect data wherever it goes 
      • “Once data is in use, encryption falls short. A tested approach that replaces sensitive values with realistic substitutes could make stolen information far less useful to hackers.”
  • Per the Cybersecurity Hub Newsletter,
    • :Your SIEM detected the incident, Could you prove it six months later?
    • “That question comes up more often than it should. Usually during an audit.
    • “The incident was investigated. The threat was contained. The alert was closed. Six months later an auditor asks for the investigation record, the incident timeline, and the documentation showing what was reviewed and what was decided.
    • “The security controls worked. The paper trail did not.
    • “We put together the Managed SIEM Compliance Evidence Checklist for NIS2 and DORA to help teams find those gaps before a review does.”
  • Here’s a link to Dark Reading’s CISO Corner.

Friday report

David Ermer–Agentic & Generative AI, CDC, CMS, Congress, COVID-19, FDA, Medical / Rx research, Medicare, No Surprises Act, OPM, Patient safety, Rx coverage, U.S. Healthcare–

Simplicity is a virtue.

From Washington, DC,

  • Beckers Payer Issues reports,
    • “The House Committee on Oversight and Government Reform announced an investigation into pharmacy benefit managers Optum Rx, CVS Caremark and Express Scripts Oct. 23, reviewing their auditing practices of independent pharmacies. 
    • “The investigation stems from concerns “that independent pharmacies have potentially been targeted for punitive audits in retaliation for their public support of legislation recently passed by the committee,” the committee’s chairman, James Comer, R-Ky., said.
    • “Under HR 6610, PBMs for Federal Employees Health Benefits Program plans would pay in-network pharmacies a benchmark price with a capped margin. The PBMs would also pay a dispensing fee that aligns with what the state Medicaid program pays. The Pharmaceutical Care Management Association, which represents PBMs, pushed back against the bill amid the committee’s July markup.
    • “Let’s understand this bill for what it is: a huge cash transfer from taxpayers to pharmacists and nothing more,” PCMA President and CEO David Marin said in a July 22 statement. “It makes providing health benefits to federal workers far more expensive, simply as a gift to one industry.”
    • “Mr. Comer said that since the July markup, several independent pharmacies that backed the bill received more audit notices than usual.”
  • The FEHBlog heartily agrees with PCMA. The FEHB and PSHB programs should not be treated like test subjects.
  • Beckers Hospital Review explains the “6 ways the federal government is going after drug prices.”and lists “Medicare’s proposed 2027 pay cuts, by specialty.”
  • The American Hospital Association News relates,
    • “The Centers for Medicare & Medicaid Services has launched a new initiative to help recruit and retain nurses in nursing homes, the agency announced Oct. 23. Under the Nurses for Nursing Homes initiative, nursing students and licensed nurses interested in working in a nursing home could be eligible to qualify for up to $40,000 in student loan repayment and/or a $10,000 stipend in exchange for a three-year commitment to work in a qualifying nursing home in a rural or higher labor-shortage area. CMS said the $275 million program is expected to support more than 4,000 nurses nationwide and will be funded through civil monetary penalties collected by CMS and states from nursing homes. CMS has committed $100 million, while states are committing to at least $175 million. A website for the program includes details on eligibility requirements, open positions, details on how to apply and other information.”
  • and
    • “The Centers for Medicare & Medicaid Services Oct. 23 released a proposed rule implementing new Health Insurance Marketplace eligibility verification requirements enacted under public law 1, which was signed into law in July 2025. Beginning in plan year 2028, this proposal would require the Marketplaces to verify certain eligibility information before providing advance premium tax credits and cost-sharing reductions, particularly related to citizenship and lawful presence status; residency; non-employer-sponsored minimum essential coverage; and annual household income, family size and eligible noncitizen status. The rule also would require enrollees to provide or confirm key eligibility information annually to continue receiving financial assistance, essentially ending automatic reenrollment for enrollees receiving premium tax credits.  Comments are due 30 days after publication in the Federal Register.”
  • STAT News tells us,
    • “The Trump administration late on Thursday proposed a rule that would severely restrict future U.S. investment in the Chinese biotech sector but still allow American drugmakers to buy the rights to medicines invented in the country.
    • “The Treasury Department proposed the rule to implement a law, called the Comprehensive Outbound Investment National Security Act, that restricts U.S. investment in industries of concern to national security. The department added biotechnology to the list of industries subject to COINS restrictions, joining the likes of semiconductors, artificial intelligence, and quantum technology.
    • “The proposal would prohibit U.S. companies from entering financial transactions with Chinese biotech companies or Chinese manufacturers of biotechnology-related equipment and tools, according to the research firm Veda.
    • “We are surprised by the aggressiveness of the proposed rule,” Veda stated in a research note to clients. “Both in terms of its prohibition of all biotechnology-related transactions and the broadness of the definition of biotechnology.”

From the U.S. Office of Personnel Management front,

  • Kevin Moss, writing in Federal News Network, points out “What’s changing in FEHB for 2027 (and ways to save)” during the Federal Benefits Open Season which begins on November 9, 2026.
  • Fedsmith calls attention to benefit matters that federal and postal employees and annuitants may need to address before yearend.

From the U.S. Food and Drug Administration front,

  • Beckers Health IT reports,
    • “The FDA has issued its most serious recall classification for certain hospital glucose meters after a software issue that could cause test results to be assigned to the wrong patient was linked to one serious injury.
    • “The recall affects Nova Biomedical’s StatStrip Glucose Hospital Meter System Gen 2.0, a handheld device used by hospitals to measure patients’ blood glucose levels.”
  • Beckers Hospital Review adds,
    • “The FDA has warned Baxter International over significant manufacturing violations at its Baxter Healthcare drug manufacturing facility in Round Lake, Ill., including deficiencies involving contamination controls and sterile injectable production.
    • “The agency identified the violations during a March 23-April 2 inspection, according to a Sept. 29 warning letter. The FDA said environmental monitoring had detected cephalosporin in multiple areas outside the intended production area since January 2025 and cited deficiencies in Baxter’s monitoring program.
    • “The FDA also identified deficiencies involving aseptic processing, visual inspection of sterile injectable drugs and investigations into leaking products and sterility failures. The agency said Baxter’s current equipment, process and airflow design posed “excessive contamination risk.”
  • MedTech Dive relates,
    • “Edwards Lifesciences has won Food and Drug Administration approval for its Pascal Precision system for tricuspid valve repair, the company said Wednesday.
    • “Pascal’s expanded label covers use in patients with symptomatic severe tricuspid regurgitation. Edwards previously received FDA approval for the device in degenerative mitral regurgitation.
    • “The approval should expand the group of tricuspid repair patients that Edwards can treat, Leerink Partners said in a note to investors.”
  • PharmExec informs us,
    • “The FDA today approved a subcutaneous induction regimen for AbbVie’s Skyrizi (risankizumab-rzaa) in adults with moderately to severely active Crohn’s disease. The decision lets patients start treatment at home with an on-body injector (OBI) induction pack instead of an intravenous infusion and continue with the same device during maintenance.1
    • “AbbVie filed for the new regimen April 27 and had said it anticipated approval later in 2026. The decision changes how therapy begins, not who is eligible, because intravenous induction remains an option.1
    • “People living with Crohn’s disease need treatments that can deliver meaningful disease control from the start,” said Roopal Thakkar, M.D., executive vice president, research and development, chief scientific officer, AbbVie. “With the approval of subcutaneous induction, we are building on the strong efficacy of Skyrizi while giving patients and physicians greater flexibility in how treatment is initiated. This is one more example of how AbbVie continues to advance treatment to better meet the needs of people living with Crohn’s disease.”
  • Cardiovascular Business lets us know,
    • “Eko Health has received U.S. Food and Drug Administration (FDA) clearance for Core 300, a new artificial intelligence (AI)-enabled stethoscope that offers both traditional analog and advanced digital listening capabilities. 
    • “The Core 300 stethoscopes give clinicians the ability to instantly switch from traditional listening to digital listening when evaluating both pediatric and adult patients. The technology behind Eko Health’s digital listening capabilities includes up to 35x amplification, noise cancellation and real-time heart data that is then displayed on the device. 
    • “These stethoscopes can also be connected to the Eko App or Eko’s FDA-cleared AI models for additional benefits. In addition, the battery life was designed to last for weeks at a time.” 

No Surprises Act News

  • The American Hospital Association News reports,
    • “The Centers for Medicare & Medicaid Services Oct. 23 announced that the submission period opened for petitions to deny the recertification of three independent dispute resolution entities. Members of the public, providers, facilities and others can submit a petition, which must identify the IDR entity seeking recertification and detail the reasons for the petition. The three organizations seeking recertification are National Medical Reviews Inc.; Keystone Peer Review Organization, Inc., which also does business as Acentra; and MCMC Services LLC. The petition period is open through Oct. 29. The departments of Health and Human Services, Labor, and the Treasury will make a final decision on recertification after reviewing any petitions submitted.” 

From the judicial front,

  • Fierce Healthcare reports,
    • “Centene has become the latest insurer to sue the federal government over its 2027 Medicare Advantage star ratings.
    • “In a lawsuit filed Thursday in Georgia’s Southern District Court, the company argues that the Centers for Medicare & Medicaid Services violated the Administrative Procedure Act in determining its latest scores. Centene says that CMS ran afoul of “core statutory safeguards” in deploying 17 measures.
    • “The use of those measures ultimately caused “significant injury” to the company, according to the complaint. For 2027, 9% of Centene’s members are enrolled in plans with at least four stars, which declined from 18% in the prior year.
    • “In implementing each of the individual Star measures that Centene challenges, CMS violated applicable law and thereby caused Centene to lose out on hundreds of millions of dollars in revenue that Centene could use to strengthen benefits, reduce premiums, and improve health outcomes,” the company said in the lawsuit.”

From the public health and medical / Rx research front,

  • The Centers for Disease Control and Prevention announced today,
    • “COVID-19, flu, and RSV are key indicators of overall respiratory illness activity
    • “The amount of acute respiratory illness causing people to seek health care is very low.
    • RSV activity is very low in most areas of the country.
    • “COVID-19 activity remains elevated in some regions but is declining nationally.
    • “Seasonal flu activity is increasing in many parts of the country but remains low nationally.
    • “Rhinovirus/Enterovirus (RV/EV) is elevated nationally, and parainfluenza viruses (PIV) are increasing.”
  • Beckers Clinical Leadership adds,
    • “Hawaii, Florida and Louisiana are reporting the highest percent of influenza-like illnesses.
    • “The CDC defines influenza-like illness, or ILI, as a fever of 100 degrees or greater, along with a cough and/or sore throat. The agency collects data on outpatient visits to healthcare providers for respiratory illness through ILINet. ILI percentages are weighted for state population and compared to baseline levels to assess flu activity. For more information on how the metric is calculated, click here.
    • “Hospitals reported 4,811 new flu admissions in the week ending Oct. 17, up from 4,024 the week prior, according to the CDC’s latest FluView report. About 2.2% of outpatient visits involved patients with respiratory illness. This metric sits below the national baseline of 2.9% and is up from 2.1% the week prior.”
    • The article ranks the State by their ILI percentages.
  • and
    • “The CDC has now activated six emergency responses for pathogens in 2026 — the latest a level 3 response to a record dengue outbreak in Florida — a pace that underscores how many infectious disease threats are landing on hospitals and public health agencies at once. 
    • “From a fatal new spillover in France to a bird flu outbreak left uncontained on a U.S. mink farm, the past several weeks have handed infection prevention and clinical leaders a dense cluster of public health concerns.”
  • The American Hospital Association News tells us,
    • “There are now 1,338 confirmed measles cases in Pennsylvania this year as the state’s ongoing outbreak continues, according to the latest data from the Pennsylvania Department of Health. Of those, 255 individuals have been hospitalized. The agency said that more than 56,000 doses of the measles, mumps and rubella vaccine were administered by healthcare providers across the state in September, and more than 39,000 have been administered so far this month. Providers typically administer 25,000 doses per month, the department said. Nationally, there have been 4,588 confirmed measles cases this year, according to the latest update from the Centers from Disease Control and Prevention. The vaccination status of 96% of cases is unvaccinated or unknown.” 
  • The University of Minnesota’s CIDRAP reports,
    • “Two new studies underscore the importance of the hepatitis B virus (HBV) vaccine birth dose, with a US study predicting that dropping or delaying initial vaccination would drive up chronic infections and an Ethiopian study finding lower mother-to-child transmission (MTCT) with birth-dose receipt.
    • ‘After US Health and Human Services (HHS) Secretary Robert F. Kennedy Jr. panned the first study, as well as the New York Times’coverage of it, on X, experts quickly pointed out deficiencies in his objections.”
  • The Washington Post relates,
    • “While cigarette smoking is still the primary risk factor for lung cancer, a growing proportion of patients with the disease are nonsmokers like [Bryant] Lin [M.D.]. Last week, Pope Leo had part of his right lung removed because of adenocarcinoma, the most common type of lung cancer. He is not known to have ever lit up.
    • “The drop in smoking rates in the United States and other countries has unexpectedly shed light on this as an emerging health issue. Never-smoker lung cancer is now the eighth leading cause of cancer-related death in the U.S. and the fifth most common cause of cancer-related deaths worldwide.
    • “Because I’m a physician, most people make the assumption I’ve never smoked, and they ask, ‘Why did you get lung cancer?’” Lin said. “Then I explain to them that roughly one out of five people with lung cancer in the United States have never smoked.”
    • “A growing body of research is identifying the disease’s unique clinical characteristics. In September, a study described a rare mutation concentrated in the southeastern U.S. that puts never-smokers at 60 times higher risk of developing lung cancer. The demographics of patients are also distinct — for instance, women who have never smoked are more than twice as likely to get lung cancer as men who have never smoked.”
    • “Two-thirds of nonsmoking-related lung cancer happens in women, so there’s certainly an association with female sex,” said Jaclyn LoPiccolo, a medical oncologist at the Dana-Farber Cancer Institute and author of the mutation study. “Nonsmoking-related lung cancer is also more common in people of East Asian descent, but whether that’s a genetic or environmental association, we don’t yet know.” 
    • “Regardless of gender or ethnicity, risk factors include exposure to secondhand smoke, radon, air pollution and asbestos. A family historyof any cancer diagnosed before age 50 in a first-degree relative is associated with increased lung cancer risk in nonsmokers.”
  • Health Day points out,
    • “For patients with atrial fibrillation (AF) and acute ischemic stroke, early initiation of rhythm control is associated with a lower risk for recurrent stroke or systemic embolism (SE), according to a study published online Oct. 21 in Neurology.”
  • and
    • “Women who enter menopause prematurely may have a higher risk of heart problems, due in part to higher blood sugar levels, a new study says.
    • “Women with menopause that occurred before age 40 had higher rates of heart disease and insulin resistance, researchers reported Tuesday at the annual meeting of The Menopause Society.
    • “Our findings suggest that insulin resistance may be one important pathway linking premature menopause with increased cardiovascular disease risk, highlighting the importance of cardiometabolic health in women who experience menopause before age 40,” lead researcher Zailing Xing said in a news release. She is assistant professor of epidemiology at Florida A&M University.”
  • MedPage Today adds,
    • “Neurokinin (NK)-receptor antagonists improved sleep disturbances in menopausal women, a meta-analysis of randomized controlled trials showed.
    • “Among women with moderate-to-severe vasomotor symptoms, the agents were associated with improvements in sleep disturbance as early as 4 weeks (standardized mean difference [SMD] -3.94, 95% CI -5.71 to -2.16) compared with placebo, reported Maria Julia Lemos, MD, of Kurah Women’s Health Institute in Macaé, Brazil, and colleagues.
    • “This trend continued at 12 weeks (SMD -3.11, 95% CI -4.60 to -1.61) and 24 weeks (SMD -2.04, 95% CI -3.93 to -0.15), Lemos reported during a presentation at the Menopause Society annual meeting that was co-published in Menopause.
    • “For women with hot flashes who can’t or don’t want to use hormone therapy, especially when poor sleep is one of their main complaints, these drugs are a good option to consider,” Lemos told MedPage Today. “They may help women sleep better, not just have fewer hot flashes.”
  • Harvard Health notes,
    • “A new pill that dramatically lowers harmful LDL cholesterol may be a good option for people who can’t tolerate statins or who haven’t lowered their LDL enough despite their current treatment with cholesterol-lowering drugs.
    • “Approved by the FDA in July 2026, enlicitide (Lipfendra) is the first oral version of a class of drugs known as PCSK9 inhibitors. These drugs work by mimicking the effect of a naturally occurring variant in the PCSK9 gene that leads to very low LDL levels. But the original drugs — which are given by injection once or twice a month — aren’t widely used. Some people aren’t comfortable giving themselves an injection. Also, most insurance companies won’t cover the cost (which range from $200 to $500 or more per month) until a person has tried other therapies without success.
    • “Enlicitide is a daily pill that must be taken on an empty stomach with a sip of water, black coffee, or plain tea. It lowers LDL by nearly 60%, which is similar to the injectable PCSK9 drugs. Less than 10% of users experienced either dizziness or diarrhea, the two most common side effects. A month’s supply will cost about $300; for now, insurance coverage remains unclear.”
  • Per STAT News,
    • “A multiple sclerosis treatment from Novartis cut by a third the rates of relapses that people with the condition have compared to a standard treatment, data presented Friday show. While that efficacy doesn’t match the performance of a rival drug from Roche, Novartis’ treatment has a cleaner safety profile that could give it a shot at being competitive in the market.”
  • and
    • “A chemotherapy-free combination of Tango Therapeutics’ experimental drug vopimetostat and Revolution Medicines’ recently approved Rasonque shrank tumors in 82% of patients with advanced pancreatic cancer, early-stage data presented at ESMO show. The Phase 1/2 trial enrolled 22 heavily pretreated patients whose tumors harbor MTAP deletions, a genetic alteration found in roughly 40% of pancreatic cancers.”
  • Beckers Hospital Review adds,
    • “Bristol Myers Squibb said Oct. 23 a study participant died from septic pneumonia about six weeks after receiving a dose of a CAR-T cell therapy being tested for multiple sclerosis. 
    • “The phase 1 trial included 66 patients with highly active relapsing multiple sclerosis or progressive forms of multiple sclerosis. In the study, most adverse events were “brief and reversible,” according to BMS. 
    • “After receiving the CAR-T therapy, zolacabtagene autoleucel, 28 of the 66 participants experienced cytokine release syndrome events, or hyperinflammation. Six patients had immune effector cell-associated neurotoxicity syndrome, including one life-threatening case, which resolved within two to four days.”

From the U.S. healthcare business and artificial intelligence front,

  • Beckers Payer Issues reports,
    • “Blue Cross Blue Shield of Massachusetts and Burlington, Mass.-based Tufts Medicine are partneringon a new health plan for BCBS employees, as well as AI implementation to streamline prior authorization.
    • “The HMO, Tufts Medicine Alliance Network, includes access to Tufts Medicine, Boston Children’s Hospital and Dana-Farber Cancer Institute. The HMO also provides next-day primary care access and specialist access within 21 days, according to an Oct. 22 news release.
    • “BCBS told Becker’s that about 35% of its workforce lives within the plan’s region, and that the plan will be available during their open enrollment. BCBS and Tufts Medicine said they are considering expanding the HMO’s availability to other employers in the future and are collaborating on similar offerings.”
  • Fierce Pharma relates,
    • “Last week’s federal holiday, Columbus Day, led to an unsurprising dip for prescriptions of both Novo Nordisk’s Wegovy pill and Eli Lilly’s oral GLP-1 rival Foundayo in the U.S. 
    • “In the prior-week reporting period, Novo’s Wegovy pill saw prescriptions fall slightly to around 173K versus the 173.5K tallied the week ending Oct. 9, according to Citi and Jefferies analysts, both of whom leverage prescribing data from IQVIA.”
    • “For that same period, prescriptions of Eli Lilly’s GLP-1 pill Foundayo slipped around 4% week over week to 58K. 
    • “The minor reversal for both drugs shouldn’t come as a surprise, given that national holidays are liable to impact weekly prescribing trends. 
    • “Looking at the broader oral GLP-1 market, Lilly’s share presently sits a little higher than 25%, according to the Jefferies team, while Novo holds a nearly 75% piece of the pie. 
    • “Meanwhile, as Novo and Lilly vie over the ever-important U.S. obesity market, the GLP-1 opportunity taking shape across other massive countries like China, India and Brazil could grow from $6.6 billion now to a whopping $22 billion by the middle of the next decade, according to a new J.P. Morgan estimate reported by Reuters Friday.” 
  • MedTech Dive tells us,
    • “Qiagen said Wednesday it has agreed to a takeover offer from EQT Private Equity valued at 10.8 billion euros (about $12.1 billion), including approximately $1.1 billion of debt.
    • “The agreement comes less than two months after the testing company, long a rumored takeover target, installed Jonathan Pratt as its new CEO. Six years ago, Thermo Fisher Scientific was set to buy Qiagen, but the deal fell apart after shareholders objected to the price.
    • “William Blair analysts, in a Thursday note, said EQT’s all-cash offer of 46.50 euros per share (about $52.20) was reasonable, given Qiagen’s relatively lower growth profile.”
  • Beckers Health IT informs us,
    • “Philadelphia-based Jefferson Health’s ambient AI rollout was associated with up to 16.6% less after-hours documentation and up to 39.3% faster chart closure among its most active users, according to a study published Oct. 23 in NEJM Catalyst Innovations in Care Delivery.
    • “The analysis covered 5,234 clinicians with access to Abridge’s ambient documentation tool, which runs inside Jefferson’s Epic EHR. It also covered 283,028 ambulatory encounters with matched patient experience surveys from July 1 to Dec. 31, 2025. Use was voluntary, and about 34% of clinicians with access actively recorded visits.
    • “Results were reported in two cohorts that reflect the separate EHR instances of Jefferson and Allentown, Pa.-based Lehigh Valley Health Network, which merged in August 2024. Among 637 clinicians who met the usage thresholds, Epic Signal data comparing 12 weeks before and after adoption showed several declines. Time in notes per appointment fell 10.5% and 17.3%. “Pajama time” fell 8.9% and 16.6%. Time to chart closure fell 25.3% and 39.3%. Weekly progress note volume held steady or rose.”

Thursday report

David Ermer–Agentic & Generative AI, CDC, CMS, FDA, Federal employment benefits, Medical / Rx research, Medicare, OPM, U.S. Healthcare–

Simplicity is a virtue.

From Washington, DC,

  • The Wall Street Journal reports,
    • “A top ally of Health Secretary Robert F. Kennedy Jr. is departing the Trump administration after frustrations with White House delays on Kennedy’s food agenda. 
    • “Calley Means, a senior adviser to Kennedy who also worked in the White House to further “Make America Healthy Again” policies, quit his role on Thursday, he told The Wall Street Journal.
    • “I leave with tremendous respect for President Trump and Robert F. Kennedy Jr.,” he said. “This movement is in the first inning and just getting started.” Means said he would continue working to further Kennedy’s MAHA agenda.”
  • Per a Health and Human Services Department news release,
    • “The U.S. Department of Health and Human Services (HHS) today announced the 2026 Update to the National Plan to Address Alzheimer’s Disease and Related Dementias, taking Department-wide actions to guide coordinated federal action on dementia risk reduction, research and innovation, care, and support for people living with dementia and their families. Secretary Kennedy made the announcement at the Broward Health Medical Center in Fort Lauderdale, Florida.
    • “Millions of American families have seen the devastating toll of Alzheimer’s disease and related dementias,” said HHS Secretary Robert F. Kennedy, Jr. “Under President Trump, HHS is shifting the national strategy toward prevention, earlier detection, and faster development of better diagnostics and treatments. We are advancing gold-standard science, reducing risk where we can, improving care, and giving patients and families stronger support at every stage of the disease.”
    • “The updated plan puts greater emphasis on reducing dementia risk across the lifespan and translating scientific discoveries into better prevention, diagnosis, treatment, and care. It also formally recognizes related dementias in the plan’s title, reflecting public input and the shared challenges that patients and families face across different forms of dementia.” * * *
    • “Details on the National Plan and participating agencies’ initiatives are available at hhs.gov/aging/adrd.”
  • The New York Times adds,
    • “Alzheimer’s Researchers Look at an Unusual Data Point: Head Shape.
      • “Could the geometry of our brains increase the risk of Alzheimer’s disease? It’s a provocative question, but one that some scientists are beginning to explore.”
  • Beckers Health IT relates,
    • “HHS plans to award Anthropic a sole-source contract to keep its workforce on the company’s Claude AI tools without an open competition.
    • “The agency posted a notice of intent Oct. 19 on SAM.gov for a “limited continuity of services award.” The award would run until the department completes a competitive multiple-award blanket purchase agreement for enterprise frontier AI models. The notice did not list a contract value or projected award date.
    • “HHS argued that only Anthropic can meet the requirement because Claude is the company’s proprietary model family and is already integrated into department infrastructure. Covered capabilities include chat, drafting and summarization, coding assistance, agentic features, connectors, and administrative controls such as single sign-on and audit export.” * * *
    • “The notice comes as Anthropic’s discounted General Services Administration OneGov deal is set to expire Oct. 31, FedScoop reported. HHS rolled out Claude across the department in December 2025 after Anthropic offered its services to agencies for $1 a year.”
  • Beckers Hospital Review tells us,
    • “Under the Healthcare False Claims Act Self-Disclosure Pilot Program, companies that meet the requirements can settle disclosed conduct through a coordinated civil release that covers the False Claims Act and certain HHS administrative authorities, according to an Oct. 22 news release shared with Becker’s. 
    • “To qualify, healthcare companies must:
      • “Reveal all relevant details of the potential violations;
      • “Provide documents that show the full nature and scope of the conduct;
      • “Detail remedial steps taken;
      • “Repay the government under the protocol, which applies a multiplier of 1.25 to 1.6
    • “The multiplier depends on various factors, including how quickly the company provided disclosure, and the scope and duration of the misconduct, whether senior leadership was involved, the company’s financial benefit, and whether the company inherited the liability via a transaction but fixed the issue promptly.
    • “In return, companies will get a Justice Department release for disclosing the conduct. As part of the resolution, the HHS Office of Inspector General will not impose exclusion or require a corporate integrity agreement. CMS will also not revoke billing or enrollment privileges, and neither CMS nor OIG will impose civil monetary penalties.”

From the U.S. Office of Personnel Management front

  • Tammy Flanagan, writing in Govexec, considers
    • “If you already have FEHB, should you sign up for Medicare B?
      • “Pairing your federal health plan with Medicare can lower out-of-pocket costs, but monthly premiums and income-based surcharges add up. Here’s what to consider before deciding whether the extra coverage is worth the price.”
  • FedWeek tells us,
    • “Several key figures are increasing for 2027 in the Social Security program affecting both current employees and retirees.
    • “For the former group, the 6.2 percent Social Security payroll tax will apply on up to $192,300 of earnings, up from $184,500. For FERS employees, that tax cuts off at that threshold and from there on they pay only the civil service retirement contribution (which is 0.8, 3.1 or 4.4 percent, depending on when they were hired).
    • “Above the cutoff CSRS Offset employees continue to pay 6.2 percent into Social Security and their pertinent percentage into the federal retirement fund, but all the money after that point goes into the federal retirement fund instead. Employees under “pure” CSRS don’t pay the Social Security payroll tax.
    • “For those drawing Social Security benefits, the earnings test applying to beneficiaries aged 62 through their “full” retirement age (65-67, depending on year of birth; 67 for those born in 1960 and after), will rise from $24,480 to $25,56v0. Those beneficiaries lose $1 in Social Security benefits for every $2 in earnings through employment or self-employment earnings above the limit.
    • “A separate earnings test applies only to earnings for months in the year an individual reaches full retirement age but prior to the individual attaining that age. One dollar in benefits will be withheld for every $3 in earnings above $67,920, up from $65,160. There is no limit on earnings beginning the month an individual attains full retirement age.”

From the U.S. Food and Drug Administration front,

  • The Washington Post reports,
    • “Federal health officials are investigating a multistate salmonella outbreak that has been linked to raw oysters and sickened 27 people across a dozen states. 
    • “Five of the cases have involved hospitalizations, health officials said. 
    • “The Centers for Disease Control and Prevention said an investigation is underway of infections linked to raw oysters harvested by the Little Wicomico Oyster Co. from the Little Wicomico River’s harvest area in Virginia. 
    • “The company recalled oysters harvested from that area from Sept. 18 through Oct. 8. People are advised not to eat, sell or serve them, officials said.”
  • Per an FDA news release,
    • “The U.S. Food and Drug Administration today announced the launch of the Neuroscience Advancement and Innovation Nexus (NAIN), a new agency program aligned with the Trump Administration’s efforts to accelerate medical innovation and deliver breakthrough treatments. NAIN is designed to advance the science, tools, and regulatory approaches needed to support the development of medical products for conditions affecting the brain and nervous system. NAIN’s inaugural initiative, the Alzheimer’s Prevention Accelerator, will focus on advancing medical products that help delay or prevent Alzheimer’s disease. Both efforts support the National Alzheimer’s Project Act (NAPA), the federal government’s comprehensive roadmap for coordinated action on Alzheimer’s and related dementias.”
  • Beckers Hospital Review tells us,
    • “The FDA has granted accelerated approval to Ultomiris (ravulizumab) to reduce proteinuria in adults with primary immunoglobulin A nephropathy at risk for disease progression, making it the first and only C5 complement inhibitor approved for this use.
    • “The approval followed Priority Review and was based on a prespecified interim analysis of the I CAN phase 3 trial, according to an Oct. 21 news release. Ultomiris demonstrated a 43.4% reduction in proteinuria compared with placebo at 34 weeks.
    • “Ultomiris is administered intravenously every eight weeks in adults, based on body weight, following a loading dose. The trial’s safety profile was consistent with the known profile of Ultomiris, with no new safety concerns identified.”
  • BioPharma Dive informs us,
    • “Compounding pharmacy Apothecary Pharma has issued a voluntary recall of its copycat version of Eli Lilly’s obesity drug Zepbound, stating in a notice that it couldn’t definitively guarantee the medication’s safety.
    • “The recall, of which Apothecary notified the Food and Drug Administration in September, covers 22 lots of compounded tirzepatide, the active ingredient in Lilly’s medicine. Those lots have beyond-use dates ranging from Oct. 8 to Nov. 26.
    • “Apothecary’s recall comes as Lilly and Novo, the only makers of FDA-licensed GLP-1 obesity medications, have sought to stop companies from selling compounded counterparts. The recall could help bolster Lilly and Novo’s claims that the knockoff versions don’t have the same quality, safety or efficacy as the FDA-approved ones.”
  • STAT News adds,
    • “For the popular diabetes and obesity medications known as GLP-1s, addiction medicine is one of many possible promising next acts.
    • “Eli Lilly is investigating a new drug, brenipatide, and testing it in alcohol use disorder. A new company called Baseline Therapeutics is studying a GLP-1 receptor agonist in alcohol, cocaine, and methamphetamine use disorders; Altimmune is testing one called pemvidutide for alcohol. Addiction medicine specialists are hopeful that the Food and Drug Administration may soon approve a new medication for alcohol use disorder — the first in two decades. 
    • “But some telehealth platforms that specialize in treating addiction aren’t waiting. In the last year, a few companies have begun to market off-label prescriptions of GLP-1s, both branded and compounded, to treat alcohol use disorder and other addictions. 
    • “Trying to drink less but your doctor won’t prescribe a GLP-1?” reads a Facebook ad from a telehealth brand called Livelyhood, which started offering the drugs in April. “Livelyhood can.” 
    • “Another, called Quel, launched in September as an online extension of the off-label prescribing at a Pennsylvania-based addiction treatment center.” * * *
    • “Telehealth companies recognized the potential for opportunism in prescribing GLP-1s for addiction ahead of FDA approval, while maintaining that their platforms are the exception. And it’s not necessarily lucrative: “Economically, GLP-1 for alcohol use disorder is much tougher than pretty much any other GLP-1 indication,” said Lively. 
    • “If that’s the case, Witkiewitz wonders: Why not wait for an FDA approval? Klein and Lira said they look forward to prescribing new drugs if they are approved. But Witkiewitz worries that if early adopters see bad outcomes, patients could be deterred from seeking approved treatments in the future. “We’re so close to having this done right and well, or having it done in a way that protects patients to the best of our abilities,” she said. “Caution is warranted, and some patience is warranted.”

From the fraud, waste and abuse front,

  • Beckers ASC Review reports,
    • “Five physicians are among 15 defendants charged in a Los Angeles healthcare fraud takedown involving $2 billion in alleged fraudulent claims, according to an Oct. 22 news release from the U.S. Attorney’s Office for the Central District of California. 
    • “Most of that total comes from a $1.6 billion substance abuse treatment scheme that DOJ calls the largest of its kind it has ever prosecuted. The physicians’ cases make up a smaller share.”
  • The Wall Street Journal adds,
    • “A Southern California drug-rehab operator allegedly engaged in an elaborate scheme that involved providing recovering addicts with illegal drugs in order to keep billing their insurers for treatment, according to federal prosecutors. 
    • “Facilities associated with Nathan Young submitted more than $1.6 billion in claims to major health insurers and were paid over $210 million between 2020 and 2026, including billings for “non-existent and woefully inadequate ‘therapy’ sessions,” prosecutors said in a recently filed criminal complaint.
    • “Young and his father, David Young, were arrested last week. Lawyers representing the Youngs didn’t respond to requests for comment. The Youngs were charged with healthcare fraud and violating an anti-kickback statute, according to federal prosecutors.” 

From the public health and medical / Rx research front,

  • Cardiovascular Business reports,
    • “Forty-three percent of on-duty firefighter fatalities over the last 35 years were attributed to cardiac causes, according to a new study published in JACC: Advances.[1] These findings call into question the types of screenings firefighters should undergo to detect potential heart problems.
    • “Researchers at Cedars-Sinai Health Sciences University explored autopsy findings from more than 3,000 on-duty firefighter deaths. The group said the proportion of cardiac-related fatalities has steadily increased over the years However, cardiac related deaths have been on the decline for the general U.S. population over the same time period.  
    • “These findings might indicate the need to change annual health screenings for firefighters. Current national screening recommendations rely on exercise stress testing, which can identify ischemic issues with blood flow, but may miss hidden structural remodeling of the heart that could lead to sudden cardiac arrest.
    • “Our research shows there may be a blind spot when it comes to routine heart screenings for firefighters in the U.S.,” senior author Alan Kwan, MD, assistant professor of cardiology in the Smidt Heart Institute at Cedars-Sinai, said in a statement. “Identifying heart conditions when they can be treated is key to addressing these new findings.”
  • Health Day relates,
    • “Newly eligible younger adults are less likely to have discussed colorectal cancer (CRC) screening with their clinician compared with their older counterparts, according to a study published online Oct. 18 in the Journal of General Internal Medicine to coincide with the American Association for Cancer Research Conference on The Science of Cancer Health Disparities, held from Oct. 18 to 21 in Atlanta.” * * *
    • “This finding strongly suggests that patients who are newly age-eligible for screening are not receiving adequate information about their screening options from a health professional, and that could be contributing to low screening rates in this age group,” [lead researcher] Jordan Baeker Bispo, Ph.D., M.P.H. said in a statement.
  • and
    • “Smartphones are costing teenagers a good night’s sleep, a new study says.
    • “Teens who use their phones late into the evening suffer from delays in falling asleep, shorter total sleep time, and sleep that’s more restless and broken, researchers reported Oct. 19 in JAMA Pediatrics.
    • “These findings suggest that reducing evening smartphone use, particularly after 10 p.m. and immediately before bedtime, may help improve sleep health in adolescents,” concluded a team led by Dr. Dimitri Christakis, a professor of general pediatrics at Seattle Children’s Research Institute.”
  • Nature adds,
    • “The speed at which regions of the brain mature during early adolescence can forecast the emergence of mental-health conditions up to four years before symptoms develop, according to a study of nearly 12,000 young people in the United States.
    • “By tracking the brains of adolescents over six years in nearly 30,000 scans, researchers mapped how the brain’s outer layer, the cerebral cortex, thins as children grow into teenagers. The team observed that sensory areas of the cortex thinned, or matured, first, followed by the regions responsible for complex thought.
    • “The findings, posted on 11 October on the preprint server bioRxiv1 ahead of peer review, challenge the theory that psychiatric disorders are caused by defects in specific brain circuits. Instead, they indicate that vulnerability to mental-health symptoms could involve disruption of the brain’s developmental timeline and could be set in motion by genes that are active before birth.
    • “The work “provides one of the clearest pictures yet of how the cortex develops from childhood into adolescence”, says Avram Holmes, a systems neuroscientist at Rutgers University in New Brunswick, New Jersey, who was not involved in the study. “It makes you think about the timing of brain development, not just the location [in the brain], when we look at psychiatric symptoms,” he says.
  • Beckers Clinical Leadership informs us,
    • “Receiving a personalized mRNA-based cancer vaccine alongside immunotherapy lowered the risk of recurrence or death by 42% versus immunotherapy alone in a phase 3 clinical trial of patients with surgically resected stage 2B to 4 melanoma.
    • “The vaccine, called intismeran autogene and jointly developed by Merck and Moderna, was tested in combination with Merck’s immunotherapy Keytruda after surgery as part of the phase 3 INTerpath-001 trial, according to an Oct. 22 news release from the companies. 
    • “The trial results were leaked online Oct. 22, The Wall Street Journal reported, two days before Merck and Moderna were expected to present the data at the European Society for Medical Oncology conference in Madrid.” * * *
    • “Read the latest trial results from Merck and Moderna here.”  
  • Fierce Pharma points out,
    • “Delaying the use of subcutaneous Parkinson’s disease treatments by one year increases annual medical costs by 59.1%, AbbVie-sponsored research found.
    • “The study, which researchers will present (PDF) at the AMCP Nexus Conference this month, modeled the impact of delaying the initiation of two subcutaneous therapies by one year. One therapy comprised foslevodopa and foscarbidopa, the combination that AbbVie sells as Vyalev. The other therapy featured apomorphine, the active ingredient in Supernus Pharmaceuticals’ Onapgo.” 

From the U.S. healthcare business and artificial intelligence front,

  • The Wall Street Journal reports,
    • “A KFF survey shows the average cost of a family health plan rose 5% this year, while workers’ contributions increased 9% to $7,471.
    • “Employers are facing healthcare cost increases driven by high-cost drugs and hospitals raising prices and using AI tools to boost billing.
    • “To manage rising costs, some employers are increasing workers’ premium contributions, raising deductibles and dropping coverage for GLP-1 drugs.”
  • Beckers Payer Issues relates,
    • “Molina Healthcare reported $38 million in net income for the third quarter of 2026, a 52% year-over-year drop from $79 million.
    • “The insurer attributed the decline mainly to a higher consolidated medical loss ratio, which was  92.9% in Q3, up from 92.6% a year earlier. Total revenue for the quarter was $11.1 billion, down 3.4% year over year. Premium revenue fell approximately 4% to $10.5 billion, reflecting lower membership in Medicaid and the ACA marketplace, partially offset by rate updates.
    • “With the apparent plateauing of medical cost trend, which remains at elevated levels, and the strength of recent rate updates for 2027, we believe we are likely observing the beginning of the turn in Medicaid margins,” President and CEO Joseph Zubretsky said in an Oct. 21 news release.”
  • and
    • “Medicare Advantage annual enrollment kicked off Oct. 15, and the ACA open enrollment period is around the corner. Employers are also navigating cost pressures, opening the door to innovative plans.
    • “Insurers have been primed to consider new health plans across commercial and government programs, and many are biting.
    • “Not every organization rolling out health plans in the coming years is a traditional insurer, however. For example, Tacoma, Wash.-based MultiCare Health System and the Muscogee (Creek) Nation are entering the MA market.
    • “The trend has extended to the employer space. Tech-enabled healthcare company Included Health said it will introduce health plans for self-insured employers Jan. 1, 2028, following its acquisition of Firefly Health, a clinically integrated health plan and advanced primary care company. Health technology and benefits administration platform Judi Health is launching a Medicare Part D Employer Group Waiver Plan, as well.”
  • Fierce Healthcare tells us,
    • “Redesign Health is making a major push deeper into health system-led innovation, merging with Sheba Medical Center’s innovation arm ARC Global.
    • “Together, the organizations want to create an end-to-end platform that helps health systems turn ideas originating with their own clinicians and operators into technology products and standalone companies that can then be scaled across a global network, company executives said. The deal was announced Thursday.
    • “The combined company is valued at approximately $2 billion, according to a source with knowledge of the deal.”
  •  and
    • “Talkiatry is expanding virtual therapy services nationwide as part of a broader push to provide comprehensive behavioral health services across the acuity spectrum, from low to high.
    • “As a national mental health practice that provides in-network psychiatry and therapy, the expansion also positions the company to offer broader behavioral health services to health systems, payers and employers.
    • “The company initially built its scale around telepsychiatry, with more than 800 employed psychiatrists and a large national insurance footprint. Talkiatry claims to be the nation’s largest private employer of psychiatrists as well as the preferred in-network psychiatry partner for more than 70 U.S. health systems.”
  • Per MedTech Dive,
    • “Labcorp said Tuesday that it has agreed to acquire Myriad Genetics’ prenatal health testing business for $210 million.
    • “The deal covers tests for assessing fetal risk of certain conditions and other aspects of prenatal care. Labcorp expects the tests to add about $160 million in revenue in year one. 
    • “Evercore ISI analysts see room for Labcorp to improve the economics of the acquired business using its infrastructure and to broaden access to the tests through its provider relationships.”
  • SmartBrief informs us,
    • “AI is making medical information easier to access.  According to a recent KFF poll, nearly a third of US adults have used AI for health information or advice in the past year, and nearly 1 in 5 have used it to compare treatment options.
    • “The appeal is clear. People can ask health questions in their own words and get answers almost immediately. But receiving an answer and knowing how and when to use it—and whether they can rely on it—are different things.
    • “Health plans will see an increasing number of members using AI to evaluate their care options. That reality creates a need for plans to fill in the gaps of today’s AI capabilities.”
    • The article identifies pathways.
  • Beckers Health IT adds,
    • “Microsoft’s AI diagnostic system correctly diagnosed 83.2% of complex New England Journal of Medicine cases, compared with 36.1% for generalist physicians, according to a study published Oct. 22 in Science.
    • “The system, called Diagnostic Orchestrator, or DxO, simulates a panel of physicians. It starts from a brief clinical presentation, then asks questions, orders tests and revises the differential diagnosis step by step. Microsoft researchers tested it on 304 NEJM clinicopathological conference cases and 325 emergency department admissions from the MIMIC-IV-ED dataset.
    • “On the emergency cases, DxO running OpenAI’s GPT-5 reached 80.3% accuracy, compared with 46.8% for physicians.
    • “The researchers also tracked estimated testing costs, using the chargemaster of Kaiser Permanente Washington’s Central Hospital in Seattle. With no budget limits, DxO averaged $5,431 per complex case. With budget constraints, it hit 80.9% accuracy at $2,241. Physicians using search and reference tools averaged $4,725.” * * *
    • “Microsoft plans to evaluate DxO in real-world settings through a partnership with Beth Israel Deaconess Medical Center in Boston, TechCrunch reported Oct. 22.”