Cybersecurity Saturday

Generative AI

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the CrowdStrike outage front,

  • Dark Reading reports,
    • The CrowdStrike update that hobbled businesses, disrupted consumer travel plans, and took French and British broadcasters offline has predictably led to a host of lawsuits filed by investors and customers of both CrowdStrike and other affected companies.
    • Yet the incident could lead to another destination: software liability.
    • The overall consensus among legal experts is that CrowdStrike is likely protected by its terms and conditions from reimbursing customers for more than they paid for the product, limiting its software liability in what the company now refers to as “the Channel File 291 Incident.” However, the fact that affected businesses and consumers have little recourse to recover damages will likely lend momentum to legislation and state regulations to hold firms responsible for such chaos, says Chinmayi Sharma, associate professor of law at Fordham University.
  • Cybersecurity Dive lets us know,
    • “A mismatched software update in CrowdStrike’s Falcon sensor led to the crash that caused a global IT outage of millions of Microsoft Windows systems on July 19, the company said Tuesday. 
    • “CrowdStrike, in a root cause analysis report, said the Falcon sensor expected 20 input fields in a rapid response content update, but the software update actually provided 21 input fields. The mismatch resulted in an out-of-bounds memory read, leading to the system crash. 
    • “We are using lessons learned from this incident to better serve our customers,” CrowdStrike CEO George Kurtz said in a statement Tuesday. “To this end, we have already taken decisive steps to prevent this situation from repeating, and to help ensure that we – and you – become even more resilient.”
  • and
    • “CrowdStrike is in talks to acquire Action1, a Houston-based patch management and vulnerability specialist. The agreement being discussed would value the company at nearly $1 billion, according to a memo sent to Action1 employees. 
    • “Action1 Co-Founder and CEO Alex Vovk sent a memo to employees Wednesday confirming the discussions, after speculation around the talks gained within the company. A spokesperson for Action1 confirmed the authenticity of the memo to Cybersecurity Dive Friday. 
    • “This proves that Action1 is in a rapidly growing market and explains why Action1 is experiencing hypergrowth and is on track to soon reach $100M AAR,” Vovk wrote in the memo.” 

From the cybersecurity policy front,

  • Per Cybersecurity Dive,
    • “For Cybersecurity and Infrastructure Security Agency Director Jen Easterly the doomed CrowdStrike software update that took global IT systems and networks offline last month holds a “big lesson” for critical infrastructure.
    • “The CrowdStrike incident was such a terrible incident,” Easterly said Wednesday during a media briefing at Black Hat, but “it was a useful exercise, like a dress rehearsal for what China may want to do to us.”
    • “The outage was not the result of a malicious act, but rather a basic field input error that caused an out-of-bounds memory read. Yet, to Easterly, the widespread chaos it caused offers a clear example of what could occur if China-affiliated attackers make good on its efforts to cause systemic disruption to U.S. critical infrastructure.
    • “When Easterly learned of the outage, around 2 a.m. on July 19: “What was going through my mind was ‘oh, this is exactly what China wants to do.’”
  • Per Cyberscoop,
    • “Jen Easterly, the head of the Cybersecurity and Infrastructure Security Agency, told attendees at the Black Hat security conference on Thursday that delivering major improvements in computer security will require a sea change in how companies approach building software. 
    • “Amid an epidemic of breaches, Easterly laid the blame squarely at the feet of the technology industry. “We don’t have a cybersecurity problem. We have a software quality problem,” she said. 
    • “We have a multi-billion dollar cybersecurity industry because for decades, technology vendors have been allowed to create defective, insecure, flawed software,” Easterly said in her remarks.
    • “To address that issue, Easterly and CISA have launched a secure by design pledge, the signatories of which commit to a series of principles to improve the security of how products are developed and deployed. Easterly said 200 companies have now signed that pledge since its launch in March.”   
  • To that end, this week, CISA and the FBI posted their “Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem.” Here’s a link to the federal government’s Internet Complaint Center supplement guidance on this effort.
  • Cyberscoop also tells us,
    • “A year after asking the hacker community how they can better help protect the open source software that is the foundation of the digital economy, the White House is looking to better secure the ecosystem through a new office dedicated to study such components in critical infrastructure.
    • “The Office of the National Cyber Director released new details Friday on several projects aimed at securing open source software. The report comes a year after the office asked attendees at DEF CON in 2023 to contribute to a request for information around how to better focus on securing open source software.
    • “The new office runs out of the Department of Homeland Security and will examine the prevalence of open source software present in critical infrastructure and how to secure it, said Nasreen Djouini, senior policy advisor at the Office of the National Cyber Director. The program will have the support of the Department of Energy’s national labs, including at Los Alamos and Lawrence Livermore.”

From the cybersecurity vulnerabilities and breaches front,

  • Again, per Cyberscoop,
    • “An Israeli cybersecurity firm has identified a zero-day vulnerability affecting major web browsers that could allow attackers to bypass normal browser security measures and potentially breach local networks.
    • “The flaw, discovered by Oligo Security, was found in how browsers handle network requests. 
    • “In summary, devices read IP addresses to connect users to websites, with 0.0.0.0 serving as a placeholder until a real address is assigned. Oligo researchers found that a would-be attack can exploit how browsers like Apple’s Safari, Google’s Chrome and Mozilla’s Firefox handle queries to 0.0.0.0, redirecting them to other addresses such as ‘localhost,’ which is typically private. 
    • “This exploit allows attackers to access private data by sending requests to 0.0.0.0. Attackers could then perform all types of nefarious actions, gaining unauthorized access and executing remote code on locally running programs, which could impact development platforms, operating systems and internal networks.
    • Oligo has dubbed the vulnerability “0.0.0.0 day,” and wrote in a blog post that it considers it to be “far-reaching, affecting individuals and organizations alike.”
  • Here are the known exploited vulnerabilities that CISA added to its catalog this week,
  • Security Week points out,
    • The US cybersecurity agency CISA on Thursday informed organizations about threat actors targeting improperly configured Cisco devices.
    • The agency has observed malicious hackers acquiring system configuration files by abusing available protocols or software, such as the legacy Cisco Smart Install (SMI) feature. 
    • This feature has been abused for years to take control of Cisco switches and this is not the first warning issued by the US government. 

From the ransomware front,

  • Per a CISA press release,
    •  “CISA—in partnership with the Federal Bureau of Investigation (FBI)—released an update to joint Cybersecurity Advisory #StopRansomware: Royal Ransomware, #StopRansomware: BlackSuit (Royal) Ransomware. The updated advisory provides network defenders with recent and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with BlackSuit and legacy Royal activity. FBI investigations identified these TTPs and IOCs as recently as July 2024.
    • “BlackSuit ransomware attacks have spread across numerous critical infrastructure sectors including, but not limited to, commercial facilities, healthcare and public health, government facilities, and critical manufacturing.
    • “CISA encourages network defenders to review the updated advisory and apply the recommended mitigations. See #StopRansomware for additional guidance on ransomware protection, detection, and response. Visit CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including additional recommended baseline protections.”
  • Per Bleeping Computer,
    • ‘​On Tuesday (August 6], IT and phone systems at McLaren Health Care hospitals were disrupted following an attack linked to the INC Ransom ransomware operation.
    • “McLaren is a non-profit healthcare system with annual revenues of over $6.5 billion, which operates a network of 13 hospitals across Michigan supported by a team of 640 physicians. It also has over 28,000 employees and works with 113,000 network providers throughout Michigan, Indiana, and Ohio.
    • “While McLaren Health Care continues to investigate a disruption to our information technology system, we want to ensure our teams are as prepared as possible to care for patients when they arrive,” a statement on the health system’s website reads.”

From the cybersecurity defenses front,

  • Dark Reading writes about how
    • “Enterprises are implementing Microsoft’s Copilot AI-based chatbots at a rapid pace, hoping to transform how employees gather data and organize their time and work. But at the same time, Copilot is also an ideal tool for threat actors.
    • “Security researcher Michael Bargury, a former senior security architect in Microsoft’s Azure Security CTO office and now co-founder and chief technology officer of Zenity, says attackers can use Copilot to search for data, exfiltrate it without producing logs, and socially engineer victims to phishing sites even if they don’t open emails or click on links.
    • The article explains how to avoid such attacks.

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the CrowdStrike front,

  • Dark Reading explains why the CrowdStrike outage should be a wakeup call for cybersecurity experts. “The incident serves as a stark reminder of the fragility of our digital infrastructure. By adopting a diversified, resilient approach to cybersecurity, we can mitigate the risks and build a more secure digital future.”
  • Cybersecurity Dive reports,
  • and
    • Federal officials said the global IT outage stemming from a faulty CrowdStrike software update is raising prior concerns about the security of the software supply chain. 
    • The U.S. Government Accountability Office released a report Tuesday [July 30] noting the July 19 outage, which led to the disruption of 8.5 million Microsoft Windows systems. The CrowdStrike incident resurrected concerns raised during the state-linked supply chain attack against SolarWinds in 2020, according to the GAO. 
    • The CrowdStrike incident highlights specific warnings about memory safety issues in software development, the White House said on Thursday. The remarks build on a February report that raised questions about the link between memory safety issues and software vulnerabilities. 
  • and
    • “The global IT outage stemming from a faulty CrowdStrike software update will lead to cyber insurance losses primarily driven by business interruption claims, Moody’s Ratings said in a report released Monday. 
    • “Businesses are expected to make claims under “systems failure” provisions, coverage that is becoming standard for cyber insurance policies, because the incident was not considered a malicious attack. Moody’s said insured organizations will link claims to direct business losses as well as contingent losses of third-party vendors. 
    • “The outage is likely to spur larger reviews of underwriting, with a focus on systems failure, according to Moody’s. The outage has already raised concerns about the risk of single points of failure, as lone organizations with a vast footprint can bring down operations across so many critical industries.”

From the cybersecurity policy front,

  • Cyberscoop lets us know,
    • “Cybersecurity legislation aimed at unscrambling regulations, strengthening health system protections and bolstering the federal workforce sailed through a key Senate committee Wednesday [July 31], moving the trio of bipartisan bills to future consideration before the full chamber.
    • “The Senate Homeland Security and Governmental Affairs Committee voted first on the Streamlining Federal Cybersecurity Regulations Act, a bill co-sponsored by committee Chair Gary Peters, D-Mich., and Sen. James Lankford, R-Okla., that seeks to streamline the country’s patchwork of federal cyber rules. 
    • “The bill would harmonize federal cyber requirements for the private sector, which has long been critical about conflicting rules imposed by agencies. A committee made up of the national cyber director, the chief of the Office of Management and Budget’s Office of Information and Regulatory Affairs, the heads of each federal regulatory agency and other government leaders as determined by the chair would be charged with identifying cyber regulations deemed “overly burdensome, inconsistent, or contradictory” and recommending updates accordingly.
    • “Also moving forward Wednesday was the Healthcare Cybersecurity Act from Sens. Jacky Rosen, D-Nev., Todd Young, R-Ind., and Angus King, I-Maine. The legislation, which came in the aftermath of the February ransomware attack on the payment processor Change Healthcare, calls on the Cybersecurity and Infrastructure Security Agency to collaborate with the Department of Health and Human Services on cyber defenses, providing resources to non-federal entities connected to threat indicators.” * * *
    • “The final cyber bill headed to the full Senate is the Federal Cyber Workforce Training Act, which tasks the national cyber director with coming up with a plan to create a centralized resource and training center for federal cybersecurity workforce development.” 
  • Fedscoop tells us,
    • “Lisa Einstein, the Cybersecurity and Infrastructure Security Agency’s senior adviser for artificial intelligence, has been tapped to serve as the agency’s first chief AI officer.
    • “A Stanford and Princeton graduate who joined CISA in 2022 as executive director of its Cybersecurity Advisory Committee, Einstein will assume the CAIO role at a time when the agency is attempting to leverage the technology to advance cyber defenses and more effectively support critical infrastructure owners and operators.
    • “I care deeply about CISA’s mission — if we succeed, the critical systems that Americans rely on every day will become safer, more reliable, and more capable. AI tools could accelerate our progress,” Einstein said in a statement. “But we will only reap their benefits and avoid harms from their misapplication or abuse if we all work together to prioritize safety, security, and trustworthiness in the development and deployment of AI tools.” 
  • and
    • “The White House issued final FedRAMP modernization guidance Friday [July 26, 2024] as a response to cloud market changes and agency needs for more diverse mission delivery.
    • “The final guidance, previewed by FedScoop before its official release, aims to reform the cloud security authorization program by increasing focus on several strategic goals, such as enabling FedRAMP to conduct “rigorous reviews” and requiring cloud service providers (CSPs) to quickly mitigate any security architecture weaknesses to protect federal agencies from the most “salient threats.” The Office of Management and Budget began accepting public comments on a draft version of the guidance last fall.
    • “The memo places particular emphasis on a program to establish an automated process for intaking, using and reusing security assessments and reviews to reduce the burden on participants and speed up the implementation process for cloud solutions.” 
  • The National Institute of Standards and Technology published on July 30, 2024,
    • “NIST Special Publication (SP) 800-231, Bugs Framework (BF): Formalizing Cybersecurity Weaknesses and Vulnerabilities, is now available. It presents an overview of the Bugs Framework (BF) systematic approach and methodologies for the classification of bugs and faults per orthogonal by operation software and hardware execution phases, formal specification of weaknesses and vulnerabilities, definition of secure coding principles, generation of comprehensively labeled weakness and vulnerability datasets and vulnerability classifications, and development of BF-based algorithms and systems.” * * *
    • Visit the Bugs Framework site at https://usnistgov.github.io/BF/.
  • and announced on August 1, 2024,
    • “The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and the National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) are excited to announce the return of the “Safeguarding Health Information: Building Assurance through HIPAA Security” conference for October 2024. After a 5-year absence, the conference is now returning to Washington, D.C. at the HHS Headquarters.
    • “The conference will explore the current healthcare cybersecurity landscape and the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. This event will highlight the present state of healthcare cybersecurity, and practical strategies, tips, and techniques for implementing the HIPAA Security Rule. * * *
    • “Virtual registration for the event is now open and costs $50 per person. 
    • “Please visit the event web page for more details and to register for virtual attendance to the conference.

From the cybersecurity vulnerabilities and breaches front,

  • Cybersecurity Dive points out,
    • “Data breaches are painfully expensive and the cost for impacted businesses has grown every year since 2020. The global average cost of a data breach is nearly $4.9 million this year, up nearly 10% from almost $4.5 million in 2023, IBM said Tuesday in its annual Cost of a Data Breach report.
    • “U.S. organizations led the world with the highest average data breach cost of almost $9.4 million, a dubious distinction it has earned for the 14th straight year. Businesses in the Middle East, the Benelux countries, Germany and Italy rounded out the top five.
    • “Healthcare was far and away the costliest industry for data breaches — as it’s been since 2011 — with an average breach cost of almost $9.8 million, the report found. That’s a decrease from last year’s $10.9 million for the sector.”  
  • Security Weeks notes,
    • “HealthEquity is notifying 4.3 million individuals that their personal and health information was compromised in a data breach at a third-party vendor.
    • “The incident, the company said in a regulatory filing with the Maine Attorney General’s Office, was identified on March 25 and required an “extensive technical investigation”.
    • “Through this work, we discovered some unauthorized access to and potential disclosure of protected health information and/or personally identifiable information stored in an unstructured data repository outside our core systems,” HealthEquity said.
    • “According to the company, the data was exposed after attackers compromised a vendor’s user accounts that had access to the online repository, gaining access to the information stored there.”
  • Per Cybersecurity Dive,
    • “Microsoft said a DDoS attack led to an eight-hour outage Tuesday [July 30] involving its Azure portal, as well as some Microsoft 365 and Microsoft Purview services. 
    • “Microsoft said an unexpected spike in usage led to intermittent errors, spikes and timeouts in Azure Front Door and Azure Content Delivery Network. An initial investigation showed an error in the company’s security response may have compounded the impact of the outage. 
    • “Microsoft said it will have a preliminary review of the incident in 72 hours and a final review within two weeks, to see what went wrong and how to better respond.”
  • CISA added the following known exploited vulnerabilities to its catalog this week.
    • “July 29, 2024
      • CVE-2024-4879 ServiceNow Improper Input Validation Vulnerability
      • CVE-2024-5217 ServiceNow Incomplete List of Disallowed Inputs Vulnerability
      • CVE-2023-45249 Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability
    • “July 30, 2024

From the ransomware front,

  • Cybersecurity Dive relates,
    • “Nearly one-third of companies that suffered a ransomware attack paid a ransom four or more times in the past 12 months to regain access to their systems, according to the 2024 Ransomware Risk Report released Tuesday by Semperis, a cybersecurity software company.
    • “This decision to pay multiple times involved 32% of attacked companies in France, Germany, the U.K. and U.S. across multiple industries, according to the survey of 900 IT and security executives.  
    • “Nearly half of the German companies queried paid four or more ransom payments, compared to one-fifth of companies in the U.S.
    • “More than a third of companies that paid the extortion demand either did not receive the decryption keys from attackers or were given corrupted keys, according to the report.”
  • Per TechTarget,
    • “Blood donation nonprofit OneBlood is actively responding to a ransomware attack that is affecting its ability to operate and provide blood to hospitals at its typical volume. According to a notice posted on OneBlood’s website on July 31, 2024, the company is operating at a “significantly reduced capacity, which impacts inventory availability.”
    • “OneBlood provides blood to more than 250 hospitals in Alabama, Florida, North Carolina, South Carolina and Georgia.
    • “OneBlood is continuing to collect, test and distribute blood to hospitals at a reduced capacity. Due to these limitations, OneBlood urged eligible donors to donate blood immediately, with an urgent request for O positive, O negative and platelet donations.”
  • Dark Reading notes,
    • “A Fortune 50 company paid $75 million to its cyberattackers earlier this year, greatly exceeding any other confirmed ransom payment in history. The beneficiary of the payout is an outfit called Dark Angels. And Dark Angels isn’t just effective — in some ways, the gang turns so much of what we thought we knew about ransomware on its head.
    • “Sure, there have been other big amounts forked over in the past: In 2021, Illinois-based CNA Financial was reported to have paid a then unprecedented $40 million ransom in order to restore its systems after a ransomware attack (the company never confirmed that figure). Later that year, the meat manufacturer JBS admitted to paying $11 million to end a disruption affecting its factories. Caesars Palace last year paid $15 million to make its ransomware disruption problems go away.
    • “But those figures pale in comparison against the $75 million in equivalent Bitcoin paid by the aforementioned large organization, which Zscaler chose to keep anonymous in its 2024 annual ransomware report, where the payout was first recorded. The dollar amount has also been corroborated by Chainalysis.”
  • and considers whether making ransom payments illegal would result in fewer attacks?
    • “Frustration is understandable as ransomware attacks continue around the globe, but simply denying victim organizations the option of paying the ransom is neither realistic nor practical. There will always be exceptions to the law, and unanticipated repercussions could make the cure worse than the disease. Instead, an effective response will require organizations to take greater responsibility for cybersecurity and government agencies to engage in good old-fashioned police work. This strategy may not be as straightforward as a ban on ransom payments, but the war against ransomware is winnable through a comprehensive, nuanced approach.
  • Security Week alerted us on July 29, 2024,
    • “Less than a week after VMware shipped patches for a critical vulnerability in ESXi hypervisors, Microsoft’s threat intel team says the flaw is being exploited by ransomware groups to gain full administrative access on domain-joined systems. 
    • “The flaw, tagged as CVE-2024-37085 with a CVSS severity score of 6.8, has already been abused by multiple known ransomware groups to deploy data-extortion malware on enterprise networks, according to a new warning from Redmond’s threat hunting teams.
    • “Strangely, Broadcom-owned VMware did not mention in-the-wild exploitation when it released patches and workarounds last week alongside warnings that it could be used by hackers to gain unauthorized access and control over ESXi hosts.”

From the cybersecurity defenses front,

  • An ISACA expert discusses “Navigating the Modern CISO Landscape: Practical Strategies for Cybersecurity Success.”
  • Dark Reading explains how to implement identity continuity with the NIST Cybersecurity Framework. “Having a robust identity continuity plan is not just beneficial but essential for avoiding financially costly and potentially brand-damaging outages.”
  • McKinsey & Co. delves into “Generative AI in healthcare: Adoption trends and what’s next.”

Midweek Update

David Ermer–AHRQ, CDC, COVID-19, FDA, Generative AI, Medical / Rx research, Mental health care, Obesity, OPM, U.S. Healthcare–
Photo by Manasvita S on Unsplash

From Washington, DC,

  • The Wall Street Journal adds,
    • “A summer Covid wave is hitting the country, but there’s one consolation: Your chances of developing long Covid have fallen since the start of the pandemic. 
    • “That’s the finding from a new study in the New England Journal of Medicine. It concluded that about 10% of people infected with the virus’s original strain developed long Covid. By contrast, the risk of developing long Covid dropped to 3.5% with the virus’s Omicron variant among vaccinated people. For the unvaccinated, the risk was 7.7.%.
    • “Researchers defined long Covid as people who experienced persistent and debilitating symptoms such as a racing heartbeat or brain fog, or other new health problems linked to the initial illness, a month or more after their infection.
    • “About 70% of the drop in long Covid cases was due to vaccination and 30% because of changes in the virus itself, the study determined. 
    • “Four years since the start of the pandemic, we’re getting used to periodic waves of Covid cases, including the uptick we’re seeing now, driven by Omicron subvariants. The threats of severe illness and lingering health problems have significantly subsided, though they haven’t disappeared.”
  • Beckers Hospital Review reports,
    • “As the House Committee on Oversight and Accountability investigates pharmacy benefit managers regarding alleged anticompetitive practices, the committee scheduled a hearing with leaders of the top three PBMs. 
    • “On July 23, [at 10 am ET], members of the House Committee on Oversight and Accountability plan to ask executives at Express Scripts/Evernorth, CVS Caremark and OptumRx about the alleged anticompetitive policies, which committee members say raise prescription drug costs, harm independent pharmacies and obstruct patient care. 
    • “The three PBMs account for about 80% of the market share. 
    • “The called witnesses are Adam Kautzner, PharmD, president of Evernorth Care Management and Express Scripts; David Joyner, executive vice president of CVS Health and president of CVS Caremark; and Patrick Conway, MD, CEO of OptumRx.”
  • The FEHBlog discovered today that on July 11, 2024, Rep. Gary Palmer (R Ala.) introduced House Jt. Resolution 187 which reads,
    • “Resolved by the Senate and House of Representatives of the United States of America in Congress assembled, That Congress disapproves the rule submitted by the Office of Personnel Management relating to Postal Service Reform Act; Establishment of the Postal Service Health Benefits Program (89 Fed. Reg. 37061), and such rule shall have no force or effect.”
  • The cited rule is the OPM’s May 2024 supplemental rule implementing the PSHBP. In the FEHBlog’s opinion, the provision of the rule which offends Rep. Palmer (and the FEHBlog) for that matter is found in an OPM FAQ:
    • “While the proposed rule reflects that Medicare Part D-eligible annuitants and their Part D-eligible family members would be automatically group enrolled into the Part D EGWP, it reflects that they may choose to opt out of receiving prescription drug coverage through the PSHB Part D EGWP. This proposed rule provides, consistent with the statute, that the Part D EGWP offered by their PSHB plan is the only PSHB prescription drug benefit available for Part D-eligible PSHB annuitants and their Part D-eligible covered family members. As proposed, Medicare Part D-eligible annuitants and their family members who choose to opt out of or disenroll from the PSHB plan’s Part D EGWP would not have access to prescription drug benefits through their PSHB plan and would not pay a lower premium than those enrolled in the Part D EGWP.“
  • Nothing in the Postal Service Reform Act suggests that Congress intended to impose such a penalty. It’s a penalty because OPM does not reduce the premium for members who are deprived of their plan’s prescription drug benefits. Furthermore, when Congress included a mandate for PSHBP annuitants to enroll in Part B, it also provided grandfathering protections and exemptions. The Part D penalty applies across the board.
  • In any case, because Part D benefits will feature improvements such as a $2,000 out of pocket cost maximum for 2025, the carrot approach to incenting Part D EGWP enrollment should be tried first.
  • The American Hospital Association News lets us know,
    • “The Administration for Strategic Preparedness and Response July 16 announced it will work with the Department of Commerce on an assessment of the active pharmaceutical industrial base to better understand the pharmaceutical supply chain and how it has changed since the COVID-19 pandemic. The assessment is based on a survey conducted last winter. The study will inform federal strategies and funding decisions related to the API supply chain and raise awareness of potential supply chain issues, such as the current limited domestic manufacturing capabilities and other potential issues. The study will survey more than 200 companies, including manufacturers, distributors, suppliers and customers. A Bureau of Industry and Security webpage answers FAQs about the project.”

From the public health and medical research front,

  • STAT News tells us,
    • “The Centers for Disease Control and Prevention just released a trove of data on Americans with disabilities that found that more than a quarter of U.S. adults have a disability — over 70 million people, a bump from prior years. This slice of the population was also much more likely to report long Covid symptoms such as chronic fatigue and brain fog. This comorbidity looms large for many disabled communities as another surge in Covid cases sweeps the country.
    • “The data, gathered in 2022, is part of the agency’s Disability and Health Data System, which has annual state and national-level data stretching back to 2016. This is the first year that the agency has released long Covid data, finding that 11% of people with disabilities had long Covid symptoms while only 7% of people without disabilities reported symptoms.
    • “For many disabilities, the highest populations exist in a swath that extends from the Deep South and Louisiana up to Appalachian communities in West Virginia and Ohio. Disability benefits claims are typically highest in these areas, but for long Covid, the geography shifted west. Idaho and other states along the Continental Divide saw much higher rates of symptoms, with Montana recording the highest prevalence at 18%.”
  • The New York Times adds,
    • “A large new study provides some of the strongest evidence yet that vaccines reduce the risk of developing long Covid.
    • “Scientists looked at people in the United States infected during the first two years of the pandemic and found that the percentage of vaccinated people who developed long Covid was much lower than the percentage of unvaccinated people who did. 
    • “Medical experts have previously said that vaccines can lower the risk of long Covid, largely because they help prevent severe illness during the infection period and people with severe infections are more likely to have long-term symptoms.
    • “But many individuals with mild infections also develop long Covid, and the study, published Wednesday in The New England Journal of Medicine, found that vaccination did not eliminate all risk of developing the condition, which continues to affect millions in the United States.”
  • STAT News also informs us,
    • “A study published Wednesday in the Journal of Clinical Oncology found that certain unmatched donors, or people whose bone marrow does not as closely resemble that of the patient’s, provided similar outcomes to matched donors so long as patients receive a key drug called cyclophosphamide to prevent dangerous complications. That suggests that patients who need a transplant might be able to safely consider both matched and some unmatched donors, vastly expanding the pool of potential acceptable donors for all patients, though particularly those of African, Latino, or Asian ancestry.
    • “It’s much harder to find a match for most of my patients. Looking to people who are donor unrelated and aren’t a perfect match for my patients has become the norm,” said Sekeres, who is the chief of hematology at Sylvester Cancer Center at the University of Miami and did not work on the study. “That’s why this study really resonated with me. The classic teaching is you want a perfect match as opposed to less than perfect. What this study suggests is, if you use the right drugs after transplant, it may not be as big of a deal.”
    • “If so, up to roughly 84% of African American patients might have a potential donor in the national registry. Currently, less than 30% of African American patients have a potential match in the NMDP registry, previously called the National Marrow Donor Program.”
  • Per BioPharma Dive,
    • “A closely watched obesity pill being developed by Roche helped people in a small Phase 1 trial lose 7.3% of their body weight over four weeks when taken once daily — 6.1 percentage points more than those given a placebo, the company said Wednesday.
    • “The data comes two months after the Swiss drugmaker disclosed trial results from another obesity drug in its pipeline, which showed the once-weekly injection helped reduce body weight by 19% over six months. Roche disclosed more detailed data for that drug, indicating none of the trial participants stopped taking it due to side effects — a reason users might quit taking Wegovy or Zepbound.
    • “The two drugs came from Roche’s $2.7 billion acquisition of biotechnology startup Carmot Therapeutics in December. The deal was part of a rush by pharmaceutical companies to enter a market estimated to be worth more than $100 billion annually by early next decade.”
  • Beckers Hospital Review interviews NYU Langone’s bariatric surgery chief about the first GLP-1 generic and other GLP-1 issues.
  • Per a National Institutes of Health press release,
    • “A neuroimaging study of young people who exhibit a persistent pattern of disruptive, aggressive, and antisocial behavior, known as conduct disorder, has revealed extensive changes in brain structure. The most pronounced difference was a smaller area of the brain’s outer layer, known as the cerebral cortex, which is critical for many aspects of behavior, cognition and emotion. The study, co-authored by researchers at the National Institutes of Health (NIH), is published in The Lancet Psychiatry.
    • “Conduct disorder has among the highest burden of any mental disorder in youth. However, it remains understudied and undertreated. Understanding brain differences associated with the disorder takes us one step closer to developing more effective approaches to diagnosis and treatment, with the ultimate aim of improving long-term outcomes for children and their families,” said co-author Daniel Pine, M.D., chief of the Section on Development and Affective Neuroscience in NIH’s National Institute of Mental Health. “Critical next steps are to follow children over time to determine if differences in brain structure seen in this study are a cause of conduct disorder or a long-term consequence of living with the disorder.”
  • The National Cancer Institute posted its latest cancer information highlights.
  • The Institute of Clinical and Economic Review “released a Draft Evidence Report assessing the comparative clinical effectiveness and value of acoramidis (BridgeBio Pharma, Inc.), tafamidis (Vyndamax®/Vyndaqel®, Pfizer Inc.), and vutrisiran (Amvuttra®, Alnylam Pharmaceuticals, Inc.) for the treatment of transthyretin amyloid cardiomyopathy (ATTR-CM).”
  • AHRQ’s Patient Safety Network informs us,
    • “Patients presenting to the emergency department (ED) are triaged to prioritize care based on level of illness. In this study, 2,543 patients presenting to an ED in Switzerland were asked to self-triage using an electronic symptom-checker. (Patients were triaged and treated based on standard-of-care nurse triage.) Recommendations were given regarding time to treat (e.g., emergency) and point-of-care (e.g., self-care) and subsequently evaluated by three panels of experts. Fifty of the 2,543 patients were judged as undertriaged, but none were judged as potentially hazardous.”

From the U.S. healthcare front,

  • Healthcare Dive points out,
    • “Elevance reported solid second-quarter results on Wednesday — including $2.3 billion in profit — but the company still lowered long-term revenue growth guidance for its health insurance business. That disconnect raised red flags for analysts.”
    • “Changing revenue growth forecasts for health benefits in the middle of the year “is unusual,” commented Jefferies analyst David Windley in a Wednesday note. “We can’t identify a single, large item that would compel [the reduction] off-cycle.”
    • “During a call with investors Wednesday, Elevance management cited several factors for dropping the guidance, including significant member losses from Medicaid redeterminations and Medicare Advantage bids for 2025 that could slow growth.”
  • Fierce Pharma reports,
    • “As myriad pharma industry attempts to challenge the Inflation Reduction Act (IRA) fall flat, Johnson & Johnson is settling into a reality of pricing rebates and Medicare drug cost negotiations.”
    • “While J&J is “not in alignment” with IRA or its price setting process, the company has accepted the reality of the situation and baked assumptions about the future costs of its drugs into its growth projections through the end of the decade, Jennifer Taubert, EVP, worldwide chairman, innovative medicine at J&J, said on an analyst call Wednesday.
    • “As it stands, J&J currently expects to grow its business by 3% next year and then 5% to 7% out through 2030, Taubert said.”
  • Per Fierce Healthcare,
    • “Electronic health record messages to patients drafted by generative AI were of similar quality and accuracy to those written by healthcare professionals, according to a newly published study conducted using queries from NYU Langone Health patients.”
    • “The analysis, headed by researchers at the system’s affiliate NYU Grossman School of Medicine, had 16 primary care physicians rate AI and human drafts without knowing how each was written.
    • “Among a sample of 334 AI-drafted messages and 169 from professionals (both physicians and non-physicians), the raters found both sets to be on par regarding informational content, completeness and whether the grader would use the draft or start again from scratch.”
    • “The findings “suggest chatbots could reduce the workload of care providers by enabling efficient and empathetic responses to patients’ concerns,” study lead William Small, M.D., of the medical school, said in a release.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy front,

  • Cybersecurity Dive lets us know,
    • “Microsoft President Brad Smith promised to move forward with significant culture changes at the tech giant as the company accepted full responsibility for its security failures, he said in testimony Thursday [June 13] before the House Committee on Homeland Security.
    • “Smith, who also serves as vice chair, testified before lawmakers Thursday in response to a blistering report from the U.S. Cyber Safety Review Board that analyzed Microsoft’s security culture following the summer 2023 hack of Microsoft Exchange Online by a state-linked threat group. 
    • “Smith was asked repeatedly during the hearing about whether Microsoft is changing its culture to encourage workers to speak up about security concerns. 
    • “We want a culture that encourages every employee to look for problems, find problems, report problems, help fix problems and then learn from the problems,” Smith said during questioning.” 
  • Cyberscoop tells us,
    • “A congressional watchdog is sending a reminder to the White House that it has a long laundry list of cybersecurity regulations to address as the 2024 election draws near.
    • “The Government Accountability Office is breaking biennial tradition with the latest update to its “high-risk list,” a term the watchdog uses to denote areas that are “vulnerable to waste, fraud, abuse, or mismanagement, or in need of transformation.”
    • “Cybersecurity has been on the GAO’s high-risk list since 1997, Sarah Kaczmarek, acting managing director for GAO’s Office of Public Affairs, said during a call with reporters this week. * * *
    • “The more than 80-page report goes over four main areas: establishing a comprehensive cybersecurity strategy with effective oversight, securing federal systems and information, protecting critical infrastructure and protecting privacy and sensitive data.
    • “The White House has yet to implement 567 out of 1,610 cybersecurity-related recommendations the government watchdog has issued since 2010, according to the report.
    • “A lot of them are really, really critical to securing the cybersecurity of our nation,” said Marisol Cruz Cain, director of information technology and cybersecurity at the GAO.”
  • Federal News Network adds,
    • “The number of cybersecurity incidents in 2023 grew by almost 10%. Agencies reported more than 32,000 cyber incidents to the Cybersecurity and Infrastructure Security Agency in fiscal 2023. The latest Federal Information Security Modernization Act (FISMA) report to Congress from the Office of Management and Budget showed an increase from more than 29,000 cyber incidents from the year before. Of those 32,000 incidents, 38% — or more than 12,000 — were due to improper usage, which means someone violated an agency’s acceptable use policy. The second biggest attack vector, once again, was email phishing, which saw more than a 50% increase in 2023 as compared to 2022. The good news, OMB said, is 99% of all incidents in 2023 were considered “unsubstantiated or inconsequential event[s].”(Most cyber events in 2023 were ‘unsubstantiated or inconsequential,’ OMB says – White House)”
  • Per a Cybersecurity and Infrastructure Security Agency (CISA) press release,
    • “Yesterday [June 13], the Cybersecurity and Infrastructure Security Agency (CISA) conducted the federal government’s inaugural tabletop exercise with the private sector focused on effective and coordinated responses to artificial intelligence (AI) security incidents. This exercise brought together more than 50 AI experts from government agencies and industry partners at the Microsoft Corp. facility in Reston, Virginia.
    • “The four-hour exercise was led by the Joint Cyber Defense Collaborative (JCDC), a public-private partnership model established by CISA to undertake joint planning efforts and drive operational collaboration. This exercise simulated a cybersecurity incident involving an AI-enabled system and participants worked through operational collaboration and information sharing protocols for incident response across the represented organizations. CISA Director Jen Easterly and FBI Cyber Division Deputy Assistant Director Brett Leatherman delivered opening and closing remarks, respectively, emphasizing the need for advancing robust operational structures to address existing and potential security threats, while prioritizing secure-by-design AI development and deployment.
    • “This tabletop exercise is supporting the development of an AI Security Incident Collaboration Playbook spearheaded by JCDC.AI, a dedicated planning effort within JCDC focused on building an operational community of AI providers, AI security vendors, and other critical infrastructure owners/operators to address risks, threats, vulnerabilities, and mitigations concerning AI-enabled systems in national critical infrastructure. The playbook, slated for publication by year-end, will facilitate AI security incident response coordination efforts among government, industry, and global partners.”

From the cybersecurity vulnerabilities and breaches front,

  • Modern Healthcare informs us,
    • “Ascension said Friday it has restored access across all markets to the core system for electronic health records and patient portals after a cyberattack.
    • “Patients should see a smoother process for scheduling appointments and filling prescriptions, plus improved wait times, Ascension said in a news release. Some information may be temporarily inaccessible as the system updates medical records collected in the last month, according to the health system. * * *
    • “Ascension did not provide further details on what additional systems still need to be restored and the expected timeline for restoration. Ascension set a June 14 deadline for restoring electronic medical records.”
  • Cybersecurity Dive adds,
    • “Personally identifiable and protected health information may have been exposed during a cyberattack at Ascension last month, the Catholic health system said Wednesday. 
    • “Hackers were able to take files from seven servers used by Ascension for routine tasks. The provider said it has about 25,000 servers across its network.
    • “The attackers gained access to Ascension systems after a worker accidentally downloaded a malicious file, according to the health system.”
  • HHS’s Health Sector Cybersecurity Coordination Center released its May 2024 report on vulnerabilities of interest to the health sector.
  • CISA added the following known exploited vulnerabilities to its catalog last week
  • Bleeping Computer adds,
    • “The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity Windows vulnerability abused in ransomware attacks as a zero-day to its catalog of actively exploited security bugs [on June 13].
    • “Tracked as CVE-2024-26169, this security flaw is caused by an improper privilege management weakness in the Windows Error Reporting service. Successful exploitation lets local attackers gain SYSTEM permissions in low-complexity attacks that don’t require user interaction.
    • “Microsoft addressed the vulnerability on March 12, 2024, during its monthly Patch Tuesday updates. However, the company has yet to update its security advisory to tag the vulnerability as exploited in attacks.”
  • CISA further warns the public,
    • “Impersonation scams are on the rise and often use the names and titles of government employees. The Cybersecurity and Infrastructure Security Agency (CISA) is aware of recent impersonation scammers claiming to represent the agency. As a reminder, CISA staff will never contact you with a request to wire money, cash, cryptocurrency, or use gift cards and will never instruct you to keep the discussion secret.
    • “If you suspect you are a target of an impersonation scammer claiming to be a CISA employee: 
      • Do not pay the caller.
      • Take note of the phone number calling you.
      • Hang up immediately.
      • Validate the contact by calling CISA at (844) SAY-CISA (844-729-2472) or report it to law enforcement.
  • Per Cybersecurity Dive,
    • “More than 100 Snowflake customers are caught in a widespread identity-based attack spree targeting the cloud-based data warehouse vendor’s customers, Mandiant said Monday in a threat intelligence report. The attacks were not caused by a breach of Snowflake’s systems, Mandiant said.
    • “Since at least April 2024, UNC5537 has leveraged stolen credentials to access over 100 Snowflake customer tenants,” Mandiant Consulting CTO Charles Carmakal said Monday in a prepared statement. “The threat actor systematically compromised customer tenants, downloaded data, extorted victims and advertised victim data for sale on cybercriminal forums.”
    • “Snowflake first disclosed the attacks on May 30 and said it first became aware of the malicious activity on May 23. Snowflake was not immediately available to comment on Mandiant’s research. Mandiant and CrowdStrike are assisting Snowflake with an ongoing investigation.”
  • and
    • “Researchers on Friday [June 14] warned a critical vulnerability in the PHP programming language is under increased exploitation activity, as the TellYouThePass ransomware group is targeting vulnerable sites, according to a blog post from Censys. 
    • “The vulnerability, listed as CVE-2024-4577, has been under attack from the threat group since at least June 7, with about 1,000 infected hosts observed as of Thursday — they are mainly located in China. The number of observed infections is down from about 1,800 as of June 10. 
    • “The Cybersecurity and Infrastructure Security Agency added CVE-2024-4577 to its known exploited vulnerabilities catalog on Wednesday. [June 12]” 

From the cybersecurity defenses front,

  • Health IT Security reports,
    • “Microsoft and Google have pledged to help rural hospitals prevent cyberattacks by offering free or discounted cybersecurity resources. The commitment from the tech giants is part of a White House-led initiative to bolster cybersecurity in the healthcare sector.”
    • “According to an announcement from the White House, Microsoft will extend its nonprofit program to provide grants to independent critical access hospitals and rural emergency hospitals. For these types of hospitals, the company will also offer a 75% discount on security products optimized for smaller organizations. Larger rural hospitals already using eligible Microsoft solutions will receive the company’s “most advanced security suite at no additional cost for one year.”
    • “The White House also said Microsoft will offer free cybersecurity assessments by technology security providers and free training for frontline and IT staff at eligible rural hospitals. The company also pledged to extend security updates for Windows 10 to participating hospitals for one year at no cost.”
  • Here’s a link to Dark Reading’s CISO corner.
  • Here ares links to an ISACA Blog article titled “Managing AI’s Transformative Impact on Business Strategy & Governance: Strategies for CISOs,” and a Tech Target article titled “How to craft a responsible generative AI strategy.”

 

Tuesday Tidbits

David Ermer–AHRQ, Congress, FDA, Generative AI, Medical / Rx research, Medicare, OPM, U.S. Healthcare, Uncategorized–
Photo by Patrick Fore on Unsplash

From Washington, DC

  • Chief Healthcare Executive lets us know,
    • Telehealth advocates have said this year represents the Super Bowl for virtual healthcare, and the game is about at halftime.
    • On the upside, telehealth leaders remain confident that Congress will approve legislation that would allow health systems and providers to continue offering virtual care and hospital-at-home programs.
    • But lawmakers may not act until late in the fourth quarter [in other words, the expected lame duck session following the November’s national election].
  • Roll Call informs us,
    • “The Supreme Court will decide a dispute about hospital reimbursement rates under Medicare, with hundreds of hospitals arguing the government had shorted them for treating low-income patients.
    • More than 200 hospitals in more than 30 states, led by Advocate Christ Medical Center in Illinois, have asked the justices to overturn a lower court ruling that allows the Department of Health and Human Services to reimburse a lower rate for treating a high proportion of low-income patients. The dispute, which the hospitals said could affect more than $4 billion in federal funds, hinges on how to determine which patients count toward that reimbursement rate and follows a 2022 Supreme Court decision over the same program.
    • The justices announced Monday that they would decide the case, which means oral arguments and a decision would come in the next term that starts in October.
  • Federal News Network tells us,
    • “The Chief Human Capital Officers (CHCO) Council has a new face taking the lead to collaborate on human capital initiatives and strategies across government.”
    • “Colleen Heller-Stein, formerly deputy CHCO at the Treasury Department, has stepped in as executive director of the CHCO Council, Federal News Network has learned. The senior-level position within the Office of Personnel Management leads agency CHCOs and other human capital leaders to innovate on best practices for managing the recruitment and retention of the federal workforce.
    • “Heller-Stein is the first career federal executive to serve in the CHCO Council leadership role. She took over the position a few weeks ago from Latonia Page, who had been working as acting executive director of the CHCO Council since September 2023. Prior to Page’s time on the job, Margot Conrad — currently deputy chief of staff at OPM — served as the council’s executive director for about two and a half years.”‘

From the public health and medical research front,

  • KFF expresses concern about the general unavailability of bird flu tests.
    • “A recent rule that gives the FDA more oversight of lab-developed tests may bog down authorization. In a statement to KFF Health News, the FDA said that, for now, it may allow tests to proceed without a full approval process. The CDC did not respond to requests for comment.”
    • “But the American Clinical Laboratory Association has asked the FDA and the CDC for clarity on the new rule. “It’s slowing things down because it’s adding to the confusion about what is allowable,” said Susan Van Meter, president of the diagnostic laboratory trade group.
    • “Labcorp, Quest Diagnostics, and other major testing companies are in the best position to manage a surge in testing demand because they can process hundreds per day, rather than dozens. But that would require adapting testing processes for their specialized equipment, a process that consumes time and money, said Matthew Binnicker, director of clinical virology at the Mayo Clinic.
    • “There’s only been a handful of H5N1 cases in humans the last few years,” he said, “so it’s hard for them to invest millions when we don’t know the future.”
  • The Wall Street Journal offers guidance on how people can improve the deathbed experiences of loved ones.
  • Beckers Hospital Review points out,
    • “Baltimore-based Johns Hopkins School of Nursing is addressing community needs by taking primary care door to door, NPR reported June 11.
    • “The Neighborhood Nursing pilot program consists of a team of nurses and community health workers that make weekly visits to three apartment buildings in Johnston Square, a predominantly Black disadvantaged neighborhood. The visits are free to patients and are not dependent on health status, income or what type of insurance, if any, they have. Visits are done in people’s homes, senior centers, lobbies, libraries and anywhere else people can be found. 
    • “In the time it has run, Neighborhood Nursing has successfully helped patients receive care and has expedited physicians’ appointments as needed. However, the greatest challenge is funding.”
  • Per Healio,
    • “From 2010 to 2021, most high and moderate risk factors for preeclampsia increased in the U.S.
    • “Multifetal gestation and nulliparity were the only preeclampsia risk factors to decrease during this period.”
  • Per BioPharma Dive,
    • “Pharmaceutical companies employ many different strategies when building their cancer drug pipelines, but one recent commonality among them is a belief in the future of targeted therapies known as antibody-drug conjugates.
    • “Many of the leading cancer drugmakers have at least one or two antibody-drug conjugates, or ADCs, in development. Others, such as Pfizer, Johnson & Johnson and Merck & Co., have used buyouts or partnerships to build an ADC portfolio.
    • “One of the best-selling ADCs on the market is AstraZeneca and Daiichi Sankyo’s Enhertu, which brought in combined sales of $2.5 billion in 2023, almost double the year before. The two companies formed a $7 billion alliance around Enhertu in 2019 and since then, the drug has secured multiple approvals and changed the way some breast cancers are treated.
    • “Over that time, AstraZeneca has made ADCs a more substantial part of its overall pipeline alongside radiopharmaceuticals and immunotherapies, giving the company many potential combinations to work with, said Carlos Doti, vice president and head of medical affairs for its U.S. oncology division.”

From the U.S. healthcare business front,

  • Beckers Payer Issues notes,
    • “CMS must recalculate the Medicare Advantage star ratings for Anthem Blue Cross Blue Shield of Georgia, a federal judge ruled June 10. 
    • “The judge ruled partially in favor of Elevance Health, which sued to challenge CMS’ star ratings methodology in December. The insurer sought new ratings for several of its subsidiaries, but the judge ruled CMS needs to recalculate ratings only for BCBS of Georgia. 
    • “Elevance’s challenge focused on CMS’ use of the Tukey method, a change announced by CMS in a 2020 final rule and implemented in 2024 star ratings. The method removes extreme outliers from measure scores to prevent outliers from affecting all MA contracts, making it more difficult for plans to earn a high star rating. In 2022, a final star ratings rule from CMS did not mention the new change, which the agency added back in the 2023 rule, citing an inadvertent removal. 
    • “CMS also limits scoring changes to 5% annually. In the lawsuit, Elevance said CMS should have factored in those limits before adding the Tukey change back in 2023 versus the other way around.
    • “Randolph Moss, a judge for the U.S. District Court in Washington, D.C, ruled CMS violated the Administrative Procedure Act in applying the Tukey methodology. However, Mr. Moss ruled Elevance proved the Tukey method affected the star rating only for BCBS of Georgia and not the other plans for which it sought revised ratings.” 
  • This opinion and last week’s Scan Health opinion may wind up before the U.S. Court of Appeals for the D.C. Circuit.
  • Per Healthcare Dive,
    • “Just three days before bankrupt Steward Health Care was set to run out of funds, the health system said it’s struck a deal to capture $225 million of additional debtor-in-possession financing to keep its operations afloat during Chapter 11 proceedings.
    • “The funds come from Steward’s FILO lenders, which include private credit lenders Sound Point Capital and Brigade Agency Services, as well as Chamberlain Commercial Funding, according to a press release shared with Healthcare Dive. 
    • “Steward will present the deal — which the system says is sufficient to finance operations prior to its July asset sales — for approval in bankruptcy court later this week.”
  • According to BioPharma Dive,
    • “Approval of Eli Lilly’s experimental Alzheimer’s disease drug donanemab would help drive sales of Eisai and Biogen’s rival medicine Leqembi, analysts wrote after a Food and Drug Administration panel on Monday supported clearance of donanemab.
    • “A rising tide lifts all boats, in our view,” wrote Myles Minter, an analyst at William Blair, in a client note. Donanemab works similarly to Leqembi by eliminating from the brain a toxic protein called amyloid that scientists see as linked to Alzheimer’s progression.”
  • McKinsey & Co. discusses the ongoing digital transformation in healthcare.
  • The International Foundation of Employee Benefit Plans shares useful insights on the final rules amending the Fair Labor Standards Act that take effect on July 1.

Monday Roundup

David Ermer–Generative AI, NIH, U.S. Healthcare–
Photo by Sven Read on Unsplash

From Washington, DC

  • The FEHBlog travelled back to DC yesterday,
  • Per a Department of Health and Human Services press release,
    • “Today, the U.S. Department of Health and Human Services’ (HHS) Health Resources and Services Administration (HRSA) announced a combined investment of $15 million over four years through the Rural Maternity and Obstetrics Management Strategies (Rural MOMS) Program to improve maternal health in rural communities and a new program focused on strengthening maternal care and reducing disparities in the Delta region (within Alabama, Arkansas, Illinois, Kentucky, Louisiana, Mississippi, Missouri, and Tennessee). HRSA Deputy Administrator Jordan Grossman highlighted these strategic investments today in Flagstaff, AZ, during the third state convening of HRSA’s Enhancing Maternal Health Initiative.”
  • The NIH Director in her blog tells us,
    • The NIH Brain Research Through Advancing Innovative Neurotechnologies® (BRAIN) Initiative has expanded scientists’ understanding of the human brain in recent years, offering fascinating insights into the ways that individual cells and complex neural circuits interact dynamically to enable us to think, feel, and act. But neuroscientists still have much more to learn about how our brains are put together at the most fundamental, subcellular level.  
    • As a step in that direction, in a new study supported in part by the NIH BRAIN Initiative and reported in the journal Science , researchers have created the most detailed nanoscale resolution map ever produced of a cubic millimeter of brain tissue, about the size of half a grain of rice. * * *
    • While there is plenty still left to uncover, the findings offer proof-of-principle that it’s possible to visualize the brain at this very detailed level. This is crucial groundwork for new research now supported by the BRAIN Initiative Connectivity Across Scales (BRAIN CONNECTS) program. BRAIN CONNECTS will develop and scale up tools to produce an equally detailed map of a complete mouse brain, which is about 1,000 times larger than the human brain fragment. The researchers now hope their 3D map and others like it will be put to work to understand both normal and disordered brain function more fully.

From the public health and medical research front,

  • The AMA News lets us know what doctors wish their patients knew about the measles.
  • NIH announced.
    • “In a proof-of-concept study, researchers at the National Institutes of Health (NIH) have developed an artificial intelligence (AI) tool that uses routine clinical data, such as that from a simple blood test, to predict whether someone’s cancer will respond to immune checkpoint inhibitors, a type of immunotherapy drug that helps immune cells kill cancer cells. The machine-learning model may help doctors determine if immunotherapy drugs are effective for treating a patient’s cancer. The study, published June 3, 2024, in Nature Cancer, was led by researchers at the National Cancer Institute’s (NCI) Center for Cancer Research and Memorial Sloan Kettering Cancer Center in New York. NCI is part of the National Institutes of Health. * * *
    • “The researchers noted that larger prospective studies are needed to further evaluate the AI model in clinical settings. They have made their AI model, called Logistic Regression-Based Immunotherapy-Response Score (LORIS), publicly available at https://loris.ccr.cancer.gov. The tool estimates the likelihood of a patient responding to immune checkpoint inhibitors based on data on the six variables described above.”
  • Health Day tells us,
    • “About one in eight U.S. seniors will be treated for a traumatic brain injury, typically during a fall, a new study finds.” About one in eight U.S. seniors will be treated for a traumatic brain injury, typically during a fall, a new study finds.
    • “Medicare data shows that about 13% of seniors suffered a severe concussion during an average follow-up period of 18 years, researchers report.
    • “Although these injuries can be treated, they increase the risk of serious conditions like dementia, Parkinson’s disease, seizures, heart disease, depression and anxiety, they added.
    • “The number of people 65 and older with TBI is shockingly high,” said senior researcher Dr. Raquel Gardner, a neurologist with the Sheba Medical Center in Israel.”
  • Healio points out,
    • “Statin therapy was tied to a 5-year CVD risk reduction in adults aged 75 years and older.”Statin therapy was tied to a 5-year CVD risk reduction in adults aged 75 years and older.
    • “Statin use did not increase the risk for major adverse events, such as liver dysfunction.”

From the U.S. healthcare business front,

  • Beckers Hospital Review reports,
    • “Nonprofit hospital margins hit 4.3% in April, up 33% year over year, according to Kaufman Hall’s “National Hospital Flash Report” released June 3.”Nonprofit hospital margins hit 4.3% in April, up 33% year over year, according to Kaufman Hall’s “National Hospital Flash Report” released June 3.
    • “Kaufman Hall examined data from 1,300 hospitals in Syntellis Performance Solutions’ database and found that while hospital margins are improving overall, so is the gap between the highest and lowest performing hospitals. The best performing hospitals had a margin of 28.9%, compared to -16.1% for the worst performing hospitals. * * *
    • “Of note, the data revealed:
      • “1. Outpatient revenue increased 10% year over year in April.
      • “2. Average length of stay dropped 4% year over year in April.
      • “3. Emergency department visits increased to hit pre-pandemic levels.”
  • BioPharma Dive informs us,
    • “An experimental GLP-1 pill helped people with obesity lose significantly more weight than a placebo over three months, according to summary results revealed by developer Structure Therapeutics Monday.
    • “Structure’s drug led to an average reduction in body weight of 6.2% over placebo. One-third of those on the drug, dubbed GSBR-1290, lost 10% or more of their body weight, compared to zero of those given placebo.”
  • Per MedTech Dive,
    • “BD has agreed to buy Edward Lifesciences’ critical care group for $4.2 billion in cash, ending Edwards’ plan to spin off the business.
    • “In a Monday announcement, BD highlighted the group’s patient monitoring technologies and artificial intelligence-enabled clinical decision products that will add to BD’s existing businesses. Edwards’ critical care unit grew revenue by 8.5% year over year to $928.1 million in 2023.
    • “RBC Capital Markets analyst Shagun Singh said the deal would streamline Edwards. “Notably, the transaction creates a pure-play structural heart company positioning them for strategic initiatives that could further create shareholder value,” Singh wrote in a note to investors.”

Midweek Update

David Ermer–CDC, Congress, COVID-19 vaccine, Generative AI, Medical / Rx research, NIH, Obesity, OPM, U.S. Healthcare–

From Washington, DC

  • The New York Times reports,
    • “The chairmen of two Senate committees overseeing health policy, concerned about companies “padding their own profits” at the expense of patients, are looking into the practices of a data analytics firm that works with big insurers to cut payments to medical providers.
    • “The firm, MultiPlan, recommends what it says are fair payments for medical care, but the firm and the insurers can collect higher fees when payouts are lower. This business model could “result in an improper conflict of interest,” the chairmen of the two committees, Ron Wyden of Oregon and Bernie Sanders of Vermont, wrote in a letter to the firm’s chief executive that was released on Tuesday.
    • “The senators called on MultiPlan to meet with the committees’ staffs to discuss an investigation last month by The New York Times that found the firm’s pricing tools could leave patients with unexpectedly large bills when they see doctors outside their health plans’ networks.”
  • Govexec tells us,
    • “The Office of Personnel Management last week gave agencies a reminder that as campaign season approaches, officials should be vigilant against efforts to “burrow” political appointees into career positions in the federal government’s competitive and Senior Executive services.
    • “In a memo to agency heads, OPM’s associate director for merit system accountability and compliance Mark Lambert and associate director for workforce policy and innovation Veronica Hinton addressed the controversial practice, which is legal, albeit with a strict set of regulations to ensure political appointees are qualified for career roles they’re lined up for.”
  • KFF introduced,
    • “A new KFF resource—Health Policy 101—explains the basics on a wide range of topics about health programs and policy in the United States, such as Medicare and Medicaid, the Affordable Care Act, health care costs and affordability, women’s health issues, and the politics of health care. Health Policy 101 chapters are available online and can be downloaded in PDF format. The “101” was created to serve as a mini “textbook” for faculty and students interested in health policy. Dr. Drew Altman, KFF’s president and CEO, is the editor of the 101 series.”

From the public health and medical research front,

  • MedPage Today informs us,
    • “The updated monovalent XBB.1.5 COVID-19 vaccines were effective against Omicron subvariants circulating during the most recent respiratory virus season, but their effectiveness waned over time, according to a brief report.
    • “The three vaccines updated to target the SARS-CoV-2 XBB.1.5 subvariant — Moderna’s and Pfizer-BioNTech’s mRNA vaccines and the Novavax vaccine — were 66.8% effective against hospitalization at 4 weeks, decreasing to 57.1% after 10 weeks, wrote Dan-Yu Lin, PhD, of the UNC Gillings School of Global Public Health in Chapel Hill, North Carolina, and colleagues.
    • “Vaccine effectiveness against infection was about 52% after 4 weeks, decreasing to 33% after 10 weeks, and to 20% after 20 weeks, the New England Journal of Medicineopens in a new tab or window correspondence showed.
    • “We expected these vaccines to be effective, especially against hospitalization and death. We also expected the effectiveness to decline over time,” Lin told MedPage Today. “However, we didn’t know beforehand the levels of effectiveness or the duration of protection.”
  • The Wall Street Journal shares the view of readers who have used GLP-1 drugs.
    • “Hundreds of readers responded in the comments space and by email to Bradley Olson’s essay about his experience using a GLP-1 drug for weight loss. Readers shared stories about their own attempts to lose weight, journeys that often took place over the course of decades and included nonmedicinal strategies before the advent of GLP-1 drugs. Our readers made overwhelmingly positive comments about the medications, and in general found that the transformational impact of the GLP-1 drugs made such difficulties as getting prescriptions filled and side effects bearable. Some readers who have struggled to lose weight wrote that they found inspiration in Olson’s essay to consider trying a medical solution.” 
  • Per BioPharma Dive,
    • “A new kind of antidepressant eased symptoms and improved sleep among adults enrolled in a large Phase 3 trial, Johnson & Johnson, the drug’s developer, said Wednesday.
    • “J&J is studying the drug, called seltorexant, as an “adjunctive” therapy to background treatment with other antidepressants like SSRIs. The company’s trial enrolled adults with major depressive disorder as well as insomnia, which often accompanies depression and isn’t well treated by SSRIs.
    • “J&J didn’t disclose detailed data in its Wednesday statement. But the company did share the trial met all of its primary and secondary goals, noting the improvement in depressive symptoms among seltorexant-treated participants at study day 43 was both statistically significant and clinically meaningful.”
  • The New York Times dives into recent research on the sense of taste.
    • “The perception of taste is a remarkably complex process, starting from that first encounter with the tongue. Taste cells have a variety of sensors that signal the brain when they encounter nutrients or toxins. For some tastes, tiny pores in cell membranes let taste chemicals in.
    • “Such taste receptors aren’t limited to the tongue; they are also found in the gastrointestinal tract, liver, pancreas, fat cells, brain, muscle cells, thyroid and lungs. We don’t generally think of these organs as tasting anything, but they use the receptors to pick up the presence of various molecules and metabolize them, said Diego Bohórquez, a self-described gut-brain neuroscientist at Duke University. For example, when the gut notices sugar in food, it tells the brain to alert other organs to get ready for digestion.”
  • Healio lets us know,
    • “Women who get an epidural during delivery appear to have a marked reduction in serious complications the first few weeks after giving birth, a new study shows.
    • “A painkilling epidural can reduce risk by 35% in women for complications like heart attack, heart failure, blood infection and hysterectomy that can occur as a result of delivery, researchers reported May 22 in the BMJ.
    • “And the risk declines even more for women with known risk factors for these complications such as obesity, other health problems or prior delivery, researchers said.
    • “For those women, an epidural can reduce their risk of complications by 50%, compared to a 33% risk reduction in those without such factors.
    • “And women delivering preterm had a risk reduction of 47%, results show.”
  • and
    • “Researchers found that a questionnaire successfully identified patients with STIs who can be safely evaluated for penicillin allergy by skin test or by a two-step graded oral challenge, according to a study.
    • “Providers caring for clients with STIs are often faced with clients reporting a history of penicillin allergy (up to 15% of clients). Penicillin remains the drug of choice for the treatment of all stages of syphilis,” Rebecca A. Lillis, MD, associate professor at the Louisiana State University School of Medicine, told Healio.
    • “Ceftriaxone is the drug of choice for treatment of gonorrhea and often avoided in clients who report a penicillin allergy, resulting in suboptimal care,” she said.”
  • The National Institutes of Health announced,
    • “A team of researchers funded by the National Institutes of Health have generated the first complete chromosome sequences from non-human primates. Published in Nature(link is external), these sequences uncover remarkable variation between the Y chromosomes of different species, showing rapid evolution, in addition to revealing previously unstudied regions of great ape genomes. Since these primate species are the closest living relatives to humans, the new sequences can provide insights into human evolution.”

From the U.S. Healthcare business front,

  • Per Fierce Healthcare,
    • “A significant gap exists between health plans that have the highest consumer experience scores and those with the lowest, according to a new survey from J.D. Power.
    • “The consumer insights firm released its annual look at commercial health plans and found that overall satisfaction lands at a score of 595 out of 1,000 points, an increase of three points from 2023’s survey. However, the analysts found a 79-point gap between plans with the highest and lowest scores.
    • “Further, plans with the best consumer satisfaction ratings are getting better, while the lowest-performing plans are sliding. Scores at the highest performers increased by 20 points, while lower scores declined by eight points.
    • “In many cases, employer-sponsored health insurance is consumers’ primary window into the healthcare system,” said Christopher Lis, Ph.D., managing director of global healthcare intelligence at J.D. Power, in a press release. “Access to care, cost of care, chronic condition management—the central pillars of the consumer healthcare experience—are all heavily influenced by commercial health plans.”
  • and
    • “The proportion of hospitals meeting the Office of the National Coordinator for Health IT’s (ONC’s) bar for interoperability rose substantially from 2018 to 2023, though a focus on day-to-date data exchange will be necessary to fill some remaining gaps.
    • “According to a recent data brief from ONC, 7 in 10 nonfederal acute care hospitals reported either “routinely” or “sometimes” engaging in all four measured domains of electronic health information interoperability: sending data (92%), receiving data (87%), querying data from outside their organization (84%) and integrating outside data into their records without manual entry (78%).
    • “The 70% top line is an improvement from the 23% of 2014 and the 46% of 2018. Interoperability remained flat at 70% from 2022 to 2023, though the ONC noted that its surveys for the two years were fielded nearly back-to-back to catch up following pandemic polling delays.”
  • Beckers Payer Issues points out,
    • “UnitedHealth Group is running around 500 use-case applications for AI across the organization, CEO Andrew Witty told investors. 
    • “Speaking at a conference on May 29, Mr. Witty said some of the company’s AI efforts are “low-hanging” opportunities aimed at speeding up administrative processes. 
    • “It’s not Einstein opportunities,” he said. “These are relatively straightforward. Some of them are already underway. They play out in areas like speed, allowing call handlers to deal with issues faster than they used to.” 
    • “Heather Cianfrocco, CEO of Optum, told investors Optum’s AI efforts are focused in two areas. 
    • “One is administrative support, particularly for clinicians, giving clinicians time back at home or in the office,” Ms. Cianfrocco said. “The second area I would highlight is identifying disease progression, or emerging disease, faster.” 

 

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy front,

  • Cybersecurity Dive tells us,
    • “An HHS agency revealed a new cybersecurity program Monday [May 20, 2024,] that aims to better safeguard hospitals as the healthcare sector faces increasing cyber threats that can derail patient care. 
    • “The initiative, which comes out of the Advanced Research Projects Agency for Health, will invest more than $50 million to build a software suite that could automatically scan model hospital environments for vulnerabilities that could be exploited by hackers and quickly develop and deploy fixes.
    • “The project seeks to help hospitals keep their vast array of internet-connected devices up to date, preventing attacks and subsequent technology outages that can last for weeks and threaten patient safety.”
  • American Hospital News adds,
    • “The Universal PatchinG and Remediation for Autonomous DEfense (UPGRADE) program will proactively evaluate potential vulnerabilities by probing for weaknesses in software. When it detects a threat, a patch could be automatically developed, tested and deployed with minimal interruption to hospital devices. 
    • “We applaud HHS’ recognition of the unique challenges and systemic nature of vulnerability management in health care,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “The research which will be empowered through the ARPA-H funding will yield technical solutions which should be applied strategically to help secure the entire sector. It is clear, health care is a critical infrastructure sector, which must not be left to defend itself on its own through uncoordinated and uneven capabilities. Continuing ransomware attacks on the health care sector represent an urgent national security, public health and safety issue. The UPGRADE program is an innovative and welcomed ‘whole of nation’ approach, which will combine the expertise of the health care sector and government experts.” 
  • Cybersecurity Dive informs us,
    • Providers are still looking for clarification on whether they’ll have to report or notify patients about data breaches stemming from the cyberattack against Change Healthcare earlier this year.
    • In a letter sent to HHS Secretary Xavier Becerra Monday [May 20, 2024], more than 50 organizations — including the American Medical Association, the College of Healthcare Information Management Executives and the American Health Information Management Association— urged the federal government to publicly confirm that Change could manage data breach reporting and notification requirements, since the technology firm and major claims processor experienced the breach. 
    • UnitedHealth Group, Change’s parent company, has previously said it would handle reporting for customers whose data may have been exposed — which could be a huge swath of Americans.
  • Bloomberg Law reports,
    • “Companies working with the US government may be required to start protecting their data and technology from attacks by quantum computers as soon as July.
    • “The National Institute for Standards and Technology, part of the Department of Commerce, will in July stipulate three types of encryption algorithms the agency deems sufficient for protecting data from quantum computers, setting an internationally-recognized standard aimed at helping organizations manage evolving cybersecurity threats. 
    • “The rollout of the standards will kick off “the transition to the next generation of cryptography,” White House deputy national security adviser Anne Neuberger told Bloomberg in Cambridge, England on Tuesday [May 21, 2024]. Breaking encryption not only threatens “national security secrets” but also the way we secure the internet, online payments and bank transactions, she added.”
  • The National Institute of Standards and Technology (NIST), announced on May 20, 2024,

From the cyber vulnerabilities and breaches front,

  • Cybersecurity Dive notes yesterday,
    • “On the eve of Memorial Day weekend, threat researchers and incident response teams are quietly preparing for the risk of malicious activity when staffing is minimal and millions of workers will be on the road. 
    • “Critical industries have faced a series of threats from criminal ransomware gangs or nation-state actors for much of 2024, and the unofficial summer kickoff weekend is a prime opportunity for malicious attacks. 
    • “We see attacks and attempted intrusions every day,” Scott Algeier, executive director of the IT-ISAC, said via email.
    • “While there is no specific threat information pointing to a Memorial Day event, “attackers are also aware of the calendar and know that security teams tend to operate with reduced staffing on weekends and holidays,” Algeier said.
    • “While there is no specific threat information pointing to a Memorial Day event, “attackers are also aware of the calendar and know that security teams tend to operate with reduced staffing on weekends and holidays,” Algeier said.”
  • HHS’s Health Sector Cybersecurity Coordination Center (HC3) has issued its April 2024 cybersecurity vulnerability bulletin.
    • In April 2024, vulnerabilities to the health sector have been released that require attention. This includes the monthly Patch Tuesday vulnerabilities released by several vendors on the second Tuesday of each month, along with mitigation steps and patches. Vulnerabilities for April are from Palo Alto, Ivanti, Microsoft, Google/Android, Apple, Mozilla, Cisco, SAP, VMWare, Adobe, Fortinet, and Atlassian. A vulnerability is given the classification of a zero-day when it is actively exploited with no fix available, or if it is publicly disclosed. HC3 recommends patching all vulnerabilities, with special consideration given to the risk management posture of the organization.
  • HC3 also issued a useful PowerPoint presentation titled “Business Email Compromise (BEC) & Healthcare.”
  • The Cybersecurity Infrastructure Security Administration added the following new known exploited vulnerabilities to its catalog:
  • Dark Reading reports yesterday that “Google Discovers Fourth Zero-Day in Less Than a Month; The tech company has rolled out fixes for a type confusion vulnerability that has already been exploited by malicious actors.”
  • Cyberscoop adds
    • “An aggressive, nebulous ring of young cybercriminals linked to a string of recent high-profile breaches is made up of approximately 1,000 people, a senior FBI official said Friday. 
    • “In remarks Friday at the cybercrime-focused Sleuthcon conference, Bryan Vorndran, assistant director of the FBI’s Cyber Division, described the group best known as Scattered Spider as a “very, very large, expansive, disbursed group of individuals,” many of whom don’t know each other directly. 
    • “Scattered Spider emanates from an online community known as “the Com.” The group is also tracked by cybersecurity firms as “0ktapus” or UNC3944, and Vorndran’s remarks provide the best number yet for the total size of the hacking crew.  
    • “Scattered Spider has breached a who’s-who of big-name companies, including the casino giant MGM Resorts and the identity management company Okta. Made up of mostly native English speakers in the United States and the United Kingdom, Scattered Spider is classified as a top three cybersecurity threat, alongside China and Russia’s foreign intelligence agency, Vorndran said.” 

From the cybersecurity defenses front,

  • Modern Healthcare lets us know
    • A recent string of massive healthcare cybersecurity breaches has put data security leaders on edge. 
    • Health system cybersecurity executives are looking at their biggest points of weakness in the aftermath of large-scale breaches at St. Louis-based health system Ascension, UnitedHealth Group’s Change Healthcare and Chicago-based Lurie Children’s Hospital
    • Recent incidents have shined a light on some of the most significant vulnerabilities at health systems. Here are four of the biggest, according to experts.. 
      • Lack of Shared Organizational Goals
      • Third party Vendor Risks
      • Multi-factor Authentication Misses
      • Slow Response Time
  • Similarly MedCity News points out,
    • “During a fireside chat at MedCity News’ INVEST conference, Nitin Natarajan — deputy director at the Cybersecurity and Infrastructure Security Agency (CISA) — shared some key ideas that people need to understand about the current state of cybersecurity in the healthcare industry. For instance, he reminded us that things won’t get better overnight, and that cybersecurity requires an all-hands-on deck approach.”


 

Tuesday Tidbits

David Ermer–CDC, CMS, Congress, FDA, Generative AI, Obesity, Rx coverage, Telehealth, U.S. Healthcare–
Photo by Patrick Fore on Unsplash

From Washington, DC

  • MedPage Today tells us,
    • Senators and experts on Tuesday examined the range of tools that brand-name drug manufacturers have used to keep generic and biosimilar competition at bay — from patent thickets and product hopping to “pay-for-delay” settlements — and wrestled with how to prevent such abuses.
    • “Too often the prices charged by Big Pharma do not reflect a scientific advancement,” argued Sen. Dick Durbin (D-Ill.), during a Tuesday hearing of the Senate Committee on the Judiciary. “Rather, they’re the result of skilled lawyers manipulating the patent system and skirting our nation’s competition laws.”
  • The Department of Health and Human Services announced,
    • “The Biden-Harris Administration is committed to lowering health care costs, promoting innovation, and making sure that taxpayer investments result in advancements in biomedical research that are accessible to everyone across the country.
    • “Today, the National Institutes of Health (NIH) issued a first of its kind draft policy proposal to promote equitable access to products stemming from NIH-owned inventions. By requiring organizations partnering with the NIH through patent license agreements to outline detailed plans for patient access to drugs, biologics, vaccines, or devices developed from NIH-owned inventions, we are accelerating how breakthroughs in medical research originating from the NIH’s Intramural Research Program can translate into affordable and sustainable solutions for patients across the country. NIH has released a request for information and welcomes public input to inform this new policy.”
  • The American Hospital News informs us,
    • “The Centers for Medicare & Medicaid Services May 21 announced that individuals now have the option to file an Emergency Medical Treatment and Labor Act complaint directly with the agency, in addition to the traditional process of contacting state survey agencies. The new form is the latest in a series of new resources from CMS to help educate the public about EMTALA.” 

From the public health and medical research front,

  • Beckers Hospital Review points out,
    • “The CDC is asking health officials in all 50 states to continue monitoring the prevalence of influenza as H5N1 bird flu infections among poultry and livestock increase and have begun to prompt concern over the possibility of human-to-human transmission, according to a news release shared with Becker’s.”The CDC is asking health officials in all 50 states to continue monitoring the prevalence of influenza as H5N1 bird flu infections among poultry and livestock increase and have begun to prompt concern over the possibility of human-to-human transmission, according to a news release shared with Becker’s.
    • “As of May 21, there has only been one confirmed human infection of the current H5N1 outbreak in a dairy farm employee in Texas, but no evidence of human-to-human transmission.”
  • KFF adds a report titled “Who is at Risk Amid the H5N1 Influenza Outbreak? Characteristics and Health Coverage of Animal Production Workers.”
  • The Blue Cross Blue Shield Association lets us know,
    • “Despite the explosion in demand for weight loss drugs known as GLP-1s, 58% of patients discontinue use before reaching a clinically meaningful health benefit. This is the key finding from new researchreleased by the Blue Cross Blue Shield Association (BCBSA) and conducted by Blue Health Intelligence® (BHI) based on data from nearly 170,000 commercial health plan members since the first FDA approval for a weight-loss GLP-1 in 2014.  
    • “When patients take medication, we want it to be safe and effective,” said Razia Hashmi MD, MPH, FAAFP, vice president of Clinical Affairs at BCBSA. “This study shows most people are unlikely to see lasting benefits.  Unfortunately, weight loss isn’t as simple as filling a prescription.”
    • “In the largest study using commercial data to date on this topic, BHI’s assessment also found that 30% of patients discontinued use of the medications within the first month. 
    • “This study underscores how much more we have to learn about these medications,” said Kim Keck, president and CEO of BCBSA. “The science behind these drugs is moving faster than our ability to truly understand which patients will benefit, how to sustain their success and how to pay for them. If we don’t get it right, we will drive up costs for everyone with little to show for it.” 
  • STAT News reports,
    • “Hundreds of genetic variants can nudge someone’s risk of breast cancer up or down or towards a particular subtype. The studies identifying those gene variants, though, have largely involved people with European ancestry and thus give a less accurate picture of breast cancer risk for people who are not white.
    • “That’s beginning to change. Last week, researchers published a genome-wide association study on breast cancer in roughly 40,000 people of African descent in Nature Genetics, marking a leap forward in scientists’ knowledge of breast cancer genetics in people of African ancestry.
    • “Before we started this study in 2016, there were just several thousand cases for Black Americans. It was a very small number,” said Wei Zheng, the study’s senior investigator and a cancer epidemiologist at Vanderbilt University. This study combined data from dozens of other studies and included genetic data for thousands of new participants, making it the largest combined breast cancer genetics study done with people with African ancestry.
    • “Specifically, the study compiled data from about 30 different studies investigating breast cancer in African or African American people. About 18,000 of them had breast cancer, while the other 22,000 were healthy controls, and investigators were able to scour their genetic data for specific variations that seemed closely related to breast cancer. The statistical power that comes with such numbers enabled the team to make two key advances.
    • “First, the team found 12 loci, or locations in the genome, that showed a significant association with breast cancer. Of those, the team identified variants of three genes that appear to increase the risk of triple negative breast cancer, one of the most aggressive subtypes. Since everyone has two copies or alleles of each gene, that means someone could have anywhere between one and six risk-related alleles of these three genes. Those who had all six risk-related alleles had roughly double the chance of getting triple negative breast cancer than those who only had three. * * *
    • “The other advance came when the researchers used the data to build a breast cancer risk prediction model for people with African ancestry. Such models take into account hundreds of different genetic variants that can slightly push breast cancer risk up, adding them all up into a polygenic risk score.”
  • The Wall Street Journal relates,
    • GSK’s experimental drug for asthma met its goals in the latest trial, moving a treatment with potential annual peak sales of more than 3 billion pounds ($3.81 billion) closer to market.
    • The British pharmaceutical company’s depemokimab drug reduced asthma attacks in late-stage trials for patients with severe eosinophilic asthma, a form of the disease caused by high levels of white blood cells, GSK said Tuesday.
    • Depemokimab could be the first approved drug to allow a long-term dosing interval, requiring only two injections a year. This would benefit patients exposed to multiple therapies, the company said.
    • GSK plans to submit the drug for approval for severe asthma in the U.S. in the second half of the year.
  • Per MedTech Dive,
    • “The Food and Drug Administration is seeking examples of artificial intelligence and machine learning models that can identify and predict freezing of gait events related to Parkinson’s disease. 
    • “Freezing of gait is a temporary loss of forward movement while walking. These episodes affect people’s quality of life and daily activities, but they can be difficult to measure because they often happen when patients are outside of a clinic or hospital setting. 
    • “By testing these models against its own data, the FDA hopes to better understand the ability of these technologies to provide digitally derived endpoints that could help with early disease detection and prevention or support treatment and care in the home.” 
  • From the U.S. healthcare business front,
  • Milliman tells us, “In 2024, the cost of healthcare for a hypothetical American family of four in a typical employer-sponsored health plan is $32,066, according to the Milliman Medical Index (MMI).”
  • The Wall Street Journal reports,
    • “National drugstore chains, once resistant to the retail apocalypse that swept across the U.S., are finally succumbing to competition from online shopping and discount stores.
    • “About 3,000 fewer drugstores were open for business at the start of this year compared with the same period in 2019, according to analytics company RetailStat, which tracks 15 pharmacy chains. 
    • “CVS Health, Walgreens and Rite Aid have each closed hundreds of stores since the onset of the pandemic. Online shopping has been growing and offers customers a more convenient way to buy household staples. 
    • “Competition has also increased from discount retailers such as Walmart, grocers such as Aldi, and dollar stores, which all sell many of the same items at lower prices. The spread of beauty stores such as Sephora further siphoned customers from drugstore aisles. 
    • “Everybody’s gone after a component of their business,” said Henry Fonvielle, president of the real-estate company Rappaport.”
  • STAT News notes that “Reports of telehealth’s death have been greatly exaggerated.”
    • “Virtual care isn’t in trouble. What is in trouble are the aftermarket telehealth solutions that largely function as a virtual extension of our siloed, fragmented health care system. This specific application of virtual care, which we call Telehealth 1.0, has consistently failed to bring meaningful value to patients, clinicians, and purchasers.
    • “In that sense, its collapse is a welcome development. It’s a sign that the market discerns where the real value lies in virtual care, and it validates the evolution from transactional, one-off care to more sophisticated virtual-first models.”
  • Per Healthcare Dive,
    • “UnitedHealth-owned Optum Rx, one of the biggest pharmacy benefit managers in the U.S., is launching a new drug pricing model next year meant to make payers’ spending on pharmaceuticals more predictable.
    • “The model, called Clear Trend Guarantee, combines costs that used to be separated out, including retail pharmacy, home delivery, specialty drug and rebates, into one single per-member price, according to a Monday release.
    • “Clear Trend is value-based, meaning Optum Rx will share in any savings tied to patient outcomes created in the model.”
  • Per Fierce Healthcare,
    • “The Purchaser Business Group on Health has unveiled a new purchasing agreement that aims to improve maternal health.”The Purchaser Business Group on Health has unveiled a new purchasing agreement that aims to improve maternal health.
    • “Benefits experts at retail giant Walmart and technology company Qualcomm led the initiative as co-chairs, with the goal of establishing “a collective commitment among employers and public purchasers of healthcare” to address maternal health and birth equity, according to an announcement from PBGH.
    • “The agreement centers on five key principles: deploying evidence-based, coordinated models to ensure high-quality care; ensuring timely access; promoting equitable care built on cultural humility; transparency and accountability; and value-based care.
    • “It also establishes a consensus for employers and public healthcare purchasers as to what high-quality and high-value maternity care is and outlines expectations for both insurers and providers to follow to meet that bar.”
  • Per BioPharma Dive,
    • “A decade ago, as British drugmaker AstraZeneca fought off a hostile takeover bid by Pfizer, CEO Pascal Soriot made a big promise: The company, he said, would boost sales by nearly three-quarters to reach $45 billion by 2023.”A decade ago, as British drugmaker AstraZeneca fought off a hostile takeover bid by Pfizer, CEO Pascal Soriot made a big promise: The company, he said, would boost sales by nearly three-quarters to reach $45 billion by 2023.
    • “With that goal now successfully met, Soriot on Tuesday announced a plan to push the company even higher, setting a target of $80 billion in annual sales by 2030. A slate of new medicines in metabolic and autoimmune disease headline the plan, which also involves sustaining existing businesses in respiratory disorders and cancer.
  • Beckers Hospital Review calls attention to “Fortune and PINC AI’s “15 Top Health Systems” list released May 21.”
  • McKinsey & Company discusses what’s new in consumer wellness trends.

Monday Roundup

David Ermer–Congress, FDA, Generative AI, Obesity, OPM, U.S. Healthcare–
Photo by Sven Read on Unsplash

From Washington, DC,

  • Healthcare Dive reports,
    • “The Senate Finance Committee is considering policies to create more stability in Medicare payments for doctors, an update cheered by physician groups that have long lobbied for reforming how the insurance program reimburses clinicians.
    • “Committee Chair Ron Wyden, D-Ore., and Ranking Member Mike Crapo, R-Idaho, released the white paper on Friday proposing Medicare adjust payments to account for inflation, a key goal for physicians that argue government reimbursement hasn’t kept pace with rising costs.
    • “The Senate Finance Committee is also interested in exploring ways to use incentives to increase provider participation in alternative payment models, and potential changes to Medicare’s budget neutrality requirements, which require the CMS to cut payment to certain specialties to raise it for others.”
  • Fedweek tells us
    • The Senate Homeland Security and Governmental Affairs Committee has passed:
      • S-4035, to require that when FEHB enrollees seek to add a family member to their coverage based on a qualifying life event that the event has occurred and that the individual is eligible for coverage; require the OPM to consider coverage of ineligible individuals when conducting FEHB fraud risk assessments; require a comprehensive audit be conducted of family members currently enrolled; and require OPM to disenroll any ineligible individual found to be receiving FEHB coverage.
  • STAT News lets us know,
    • “Executives from the three major pharmacy benefit manager companies have been invited to testify before the House Committee on Oversight and Accountability next month, four sources familiar with the planning told STAT.
    • “Executives from Optum, CVS Caremark, and Express Scripts, owned by Cigna, were asked to testify before the panel on June 4. * * *
    • “Lawmakers are next eyeing action in December, when a number of health care programs and authorities are expiring.
    • “Ipsita Smolinski, founder and managing director of the consulting firm Capitol Street, said she believes some PBM reforms will pass in December, but not ones that are detrimental to the industry’s business model.
    • “They are largely Medicare and Medicaid, and provide minimal system savings,” she said.”
  • The U.S. Office of Personnel Management announced,
    • “Today, the U.S. Office of Personnel Management (OPM) highlights key actions taken to recruit, hire, and train AI and AI-related talent into the federal government. OPM’s efforts support the AI in Government Act of 2020 and President Biden’s landmark Executive Order on Safe, Secure, and Trustworthy AI.   
    • “Recruiting AI talent ensures the federal government can use the latest technology to tackle global challenges, improve government services, and better support the American public,” said OPM Acting Director Rob Shriver. “As a strategic partner to federal agencies, OPM has taken a number of actions that will set agencies up to compete for top talent in this critical field now and in the future.” 

From the public health and medical research front,

  • The Washington Post and Consumer Reports tell us about “Heart checkups you should have and those you can probably skip.”
  • Per MedTech Dive,
    • “Physician enthusiasm for new pulsed field ablation systems suggests the treatment will be rapidly adopted, to the benefit of device makers bringing the products to market, said analysts who attended the Heart Rhythm Society’s (HRS) annual meeting over the weekend.
    • “Talk about pulsed field ablation (PFA), a catheter-based cardiac ablation technique to treat atrial fibrillation (AFib), dominated the meeting in Boston.
    • “The amount of data and discussions on pulsed field ablation (PFA) was almost overwhelming, with late-breaking data presentations packed by physicians,” Citi Research analyst Joanne Wuensch said in a report to clients Sunday. * * *
    • “PFA is seen as a potentially safer alternative to traditional radiofrequency and cryoablation to treat AFib, the most common form of irregular heart rhythm. Shorter operating times are viewed as another advantage.
    • “Antiarrhythmic drugs are currently recommended as the first treatment for AFib but are associated with adverse events, according to the HRS. PFA differs from thermal ablation to disable cardiac cells by using electricity instead of heat or extreme cold.”
  • Medscape discusses how artificial intelligence fits into clinical practice.
  • MedPage Today informs us,
    • “The FDA approved the first interchangeable biosimilars to aflibercept (Eylea) to treat macular degeneration, according to an announcementopens in a new tab or window from the agency.
    • “As interchangeable biosimilars, aflibercept-jbvf (Yesafili) and aflibercept-yszy (Opuviz) have the same approved indications as the reference product: diabetic macular edema, diabetic retinopathy, macular edema following retinal vein occlusion, and neovascular age-related macular degeneration (AMD). Like reference aflibercept, the two biosimilars are administered via intravitreal injection.
    • “The FDA pointed out in the announcement that a biosimilar “has no clinically meaningful differences” from the reference product, which means that patients “can expect the same safety and effectiveness from the biosimilar as they would the reference product.” Interchangeability means that the biosimilar met other requirements and may be substituted for the reference product without consulting the prescriber.”

From the U.S. healthcare business front,

  • STAT News relates,
    • “Americans, especially Medicare beneficiaries, are getting more medical care these days. Demand from aging Baby Boomers is keeping people in doctor’s offices, and health care providers are continuing to build capacity post-Covid.
    • “Those trends — the same ones that tanked health insurance stocks a few weeks ago — made a strong mark on nonprofit health systems’ first quarter financial reports. STAT took a look at 20 large nonprofit health systems and found that all but four reported higher operating and net margins in the first three months of 2024 compared with the same period in 2023. Hospitals are seeing more patients and cutting down on the expensive contract labor they relied on during the Covid-19 pandemic. And they’re seeing strong investment gains on the non-operating side.”
  • The Wall Street Journal reports,
    • “Hims & Hers Health shares soared after the company said it would add injectable weight-loss drugs to its platform, granting access to the popular treatments to its telehealth patients.
    • “The company on Monday said it now offers access to GLP-1 injections in addition to its oral weight-loss treatments, giving users a broader option to choose from. It will be providing a compounded form of the injections that use the same active ingredients as the popular drugs Ozempic and Wegovy, which are facing shortages that are limiting access for some patients.
    • “The price for compounded GLP-1 injections will start at $199 a month. Its oral medication offering starts at $79 a month. Both are not available in all states.
    • “Hims & Hers said it plans to make branded GLP-1 options available to customers once consistent supply is available through the pharmacies’ wholesaler.”
  • Per Healthcare Dive,
    • “Steward offered specifics on how it intends to auction off its assets in motions filed in bankruptcy court last week, including a timeline for selling its hospitals and physician group as well as contingency plans, including possible closures, if the assets fail to lure qualified bidders.
    • “The physician-owned healthcare network, which filed for Chapter 11 bankruptcy earlier this month, operates 31 hospitals and a physician group, Stewardship Health, in Massachusetts, Arizona, Ohio, Pennsylvania, Arkansas, Louisiana, Texas and Florida. 
    • “All of its assets are up for sale — and Steward is looking to sell quickly, according to the filings.
    • “Steward says it is in advanced discussions with Optum and hopes to finalize an agreement in the near-term for the company to serve as the stalking horse bidder for its physician group, Stewardship Health — the initial bid that sets the floor price during auction.” 
  • NBC News notes,
    • “Many of the ADHD medication shortages that have plagued the U.S. for the last two years have now been resolved, the Food and Drug Administration says. Yet some doctors and patients report they are still struggling to get prescriptions filled.
    • “Dr. Royce Lee, a psychiatrist at the University of Chicago Medicine, said supply has gotten better but it’s still an issue for about a third of the patients he writes prescriptions for. This often means he still has to call around to pharmacies to see if they have the medications in stock, switch patients to different drugs, and deal with insurance companies to confirm coverage.
    • “I do see signs of the shortages easing up,” Lee said. “But there are still enough shortages that every day we’re having to put in a little bit of work for prescriptions that need to be changed or hunted down.”
    • “I think a lot of people are still not getting their treatments,” he added.”