Weekend Update

Generative AI

Weekend Update

David Ermer–Congress, Generative AI, Medical / Rx research, U.S. Healthcare–

From Washington, DC

  • Roll Call discusses likely Senate activities this week.
  • Congress in the July 4, 2025, budget reconciliation act (§ 90101, at 291) did enact a law requiring OPM to place more internal controls over family member eligibility.
    • – No later than 12/31/25, OPM must develop a process by which any [ineligible] individual enrolled in, or covered under, a [FEHB or PSHB] shall be disenrolled or removed from enrollment in, or coverage under, that plan.
  • This requirement should include implementation of the HIPAA 820 standard enrollment roster transaction. 
    • – No later than July 3, 2026, OPM must issue regulations and implement a process to verify – (1) the veracity of any qualifying life event through which an enrollee seeks to add a member of family to his/her coverage; and (2) that, when an enrollee in the Program seeks to add a member of family to his/her coverage, including during any open season, the individual so added is a qualifying member of family with respect to the enrollee.
  • It would be sensible for OPM to implement a program similar to TRICARE’s DEERS program which places the reporting burden on the TRICARE enrollee. 
  • HIPAA Suite explains,
    • “The HIPAA 820 transaction set [which has been around since 2008] handles the [electronic] communication between a sponsor that is an entity that pays for someone’s health care, and another entity that manages health care benefits, such as an insurance company.
    • “For example, a large employer that has a contract with an insurance company or a government agency that handles social and health benefits will use the 820 transaction to manage premium payments. This information can either be very detailed and contain demographic information on each individual that is covered or just contain a summary of the payment for all members.
  • The HIPAA standard transaction law requires health plans to be able to process the HIPAA 820. What’s more nearly half of FEHB and PSHB enrollees have self only coverage.

From the public health and medical reseach front,

  • MedPage Today reports,
    • “For years, we’ve told our patients that human papillomavirus (HPV) vaccination works best when administered before sexual debut — and rightfully so. But what happens when a woman has already developed high-grade cervical dysplasia and undergoes surgical treatment?
    • Our recent study, published in The Lancet Regional Health – Europe, explored that very question. And the results were striking: women who received the HPV vaccine after surgical excision (conization) experienced a 74% reduction in recurrent high-grade cervical lesions (CIN2+), with the most dramatic benefit seen within the first 6 months after surgery.
  • and
    • “Cases of “Ozempic mouth” and “Ozempic teeth” have recently been described in the news, with most of the problems — inflammation affecting the gums, tooth decay, and even bad breath — linked to a dry mouth.
    • “All of the GLP-1 agonists that we use now cause changes in how everything is secreted in your GI tract,” Ann Marie Defnet, MD, who specializes in obesity medicine and bariatric surgery at Northwell Health’s North Shore University Hospital and Long Island Jewish Medical Center in New York City, told MedPage Today. And this “definitely has an impact on saliva.”
    • “People taking GLP-1 drugs also tend to be a bit dehydrated because they are often not hungry or thirsty, she noted.
    • “I haven’t seen too many horrible cases of periodontal disease, gingivitis, or anything like that, nor have I had any patients really complaining about dry mouth,” she noted. “But definitely I have patients all the time that [say], ‘Oh yeah, I can tell I’m dehydrated.'”
    • “Defnet said she believes some of the serious oral health issues that have been reported are likely representative of “more of a later stage issue with patients who maybe just aren’t staying hydrated in general.”
    • “One of the big things I always counsel my patients on is they just have to remember to continue to drink water, even if they’re not thirsty, even if they’re not hungry,” Defnet said. “That seems to help with all of these symptoms.”
  • The New York Times discusses “Coronary artery calcium testing [which] can reveal plaque in arteries, offering a more precise estimate of a patient’s risk [of having a heart attack]. Yet the test remains underused.”
    • “A brief and painless CT scan, it would show whether the fatty deposits called plaque were developing in the arteries leading to her heart.
    • “When plaque ruptures, it can cause clots that block blood flow and trigger heart attacks. The scan would help determine whether Ms. Hollander would benefit from taking a statin, which could reduce plaque and prevent more from forming.
    • “The test is used by more people every year,” said Dr. Michael Blaha, co-director of the preventive cardiology program at Johns Hopkins University. Calcium scans quadrupled between 2006 and 2017, his research team reported, and Google searches for related terms have risen even more sharply.
    • “Yet “it’s still being underused compared to its value,” he said.
    • “One reason is that although the test is comparatively inexpensive — sometimes up to $300, but often $100 or less — patients must pay for it out of pocket. Medicare rarely covers it, though some doctors argue that it should.”

From the U.S. healthcare business front,

  • Radiology Business lets us know,
    • “Physicians are increasingly exiting Medicare, according to new research published in JAMA Health Forum. 
    • “Radiology and other specialties have expressed concern in recent years that inadequate payment rates could push practices to close or stop accepting the federal program for seniors. Since 2001, Medicare reimbursements to physicians have fallen 33%, when adjusting for inflation, according to the American Medical Association. 
    • “Researchers recently sought to test this theory, analyzing 100% of fee-for-service Medicare Part B claims logged between 2010 to 2024. They found the share of physicians exiting Medicare increased “significantly” from 1.8% to 3.6% by the end of the study period. 
    • “The findings may reflect multiple factors, including the greater burden of new communication methods (e.g., portal messages) and demands for clinical documentation,” Hannah T. Neprash, PhD, and Michael E. Chernew, PhD, healthcare policy experts with the University of Minnesota and Harvard Medical School, respectively, wrote July 18. “More rapid growth in exit[s] among small practices likely contributes to consolidated physician markets, given that new physicians increasingly work for large practices.”
    • “Researchers excluded docs who on average billed for fewer than 100 Medicare claims annually. They defined an exit as the absence of any claims in the payment program for 12 consecutive months. Altogether, the study sample included over 791,000 physicians at an average age of nearly 45. Physician Medicare exits displayed a gradual increase from 2010-2013 before stabilizing between 2014-2016. They saw another gradual increase from 2017-2019 and then spiked amid the COVID-19 pandemic in 2020-2021 before returning to regular levels by 2023.” 
  • The boilerplate in an FEHB or PSHB brochure (meaning its OPM policy) reads,
    • If you are enrolled in Medicare Part B, a physician may ask you to sign a private contract agreeing that you can be billed directly for services ordinarily covered by Original Medicare. Should you sign an agreement, Medicare will not pay any portion of the charges, and we will not increase our payment. We will still limit our payment to the amount we would have paid after Original Medicare’s payment. You may be responsible for paying the difference between the billed amount and the amount we paid.
  • MedCity News informs us that “Sentara Health has rolled out Regard’s AI-powered chart review and discharge summary tool across all 12 of its hospitals [located in Virginia and North Carolina]. The tool has delivered consistent benefits when it comes to patient safety and documentation accuracy, said Joseph Evans, Sentara’s chief health information officer.

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

Exploitation of Microsoft SharePoint Vulnerabilities

  • Last Sunday, July 20, the Cybersecurity and Infrastructure Security Agency (CISA) added a known exploited vulnerability to its catalog
    • CVE-2025-53770 Microsoft SharePoint Server Remote Code Execution Vulnerability
  • CISA also created an alert on the new KVE, which the agency updated on Tuesday and Thursday.
  • The Wall Street Journal reported on July 21,
    • “Microsoft issued an alert about “active attacks” targeting its server software and urged customers to install new security updates that have been released.
    • “Microsoft’s Security Response Center said in a blog post over the weekend that the attacks target on-premises SharePoint server customers and exploit vulnerabilities that were partially addressed by a July security update.
    • “Organizations typically use Microsoft SharePoint to create intranet websites, store and organize information, and facilitate file-sharing among workers. Cloud-based SharePoint Online in Microsoft 365 isn’t affected, the company said.
    • “By Monday, cybersecurity investigators said that the SharePoint attacks were widespread. At least one of the “multiple” hacking groups involved in the attacks was linked to China, according to Google’s Mandiant cybersecurity group.
    • “Microsoft declined to comment beyond its blog post.
    • “Hackers exploiting the SharePoint flaws then stole cryptographic keys that could be used to run commands on the affected server in the future, even if it had been patched, cybersecurity investigators said on Monday.”
  • and added on July 24,
    • Last year, Satya Nadella pledged to make security priority number one at Microsoft. A new hack involving China is showing just how difficult that can be.
    • The attack involves several versions of Microsoft’s SharePoint software that serve as a document storage platform for customers who don’t want to use the cloud. Microsoft released patches for a pair of SharePoint bugs earlier this month, but the fixes were quickly bypassed, allowing China-linked hackers to break into hundreds of organizations, according to security researchers.
    • Instead of protecting customers, the faulty patches may have served as a road map for hackers to hone their attacks, the researchers said.
    • It’s the latest in a string of lapses by the technology giant that have benefited China’s vast and global cyber-espionage operations, a top U.S. national security threat. * * *
    • “In the SharePoint attack * * * the issue began in May 2025, at a hacking contest in Berlin where the Vietnamese researcher [and pentester] Dinh Khoa (LinkedIn page) won $100,000 and a laptop.
    • “This is a very hard target so we spent a lot of time digging into it,” Khoa said in an interview posted online after the contest.
    • “To the applause of audience members, he showed how to break into a SharePoint system and was soon escorted into a private room where he explained the bugs to a representative from Microsoft and Dustin Childs, head of threat awareness with cybersecurity company Trend Micro’s Zero Day Initiative. Two months later, on July 8, Microsoft fixed the bugs. They were two of the 130 bugs that Microsoft fixed that month.” * * *
    • “On Saturday [July 19], Microsoft took the unusual step of issuing two emergency patches, which contain “more robust protections” to the bugs that Khoa had found, the company said. SharePoint customers should also change the cryptographic keys used by their servers, a move that—when combined with the new patches—effectively closes the back door created by the attack, Microsoft said.”
  • Cyberscoop noted on July 24,
    • The fallout from an attack spree targeting defects in on-premises Microsoft SharePoint servers continues to spread nearly a week after zero-day exploits were discovered, setting off alarms across the globe. More than 400 organizations have been actively compromised across four waves of attacks, according to Eye Security.
    • Multiple government agencies, including the Departments of Energy, Homeland Security and Health and Human Services, have been hit. The California Independent System Operator, which operates some of the state’s wholesale electric grid, was also impacted.
    • As more victims confirm varying levels of compromise from the attack spree, researchers are learning and sharing more details about post-exploit activities. One of the China-based attackers behind the initial wave of attacks, Storm-2603, deployed Warlock ransomware starting July 18, Microsoft Threat Intelligence said Wednesday in an updated blog post.
    • The Chinese government-affiliated threat groups Linen Typhoon and Violet Typhoon — which have been active for at least a decade — are also actively exploiting the zero-day vulnerabilities, Microsoft said. Linen Typhoon has focused on stealing intellectual property and Violet Typhoon is an espionage threat group. Storm is a moniker Microsoft uses for threat groups in development.
  • NextGov/FCW discusses the impact of the Sharepoint vulnerabilities on federal government agencie here (Homeland Security, among other agencies affected) and there (Defense Department not affected).

From the cybersecurity breaches and vulnerabilities front,

  • Security Week informs us,
    • “The Alcohol & Drug Testing Service (TADTS) is notifying roughly 750,000 people that their personal information was compromised in a July 2024 data breach.
    • “TADTS is based in Texas and was until recently known as the Texas Alcohol and Drug Testing Service. It provides workplace and individual alcohol and drug testing services in Texas and other states.
    • “The incident, TADTS says, was identified on July 9, 2024, and involved unauthorized access to and the theft of data maintained in its systems.
    • “The investigation into the potentially compromised information, conducted with the assistance of a professional data mining team, was concluded only recently, and determined that personal information was included in the stolen data.” * * *
    • “While TADTS did not share details on the type of cyberattack it fell victim to, the infamous BianLian ransomware group took credit for the intrusion on July 14, 2024, claiming the theft of roughly 218 gigabytes of data.
    • “It is unclear whether the hackers released the stolen information publicly, as their Tor-based leak site is currently offline and the group has been quiet for months, with their last known victim announced on March 31.”
  • and
    • “Marketing software and services company Cierant Corporation and law firm Zumpano Patricios have independently disclosed data breaches, each impacting more than 200,000 individuals.
    • “What the Cierant and Zumpano Patricios incidents have in common is that the number of impacted people was brought to light in recent days by the healthcare data breach tracker maintained by the US Department of Health and Human Services (HHS).
    • “The Zumpano Patricios breach impacts nearly 280,000 individuals. The law firm, which has offices in several major US cities, is representing healthcare providers in disputes with health insurance companies over medical service payments to patients. 
    • “Zumpano Patricios is informing impacted individuals that it had detected an intrusion in its IT network on May 6, 2025, but could not determine the date and time of initial access. 
    • “An investigation revealed that the hackers accessed and possibly exfiltrated files containing information such as patient name, date of birth, Social Security number, provider name, health insurer information, dates of service, and amounts charged by the provider and payments they received.”
  • Cybersecurity Dive tells us,
    • “Hackers breached the Philadelphia Indemnity Insurance Company in June and stole customer data, the company said in a filing with the California Attorney General’s office. 
    • “An unauthorized party accessed customer data during an intrusion discovered between June 9 and June 10, according to the disclosure.
    • “The company previously called the incident a network outage, however it said there was no ransomware and no encryption. The company did report the incident to law enforcement and retained outside forensic experts to investigate.”
  • In addition to the June 20 addition discussed above, CISA added six known exploited vulnerabilities to its catalog this week.
    • July 22, 2025
      • “CVE-2025-49704 Microsoft SharePoint Code Injection Vulnerability
      • “CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerability”
        • Cybersecurity Dive explains,
          • “The [Sharefile] intrusions are exploiting ToolShell, an attack sequence that combines remote code injection and network spoofing vulnerabilities tracked as CVE-2025-49704 and CVE-2025-49706.” 
    • Also July 22, 2025,
      • CVE-2025-54309 CrushFTP Unprotected Alternate Channel Vulnerability
        • Tenable discusses the CrushFTP vulnerability
      • CVE-2025-6558 Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
      • CVE-2025-2776 SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
      • CVE-2025-2775 SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability
  • Security Week notes,
    • “SonicWall on Wednesday announced patches for a critical vulnerability in Secure Mobile Access (SMA) 100 series secure access gateways, urging organizations to take immediate action in the wake of the recently disclosed Overstep malware attacks.
    • “The newly addressed flaw, tracked as CVE-2025-40599 (CVSS score of 9.1), is described as an arbitrary file upload issue in the SMA 100’s web management interface.
    • “The bug can be exploited by remote attackers to upload arbitrary files to the system, which could lead to remote code execution (RCE). The attackers need administrative privileges to exploit the security defect, SonicWall’s advisory reads.”
  • and
    • “The Lumma Stealer has returned after Microsoft and law enforcement caused significant disruption to its infrastructure, Trend Micro reported on Tuesday.” * * *
    • “The ability of Lumma Stealer’s operators to regroup and innovate poses a continued risk to organizations and individuals worldwide,” Trend Micro said. “This emphasizes the need for ongoing vigilance, proactive threat intelligence, and sustained collaboration between law enforcement and the cybersecurity community. Without this, even the most significant takedowns might only offer temporary relief from evolving cyber threats.”
  • Per Dark Reading,
    • “A suspected Chinese nation-state threat group is conducting an extensive cyberespionage campaign that takes advantage of vulnerable VMware ESXi and vCenter environments.
    • “Since early 2025, researchers at Sygnia have responded to multiple incidents tied to a cyberespionage campaign they track as “Fire Ant.” According to research published Thursday, Fire Ant actors are establishing initial access in organizations’ VMware systems, which have become popular targets for attackers in recent years.
    • “More importantly, Fire Ant actors used deep knowledge of the target environments and strong capabilities to consistently bypass segmentations and reach isolated portions of the network.”

From the ransomware front,

  • In line with this week’s theme, Bleeping Computer points out,
    • “A China-based hacking group is deploying Warlock ransomware on Microsoft SharePoint servers vulnerable to widespread attacks targeting the recently patched ToolShell zero-day exploit chain.
    • “Non-profit security organization Shadowserver is currently tracking over 420 SharePoint servers that are exposed online and remain vulnerable to these ongoing attacks.
    • “Although Microsoft has observed this threat actor deploying Warlock and Lockbit ransomware in the past, Microsoft is currently unable to confidently assess the threat actor’s objectives,” the company said in a Wednesday report.”
  • July 22, 2025, CISA issued an alert and advisory on Interlock ransomware.
  • Per Bleeping Computer,
    • “Law enforcement has seized the dark web extortion sites of the BlackSuit ransomware operation, which has targeted and breached the networks of hundreds of organizations worldwide over the past several years.
    • “The U.S. Department of Justice confirmed the takedown in an email earlier today, saying the authorities involved in the action executed a court-authorized seizure of the BlackSuit domains.
    • “Earlier today, the websites on the BlackSuit.onion domains were replaced with seizure banners announcing that the ransomware gang’s sites were taken down by the U.S. Homeland Security Investigations federal law enforcement agency as part of a joint international action codenamed Operation Checkmate.”

From the cybersecurity policy and law enforcement front,

  • Cyberscoop reports,
    • “The Trump administration’s new AI Action Plan calls for companies and governments to lean into the technology when protecting critical infrastructure from cyberattacks.
    • “But it also recognizes that these systems are themselves vulnerable to hacking and manipulation, and calls for industry adoption of “secure by design” technology design standards to limit their attack surfaces.
    • “The White House plan, released Wednesday, calls for critical infrastructure owners — particularly those with “limited financial resources” — to deploy AI tools to protect their information and operational technologies.
    • “Fortunately, AI systems themselves can be excellent defensive tools,” the plan said. “With continued adoption of AI-enabled cyberdefensive tools, providers of critical infrastructure can stay ahead of emerging threats.” * * *
    • “The Trump plan states that “all use of AI in safety-critical or homeland security applications should entail the use of secure-by-design, robust, and resilient AI systems that are instrumented to detect performance shifts, and alert to potential malicious activities like data poisoning or adversarial example attacks.”
    • “The plan also recommends the creation of a new AI-Information Sharing and Analysis Center (AI-ISAC) led by the Department of Homeland Security to share threat intelligence on AI-related threats.”
  • Cybersecurity Dive lets us know,
    • “Sean Plankey, President Donald Trump’s nominee to lead the Cybersecurity and Infrastructure Security Agency, faced sharp questions during a Senate confirmation hearing Thursday about the looming expiration of an information-sharing law and CISA’s work on election security.
    • Plankey — currently a senior adviser to Secretary of Homeland Security Kristi Noem — explained his vision for leading an agency that has experienced major workforce cuts and faces significant budget reductions in Trump’s Fiscal Year 2026 spending proposal.”
    • The Senate Homeland Security and Governmental Affairs Committee will vote on whether to send Mr. Plankey’s nomination to the Senate floor at a business meeting next Thursday.
  • Cyberscoop adds,
    • “President Donald Trump’s pick to lead the Cybersecurity and Information Security Agency told senators Thursday that he would prioritize evicting China from the U.S. supply chain, and wouldn’t hesitate to ask for more money for the shrunken agency if he thought it needed it.
    • “If confirmed it will be a priority of mine to remove all Chinese intrusions, exploitations or infestation into the American supply chain,” Sean Plankey told Rick Scott, R-Fla., at his confirmation hearing before the Homeland Security and Governmental Affairs Committee. Scott had asked Plankey about reports of Chinese infiltration of U.S. energy infrastructure.”
  • Per a National Institute of Standards and Technology news release,
    • “NIST has issued draft updates to Special Publication (SP) 800-53 to provide additional guidance on how to securely and reliably deploy patches and updates in response to the Executive Order 14306, Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144. A two-week expedited public comment period on the draft updates is open through August 5, 2025.” 
  • Per a July 23, 2025, HHS news release,
    • “Today, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) announced a settlement with Syracuse ASC, LLC doing business as Specialty Surgery Center of Central New York, for potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security and Breach Notification Rules. Syracuse ASC is a single-facility, ambulatory surgery center located in Liverpool, New York that provides ophthalmic and ENT surgical services and pain management procedures to patients.” * * *
    • “The settlement resolves an OCR investigation concerning a ransomware breach of ePHI that affected 24,891 individuals. OCR initiated the investigation in October 2021 after Syracuse ASC reported to HHS that an unauthorized individual had accessed its network in March 2021. Further investigation revealed that Syracuse ASC was affected by a ransomware attack involving the PYSA ransomware variant, which is a cross-platform cyber weapon known to target the healthcare industry. OCR’s investigation found that Syracuse ASC never conducted an accurate and thorough risk analysis to determine the risks and vulnerabilities to the ePHI it held. OCR also found that Syracuse ASC failed to timely notify affected individuals and the Secretary of the breach.
    • “Under the terms of the resolution agreement, Syracuse ASC agreed to implement a corrective action plan that OCR will monitor for 2 years and paid $250,000 to OCR.”
  • Cyberscoop reports,
    • “Ukrainian authorities Tuesday [July 22, 2025] arrested the alleged administrator of XSS.is, a Russian-language cybercrime forum, following a four-year investigation by the Paris public prosecutor’s office. 
    • “Law enforcement officials from France and Europol seized the domain of the influential forum following the arrest. Authorities have not named the suspected administrator of XSS.is.
    • “The forum, which was active since 2013, had more than 50,000 registered users and was a key marketplace for stolen data, malware, access to compromised systems and ransomware services, officials said. “It has long been a central platform for some of the most active and dangerous cybercriminal networks, used to coordinate, advertise and recruit,” Europol said in a news release.”
  • Dark Reading alerts us,
    • “A “laptop farmer” [Christina Marie Chapman] in Arizona responsible for enabling North Korean IT worker infiltration into US companies is going to jail for eight and a half years, after raising $17 million in illicit funds for Kim Jong-Un’s regime. That news, however, is merely a drop in the justice bucket, and DPRK’s efforts to siphon salaries off of American companies is unlikely to wane anytime soon. So, US organizations need to wrap their heads around the magnitude of the threat.
    • “North Korea’s multiyear HR-compromise effort has the twin goals of earning money for the hermit kingdom’s nuclear program and other efforts via salaries, as well as gaining a foothold inside corporate networks for the purpose of planting cryptominers or malware for stealing secrets.”
  • Cybersecurity Dive adds,
    • “The U.S. Department of the Treasury on Thursday [July 24, 2025] sanctioned three North Koreans and their company for participating in remote IT worker scams and other operations designed to generate revenue for Pyongyang.
    • “The sanctions target the North Korean firm Korea Sobaeksu Trading Co., Sobaeksu employee Kim Se Un, Sobaeksu “IT team leader” Jo Kyong Hun and Kim’s associate Myong Chol Min. 
    • “The Treasury Department calls Sobaeksu a front for North Korea’s Munitions Industry Department, which oversees the country’s nuclear weapons program. North Korea “has previously utilized Sobaeksu to send teams of IT workers overseas, including to Vietnam, in order to generate revenue,” the department said.”

From the cybersecurity defenses front,

  • HelpNet Security explains “Why we must go beyond tooling and CVEs to illuminate security blind spots.”
  • SC Media discusses “exposure management [, which is] a new blueprint for modern cyber defense.
  • Here is a link to Dark Reading’s CISO Corner.

Midweek update

David Ermer–CDC, CMS, Congress, FDA, Generative AI, Medical / Rx research, Medicare, Rx coverage, U.S. Healthcare–

From Washington, DC,

  • Roll Call reports,
    • “Senate Republicans say they are working on a bipartisan health package to lower drug and health insurance costs, a development that’s news to some Democrats who remain skeptical that their GOP colleagues will work with them.
    • “Sen. Bill Cassidy, R-La., is leading the talks, with a particular focus on more transparency from pharmacy benefit managers, so-called upcoding practices in Medicare Advantage and other health items.
    • “A group of Republican senators, including Lisa Murkowski of Alaska, are pushing to extend expiring health insurance subsidies for people who buy their own insurance on the marketplaces.
    • “Republicans are tight-lipped about the package, which is in the very early stages, said Sen. Michael D. Crapo, R-Idaho, who chairs the Senate Finance Committee.
    • “We’re going to have PBM legislation that hopefully will remain bipartisan, and there have been a number of other initiatives. I’m not going to start singling things out,” Crapo said Tuesday. “We are discussing everything that people want to look at as issues,” including Medicare Advantage, a private alternative to traditional Medicare, adding that he was disappointed certain changes weren’t addressed in the reconciliation package.”
  • Healthcare Dive offers more details on Tuesday’s Senate hearing about the Medicare Advantage program.
  • Mercer tells us,
    • “The Affordable Care Act (ACA) benchmark for determining the affordability of employer-sponsored health coverage will increase significantly for the 2026 plan year according to IRS Rev. Proc. 2025-25 — to 9.96% of an employee’s household income up from the 2025 plan-year level of 9.02%. This affordability percentage can affect individuals’ eligibility for federally subsidized coverage from a public exchange, as well as employers’ potential liability for shared-responsibility (or “play or pay”) assessments.” * * *
    • “Employers should review the required employee contribution for 2026 coverage if they plan to meet the ACA’s affordability limit under the applicable safe harbor. For the many plans using the FPL affordability safe harbor, the considerations differ for calendar- and non-calendar-year plans.”
  • Modern Health lets us know,
    • “Medicare may soon test a plan to equalize reimbursements for outpatient services regardless of where the care is provided.
    • “This foray into so-called site-neutral payment would begin next year and focus on physician-administered medications such as chemotherapy drugs. Hospitals would get paid less than they are now for providing those services.
    • “The plan, contained in the Hospital Outpatient Prospective Payment System proposed rule for 2026 that the Centers for Medicare and Medicaid Services issued last Tuesday, reflects growing interest in setting uniform Medicare rates for services across settings.”
  • The American Hospital Association New informs us,
    • The White House July 23 released an action plan with a series of more than 90 policy recommendations to expand the use of artificial intelligence. The plan follows a directive from the administration’s Jan. 23 executive order, “Removing Barriers to American Leadership in Artificial Intelligence.” The policy recommendations are aligned across three pillars — accelerating innovation, building American AI infrastructure, and leading in international diplomacy and security. The action plan recommends the launch of sector-specific efforts, including health care, to convene stakeholders to accelerate the development and adoption of national standards for AI systems. It also calls for testing AI system pilots in real-world settings across health care and other sectors through regulatory sandboxes and AI centers of excellence.
    • Other policy recommendations include removing onerous federal regulations that hinder AI development and deployment; expediting permits for building data centers and semiconductor facilities; expanding AI literacy and skills for education and workforce training; and bolstering critical infrastructure cybersecurity pertaining to AI.
  • and
    • “The Department of Health and Human Services July 23 announced it is recommending the removal of thimerosal from all U.S. flu vaccines. The announcement follows a recommendation last month by the Centers for Disease Control and Prevention’s Advisory Committee on Immunization Practices.”

From the Food and Drug Administration front,

  • STAT News reports,
    • “The FDA posted a webpage yesterday allowing drug companies to indicate their interest in participating in a pilot voucher program that aims to cut product review times down to just one to two months. The agency will be choosing five companies in the first round.
    • “The FDA announced last month that it would launch this program to reward companies whose actions align with certain policy priorities, including addressing unmet public health needs, beefing up domestic production of drugs, and delivering more innovative cures.
    • “The webpage states that another “program priority” is increasing affordability, such as lowering drug prices in line with President Trump’s most favored nation policy.
    • “Critics say the voucher program raises concerns that the FDA is injecting politics into drug review decisions that should be centered around science, and that one to two months is not a sufficient amount of time to review new drugs.”
  • Per BioPharma Dive,
    • “Roche is pausing sales of the Duchenne gene therapy Elevidys in some countries outside the U.S. after partner Sarepta Therapeutics agreed Monday to a Food and Drug Administration request to do the same in the U.S.
    • “Roche said Wednesday it is temporarily and voluntarily halting shipments of the treatment in countries that reference the FDA’s approval of Elevidys in their local decision. The Swiss pharmaceutical company markets the gene therapy outside the U.S. under a 2019 alliance with Sarepta and will continue to ship Elevidys in countries that don’t rely on FDA decisions.
    • “The FDA asked Sarepta to stop shipping Elevidys following the deaths from acute liver failure of two teenagers treated with it earlier this year. Both Sarepta and Roche maintain the benefit-risk balance to treatment remains positive in younger patients who can still walk.”
  • Fierce Pharma points out,
    • “Just when the future looked bleak for GSK’s Blenrep comeback in the U.S., the FDA has blessed the company’s multiple myeloma ambitions with a glimmer of hope.
    • “Following last week’s negative feedback from the FDA’s Oncologic Drugs Advisory Committee (ODAC), the agency was scheduled to make the final call on the drug’s use in patients with multiple myeloma who have received at least one prior line of therapy by July 23. 
    • “Now, the FDA has pushed back its decision date to Oct. 23, tacking on extra time to “review additional information provided in support of the application,” GSK announced Wednesday.”
  • The AHA News notes,
    • “The Food and Drug Administration July 22 released an early alert for Novum IQ large volume infusion pumps by Baxter. The company stated that the pump has potential for under infusion when transitioning to a higher flow rate. The FDA said Baxter has reported 79 serious injuries and two deaths associated with the issue as of June 27.”

From the judicial front,

  • Federal News Network reports,
    • “Details of the imminent reductions in force and staffing reorganizations planned across government will remain under wraps after an appeals court blocked a judge’s order for a list of those plans to be released.
    • “The Ninth Circuit Court of Appeals granted the Trump administration’s request for an emergency stay on U.S. District Court Judge Susan Illston’s order for the government’s lawyers turn over the dozens of RIF plans they said are ready for implementation.
    • “The appeals court’s decision means agencies can still move forward with any planned RIFs and staffing reorganizations without needing to divulge that information either to the court or to the public, at least for the time being.”
  • Per Bloomberg Law,
    • “Neurological Surgery Practice of Long Island, PLLC sued the Health and Human Services, Labor, and Treasury departments in April 2023, alleging the agencies failed to establish and enforce procedures to resolve surprise billing disputes as required by Congress under the No Surprises Act. The law requires insurers and doctors to resolve unexpected out-of-network bills through arbitration, rather than billing the patient.”
    • The district court ruled against the provider, and today the U.S. Court of Appeals for the Second Circuit affirmed (Dropbox link) the district court’s ruling (No. 24-1884).

From the public health and medical research front,

  • CBS News reports,
    • “Rich’s Ice Cream is recalling 110,292 cases of frozen dessert products across 23 states due to potential listeria contamination, which can lead to serious illness.
    • “The recall, which was first initiated in June, was recently updated to a Class II threat, meaning the product “may cause temporary or medically reversible adverse health consequences,” the U.S. Food and Drug Administration says.
    • “According to federal health officials, the products were distributed to Alabama, Arizona, California, Florida, Georgia, Illinois, Iowa, Louisiana, Massachusetts, Montana, Nebraska, Nevada, New Jersey, New York, Ohio, Oklahoma, Oregon, Pennsylvania, South Carolina, Tennessee, Texas, Virginia and Wisconsin. They were also sold in Nassau, Bahamas.” * * *
    • “Customers can visit the Rich’s Ice Cream website for more information on product labels.”
  • The University of Minnesota informs us,
    • “Amid ongoing record post-elimination measles activity in the United States, four states have reported more measles cases, including Colorado, Iowa, New Mexico, and Wyoming.
    • “Meanwhile, in its weekly update, the US Centers for Disease Control and Prevention (CDC) added 10 more cases to the national total, which has now reached 1,319 cases.
    • “In early July, the United States passed its previous post-elimination record of measles cases, and though cases in the West Texas outbreak have declined steadily, smaller outbreaks and travel-linked cases continue to push the nation’s total higher. The surge in US measles activity is part of a global rise in cases made worse by dropping childhood immunization rates.
    • “The CDC said the number of affected states remained at 40, with the number of outbreaks holding at 29. So far, 87% of the nation’s cases are connected to outbreaks and 92% of affected patients are unvaccinated or have unknown vaccination status. Children ages 5 to 19 years old are the most affected age group, followed closely by adults ages 20 and older.”
  • Per STAT News,
    • “The H5N1 bird flu virus has historically extracted a heavy toll when it infects humans, with nearly half of confirmed cases ending in death over the past three decades. But of the 70 cases reported in the United States over the past 18 months, only a single death occurred, leaving experts puzzled at how to explain the phenomenon.
    • “A new study published Wednesday adds weight to an argument that the immunity people have developed to the virus that caused the most recent flu pandemic, an H1N1 virus that emerged in 2009, has induced some cross-protection that may be making it harder for H5N1 to infect people, and mitigating the severity of the ensuing disease when such infections occur.
    • “The paper, published in the journal Science Translational Medicine, reports on a number of studies done in ferrets, the closest animal model for what happens when humans are infected with influenza. It showed that while H5N1 is lethal to ferrets with no immunity to influenza, animals that have previously been infected with influenza A — either H3N2 or H1N1 — appear to have some protection when they are later exposed to the bird flu virus. The protection is particularly strong with H1N1.
    • “Seema Lakdawala, one of the authors of the study, said the findings provide hope that, should H5N1 — long considered a major pandemic threat — acquire the ability to spread easily to and among humans, the resulting pandemic might not be as disastrous as people have feared.”
  • MedPage Today tells us,
    • “A meta-analysis pooled data on dose-response associations between daily steps and a broad range of health outcomes.
    • “Increasing daily step counts above 2,000 was associated with risk reductions in mortality and cardiovascular, cancer, and other outcomes.
    • “A goal of 5,000 to 7,000 steps per day [not 10,000 steps] was deemed appropriate for achieving good health.”
  • HCPLive points out,
    • “A study found no significant differences in IBS symptom severity between gluten, wheat, and sham challenges, questioning the role of these ingredients as triggers.
    • “Despite findings, many patients continued a gluten-free diet, indicating psychological factors may influence symptom perception and dietary choices.”
  • HHS, FDA and USDA discuss their approach to ultra-processed food here.

From the U.S. healthcare business front,

  • Fierce Healthcare reports,
    • “Molina Healthcare is seeing sustained pressure as the insurer released its second quarter financial results.
    • “For the full year, the company anticipates a floor of $16.90 per diluted share and adjusted earnings to be at least $19.00 per diluted share. Earlier this month, the insurer warned medical cost pressures would affect adjusted earnings, lowering its target to $21.50 to $22.50 per share.
    • “Molina’s stock has dipped about 4% in after-hours trading.
    • “The current earnings pressure we are experiencing results from what we believe to be a temporary dislocation between premium rates and medical cost trend which has recently accelerated.,” said CEO and President Joseph Zubretsky in a statement. “We are still performing near our long-term target ranges, and nothing has changed our outlook for the long-term performance of the business.”
    • “Adjusted net income for the quarter is $5.48 per diluted share, similar to its preview from early July, for a decrease of 6% year-over-year.”
  • MedCity New tells us,
    • “Aeroflow Health, a health tech company, has teamed up with Cigna to provide virtual nutrition services to its members nationally, the company announced (Opens in a new window)on Tuesday.
    • “Asheville, North Carolina-based Aeroflow Health was founded in 2001 and offers an array of medical devices covered by insurance. The company has four lines: Aeroflow Breastpumps, Aeroflow Diabetes, Aeroflow Sleep and Aeroflow Urology. In addition to medical devices, it provides education and consultations. The company has partnerships with more than 1,000 insurance plans.
    • “Through the partnership with Cigna, Aeroflow Health will serve Cigna members who would “most benefit from nutrition interventions,” such as new mothers, those with diabetes or those with a chronic disease, according to the announcement. These patients will have access to registered dietitians, who can create personalized meal plans and provide tips to support their goals, such as boosting breast milk production, losing weight, reducing cholesterol or lowering the risk of heart disease.”
  • Healthcare Dive relates,
    • “Tenet Healthcare raised its 2025 financial guidance on Tuesday after releasing second-quarter earnings that showed year-over-year growth in revenue and adjusted earnings before interest, taxes, depreciation and amortization.
    • “The hospital operator now expects between $20.95 billion and $21.25 billion in revenue for 2025 on net income of $1.3 billion to $1.4 billion. Previously, Tenet projected $20.6 billion to $21 billion in revenue and $1.1 billion to $1.2 billion in income.
    • “Still, Tenet declined to answer questions on a Tuesday morning call with investors about the future financial impacts from the recently enacted “One Big Beautiful Bill” and potentially expiring Affordable Care Act exchange premium tax credits. Tenet’s stock declined about 15% by market close on Tuesday.”
  • Per Fierce Healthcare,
    • “Community Health Systems (CHS) shared word that it beat Q2 consensus estimates for both revenue and earnings, as well as news that CEO Tim Hingtgen will retire later this year.
    • “The public for-profit logged net operating revenues of $3.13 billion for the quarter, above the $3.02 billion estimate. That’s a 0.2% dip from the second quarter of 2024 though same-store net operating revenues rose 6.5%, reflecting divestitures the company underwent during the past year.
    • “The revenues outline a 7.4% year-over-year decline in admissions and an 8.3% decline in year-over-year admissions. However, same-store admissions rose by 0.3% while same-store adjusted admission fell by 0.7%.
    • “Net income attributable to stockholders was $282 million ($2.09 per share), as opposed to the $13 million net loss (-$0.10 per share) a year prior. Those decrease to a $0.05 net loss per share for Q2 2025 and $-0.17 net loss per share for Q2 2024 when excluding adjusting items related to early extinguishment of debt and asset sales.”
  • Beckers Hospital Review lets us know how health systems are staying ahead of drug shortages, and
    • “Pfizer and Bristol Myers Squibb have launched a direct-to-patient program offering their blood thinner Eliquis at a 40% discount for cash-paying patients. 
    • “The list price for Eliquis (apixaban) is $606 for a 30-day supply, but through the new program, the discounted price is approximately $242. More than 15 million Americans have prescriptions for Eliquis, according to a July 17 news release from Bristol Myers Squibb.” 
  • Optum, writing in LinkedIn, discusses the connection between AI and Rx benefits.
  • Per a news release, the Institute for Clinical and Economic Review (ICER) has issued its Draft Evidence Report on Treatment for Non-Cystic Fibrosis Bronchiectasis. The public comment period is now open until August 19, 2025; Requests to make oral comment during public meeting also are being accepted.
  • Per BioPharma Dive,
    • “A new biotechnology company debuted Wednesday with a hefty bankroll and an immunotherapy approach it claims has the potential to treat an array of tough-to-reach solid tumors.
    • “Called Dispatch Bio, the startup was formed in 2022 through a collaboration between Arch Venture Partners and the Parker Institute for Cancer Immunotherapy and built around technologies from scientific labs in Pennsylvania and California. It has since raised $216 million and developed a lead program that’s expected to enter clinical testing next year.
    • “Dispatch aims to deliver to cancer cells a sequence for a unique type of protein flag, known as an antigen, that it says can draw in specially engineered immune cells it plans to administer afterwards. The company believes its approach could yield a “universal” solid tumor treatment.”
  • and
    • “Abivax’s shares soared more than 500% on Wednesday after the company released positive Phase 3 results for its experimental ulcerative colitis medicine.
    • “The Paris-based biotech conducted two studies of its drug, obefazimod, in patients with moderately to severely active ulcerative colitis who didn’t receive enough relief from prior therapies. The 50 milligram dose of the medicine achieved a pooled 16.4% placebo-adjusted clinical remission rate at week 8, better than what was reported in Phase 2 testing, Abivax said late Tuesday.
    • “Researchers are now conducting a 44-week maintenance trial that should yield topline results in the second quarter of next year. If those results are also positive, Abivax plans to submit applications to U.S. and European regulators in the second half of 2026.”

Weekend update

David Ermer–Congress, FDA, Generative AI, Medical / Rx research, Mental health care, OPM, U.S. Healthcare–

From Washington, DC

  • Roll Call discusses expected floor activities this week on Capitol Hill.
  • The House Financial Services and General Government Subcommittee of the House Appropriations Committee will meet on Monday July 21 to mark up its appropriations bill which includes OPM appropriations.
    • The bill includes the following FEHB Program measures
      • Ban on applying full federal cost accounting standards on FEHB and PSHB carriers (Sec. 611).
      • Banning abortion coverage except “where the life of the mother would be endangered if the fetus were carried to term, or the pregnancy is the result of an act of rape or incest. (Sec. 614, also known as the Hyde Amendment).
      • A contraception mandate with certain exceptions (Sec. 726) which has been modified by the Affordable Care Act’s contraception mandate.
      • A new ban for 2026 (Sec. 761) which reads as follows:
        • “None of the funds made available by this Act, or in any previous appropriation, may be provided for in insurance plans in the Federal Employees Health Benefits program to cover the cost of surgical procedures or puberty blockers or hormone therapy for the purpose of gender affirming care.”
  • OPM Director Scott Kupor has begun writing a weekly blog about OPM. Here is a link to his first post which is worth reading. 
  • USA Today reports,
    • “Social Security recipients could get a 2.7% raise next year, up from last month’s estimate of 2.5%, based on the latest inflation report, according to a new estimate.
    • “The Consumer Price Index for Urban Wage Earners and Clerical Workers (CPI-W), the index used to calculate the annual adjustment to Social Security benefits, gained 2.6% in June. Overall inflation rose 2.7%from May’s 2.4% increase. The Federal Reserve’s inflation goal is 2%.” * * *
    • [However,] Medicare Part B costs are rising several times faster than its average rate of increase in recent years.
    • “According to the 2025 Medicare Trustees annual report released in June [2025], the Medicare Part B premium for 2026, is expected to increase to $206.50 from $185.00 in 2025 for a jump of $21.50 per month, or 11.6%. That’s the largest Part B increase since 2022 when it rose 14.5%.” 
  • MedTech Dive informs us,
    • “A warning letter sent by the Food and Drug Administration to wearable company Whoop has sparked a debate on when wellness claims should be regulated as medical devices.
    • Whoop, a company selling a wearable wristband to track metrics such as sleep, heart rate and strain, received the warning letter on Monday for marketing a blood pressure insights feature without FDA authorization. 
    • “The feature provides daily systolic and diastolic blood pressure estimates by measuring heart rate variability during sleep. Whoop’s website states that the feature is intended to help users track blood pressure trends and have a deeper understanding of how blood pressure affects their wellness. The website also marketed the feature as an example of how Whoop is “delivering medical-grade health & performance insights,” according to the warning letter. 
    • “In a response posted Tuesday, one day after the letter was sent to the company, Whoop said it disagrees with the FDA’s assertion that the blood pressure feature should be reviewed as a medical device before being available in the U.S., claiming it is a wellness feature, not a medical device.
    • “This interpretation is also inconsistent with the 21st Century Cures Act, which clarifies that functions intended to promote a healthy lifestyle — and unrelated to the diagnosis, cure, mitigation, prevention, or treatment of a disease or condition — are excluded from the definition of a medical device,” a Whoop spokesperson wrote in an emailed statement.” 

From the public health and medical research front,

  • The New York Times reports,
    • “Across the United States, an intricate system of hospitals, doctors and nonprofit donation coordinators carries out tens of thousands of lifesaving transplants each year. At every step, it relies on carefully calibrated protocols to protect both donors and recipients.
    • “But in recent years, as the system has pushed to increase transplants, a growing number of patients have endured premature or bungled attempts to retrieve their organs. 
    • “Across the United States, an intricate system of hospitals, doctors and nonprofit donation coordinators carries out tens of thousands of lifesaving transplants each year. At every step, it relies on carefully calibrated protocols to protect both donors and recipients.
    • “But in recent years, as the system has pushed to increase transplants, a growing number of patients have endured premature or bungled attempts to retrieve their organs. 
    • “Circulatory death donation is different. These patients are on life support, often in a coma. Their prognoses are more of a medical judgment call.
  • The FEHBlog certainly will be taking another look at his living will.
  • NPR Shots tells us
    • “After about age 40, our brains begin to lose a step or two.
    • “Each year, our reaction time slows by a few thousandths of a second. We’re also less able to recall items on a shopping list.
    • “Those changes can be signs of a disease, like Alzheimer’s. But usually, they’re not.
    • “Both of those things, memory and processing speed, change with age in a normal group of people,” says Matt Huentelman, a professor at TGen, the Translational Genomics Research Institute, in Phoenix.
    • “Huentelman should know. He helps run MindCrowd, a free online cognitive test that has been taken by more than 700,000 adults.”
    • “About a thousand of those people had test scores indicating that their brain was “exceptional,” meaning they performed like a person 30 years younger on tests of memory and processing speed.
    • “Genetics played a role, of course. But Huentelman and a team of researchers have been focusing on other differences.” * * *
    • “Early results suggest that sleep and maintaining cardiovascular health are a good start. Other measures include avoiding smoking, limiting alcohol and getting plenty of exercise.”
  • New York Times Well lets us know “Want More Self-Control? The Secret Isn’t Willpower. People who can delay gratification and master their impulses thrive in life. And experts say that you can learn skills to rein in bad habits.”
  • The Wall Street Journal reports,
    • “Long contentious, chronic Lyme, as it is called by patient advocates, has gained more acknowledgment and investment by researchers after Covid-19 showcased how an infection can leave people with lingering symptoms that last months or longer. The virus’s aftermath looked strikingly similar to what some Lyme disease patients had been describing for years.
    • * * * “In May, the National Academies of Sciences, Engineering and Medicine published a report saying that research funders should put more emphasis on developing treatments for patients with lingering symptoms after Lyme disease, even as the root cause behind why patients experience the symptoms remains a mystery.” * * *
    • “Some laboratory researchers are investigating what might be behind the symptoms, including whether a molecule that the bacteria left behind could be driving inflammation. Newer trials are now looking at whether certain antibiotics or electrical nerve stimulation might help treat the condition, since persistent infection and immune-system or neural-network dysfunction are also theories doctors have proposed. Prior trials haven’t found a benefit to more antibiotics after initial treatment.
    • “We’re not just focusing on one mechanism but many different possible mechanisms as to why people might have persistent symptoms,” said Dr. Brian Fallon, director of the Lyme and Tick-Borne Disease Research Center at Columbia University and head of the Lyme-focused clinical trial network that launched in 2021. 
    • “Preventing tick bites remains a person’s best defense against Lyme and other tickborne diseases. People should avoid wooded and brushy areas with high grass, walk in the center of trails and cover up extremities, health officials say. Wearing insect repellent, checking your body for ticks and showering soon after being outdoors also help reduce the risk.”
  • Modern Healthcare relates,
    • “People are beginning to trust AI for getting their health information, according to survey data from the Annenberg Public Policy Center of the University of Pennsylvania. Nearly eight out of 10 U.S. adults say they’re likely to look online for the answer to a question about a health symptom or condition. Of who are using AI, 75% say that AI-generated responses provide them with the answer they need. Most Americans (63%) think AI-generated health information is reliable.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front,

  • Cyberscoop reports,
    • “Congress is set to revisit Stuxnet — the malware that wreaked havoc on Iran’s nuclear program 15 years ago — next week in the hopes that the pioneering attack can guide today’s critical infrastructure policy debate, CyberScoop has learned.
    • “The House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection will hold a hearing July 22 to examine the operation that, according to independent reports, was carried out by the U.S. and Israeli governments and targeted Iran’s nuclear enrichment facilities in Natanz.
    • “Witnesses listed for the hearing are Tatyana Bolton, executive director of the Operational Technology Cybersecurity Coalition; Kim Zetter, cybersecurity journalist and author of “Countdown to Zero Day”; Dragos CEO Robert Lee; and Nate Gleason, Lawrence Livermore National Laboratory program leader, according to a copy of the notice.”
  • The Cybersecurity and Infrastructure Security Agency (CISA) released a blog post titled “Securing Core Cloud Identity Infrastructure: Addressing Advanced Threats through Public-Private Collaboration.”
    • “In recent years, the cloud landscape has faced increasingly sophisticated threat activity targeting identity and authentication systems. As cloud infrastructure has become more ubiquitous—underpinning key government and critical infrastructure data—sophisticated nation-state affiliated actors have exposed limitations in token authentication, key management, logging mechanisms, third-party dependencies, and governance practices. These threats reaffirm the critical role that public-private collaboration plays to safeguard cloud infrastructure and address the evolving technical and security challenges confronting our nation.”  
  • Cyberscoop informs us,
    • “An international law enforcement operation conducted this week targeted the members of and infrastructure used by NoName057(16), a pro-Russian hacktivist group that has conducted distributed denial-of-service (DDoS) attacks across Europe since early 2022.
    • “Operation Eastwood disrupted over 100 servers worldwide and resulted in two arrests, seven international arrest warrants, and 24 house searches across multiple jurisdictions. The operation, coordinated by Europol and Eurojust with participation from 12 countries, broke up a cybercrime network that had mobilized an estimated 4,000 members who conducted attacks against entities in countries across Europe and in Israel.”
  • and
    • “An Armenian national is in federal custody and faces charges stemming from their alleged involvement in a spree of attacks in 2019 and 2020 involving Ryuk ransomware, the Justice Department said Wednesday.
    • “Karen Serobovich Vardanyan, 33, was extradited from Ukraine to the United States on June 18 and pleaded not guilty to the charges in his first appearance in federal court June 20. Vardanyan is awaiting a seven-day jury trial scheduled to begin Aug. 26.”
  • Security Week informs us,
    • “A former US soldier accused of hacking into AT&T and Verizon systems and leaking presidential call logs pleaded guilty to fraud and identity theft charges, the US Department of Justice announced.
    • “According to court documents, the individual, Cameron John Wagenius, 21, engaged in hacking and extortion activities between April 2023 and December 2024, while on active duty with the US Army.
    • “Using the nickname ‘kiberphant0m’, Wagenius and his co-conspirators aimed to defraud at least 10 organizations after obtaining login credentials for their networks.”

From the cybersecurity breaches and vulnerabilities front,

  • Cybersecurity Dive reports,
  • and
    • “One in four CISOs has experienced an AI-generated attack on their company’s network in the past year, and AI risks now top their priority lists, according to a report released Thursday from cybersecurity firm Team8.
    • “The true number of companies targeted by AI-powered attacks “may be even higher,” Team8 said in its report, “as most AI-driven threats mimic human activity and are difficult to detect without advanced metrics like time to exploitation and velocity indicators.”
    • “AI outranked vulnerability management, data loss prevention and third-party risk on CISOs’ priority lists, according to the report, which is based on interviews with more than 110 security leaders from major enterprises.”
  • Per Dark Reading,
    • “Automated firmware-analysis tools and the falling cost of the technical hardware needed to inspect computer processors and memory are leading to a surge in reports of firmware vulnerabilities and motherboard security weaknesses.
    • “In the latest example, motherboard manufacturer Gigabyte disclosed on July 10 that a set of four firmware vulnerabilities had persisted in its platform, even though the original issues — in the firmware provided by independent BIOS vendor AMI — were patched years ago. The issues affect the System Management Mode (SMM) modules on older Intel-based systems, Gigabyte stated in its disclosure.”
  • and
    • “When it comes to managing cybersecurity profiles for office printers, just 36% of IT teams are patching their firmware promptly — leaving a glaring gap in defenses that attackers could exploit to devastating effect.
    • “That’s according to HP Wolf Security, which found evidence of widespread failures across every stage of the printer life cycle in a global survey of 800+ IT and security decision-makers.
    • “Failure to promptly apply firmware updates to printers unnecessarily exposes organizations to threats that could lead to damaging impacts, such as cybercriminals exfiltrating critical data or hijacking devices,” according to the report, released today.”
  • Infosecurity Magazine tells us,
    • “Cybercriminals have been observed adopting AI-powered cloaking tools to bypass traditional security measures and keep phishing and malware sites hidden from detection.
    • “According to new research from SlashNext, Platforms like Hoax Tech and JS Click Cloaker are offering “cloaking-as-a-service” (CaaS), allowing threat actors to disguise malicious content behind seemingly benign websites.
    • “Using advanced fingerprinting, machine learning and behavioral targeting, these tools selectively show scam pages only to real users while feeding safe content to automated scanners.
    • “I think that this is a clear example of a technology and set of tools being used in a bad way,” said Andy Bennett, CISO at Apollo Information Systems.”
  • Per HelpNet Security,
    • “A new report from Living Security and the Cyentia Institute sheds light on the real human element behind cybersecurity threats, and it’s not what most organizations expect.
    • “The Risky Business: Who Protects & Who Puts You at Risk report analyzes data from over 100 organizations and challenges conventional thinking by revealing that a small portion of users, just 10 percent, are responsible for nearly 73 percent of all risky behavior in the enterprise.
    • “The riskiest users aren’t who and where you think,” the report notes. Surprisingly, remote and part-time workers are often less risky than full-time, in-office employees. Meanwhile, 78 percent of users help reduce cyber risk more than they contribute to it.”
  • Dark Reading explains “How Criminal Networks Exploit Insider Vulnerabilities. Criminal networks are adapting quickly, and they’re betting that companies won’t keep pace. Let’s prove them wrong.”
  • CISA added two known exploited vulnerabilities to its catalog this week.
    • July 14, 2025
      • CVE-2025-47812 Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability
        • Cybersecurity News discusses this KVE here.
    • July 18, 2025
      • CVE-2025-25257 Fortinet FortiWeb SQL Injection Vulnerability
        • The Hacker News discusses this KVE here.

From the ransomware front,

  • IT Pro lets us know,
    • “Ransomware attacks come with an average recovery cost of $4.5 million, according to a recent survey, which also found a high proportion of businesses have fallen prey to the malware in the past year.
    • “Data from Absolute Security, which surveyed 500 CISOs based in the US through Censuswide, found 72% of respondents’ firms had dealt with ransomware attacks in the 12 months prior to the survey.
    • “Respondents registered extreme concern over the potential cost of ransomware attacks, with nearly three quarters (73%) indicating a successful ransomware attack could critically incapacitate their business.”
  • Chief Healthcare Executive reports,
    • “While hospitals have endured the threat of attacks from ransomware groups for years, other providers are targets for attacks.
    • “Ransomware groups are going after ambulatory surgical centers, physician practices and specialty care groups, says Steve Cagle, the CEO of Clearwater, a cybersecurity firm.
    • “We’ve seen this trend for some time now,” Cagle tells Chief Healthcare Executive®. “It’s more attacks on specialty or ambulatory …. physician practice management, specialty care groups.”
    • “Radiology centers, imaging centers, health clinics and dental clinics are also being targeted for attacks, Cagle says. More than 300 breaches of health data have already been reported to the Department of Health & Human Services in the first half of the year.”
  • Cybersecurity Dive points out,
    • “DragonForce, a cyber criminal group connected to a series of attacks against retail firms in recent months, is claiming credit for an attack on the North Carolina-based department store chain Belk.
    • “The group claimed on its leak site that it has approximately 156 gigabytes of data stolen from the company. 
    • “Researchers have linked DragonForce to an April attack on Marks & Spencer, one of the first breaches in a months-long attack spree linked to Scattered Spider. DragonForce claimed credit for the intrusion, but M&S officials believe the group was working with Scattered Spider during the attack.” 
  • Morphisec discusses “Matanbuchus [which} is a malware loader that has been available as a Malware-as-a-Service (MaaS) since 2021. It is primarily used to download and execute secondary payloads on compromised Windows systems, making it a critical first step in various cyberattacks.”
  • Infosecurity Magazine informs us,
    • “The Interlock ransomware gang has been detected targeting organizations with a new remote access trojan (RAT) in a widespread campaign, according to researchers from The DFIR Report in partnership with Proofpoint.
    • “The new malware, observed since June 2025, uses the general-purpose PHP programming language. This differs from the previously identified JavaScript-based ‘NodeSnake’ RAT deployed by Interlock.
    • “In certain cases, the deployment of the PHP variant of the Interlock RAT has led to the deployment of the Node.js version.
    • “PHP is a common web scripting language, which can be leveraged across various platforms and databases.”
  • Bleeping Computer reports,
    • “The Japanese police have released a Phobos and 8-Base ransomware decryptor that lets victims recover their files for free, with BleepingComputer confirming that it successfully decrypts files.
    • “Phobos is a ransomware-as-a-service operation that launched in December 2018, enabling other threat actors to join as affiliates and utilize their encryption tool in attacks. In exchange, any ransom payments were split between the affiliate and the operators.
    • “While the ransomware operation did not receive as much media attention as other ransomware operations, Phobos is considered one of the most widely distributed ransomware operations, responsible for many attacks on businesses worldwide.”

From the cybersecurity research front,

  • Cyberscoop tells us,
    • “A financially motivated threat group is attacking organizations using fully patched, end-of-life SonicWall Secure Mobile Access 100 series appliances, Google Threat Intelligence Group said in a report released Wednesday [July 16].
    • “The group, which Google identifies as UNC6148, is using previously stolen admin credentials to gain access to SonicWall SMA 100 series appliances, remote access VPN devices the vendor stopped selling and supporting earlier this year. UNC6148 is likely intruding networks to steal data for extortion and possibly deploy ransomware, according to researchers.
    • “The attacks stress the consistent risk SonicWall customers have confronted via exploited vulnerabilities, especially a series of defects affecting the outdated SonicWall SMA 100 series devices.”
  • Per Bleeping Computer,
    • “Hackers have adopted the new technique called ‘FileFix’ in Interlock ransomware attacks to drop a remote access trojan (RAT) on targeted systems.
    • “Interlock ransomware operations have increased over the past months as the threat actor started using the KongTuke web injector (aka ‘LandUpdate808’) to deliver payloads through compromised websites.
    • “This shift in modus operandi was observed by researchers at The DFIR Report and Proofpoint since May. Back then, visitors of compromised sites were prompted to pass a fake CAPTCHA + verification, and then paste into a Run dialog content automatically saved to the clipboard, a tactic consistent with ClickFix attacks.”
  • Per Cybersecurity Dive,
    • “Microsoft on Wednesday said it has seen the cybercrime group Scattered Spider using new techniques in attacks on the airline, insurance and retail industries since April. 
    • “The hacker group, which Microsoft tracks as Octo Tempest, is still using its trademark social-engineering tactics to gain access to companies by impersonating users and contacting help desks for password resets, according to the Microsoft Defender Security ResearchTeam blog post. 
    • “But the hackers are also abusing short messaging services and using adversary-in-the-middle tactics. And in recent attacks, the threat group has deployed the DragonForce ransomware and concentrated on breaching VMWare ESX hypervisor environments.” 
  • Per Dark Reading,
    • “A threat actor known as “PoisonSeed” was credited with a novel attack technique that is able to bypass FIDO-based protections in an organization.
    • “That’s according to a report this week from MDR vendor Expel, titled “PoisonSeed bypassing FIDO keys to ‘fetch’ user accounts.” FIDO, or Fast Identity Online, refers to a technology-agnostic set of specifications for authentication. The technology, which was originally developed by the FIDO Alliance, is considered a gold standard in security, commonly seen in non-password authentication technologies like physical security keys.
    • “Expel’s research concerns a strategy for gaining access to a victim through the cross-device sign-in features available in FIDO security keys in a way that can bypass certain safeguards. Though the report does not concern a vulnerability in FIDO technology itself, it acts as a reminder to the defender that security does not end with a phishing-resistant security key.”

From the cybersecurity defenses front,

  • Cybersecurity Dive interviews Mark Ryland who is Amazon’s security director.
  • CSO calls attention to “eight tough trade-offs every CISO must navigate.”
  • Blocks and Files explains how a “simulated ransomware attack reveals gaps in recovery planning.”
  • Here’s a link to Dark Reading’s CISO Corner.

Midweek update

David Ermer–CDC, CMS, Congress, FDA, Generative AI, Medical / Rx research, Medicare, NIH, Obesity, OPM, Rx coverage, U.S. Healthcare–

From Washington, DC

  • The U.S. Office of Personnel Management has posted a bio of its new Director Scott Kupor.
  • USA Today reports,
    • “President Donald Trump signed a law that extends tougher prison sentences for fentanyl trafficking, surrounded by relatives of people who died from overdoses and lawmakers who approved the bill.
    • “Today we strike a righteous blow to the drug dealers, narcotic traffickers and criminal cartels,” Trump said. “We take a historic step toward justice for every family touched by the fentanyl scourge.”
    • “The law places fentanyl on the Drug Enforcement Administration’s list of most serious drugs with no accepted medical use and a high potential for abuse. The list includes drugs such as heroin, cocaine and LSD. Fentanyl has been temporarily assigned to the Schedule 1 category since 2018. The law makes the designation permanent.
    • “The law also makes permanent mandatory minimum penalties of five years in prison for trafficking 10 grams of fentanyl and 10 years for 100 grams.”
  • Per a Senate news release,
    • “Sens. Chuck Grassley (R-Iowa) and Maggie Hassan (D-N.H.) reintroduced the Healthy Moms and Babies Act to improve maternal and child health care across the nation. The maternal health crisis in the United States particularly affects those living in rural America and women of color. Grassley previously chaired the Senate Finance Committee and continues to serve as a committee member, alongside Hassan.
    • “The legislation builds on Grassley and Hassan’s longstanding efforts to improve maternal and child health by delivering high-quality coordinated care, supporting women and babies with 21st century technology and taking other steps to reduce maternal mortality.” * * *
    • “Additional information on the Grassley-Hassan Healthy Moms and Babies Act is available below:
  • STAT News informs us,
    • “Doctors for decades have been paid using rates developed largely under the advice of the industry’s main lobbying group, the American Medical Association. Experts have railed against the system for decades, calling it complex and filled with self-interested factions that ultimately favor surgeons and higher-priced specialists over primary care clinicians. 
    • “Medicare’s proposal for 2026 would create a so-called “efficiency adjustment” that would reduce payment by 2.5% for thousands of procedures and diminish some of the influence held by the AMA’s advisers, known as the Relative Value Scale Update Committee, or the RUC. 
    • “This is probably one of the most controversial components of this rule,” said Shari Erickson, a top official with the American College of Physicians, which mostly lobbies for primary care doctors. “It is sort of continuing to chip away at some of the concerns that many have raised about the RUC and the power that they’re viewed as having.”
    • “The result is that family medicine doctors and other primary care physicians would see the highest average increases in their payments, per Medicare’s estimates. Dermatologists, gastroenterologists, general surgeons, neurosurgeons, ophthalmologists, orthopedic surgeons, pathologists, and radiologists would experience some of the biggest net decreases to their Medicare pay.
    • “Importantly, the agency would exempt services that are based on time — for example, routine 15- and 30-minute visits performed by primary care physicians. More broadly, Medicare is using the savings from these cuts to bump up the “conversion factor” that dictates the payment rates for all physician services.
    • “Michael Abrams, managing partner of health care strategy firm Numerof & Associates, said this would help fix what’s been a “very serious issue” for decades: the pay imbalance between primary and specialty care.” 
  • The Government Accountability Office released a report on comparative clinical effectiveness research this week.
    • “Comparative clinical effectiveness research compares the success and outcomes of available treatment options for various diseases and conditions. Findings from this research can provide important information on more effective treatments. The Department of Health and Human Services shares these research findings with the public and helps to apply the findings in health care settings.
    • “But we found that HHS hasn’t done a thorough evaluation of these activities. Completing an evaluation will help to show if HHS’s efforts are promoting evidence-based care and, ultimately, improving health outcomes.
    • “Our recommendation [to HHS] addresses this issue.”
  • From the judicial front,
    • Fierce Healthcare lets us know,
      • “Blue Cross and Blue Shield of Kansas City has improperly reduced payments for inpatient services in coordination with third-party vendors, a lawsuit from AdventHealth Shawnee Mission Medical Center alleges.
      • “The hospital claims Blue KC uses clinical validation audits to reject medical diagnoses and declare them “invalid” under “secret and dubious criteria,” in violation of state and federal law, the lawsuit (PDF) says. Blue KC, allegedly, has not paid more than $2 million owed to the AdventHealth hospital after invalidating more than 350 medical diagnoses.
      • “At the crux of the plaintiff’s argument is Blue KC’s relationship with third-party care platforms for providers and payers. The health system has never approved of Blue KC’s relationship with vendors performing clinical validation audits, yet AI technology can supplant a physician’s opinion. Vendors used by Blue KC have publicly touted its AI technology in the past.”

From the Food and Drug Administration front,

  • Per an FDA news release,
    • “The U.S. Food and Drug Administration today announced it is revoking, or proposing to revoke, 52 food standards after concluding they are obsolete and unnecessary. The 52 standards are for canned fruits and vegetables, dairy products, baked goods, macaroni products and other foods.
    • “Today’s actions are the first results from the agency’s ongoing analysis of its portfolio of over 250 food Standards of Identity (SOI) to make sure they are useful, relevant and serve consumers in the best possible way. The removal of these standards is in alignment with broader efforts to ensure that HHS is directing resources to where they’re most needed – delivering better outcomes for the American people.”
  • Per Fierce Pharma,
    • “The FDA is raising efficacy questions over Lundbeck and Otsuka’s proposed combination of their Rexulti with Viatris’ Zoloft as a treatment for post-traumatic stress disorder (PTSD).
    • “For an upcoming meeting of the FDA’s Psychopharmacologic Drugs Advisory Committee, the agency is asking an expert panel to weigh in on whether results from an exploratory phase 2 trial and a positive phase 3 study can overcome negative findings from a second phase 3 of the combination.
    • “Discordant results” from the two phase 3 trials have FDA reviewers worried, especially since the agency said it was unable to identify an explanation for the differing outcomes despite “extensive exploratory analyses.”

From the public health and medical research front,

  • Health Day tells us,
    • “Folks using GLP-1 weight loss drugs like Ozempic are more likely to suffer from severe acid reflux, a new study says.
    • “People with type 2 diabetes were more likely to suffer from gastroesophageal reflux disease (GERD) if they were prescribed a GLP-1 drug compared to those taking sodium-glucose cotransporter-2 (SGLT-2) inhibitors, researchers reported today in the Annals of Internal Medicine.
    • “We estimated that most GLP-1 (drugs) increased risk for GERD,” concluded the research team led by Laurent Azoulay, an associate professor with the Jewish General Hospital’s Center for Clinical Epidemiology in Montreal, Canada.
    • “The risk for serious GERD-related complications was higher among smokers, people with obesity and folks with existing stomach problems, researchers said.
    • “Although our findings need to be corroborated in other studies, clinicians and patients should be aware of a possible adverse effect of GLP-1 (drugs) on GERD,” researchers noted.”
  • BioPharma Dive reports,
    • “In experimental, dual-acting obesity drug from Hengrui Pharma and biotechnology startup Kailera Therapeutics succeeded in a Phase 3 trial in China, positioning the companies to seek approval there and to begin global late-stage testing.
    • “The drug, a once-weekly injection dubbed HRS9531, spurred about 18% weight loss in treated participants after 48 weeks, roughly 16% more than those given a placebo. Nearly 9 in 10 people given HRS9531 lost at least 5% of their body weight and over 44% achieved at least 20% weight loss, the companies said Tuesday.
    • “Hengrui and Kailera didn’t disclose specific safety data, only noting that most treatment-emergent adverse events were mild to moderate and gastrointestinal-related. Detailed results will be presented at a future medical meeting. Hengrui will file an approval application in China, while Kailera will initiate global studies that involve higher doses and a longer treatment duration, the startup’s CEO, veteran executive Ron Renaud, said in the statement.”
  • Cardiovascular Business relates,
    • “Vitamin D supplements can help patients reduce their risk of developing cardiovascular disease (CVD), according to a new analysis in Nutrients.[1] In fact, the team behind the new study argued that prior research finding no connection between vitamin D and CVD was flawed.  
    • “The global prevalence of CVD for 2025 was estimated at 598 million, and global CVD deaths at 20.5 million,” wrote first author William B. Grant, PhD, with the Sunlight, Nutrition, and Health Research Center in San Francisco. “Thus, finding ways to reduce the risk of CVD is warranted. There has been a long-standing debate regarding the role of vitamin D in reducing the risk of CVD.”
    • “Grant et al. did note that many randomized controlled trials (RCTs) have found that vitamin supplements fail to reduce cardiovascular risks when compared to a placebo. However, the team added, several other kinds of stories have told another story—and there is a reason for this difference.
    • “RCTs are used for medications to evaluate the use of drugs to prevent and treat diseases,” they wrote. “These drugs are not found in nature, whereas vitamin D is. Additionally, pharmacological agents have narrow dose–response curves. In contrast, nutrients are threshold agents and have broader and often S-shaped dose–response curves.”
  • and
    • “A new-look polymer heart valve is associated with encouraging one-year outcomes in patients undergoing surgical mitral valve replacement (SMVR), according to new data presented at New York Valves 2025 and published in the Journal of the American College of Cardiology.[1]
    • “The Tria mitral valve from Utah-based Foldax is built using LifePolymer, a proprietary material that does not include any animal tissue. Both the frame of the valve and its leaflets are robotically generated to match the patient’s native mitral valve.
    • “The valve made headlines in early June when it was approved for commercial use in India. This represented the first time a polymer heart valve had ever gained such an approval anywhere in the world.”
  • Per a National Institutes of Health press release,
    • “A scientific team supported in part by the National Institutes of Health (NIH) has developed a new, ultra-high-resolution brain imaging system that can reconstruct microscopic brain structures that are disrupted in neurological and neuropsychiatric brain disorders. The new system is a significant advance over conventional magnetic resonance imaging (MRI) scanners that cannot visualize these tiny but clinically important structures.
    • “The system, called the Connectome 2.0 human MRI scanner, overcomes a significant hurdle for neuroscientists: being able to bridge different brain regions and probe tiny structures necessary to define the “connectome,” the complex matrix of structural connections between nodes in the nervous system, and to do it noninvasively in living humans.
    • “This research is a transformative leap in brain imaging – pushing the boundaries of what we can see and understand about the living human brain at a cellular level,” said John Ngai, Ph.D., Director of NIH’s Brain Research Through Advancing Innovative Neurotechnologies® Initiative, or The BRAIN Initiative®. “The new scanner lays essential groundwork for the BRAIN CONNECTSprogram’s ultimate goal of developing a wiring diagram for the human brain.”
    • “The scanner is innovative in two major ways: it fits snugly around the heads of living people, and it has many more channels than typical MRI systems. These advances greatly increase the signal-to-noise ratio of the system, providing much sharper images of very small biological brain structures than previously possible. These technical upgrades will enable scientists to map human brain fibers and cellular architecture down to nearly single-micron precision to study how subtle changes in cells and connections relate to cognition, behavior, and disease.”
  • Per a National Institute of Standards and Technology news release,
    • “In an effort to foster progress in cancer research, the National Institute of Standards and Technology (NIST) is releasing detailed and comprehensive data about the entire genetic content of a pancreatic cancer cell. Scientists can use it to research tumors, improve cancer diagnostic tests, and develop new cancer treatments.
    • “The NIST data on this cancer genome — that is, the full set of genetic instructions from the cell, including the mutations that caused the disease — is several terabytes in size. The genome came from a 61-year-old pancreatic cancer patient who explicitly consented to making the genetic code of her cancer cells publicly available for research and clinical use.”
  • Per STAT News,
    • “One in five individuals who receive a kidney transplant experience a rejection episode within a year. A new approach to donor-recipient matching could help change that.
    • “Mismatches between donors and recipients in SIRP-alpha, an immune cell surface receptor, could contribute to transplant rejection, researchers report in a study published Wednesday in Science Translational Medicine.
    • “What’s groundbreaking about it is that innate immune cells, immune cells that we have not necessarily associated with sensing the graft and attempting to reject it, are now in the center of the rejection battle,” said Fadi Lakkis, a study co-author and professor of nephrology at Stanford University.”
  • and
    • “Ten years ago, U.K. policymakers gave the green light to a pioneering reproductive technology meant to spare children from being born with types of rare but sometimes fatal diseases caused by genetic mutations in the powerplants of cells. The method involved combining not just the genes of a mother and father to produce an embryo, but a bit of DNA from a third person as well. 
    • “On Wednesday, the team in England that has been performing the technique reported that eight healthy babies have been born so far, highlighting that the approach reduced the risk of children inheriting disease-causing mutations in the pieces of DNA contained in our mitochondria. The results, published in a pair of papers in the New England Journal of Medicine, have been long awaited as the first large test of the approach, which is known as mitochondrial replacement therapy or mitochondrial donation. 
    • “All the children are well and continue to meet developmental milestones,” Bobby McFarland, a professor of pediatric mitochondrial medicine at Newcastle University and one of the experts behind the research, told reporters at a press conference in London Wednesday.”
  • and
    • “An oral capsule can efficiently deliver liquid mRNA therapy directly to the gut, a possible new delivery mechanism for mRNA vaccines, a new study finds.
    • “In the study published in Science Translational Medicine on Wednesday, researchers said they successfully used RNACap, a capsule engineered to prevent stomach acids from degrading liquid mRNA therapy to treat inflammatory bowel disease. Once the capsule was in the gut, they used normal stomach contractions to release the mRNA therapy.”

From the U.S. healthcare business front,

  • Fierce Healthcare reports,
    • “ChristianaCare and Virtua Health are exploring a potential merger that would yield an eight-hospital nonprofit regional health system spanning 10 New Jersey, Delaware, Pennsylvania and Maryland counties.
    • “The systems have signed a nonbinding letter of intent to explore the deal; they announced Wednesday but did not give a timeline for when the combination could be executed. The resulting entity would have almost 30,000 employees, more than 600 sites of care and over $6 billion in annual revenues.
    • “At a time of great uncertainty in health care, ChristianaCare and Virtua Health have the foresight and courage to explore what is possible,” Janice Nevin, M.D., president and CEO of ChristianaCare, said in the announcement. “We are excited to take this bold step to double down on our mission, multiply our excellence and ensure our legacy of high-quality care in our local communities for generations to come.
    • “Together, we aim to create an integrated regional health system built on human connection, clinical excellence and a deep commitment to all people in the communities we serve,” Virtua Health President and CEO Dennis Pullin said.”
  • BioPharma Dive informs us,
    • “Johnson & Johnson on Wednesday reported quarterly prescription drug sales that for the first time surpassed $15 billion, highlighting the strength of the pharmaceutical company’s portfolio during a year in which its formerly top-selling drug lost market exclusivity.
    • “Second quarter sales for J&J’s pharmaceuticals business reached $15.2 billion between April and June, nearly 4% higher than the same period last year on an operational basis. Overall second quarter sales were up 4.6% on the same basis to total $23.7 billion, beating Wall Street forecasts.
    • “J&J now expects higher operational growth for 2025, increasing the midpoint of its guidance range for both adjusted sales and earnings per share.”
  • MedTech Dive relates,
    • “Quest Diagnostics is planning to offer laboratory testing based on Fujirebio Diagnostics’ recently Food and Drug Administration-authorized Alzheimer’s disease blood test.
    • “In May, Fujirebio’s in vitro diagnostic became the first blood test to aid in the diagnosis of Alzheimer’s cleared by the FDA. Quest, which disclosed its plans for the IVD last week, launched a laboratory-developed test for similar biomarkers in April.
    • “The clinical lab plans to make Fujirebio’s Lumipulse G pTau 217/β-Amyloid 1-42 Plasma Ratio test available for use by physicians and researchers this summer.”
  • KFF issued a report about “The Uncertain Future of “Medicare’s Stand-Alone Prescription Drug Plan Market and Why It Matters.”
    • “Ahead of Medicare’s annual mid-year announcement about the national average premium for Part D prescription drug coverage in 2026 and other plan details, two questions loom large for the insurers that sponsor Part D stand-alone prescription drug plans (PDPs) and the 23 million people in traditional Medicare who are currently enrolled in these plans: Will the Trump administration continue Medicare’s Part D premium stabilization demonstration for a second year, and what will the PDP market look like in 2026 and in subsequent years? The answer to the first question could determine whether monthly PDP premiums remain at a relatively affordable level and whether PDP availability remains stable in 2026. The answer to the second question has larger implications for the viability of traditional Medicare as an option for beneficiaries nationwide but especially for beneficiaries who live in rural areas. This is because rural Medicare beneficiaries are more likely to be enrolled in traditional Medicare and rely more on drug coverage from stand-alone PDPs than Medicare Advantage plans.”
  • The Brown & Brown consulting firm explains why employers and health plans should be paying attention to surgical centers of excellence.
  • Per Fierce Healthcare,
    • “Employers have spent several years taking steps to avoid shifting healthcare costs to workers, but as expenses continue to rise, some firms are looking to change course, a new survey shows.
    • “Analysts at Mercer polled 711 employers (PDF), including large and small firms, and found that 51% said they are either likely or very likely to shift costs to employees for their 2026 plans. That’s up from 45% who said the same for 2025, according to the survey.
    • “Of that group, 19% said they were very likely to shift costs and 33% said they were likely to do so in 2026, the survey found. For 2025, 14% of employers said very likely and 31% said likely.
    • “Employers’ healthcare costs grew 4.5% in 2024 and are expected to increase by an average of 5.8% this year, according to Mercer. That figure accounts for cost-saving measures, but costs could rise by an estimated 8% if employers take no action.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front,

  • Cybersecurity Dive reports,
    • “U.S. government officials said critical infrastructure operators should be on alert for Iranian cyberattacks.
    • “In a threat advisory published Monday [June 30], multiple agencies said Iran might target U.S. firms “for near-term cyber operations” due to “the current geopolitical environment” — a reference to the Trump administration joining Israel’s aerial campaign against Iran’s nuclear program and related assets.
    • “Defense contractors, especially firms that have relationships with Israeli companies, are likely at heightened risk of targeting, according to the advisory.”
  • and
    • “The Department of Justice on Monday [June 30] announced a series of actions as part of an investigation into the North Korean government’s deployment of its citizens abroad to pose as IT workers and illicitly earn money for the regime.
    • “Newly unsealed charging documents describe two separate schemes to trick U.S. companies into hiring people who funneled their paychecks to the North Korean government and exploited their access to the companies’ networks to steal sensitive information and cryptocurrency.
    • “Law enforcement officials, who have repeatedly issued alerts about Pyongyang’s IT worker schemes, warned U.S. businesses on Monday to carefully screen their remote employees to avoid falling victim to similar ruses.
  • Cyberscoop tells us,
    • “The Chinese hackers behind the massive telecommunications sector breach are “largely contained” and “dormant” in the networks, “locked into the location they’re in” and “not actively infiltrating information,” the top FBI cyber official told CyberScoop.
    • “But Brett Leatherman, new leader of the FBI Cyber division, said in a recent interview that doesn’t mean the hackers, known as Salt Typhoon, no longer pose a threat.
    • “While there’s been some debate about whether Salt Typhoon should be getting more attention than fellow Chinese hackers Volt Typhoon — whom federal officials have said are prepositioned in U.S. critical infrastructure, poised for destructive action in the event of a conflict with the United States — Leatherman said the groups aren’t as different as some think.
    • “Salt Typhoon, even though it was [an] espionage campaign, had access to telecommunications infrastructure,” he said. “You can pivot from access in support of espionage to access in support of destructive action.”
  • and
    • “Federal authorities levied sanctions Tuesday on Aeza Group, a bulletproof hosting service provider based in Russia, for allegedly supporting a broad swath of ransomware, malware and infostealer operators.
    • “Aeza Group has provided servers and specialized infrastructure to the Meduza, RedLine and Lumma infostealer operators, BianLian ransomware and BlackSprut, a Russian marketplace for illicit drugs, according to the Treasury Department’s Office of Foreign Assets Control. Lumma infected about 10 million systems before it was dismantled through a coordinated global takedown in May.
    • “The Treasury Department’s action against Aeza Group follows a wave of cybercrime crackdowns across the globe. Prolific cybercriminals have been arrested, and infostealers, malware loaders, counter antivirus and crypting services, cybercrime marketplaces, ransomware infrastructure and DDoS-for-hire operations have all been seized, taken offline or severely disrupted by global coordinated campaigns since May.
    • “Officials accused Aeza Group of helping cybercriminals target U.S. defense companies and technology vendors.”

From the cybersecurity breaches and vulnerabilities front,

  • Cybersecurity Dive informs us,
    • “Australian carrier Qantas said hackers who breached one of its call centers stole a significant quantity of customer data.
    • “The airline said on its website that it detected unusual activity on Monday [June 30] on a third-party platform that one of its call centers used. The airline took immediate action and was able to contain the attack, which it blamed on a criminal hacker.
    • “Qantas said it is investigating the extent of the intrusion but warned that the hackers accessed a “significant” amount of customer data, including names, addresses, phone numbers, dates of birth and frequent-flyer numbers. 
    • “The breach did not compromise any credit card details, personal financial information or passport information, Qantas said, because those are stored in a separate system. The intrusion also did not expect login information for customers’ frequent-flyer accounts.
    • “Qantas said it was working with government authorities, including the Australian Cyber Security Centre and the National Cyber Security Coordinator, as well as independent forensic experts to investigate the breach.
    • “All of Qantas’ systems are now secure and the airline is operating normally, according to the company. It said it was in the process of contacting customers to alert them to the incident.” 
  • Per Security Week,
    • “Missouri healthcare provider Esse Health is notifying over 263,000 people that their personal information was stolen in a disruptive April 2025 cyberattack.
    • “The incident was discovered on April 21 and impacted the organization’s access to the electronic medical record system, while also taking down its phone system.
    • “By May 13, the healthcare provider had restored certain systems and was able to fulfill scheduled appointments or procedures. The phone systems were restored in early June, along with other primary patient-facing network systems, the organization said in an incident notice.
    • “On June 20, Esse Health said its investigation into the attack determined that a threat actor breached its network on April 21 and stole files containing personal information.
    • “The exfiltrated data included names, addresses, dates of birth, Social Security numbers, medical record numbers, patient account numbers, health information, and health insurance details.”
  • and
    • “Benefits and payroll solutions firm Kelly & Associates Insurance Group (dba Kelly Benefits) has informed authorities that a recent data breach impacts more than 550,000 people.
    • “The company revealed in April that hackers had gained access to its systems in December 2024, and an investigation had shown that the threat actor managed to steal files storing personal information.
    • “The incident resulted in the theft of information such as name, date of birth, Social Security number, tax ID number, medical information, health insurance information, and financial account information. 
    • “Kelly Benefits is notifying impacted individuals on behalf of more than 40 affected customers, including Aetna Life Insurance Company, Amergis, Beam Benefits, Beltway Companies, CareFirst, The Guardian Life Insurance Company of America, Fidelity Building Services Group, Intercon Truck of Baltimore, Humana Insurance ACE, Merritt Group, Publishers Circulation Fulfilment, Quantum Real Estate Management, United Healthcare, and Transforming Lives.
    • “Data breach reports submitted by Kelly Benefits to the Maine Attorney General’s Office since early April show that the number of impacted individuals has steadily increased as the company’s investigation progressed.” 
  • The Center for Medicare and Medicaid Services announced on June 30,
    • The Centers for Medicare & Medicaid Services (CMS) is notifying Medicare beneficiaries whose personal information may have been involved in a data incident affecting Medicare.gov accounts. CMS identified suspicious activity related to unauthorized creation of certain beneficiary online accounts using personal information obtained from unknown external sources. CMS takes this situation very seriously. The safeguarding and security of personally identifiable information is of the utmost importance to CMS. 
    • Following detection of the incident, CMS worked quickly to deactivate affected accounts, assess the scope and impact of the compromise, and mitigate the effects on impacted individuals. CMS is working closely with appropriate parties to investigate this situation.
    • Approximately 103,000 beneficiaries may have been impacted. Notifications to affected individuals are being mailed, informing them of the incident, outlining steps being taken to protect their information, and providing guidance on actions they may wish to take. 
  • The Cybersecurity and Infrastructure Security Agency added five known exploited vulnerabilities to its catalog this week.
  • Dark Reading warns
    • “While browser extensions add useful functionality to Web browsers, such as blocking ads, managing passwords, and taking notes, they also increase the organization’s security and privacy risks.
    • “Browser extensions require certain levels of permissions that are attractive to attackers. Some extensions need access to the user’s location, browsing history, or the user’s clipboard to see what data the user has copied. Some extensions go further, requesting access to nearly all of the data stored on the user’s computer as well as the data accessed while visiting different websites. Attackers can exploit extensions with these heightened permissions to access potentially sensitive information, such as Web traffic, saved credentials, and session cookies.
    • “Even extensions with relatively modest permissions can manipulate those permissions to obtain access to the inner workings of every Web page displayed on a user’s screen, warns LayerX CEO and co-founder Or Eshed. LayerX research shows that 53% of enterprise users have installed extensions labeled with “high” or “critical” permissions scope. This is why browser extensions are a prime avenue for exploitation by threat actors, he adds.  
    • “[Attackers] can use it to copy or rewrite data or exploit Web page permissions for even more access,” Eshed says.”
  • Security Week adds,
    • A vulnerability in the Forminator WordPress plugin could allow attackers to take over more than 400,000 impacted websites.
    • A popular form builder plugin with more than 600,000 active installations, Forminator supports the creation of various types of forms, including contact and payment forms, polls, and more.
    • The WordPress plugin was found vulnerable to CVE-2025-6463 (CVSS score of 8.8), an arbitrary file deletion flaw that exists because file paths are not sufficiently validated in a function used to delete a form submission’s uploaded files.

From the ransomware front,

  • Bleeping Computer reports,
    • “The Hunters International Ransomware-as-a-Service (RaaS) operation announced today that it has officially closed down its operations and will offer free decryptors to help victims recover their data without paying a ransom.
    • “After careful consideration and in light of recent developments, we have decided to close the Hunters International project. This decision was not made lightly, and we recognize the impact it has on the organizations we have interacted with,” the cybercrime gang says in a statement published on its dark web leak earlier today.
    • “As a gesture of goodwill and to assist those affected by our previous activities, we are offering free decryption software to all companies that have been impacted by our ransomware. Our goal is to ensure that you can recover your encrypted data without the burden of paying ransoms.” * * *
    • “Threat intelligence firm Group-IB also revealed in April that Hunters International was rebranding with plans to focus on data theft and extortion-only attacks and had launched a new extortion-only operation known as “World Leaks.”
  • Security Week advises,
    • The key tool for surviving ransomware, or any attack scenario, is an IR plan. But an IR plan is only worthwhile if it’s comprehensive, current, and tested. IR plans are not “best practices”, nor singular documents stored in a safe place. They are living resources that require attention and maintenance. In this way, the proof of an IR plan’s efficacy is in that organizational muscle memory – most effectively trained through Tabletop exercises.  So, what are the primary “muscles,” and the repetitive “exercises” in which you can train an organization to respond decisively, immediately, confidently, and automatically.”
      • Plan your workout
      • Warm up
      • Train, recover, repeat
      • Measure your gains 

From the cybersecurity defenses and business front,

  • Withum offers guidance on how to align your firm’s cybersecurity practices with Labor Department best practices for ERISA plan fiduciaries.
  • Per Security Week,
    • Cloudflare has reversed its block on AI-crawling from optional to default, allowing finer grained crawling but only with agreement from all parties concerned.
    • LLMs are what they learn. From their inception the biggest source of learning has been the internet, so there has been a natural tendency for AI developers to scrape the internet as widely as possible.
    • Cloudflare has now introduced an option for their customers to accept or reject website scraping by AI vendors. Hitherto, internet scraping has been a major part of gathering training data for large LLM (gen-AI) developers; but the process has raised questions and objections over legality, copyright infringement, and accuracy.
  • Dark Reading lets us know,
    • “How businesses can align cyber defenses with real threats. Companies that understand the motivations of their attackers and position themselves ahead of the competition will be in the best place to protect their business operations, brand reputation, and their bottom line.”
  • and
    • “One year after a buggy CrowdStrike update knocked IT systems offline, organizations seeking to strike the right balance between security and productivity have viewed the incident as a learning opportunity.
    • “The cost of the CrowdStrike outage was estimated at $5.4 billion, affecting payment systems, airline reservations, and a variety of other industries. The impact of the outage highlights why many operational technology (OT) teams are as sensitive to patches and other updates in their critical infrastructure, as they are highly averse to outages that can happen if such updates are defective.
    • “But when balancing security and productivity, it is imperative not to view the CrowdStrike outage as a reason to forgo patching completely. The ever-growing volume of vulnerabilities and threats requires organizations to remain resilient and anti-fragile — that is, to have the ability to proactively respond to issues and continuously improve.”
  • Per Security Week,
    • “LevelBlue announced on Tuesday [July 1] that it’s acquiring managed detection and response (MDR) services company Trustwave from The Chertoff Group’s MC² Security Fund.
    • “LevelBlue, formerly known as AT&T Cybersecurity, was launched in May 2024 as a joint venture between WillJam Ventures and AT&T. 
    • “The company’s acquisition of Trustwave comes shortly after it announced plans to buy Aon’s cybersecurity consulting business. The deals are part of a plan to become the largest pure-play managed security services provider (MSSP). 
    • “Once the acquisition has been completed, LevelBlue’s expertise in strategic risk management and cybersecurity infrastructure will be integrated with Trustwave’s platform and MDR service.”
  • Here’s a link to Dark Reading’s CISO Corner.

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front,

  • Federal News Network reports,
    • “House appropriators have advanced a homeland security spending bill that endorses many of the Trump administration’s budget proposals, while rejecting steep cuts to cybersecurity and artificial intelligence personnel.
    • “The fiscal 2026 homeland security appropriations measure includes $66.36 billion in discretionary spending. The GOP-led committee passed the bill Tuesday [June 24, 2025] on a 36-27 vote.
    • “The bill follows the broad contours of Trump administration policies by prioritizing funding for Customs and Border Protection and Immigration and Customs Enforcement. Appropriators are also expecting significant funding for the Department of Homeland Security to be included in the budget reconciliation bill.”
  • Cyberscoop tells us,
    • “With time running short before expiration of a cyber information-sharing law highly valued by the private sector, Congress is taking a look at the possibility of a short-term extension.
    • “The 2015 Cybersecurity Information Sharing Act, which provided legal safeguards for companies to share threat data, is due to sunset at the end of September, and Congress doesn’t tend to work much in August.
    • “A bipartisan pair of senators have introduced a bill to simply extend it for another 10 years. But a House bill is still in the works and might take a different approach that involves making changes to the law going forward, industry officials told CyberScoop on Wednesday. Getting competing proposals through both chambers, then settling differences and finalizing a bill to get to the president’s desk, could take significant time.
    • “There are other things that are being considered in the mix,” said John Miller, senior vice president of policy for trust, data and technology and general counsel at the Information Technology Industry Council. One would be attaching language to a continuing resolution funding measure that would extend the 2015 law for a short period of time.”
  • Cybersecurity Dive informs us,
    • “Federal officials and private-sector security leaders said Tuesday [June 24, 2025] that they are closely monitoring for cyberattacks related to the Iran conflict but thus far have not observed any significant activity. 
    • “The Department of Homeland Security warned Sunday that Iran-linked actors or hacktivist groups may launch attacks against U.S. critical infrastructure operators, citing a recent history of attacks against poorly configured water utilities and other systems. 
    • “An apparent truce announced late Monday by President Donald Trump appeared to lower international tensions, but officials remain on guard for any potential threat activity.
    • “The Cybersecurity and Infrastructure Security Agency (CISA) “is actively coordinating with government, industry, and international partners to share actionable intelligence and strengthen collective defense,” CISA spokesperson Marci McCarthy said in a statement. “There are currently no specific credible threats against the homeland.”
  • NextGov/FCW notes,
    • “Morgan Adamski is leaving her role as executive director of U.S. Cyber Command, handing the reins to Patrick Ware.
    • “After 17 years of service at the National Security Agency, I’ve decided to turn the page to an exciting new chapter in my career. It has been an extraordinary journey contributing to the defense of our Nation and advancing the cybersecurity mission across the U.S. Government,” Adamski wrote in a LinkedIn post Friday [June 27, 2025].
    • “The number three spot in the combatant command is typically held by a civilian on detail from the National Security Agency.
    • “Though Adamski did not clarify where she would be headed next, she noted her commitment to ensuring there were cyber solutions on “both sides of the fence.”
  • CISA and the National Security Agency have released a report titled “Memory Safe Languages: Reducing Vulnerabilities in Modern Software Development.’
  • Per Cyberscoop,
    • Kai West, a prolific cybercriminal better known for operating under the moniker “IntelBroker,” was arrested in France earlier this year and faces federal charges for allegedly stealing data from more than 40 organizations during a two-year period, the Justice Department said Wednesday [June 25, 2025]. 
    • Federal prosecutors unsealed a four-count indictment charging West, a British national, with conspiracy to commit computer intrusions, accessing a protected computer to obtain information and wire fraud. The United States is seeking his extradition for the charges, which each carry maximum sentences of five to 20 years in prison. 

From the cybersecurity breaches and vulnerabilities front,

  • Beckers Health IT identifies the top ten states for healthcare data breaches between February 2023 and April 2025.
  • CISA added three known exploited vulnerabilities to its catalog this week.
    • June 25, 2025
      • CVE-2024-54085 AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability
        • Network World discusses this KVE here.
      • CVE-2024-0769 D-Link DIR-859 Router Path Traversal Vulnerability
        • Cybersecurity News discusses this KVE here.
      • CVE-2019-6693 Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
        • Cybersecurity News discusses this KVE here.
  • Cyberscoop reports,
    • Citrix on Wednesday [June 25, 2025] disclosed an actively exploited zero-day vulnerability affecting multiple versions of NetScaler products, an alarming development from a vendor that’s been widely targeted in previous attack sprees.
    • The zero-day (CVE-2025-6543) was disclosed by Citrix nine days after it issued a security bulletin for a pair of defects (CVE-2025-5777 and CVE-2025-5349) in the same products. All three vulnerabilities affect the company’s networking security appliance NetScaler ADC and its virtual private network NetScaler Gateway. 
    • “Exploits of CVE-2025-6543 on unmitigated appliances have been observed,” Citrix said in a security bulletin for the zero-day. Citrix did not respond to a request for comment. 
    • Citrix described the critical zero-day CVE-2025-6543, which has a base score of 9.2 on the CVSS scale, as a memory overflow defect that attackers can exploit for unintended control flow and denial of service. Exploitation can only occur if targeted NetScaler instances are configured as a gateway or an authentication, authorization and accounting (AAA) virtual server, according to Citrix.”
  • and
    • “The aviation industry has seemingly become the latest target of Scattered Spider, a sophisticated cybercriminal group that has shifted its focus from retail and insurance companies to airlines in what cybersecurity experts describe as a coordinated campaign against the sector.
    • “Hawaiian Airlines disclosed a cybersecurity incident Friday [June 27, 2025] affecting some of its IT systems while maintaining that flights continued operating safely and on schedule. The attack, first detected June 23, according to SEC filings, prompted the airline to engage federal authorities and cybersecurity experts for investigation and remediation efforts.
    • “Multiple incident responders have attributed the Hawaiian Airlines attack to Scattered Spider, also known as Muddled Libra or UNC3944. The assessment comes as cybersecurity firms Unit 42 and Mandiant issued warnings about the group’s apparent pivot to targeting aviation companies.
    • “Charles Carmakal, chief technology officer at Mandiant Consulting – Google Cloud, confirmed his company is “aware of multiple incidents in the airline and transportation sector which resemble the operations of UNC3944 or Scattered Spider.” The group has demonstrated a pattern of focusing intensively on single industries before moving to new sectors.”
  • Per Hacker News,
    • “Unknown threat actors have been distributing a trojanized version of SonicWall’s SSL VPN NetExtender application to steal credentials from unsuspecting users who may have installed it.
    • “NetExtender enables remote users to securely connect and run applications on the company network,” SonicWall researcher Sravan Ganachari said. “Users can upload and download files, access network drives, and use other resources as if they were on the local network.”
    • “The malicious payload delivered via the rogue VPN software has been code named SilentRoute by Microsoft, which detected the campaign along with the network security company.” * * *
    • “The development comes as G DATA detailed a threat activity cluster dubbed EvilConwi that involves bad actors abusing ConnectWise to embed malicious code using a technique called authenticode stuffing without invalidating the digital signature.
    • “The German cybersecurity company said it has observed a spike in attacks using this technique since March 2025. The infection chains primarily leverage phishing emails as an initial access vector or through bogus sites advertised as artificial intelligence (AI) tools on Facebook.”

From the ransomware front,

  • Bleeping Computer notes,
    • “Ahold Delhaize, one of the world’s largest food retail chains, is notifying over 2.2 million individuals that their personal, financial, and health information was stolen in a November ransomware attack that impacted its U.S. systems.
    • “The multinational retailer and wholesale company operates over 9,400 local stores across Europe, the United States, and Indonesia, employing more than 393,000 people and serving approximately 60 million customers each week in-store and online.” * * *
    • “In a Thursday filing with Maine’s Attorney General, the retail giant revealed that the attackers behind the November breach stole the data of 2,242,521 individuals after gaining access to the company’s internal U.S. business systems on November 6, 2024.”Mich
  • Michigan Health Watch adds,
  • Dark Reading reports,
    • “A newly discovered ransomware group dubbed “Dire Wolf” has already taken a bite out of 16 organizations globally since its emergence only last month, mainly across the technology and manufacturing sectors, researchers have found.
    • “The group uses a double extortion tactic with a monthlong turnaround time for paying ransom, and deploys custom encryptors tailored to specific victims, security firm Trustwave revealed in a blog post published June 24. Researchers from Trustwave SpiderLabs recently uncovered and observed a ransomware sample from the emerging threat group and gained insights on how it operates, they said.
    • “So far, the group’s victims have spanned 11 countries, with the US and Thailand reporting the highest numbers of attacks, followed by Taiwan. So far, five of the 16 victims listed on the group’s data leak site have data scheduled to be uploaded by the end of June, presumably because they didn’t pay the ransom, according to the post.”
  • Per Cybersecurity Dive,
    • “Only half of ransomware attacks on organizations this year have involved data encryption, once the attack’s defining feature, according to a Sophos report published on Tuesday [June 24, 2025].
    • “Both the average ransom demand and average ransom payment have dropped significantly over the past year (by 34% and 50%, respectively).
    • “Less than a third of respondents in the survey who paid a ransom said the amount matched the attackers’ initial demand, with 53% of victims paying less and 18% paying more.”

From the cybersecurity defenses front,

  • Cyberscoop reports,
    • “When a faulty software update from cybersecurity firm CrowdStrike last year caused possibly the largest IT outage in history, Microsoft ended up taking much of the blame.
    • “CrowdStrike’s Falcon endpoint detection and response was on millions of Windows devices worldwide, and like most antivirus products that need broad access to different systems to do their job, the software had direct access to the Windows kernel.
    • “When CrowdStrike’s update crashed, so did millions of Windows-powered systems and devices around the world. A series of security announcements by Microsoft on Thursday [June 26, 2025] are designed to reduce the possibility of future third-party outages and other security threats that can take an organization’s IT out of commission for extended durations.
    • “Among those changes: antivirus software like the kind installed by CrowdStrike and other third-party cybersecurity will no longer have direct access to the Windows kernel. The company will be previewing a new endpoint security platform to vendors next month that requires security updates to go through layers of testing and review before they ship to Windows devices and systems worldwide.”
  • Per Cybersecurity Dive,
    • “Cybersecurity insurance premiums declined 2.3% year over year to roughly $7.1 billion in 2024, according to a new report released on Monday [June 23, 2025] by credit rating agency AM Best.
    • “Meanwhile, cyber insurance providers’ loss ratio — the proportion of premiums they use to pay out claims — remained below 50%, indicating that the market remains profitable.
    • “AM Best offered several possible explanations for the slight premium decline.”
  • and
    • “Two reports — one that KPMG released on Thursday and one that Thales released last month — illustrate how generative AI is raising security concerns for business leaders.
    • “Business leaders surveyed by KPMG reported prioritizing security oversight in their generative AI budgeting decisions, with 67% saying they plan to spend money on cyber and data security protections for their AI models. Fifty-two percent cited risk and compliance as a budgetary priority.
    • “Those spending decisions reflect corporate executives’ growing worries about AI security. ***
  • WEDI is offering a free healthcare cybersecurity webinar on June 15, 2025, at 1:00 pm ET.
  • The ISACA Blog considers Proactive Approaches to Identify Cyberthreats.
  • Here is a link to Dark Reading’s CISO Corner.

Midweek report

David Ermer–CDC, Congress, FDA, Generative AI, Medical / Rx research, Medicare, Obesity, U.S. Healthcare–

From Washington, DC,

  • The Wall Street Journal reports,
    • “Senate Republican leaders kept pressing the gas pedal Wednesday to get their “one big, beautiful bill” passed by this weekend, even while hundreds of billions of dollars in crucial decisions are being negotiated, key senators are holding out, and some House lawmakers are crying foul.
    • “President Trump wants the legislation on his desk by July 4, and Republicans hope the megabill’s perceived inevitability overcomes any momentary implausibility. Senators aim to start votes as soon as Friday on the legislation, which would cut taxes, reduce spending on Medicaid and nutrition assistance, and boost spending on border security and national defense. The House could send the bill to Trump early next week. 
    • “For now, there aren’t enough votes for a bill that isn’t finished yet. 
    • “It is this mysterious process of trying to be able to move specific ideas through 53 other people and trying to be able to get ideas and opinions,” said Sen. James Lankford (R., Okla.). “And where do people land? It’s a moving target.”
    • “Senators aren’t quite ready to vote, and they expect to change the legislation in the days ahead. Several senators, including Josh Hawley (R., Mo.) and Dan Sullivan (R., Alaska), said they want to be able to review the whole bill before taking the first procedural step—a vote to open debate. 
    • “Our guys are all going to keep advocating for what they want, till the final minute, till we pass it,” said Sen. John Hoeven (R., N.D.) “That’s how it works.” 
  • and
    • “Health Secretary Robert F. Kennedy Jr.’s new panel of vaccine advisers will re-evaluate the recommended schedule for vaccines for children and teenagers, including for measles and hepatitis B, its new chairman said Wednesday.
    • “The new slate of advisers met for the first time Wednesday in Atlanta, kicking off a two-day meeting with an agenda partially set by political appointees. Meanwhile, on Capitol Hill, the nominee to lead the Centers for Disease Control and Prevention, Susan Monarez, told senators she believes vaccines save lives and there is no causal link between vaccines and autism.” * * *
    • “Monarez, if confirmed, would have the power to decide whether or not to adopt ACIP recommendations. Asked if she agreed with Kennedy’s decision to remove all members of the previous committee, Monarez responded “that the secretary had to make a decision related to ensuring that the ACIP could be supportive of restoring public trust in decision-making.”
    • “The vaccine advisory panel is set Thursday to hear a presentation on thimerosal, a preservative that antivaccine activists have often blamed for autism, from Lyn Redwood, a nurse practitioner who is president emerita of Children’s Health Defense, an antivaccine nonprofit previously helmed by Kennedy. Antivaccine activists have long claimed that thimerosal causes autism. Rates of the disorder have continued to climb even after thimerosal was removed from most vaccines in the early 2000s.”
  • Beckers Health IT tells us,
    • “Health and Human Services Secretary Robert F. Kennedy Jr. says he wants every American using a wearable health device within four years, Politico reported June 24.
    • “Speaking during a June 24 hearing of the House Energy and Commerce Health Subcommittee, Mr. Kennedy said the department is preparing “one of the biggest advertising campaigns in HHS history” to promote wearable technology.
    • “The devices are central to Mr. Kennedy’s “Make America Healthy Again” initiative. He told lawmakers that wearables give people a way to “take control of their own health.”
  • Govexec fills us in on what happened at yesterday’s House Oversight and Government Reform Subcommittee on Government Operations hearing titled “The Route Forward for the U.S. Postal Service: A View from Stakeholders.”
  • The American Hospital Association News informs us,
    • “The Administration for Strategic Preparedness and Response June 25 announced it conducted an exercise transporting simulated patients with high-consequence infectious diseases in a new portable biocontainment unit from Toronto to U.S. hospitals in the northeast and southeast. The hospitals are all Regional Emerging Special Pathogen Treatment Centers for highly infectious diseases. ASPR said the biocontainment unit is the first domestic resource for isolating and transporting patients with high-consequence infectious diseases, such as Ebola, across long distances to RESPTCs. The unit can be transported by air or by ground.”
  • CMS called attention to its Medicare website explaining how to get medical assistance in a disaster or emergency.

From the state and local government front,

  • Politico lets us know,
    • New York City Mayor Eric Adams announced [June 22] he will not move forward with a contentious effort to cut costs by shifting retired city workers to a Medicare Advantage plan, bringing a sudden end to a four-year saga.
    • “We have heard concerns from retirees about these potential changes at numerous older adult town halls and public events, and our administration remains focused on ensuring that New York City remains an affordable place to live,” Adams said in a statement Friday.
    • Just two days earlier, the state Court of Appeals ruled in City Hall’s favor in a lawsuit over the Medicare Advantage transition, handing Adams a rare win in the long legal battle to implement a plan he inherited from former Mayor Bill de Blasio.

From the Food and Drug Administration front,

  • STAT News reports,
    • Outgoing Food and Drug Administration regulator Jacqueline Corrigan-Curay acknowledged to staff [June 24] that much is still in flux at the agency, weeks before she retires.
    • “We are leaner and therefore we have to find ways to be efficient and do things in new ways,” she told staff, according to a recording of a town hall meeting obtained by STAT. 
    • She did not say who will be the next leader of the Center for Drug Evaluation and Research once she retires next month. Her retirement is the latest in a series of departures of senior officials at the FDA, who have either chosen to take early retirements, left for other jobs, or been forced out by political appointees.
    • “CDER has filled one leadership position, though. At the meeting, Corrigan-Curay introduced staff to the new deputy director of CDER, Mike Davis. Davis, a psychiatrist and pharmacologist, was most recently chief medical officer at the Usona Institute, a nonprofit organization developing psychedelic drugs for the treatment of depression and PTSD. He previously spent six years at the FDA as a clinical team leader in the psychiatry division.” 
  • Per BioPharma Dive,
    • “The Food and Drug Administration is investigating two deaths among [over 900] patients treated with Sarepta Therapeutics’ gene therapy Elevidys for Duchenne muscular dystrophy. Both patients died this year of acute liver failure after receiving Elevidys, with the second case reported earlier this month. The FDA said their deaths appear to be related to treatment and that it will evaluate “the need for further regulatory action.”
  • Per MedPage Today,
    • “The FDA said Wednesday it has expanded existing warnings on the two leading COVID-19 vaccines about a rare heart side effect mainly seen in young men.
    • “Myocarditis, a type of heart inflammation that is usually mild, emerged as a complication after the first shots became widely available in 2021. Prescribing information from both Pfizer and Moderna already advises doctors about the issue.
    • “In April, the FDA sent letters to both drugmakers asking them to update and expand the warnings to add more detail about the problem and to cover a larger group of patients. While the FDA can mandate label changes, the process is often more of a negotiation with companies.”

From the public health and medical research front,

  • The American Hospital Association News tells us,
    • “A study published June 25 by the Journal of the American Heart Association found that heart disease death rates fell 66% from 1970 to 2022. Deaths from heart attacks decreased 89% in that time span. The study attributed the declines to advancements in intervention and prevention efforts. Meanwhile, deaths from other types of heart disease, including arrhythmia, heart failure and hypertensive heart disease, increased by 81% during the same period. The study said the rising prevalence of obesity, diabetes, hypertension and physical inactivity have contributed to those causes.”
  • Cardiovascular Business adds,
    • “A team of surgeons with Baylor St. Luke’s Medical Center in Houston has made history, performing what is believed to be the first fully robotic heart transplant in the United States. 
    • “The procedure occurred in March 2025. Kenneth K. Liao, MD, PhD, chief of cardiothoracic transplantation and circulatory support at Baylor College of Medicine and chief of cardiothoracic transplantation and mechanical circulatory support at Baylor St. Luke’s Medical Center, and colleagues completed the transplant using an advanced Da Vinci surgical system. 
    • “The patient’s chest did not need to be opened all for the procedure—everything was done through small incisions.
    • “Opening the chest and spreading the breastbone can affect wound healing and delay rehabilitation and prolong the patient’s recovery, especially in heart transplant patients who take immunosuppressants,” Liao explained in a statement. “With the robotic approach, we preserve the integrity of the chest wall, which reduces the risk of infection and helps with early mobility, respiratory function and overall recovery.”
    • “The patient in question was a 45-year-old male who had been hospitalized with advanced heart failure for four months. He was discharged after being observed in the hospital for a month. There have been no complications.”
  • Per Medscape,
    • “The investigational non-peptide small-molecule oral GLP-1 agonist orforglipron significantly reduced A1c over 40 weeks in adults with early type 2 diabetes, according to the results of ACHIEVE-1 sponsored by Eli Lilly. 
    • “In the trial, orforglipron reduced A1c to the 6.5% range and produced clinically meaningful weight loss with a safety profile similar to that of other GLP-1 drugs. ACHIEVE-1 is the first of seven phase 3 studies of the safety and efficacy of the drug in over 6000 patients with type 2 diabetes and obesity,
    • “Orforglipron and other similar non-peptide small molecules “have the potential to be widely accepted as a much earlier therapy for type 2 diabetes,” Julio Rosenstock, MD, senior scientific advisor for Velocity Clinical Research and clinical professor of medicine at the University of Texas Southwestern Medical Center, Dallas, said at a press briefing here at the American Diabetes Association (ADA) 85th Scientific Sessions. The findings were simultaneously published in the New England Journal of Medicine.”
  • STAT New relates,
    • “A study tracking nearly 250,000 Swedish people using ADHD medication for 14 years found that these treatments can reduce risks of traffic crashes, injuries, and criminal behavior — and that conclusion remained true even as more girls, women, and adult men received a diagnosis.
    • “I wish we had access to this kind of data for the U.S.,” said Ryan Sultan, who was not part of the study and is a psychiatrist and professor at Columbia University Irving Medical Center where he specializes in ADHD. “Being able to follow them from birth means that their data is really, really powerful.”
    • “The study arrives as providers in the United States contend with twin realities: ADHD medication prescriptions are skyrocketing — largely thanks to telehealthand diminishing stigma — while medication shortages are imperiling people’s access to these critical treatments. Scientists are also learning more about how the condition interacts with other variables, such as how menstrual periods can affect symptoms and treatment. 
    • “We’re in a moment in U.S. society where … everyone and their grandmother are asking whether they have ADHD or not,” said Sultan. “It’s really interesting to be thinking about, when we’re expanding [access], who are we actually expanding it to, and who are we actually treating?”
  • Medical Economics points out,
    • “According to Dexcom’s 2025 State of Type 2 Report, most U.S. physicians now consider continuous glucose monitoring (CGM) one of the most impactful interventions for managing type 2 diabetes, surpassing even medications and lifestyle counseling in future importance.
    • “The findings are based on a national survey of 310 adults with type 2 diabetes and 111 U.S. health care professionals (HCPs), including primary care physicians, nurse educators and diabetes specialists.
    • “CGM adoption remains relatively low among patients — just 16% of U.S. adults with type 2 diabetes currently use the technology — but satisfaction among users is high. The vast majority report improved quality of life, reduced stress and better engagement with their glucose data. Physicians, meanwhile, see CGM as a key solution to longstanding pain points, including poor adherence, low health literacy and difficulty tracking glucose fluctuations outside clinic visits.
    • “The report highlights a disconnect between CGM’s perceived value and its real-world accessibility. Most patients cite cost or insurance coverage as the top reason for not trying it. Most physicians say they lack the tools to educate patients on its benefits. And nearly three-quarters of people with type 2 diabetes say they need better understanding of how diabetes technology can help them manage their condition.”
  • Per the American Journal of Managed Care,
    • The use of pre-exposure prophylaxis (PrEP) for prevention of HIV has helped to curb the spread of the virus nationally. Knowing how much PrEP is needed in certain areas can help to more specifically target vulnerable populations who need it more.
    • A model was developed that could estimate the need for PrEP, according to a study published in Annals of Epidemiology. Public health authorities can use this information to monitor progress and establish resource allocation.

From the U.S. healthcare business front,

  • Modern Healthcare reports,
    • “U.S. households, businesses and governments will spend $8.6 trillion on healthcare in 2033, when the sector will comprise just over one-fifth of gross domestic product, according to a federal report issued Wednesday.
    • “The Centers for Medicare and Medicaid Services Office of the Actuary attributes its forecast to factors such as a rapidly aging population and high demand for healthcare. The independent CMS division published its analysis in the journal Health Affairs.
    • “National health expenditures will increase 5.8% a year on average from 2024 to 2033, the actuaries predict. The healthcare spending trend is expected to continue outpacing economic growth, which the office projects will average 4.3% annually over the coming decade.”
  • Fierce Healthcare adds,
    • “In an uncertain policy and macroeconomic environment, healthcare finance leaders are concerned about what the future holds, a new report showed.
    • “Analysts at Deloitte surveyed 64 finance leaders, split evenly between executives from health systems and insurers, to capture what they view as the biggest challenges and opportunities coming down the pike. Most (84%) of those surveyed said they are worried about business conditions given the cloudy policy outlook, economic concerns and potential disruptions from tariffs and the supply chain.
    • “Over the past several years, workforce challenges, cost reductions and cybersecurity have all been top concerns for finance leaders in healthcare. However, this year’s survey found external factors taking on a much greater role.”
    • “Internal concerns like workforce challenges, cost reduction, and cybersecurity—once top priorities for healthcare chief financial officers in our previous surveys—seem to have become less urgent amid rising external factors, according to survey respondents,” the researchers said.”
  • Per a press release,
    • “Optum is accelerating the adoption of artificial intelligence (AI) for health care technology companies, providers and payers with the launch of the Optum AI Marketplace. The new marketplace is the only health care-specific AI digital platform of its kind, built by health care developers to simplify AI integration across clinical and administrative systems.
    • “Many emerging health care organizations want to modernize their systems but don’t have the time, resources, or infrastructure to build AI solutions on their own. The new marketplace addresses these gaps by offering a centralized, health care-specific ecosystem of curated solutions and APIs that are ready to implement, helping organizations streamline operations, reduce integration costs, and scale AI adoption.
    • “Optum brings decades of health care expertise and advanced data infrastructure to the AI Marketplace. This foundation ensures the platform is built for real-world health care needs and supports faster, more effective AI and API implementation. With more than 1.4 billion API transactions each year, the marketplace powers real-time insights and seamless integrations across the health care landscape.” * * *
    • Discover more at Optum AI Marketplace.
  • Per Beckers Hospital Review,
    • Overall demand for healthcare services is poised to continue its significant growth across various service lines over the next decade, with outpatient care expected to experience the highest growth rate and inpatient services seeing more moderate increases, according to Sg2’s 2025 Impact of Change Forecast published in June.
    • Sg2’s forecasting model integrates a broad range of factors, including national data, institutional data, and market trends. National population changes, epidemiological shifts, economic influences, policy developments and advances in technology were considered in the projections.
    • Sg2 used data from the HCUP National Inpatient Sample and CMS Limited Data Sets, alongside its own analysis of healthcare usage trends.
  • Per Beckers Payer Issues,
    • “Medicare Advantage enrollees experience longer hospital stays before being discharged to post-acute care settings compared to individuals enrolled in traditional Medicare, according to a June 2025 analysis by NORC at the University of Chicago.
    • “The analysis was commissioned by the Coalition to Strengthen America’s Healthcare, a group of more than 5,000 hospitals, businesses and hospital associations that includes the AHA and FAH. 
    • “The researchers found that while hospital discharges overall declined over the five-year study period, discharges to post-acute settings increased for MA enrollees and decreased slightly for traditional Medicare enrollees. At the same time, MA enrollees had longer hospital stays prior to post-acute discharge, with the gap widening over time.
    • “While the data is age-adjusted, the study did not control for clinical or demographic differences that could affect length of stay or discharge destination. Future research is recommended using tools like HCC risk scores and claims-based frailty index to better isolate coverage-related effects.”

Weekend update

David Ermer–Congress, Generative AI, Medical / Rx research, Obesity, SCOTUS–

From Washington, DC,

  • Per a Senate news release,
    • “Senate Finance Committee Chairman Mike Crapo (R-Idaho) today [June 22] released the Joint Committee on Taxation’s (JCT) revenue estimate of the Finance Committee’s tax title [of the budget reconciliation bill], which shows that under a current policy baseline, the legislation has a net revenue impact of $442 billion.
    • “Washington has a spending problem, not a tax problem.  Extending the Trump tax cuts prevents a $4 trillion tax increase—this is not a change in current tax policy or tax revenue. This score more accurately reflects reality by measuring the effects of tax policy changes relative to the status quo.”
  • Roll Call discusses expected Congressional activities on Capitol Hill this week.
    • “The budget reconciliation package continues to dominate the agenda in Congress this week, as lawmakers are also expected to debate President Donald Trump’s weekend military strikes against Iranian nuclear targets.
    • “An all-senators briefing on the situation with Iran is slated for Tuesday afternoon, and a war powers resolution from Sen. Tim Kaine, D-Va., could see quick floor action. Kaine wants senators on the record on whether the United States should engage in hostilities against Iran.
    • “While a Senate aide said the measure does not formally ripen for expedited consideration until the end of the week, Republicans may seek to clear it from the decks earlier in the week in order to get their sweeping budget reconciliation package on the floor.” * * *
    • “The House, meanwhile, returns from a Juneteenth recess poised to begin floor debate on fiscal 2026 appropriations, while waiting for the Senate to amend and send back the budget reconciliation package.”
  • The Supreme Court will be releasing more opinions on Thursday June 26 and likely also Friday June 27.
  • Per MedPage Today,
    • “Updated Dietary Guidelines for Americans, which could be released as early as this month, will drop a long-standing recommendation to limit alcohol consumption to one or two drinks per day, Reuters reported this week, citing three sources familiar with the matter.
    • It’s “surprising, especially given what we now understand about how alcohol impacts health,” Lindsay Malone, MS, a registered dietitian nutritionist at Case Western Reserve University in Cleveland, told MedPage Today by email.
    • “In the absence of clear guidance, people are left wondering: how much, if any, is actually safe and healthy?” she said. “I don’t see any upside to this.”
    • “The guidelines will likely still include a brief statement that encourages drinking in moderation or limiting intake due to associated health risks, Reuters‘ sources said.”

From the public health and medical research front,

  • Fortune Well reports,
    • “Millions more Americans should be taking weight-loss drugs to prevent heart disease, according to the American College of Cardiology. 
    • “Exercise and a clean diet aren’t always enough for heart health, the nation’s top cardiology organization said in new recommendations released on Friday. Weight-loss drugs should be used earlier, making them part of the first line of defense for obese patients, the group said.
    • “Novo Nordisk A/S’s Wegovy and Eli Lilly & Co.’s Zepbound should be considered when choosing primary treatments to avert heart disease, the leading cause of death in the US, according to the new guidelines. The popular drugs are more effective than lifestyle changes and have fewer risks than surgery, the nonprofit medical association said.”
  • and
    • I woke up from surgery groggy, with three minuscule incisions in my abdomen and huge peace of mind. I’d just had my fallopian tubes laparoscopically removed, as it’s the best—and possibly only—defense against ovarian cancer, which, though rare, is the most lethal gynecological cancer there is.
    • “There is no detection method for ovarian cancer (a common misunderstanding is that it’s the Pap smear, but that’s for cervical cancer). That’s largely because of something discovered relatively recently: About 80% of the time, cancer of the ovaries forms in the fallopian tubes, which are not easily reached or biopsied. So, the cancer is not found until it spreads beyond the tubes, by which point it has typically reached a later stage and is harder to treat, with cure rates as low as 15%. 
    • “The cancer and its pre-cancer lesions are also not detectable through blood tests. 
    • “I myself had no idea about any of this until 2023, when I wrote about the Ovarian Cancer Research Alliance (OCRA) making sweeping recommendations: that all women get genetically tested to know their risk of the disease, and that all women, regardless of their risk factor, consider having what’s called an opportunistic salpingectomy—the prophylactic removal of fallopian tubes if and when they are already having another abdominal surgery.
    • “The strategy—endorsed by the American College of Obstetrics & Gynecology since 2015—was believed to cut down the risk of ovarian cancer by up to 60%. It was adopted as a wide recommendation after a sobering U.K.-based clinical trial followed 200,000 women for more than 20 years and found that screening and symptom awareness do not save lives.”
  • The New York Times adds,
    • “Doctors call the new weight-loss drugs revolutionary. Game-changing. Unprecedented.
    • “Soon, they may also call them obsolete.
    • “Drugmakers are racing to develop the next wave of obesity and diabetes medications that they hope will be even more powerful than those currently on the market.
    • “I think what we are going to see very quickly is that Wegovy has received a lot of the press attention, because it got there first,” said Simon Cork, a senior lecturer at Anglia Ruskin University in England who has studied obesity. “But it will be rapidly overtaken by much more potent medications.”
    • “On Saturday, researchers presented data at an annual meeting of the American Diabetes Association on perhaps the most anticipated of these medications: a daily pill. A late-stage study showed that the drug, called orforglipron, appeared to be about as effective as a weekly Ozempic injection at inducing weight loss and lowering blood sugar. It is just one of over a dozen experimental medications that researchers will share data about at the conference this weekend.
    • “Some of these drugs are still in early trials, but others could hit the market as soon as next year. They include medications that may lead to more weight loss than the roughly 15 to 20 percent body weight people lose on existing drugs. They may also be easier to take than weekly injections and help people shed pounds without dropping as much muscle. More competition — and, in the case of the pill, lower manufacturing costs — might also mean that, eventually, patients pay less.”
  • and
    • “A single infusion of a stem cell-based treatment may have cured 10 out of 12 people with the most severe form of type 1 diabetes. One year later, these 10 patients no longer need insulin. The other two patients need much lower doses.
    • “The experimental treatment, called zimislecel and made by Vertex Pharmaceuticals of Boston, involves stem cells that scientists prodded to turn into pancreatic islet cells, which regulate blood glucose levels. The new islet cells were infused and reached the liver, where they took up residence.
    • “The study was presented Friday evening at the annual meeting of the American Diabetes Association and published online by The New England Journal of Medicine.
    • “It’s trailblazing work,” said Dr. Mark Anderson, professor and director of the diabetes center at the University of California in San Francisco. “Being free of insulin is life changing,” added Dr. Anderson, who was not involved in the study.
  • Per STAT News,
    • “GLP-1 drugs could treat more than just diabetes and obesity. They may also reduce migraine frequency.
    • “That is according to the findings of a study presented on Friday at the European Academy of Neurology congress. The pilot study found that GLP-1 agonists reduced monthly migraine days by almost half. The authors hypothesized that the drug lowers migraine frequency by reducing intracranial pressure.”
  • The Washington Post reports,
    • “The lung tissue of people with chronic obstructive pulmonary disease contains triple the sootlike particle buildup found in similar tissue in smokers’ lungs, a recent analysis finds.
    • “The study found that COPD patients’ alveolar macrophages — a type of lung cell that removes dust, particles and microorganisms from the lungs — contain more carbon than those of smokers. The carbon-containing alveolar macrophages in COPD patients’ lungs were also larger than macrophages without visible carbon, the study found.
    • “Published in ERJ Open Research, the study looked at carbon deposits in the cells. Alveolar macrophages are an important part of the immune system, activating other immune defense cells to protect the body from inhaled invaders. People with COPD have inflamed airways and more alveolar macrophages than healthy people.” * * *
    • “The study does not prove what caused the changes in the COPD patients’ lung tissue. Those with COPD may be less able to clear carbon from their lungs, the researchers write, or perhaps those with a reduced ability to clear carbon are likelier to develop COPD. Pollution or indoor particulate matter may also be to blame, they conclude.”
  • and
    • “The thought of getting back to an exercise routine after surgery might make you wince. It can be a struggle to know where to begin, especially if your body isn’t working the way it used to.
    • “The good news is that heading to your local pool or aquatic therapy can be a great alternative to land-based physical therapy and exercise. Research, including a 2024 study, says aquatic exercise can significantly help patients recover both mentally and physically after most surgeries.
    • “Water therapy is sometimes even more effective than land-based therapy because surgery patients don’t have the same range of motion and mobility,” says Mara Karamitopoulos, a pediatric orthopedic surgeon at NYU Langone Health in New York.”

From the U.S. healthcare business front,

  • Beckers Payer Issues tells us,
    • “At Becker’s 15th Annual Meeting, leaders from Microsoft and Blue Shield of California shared how AI is one tool to help transform payer operations — not by replacing humans, but by personalizing care, cutting friction and restoring trust.
    • “Christine McKinney, vice president of customer experience and digital transformation at Blue Shield of California (Oakland) emphasized the strategic use of AI as both a data enabler and an engagement enhancer.”
    • The article offers takeaways from the presentation.
  • Kauffman Hall adds,
    • “As AI transformation remains top of mind for healthcare leaders, I’ve noticed two common pitfalls plaguing new entrants and early adopters.
    • “Those in the early stages are often susceptible to the “ready, fire, aim” approach – quickly identifying a tool and searching for a problem to match.
    • “Early adopters are having trouble defining clear return on investment (ROI), which may go beyond financials.
    • “These pitfalls are reflected in our data as well. 36% of health systems lack a formal AI prioritization framework, and a recent Vizient benchmarking survey found the top barrier to implementing AI is a lack of clear ROI.
    • “A successful AI strategy must include a clear prioritization framework and a deeper understanding of value. With this in mind, here is an example of one organization’s success and three steps to move beyond the hype and maximize ROI.”