Tuesday report

Generative AI

Tuesday report

David Ermer–CDC, CMS, COVID-19 vaccine, FDA, Federal employment benefits, Generative AI, Medical / Rx research, Medicare, No Surprises Act, Obesity, OPM, Telehealth, U.S. Healthcare–

From Washington, DC,

  • Federal News Network tells us,
    • “The guarantee of back pay for furloughed federal employees is now in limbo, as the White House weighs a different interpretation of the 2019 law that ensures federal employees get compensated following a government shutdown.
    • “A new draft legal opinion from the Office of Management and Budget, as first reported by Axios, argues that whatever funding legislation Congress ultimately passes to end the current shutdown must explicitly include appropriations to provide back pay for furloughed federal employees. And if it’s not expressly written in the spending legislation, the OMB memo argues that furloughed workers cannot receive any retroactive compensation.
    • “A copy of the OMB document, which a senior White House official shared with Federal News Network, appears to contradict OMB’s previous interpretation of the Government Employee Fair Treatment Act, or GEFTA, which President Donald Trump signed into law in 2019 during the last government shutdown. Both OMB and the Office of Personnel Management previously affirmed that under GEFTA, excepted and furloughed employees would be given back pay as soon as possible, once any current or future shutdown ends.”
  • In the FEHBlog’s opinion, this draft OMB opinion is a lead balloon.
  • Healthcare Dive shares six takeaways from CMS Administrator Mehmet Oz’s appearance on Monday before a Washington D.C. think tank audience.
  • Modern Healthcare reports,
    • “Federal regulators say they have made inroads into speeding up the process to resolve out-of-network billing disputes. It’s not enough for frustrated providers and health insurance companies.
    • “The No Surprises Act’s Independent Dispute Resolution, or IDR, process has been a punching bag for both camps since it launched in 2022, and a backlog of cases had piled up by the beginning of this year.
    • “But the share of IDR cases unsettled after 30 business days fell from 69% in January to 34% in July, the most recent month for which data are available, according to the Health and Human Services, Labor and Treasury departments. Likewise, 96.5% of disputes submitted since 2022 are either resolved or are less than 30 business days old, the departments wrote in a notice published Sept. 19.
    • “The departments’ efforts have delivered remarkable improvements in the throughput of cases compared to prior years,” the notice says. “IDR entities are now resolving disputes faster than they are submitted.”
  • STAT News informs us,
    • “The agreement between Pfizer and the Trump administration to lower drug prices has sent other companies scrambling to make a deal.
    • “Several major pharmaceutical firms that received letters from President Trump demanding lower prices have been hustling to show progress, with some hoping to announce a deal with the White House as soon as this week, according to five Washington representatives and lobbyists for the companies, granted anonymity to speak about private deliberations.”
    • “They have to now,” said one lobbyist of their clients’ thinking, noting the “anger”with Pfizer for effectively adding to their pressure to come to an agreement with the administration.
    • “The people cautioned that negotiations remain unfinished and several variables, including the government shutdown, could delay any announcements.
    • “The growing chatter around potential announcements signals the Trump administration’s pressure campaign may be paying off. But whether the deals will actually accomplish the administration’s objective — lowering prescription drug prices — remains unknown.”
  • Fierce Healthcare points out,
    • “The current state of the Medicare Part D market is a mixed bag, with premiums declining but many payers scaling back options, according to a new analysis from KFF.
    • “The report noted that the Centers for Medicare & Medicaid Services put an emphasis on “stability” in Part D when it announced premium estimates in late September, but KFF found that the total number of stand-alone Part D plans available will decrease in 2026, marking the third straight year of shrinking plan options.
    • “Some payers are trimming down their offerings, per the report. For example, Centene is ending three drug plans offered through WellCare and Health Care Service Corporation is discontinuing one of Cigna’s three Part D plans and pulling back from certain regions.
    • “Other insurers, such as Elevance Health, are exiting the stand-alone Part D plan market entirely.
    • “For 2026, beneficiaries in each state will be able to select from between eight and 12 stand-alone Part D plans, in addition to Medicare Advantage prescription drug coverage. Across the 34 Part D plan markets, a total of 360 plans will be made available by 17 parent organizations—a decrease of 22% from 2025.”
  • “As many major insurers scale back on Medicare Advantage,” Beckers Payer Issues takes a “look at the insurers that are fully backing out.”
  • NextGov/FCW explains how OPM Director Scott Kupor plans “to attract tech talent [to federal government employment] after months of workforce cuts.”
  • Per HR Dive,
    • “The U.S. Senate confirmed Brittany Panuccio, an assistant U.S. attorney for the Justice Department in Florida, as a commissioner for the U.S. Equal Employment Opportunity Commission in a 51-47 vote Tuesday. Panuccio’s confirmation was part of an en bloc vote on several nominations.
    • “Panuccio fills the seat vacated in December by Keith Sonderling, who was named deputy labor secretary in March, and gives Republicans a majority. Her term expires July 1, 2029. 
    • “Panuccio’s confirmation restores a quorum to EEOC, which has operated with only two commissioners since January, when President Donald Trump fired Democratic commissioners Charlotte Burrows and Jocelyn Samuels before the expiration of their terms.”

From the Food and Drug Administration front,

  • Healio adds,
    • “The FDA approved Zoryve cream 0.05% for the treatment of children aged 2 to 5 years with mild to moderate atopic dermatitis, according to a press release. 
    • “Currently, there are approximately 1.8 million children aged 2 to 5 years being treated with a topical therapy for AD. Zoryve (roflumilast, Arcutis) cream 0.05% is a once-daily, next-generation phosphodiesterase-4 inhibitor that offers a nonsteroidal option for children and their caregivers.
    • “It is essential to have safe and effective treatments for children, who are often diagnosed with atopic dermatitis at a young age and can live with the condition across their lifetime,” Lawrence F. Eichenfield, MD, chief of pediatric and adolescent dermatology at Rady Children’s Hospital-San Diego and vice chair of the department of dermatology at University of California San Diego, said in the release. “Young children often experience widespread disease, affecting large portions of their skin. Although topical steroids have been the standard treatment for years, they are not appropriate for long-term use.”

From the public health and medical / Rx research front,

  • The Wall Street Journal reassuringly explains how to get a Covid booster vaccination under the CDC’s newly approved guidelines.
  • MedPage Today reports
    • “To prevent measles outbreaks, public health systems and clinicians should look below the 35,000-foot view of state- and county-level vaccination rates against measles, mumps, and rubella (MMR) and instead aim their focus on at-risk school districts and schools, according to a statewide analysis of Texas counties.”
  • and
    • “The pre-cooked pasta Listeria recall broadened to include pasta salads and prepared dishes at Kroger, Trader Joe’s, and more grocery stores.
    • “Some Hello Fresh meals may contain Listeria-tainted spinach, USDA’s Food Safety and Inspection Service warned.
    • “Chicken corn dog products from Foster Poultry Farms also were recalled after wood was found in the batter causing at least five injuries. (NBC News)”
  • Per Healio,
    • “Changing trajectories of heart health markers during young adulthood were associated with potentially increased risk for cardiovascular disease later in life, researchers reported.
    • “In addition, individuals who maintained higher levels of CV health through young adulthood had lower risk for incident CVD vs. those whose CV health was maintained at lower levels or declined, according to data published in JAMA Network Open.”
  • and
    • “Acupuncture needling greatly improved pain-related disability in older adults with low chronic back pain compared with usual care, a randomized controlled trial demonstrated.
    • “Acupuncture may be an effective and safe pain management tool for many older adult patients,” Lynn L. DeBar, PhD, MPH, a researcher at Kaiser Permanente Center for Health Research, told Healio. “While it is unlikely to take away all the pain, this study suggests that it can decrease pain-related disability substantively.”
  • The New York Times considers that “He was expected to get Alzheimer’s 25 years ago. Why hasn’t he? Scientists are searching for the secret in [76-year-old] Doug Whitney’s biology that has protected him from dementia, hoping it could lead to ways to treat or prevent Alzheimer’s for many other people.”
  • Per Health Day,
    • “Preschoolers who regularly overeat are likely swallowing their emotions as well, a new study says.
    • “Girls who overeat as preschoolers are more likely to develop anxiety, impulsivity and hyperactivity when they grow into teenagers, researchers reported in the journal BMC Pediatrics.
    • “The results indicate that children’s eating patterns could be early signs of mental health challenges, researchers said.
    • “Occasional overeating is normal, but if a child frequently overeats, it can be a sign of emotional struggles,” senior researcher Linda Booij, a professor of psychiatry at McGill University in Quebec, Canada, said in a news release.”
  • Per Genetic Engineering and Biotechnology News,
    • “A research team co-led by scientists at Institute for Bioengineering of Catalonia (IBEC) and West China Hospital Sichuan University (WCHSU), working with partners in the U.K., has developed a nanoparticle technology that studies showed can reverse Alzheimer’s disease (AD) in mice. Unlike other types of nanomedicine that rely on nanoparticles as carriers for therapeutic molecules, this approach employs nanoparticles that are bioactive in their own right, and which the team refers to as “supramolecular drugs.”
    • “Instead of targeting neurons directly, the therapy restores proper function of the blood-brain barrier (BBB), the vascular gatekeeper that regulates the brain’s environment. The BBB is a cellular and physiological barrier that separates the brain from the blood flow to protect it from external dangers such as pathogens or toxins. Through their newly reported research the investigators demonstrated that targeting a specific mechanism enables undesirable “waste proteins” produced in the brain to pass through this barrier and be eliminated in the circulation. In Alzheimer’s disease, the main waste protein is amyloid-β (Aβ), the accumulation of which impairs normal neuronal function.
    • “By repairing this critical interface, the researchers observed a significant reduction in brain amyloid-β (Aβ) levels and a reversal of Alzheimer’s pathology in the animal models, with cognitive benefits lasting up to six months following treatment.
    • “Study lead Giuseppe Battaglia, PhD, ICREA research professor at IBEC, principal investigator of the Molecular Bionics Group, and colleagues reported on their findings in Signal Transduction and Targeted Therapy, in a paper titled “Rapid amyloid-β clearance and cognitive recovery through multivalent modulation of blood–brain barrier transport,” in which they stated, “This innovative therapeutic paradigm offers a promising pathway for developing effective clinical interventions, addressing vascular contributions to AD, and ultimately enhancing patient outcomes…The therapeutic trilogy achieved—amyloid clearance, barrier restoration, and sustained cognitive recovery—establishes a blueprint for precision neurovascular medicine.”

From the U.S. healthcare business front,

  • Fierce Healthcare reports,
    • “It was a repeat performance for all 10 children’s hospitals named as the nation’s best in this year’s iteration of U.S. News & World Report’s ranking.
    • “The highly watched list, now in its 19th year, reviewed outcomes, practices and surveyed opinions for 198 children’s hospitals.
    • “Of these, 86 hospitals were named in some respect, whether that be a top-10 ranking for 10 different pediatric specialties and/or as one of 50 unranked facilities named as a high performer on pediatric and adolescent behavioral health.
    • “Among these, 10 children’s hospitals were named to the list’s honor roll for scoring well across multiple specialties. That unranked collection is identical to last year’s honorees.
      • “Boston Children’s Hospital
      • “Children’s Hospital Colorado, Aurora
      • “Children’s Hospital Los Angeles
      • “Children’s Hospital of Philadelphia
      • “Children’s National Hospital, Washington, D.C.
      • “Cincinnati Children’s
      • “Nationwide Children’s Hospital, Columbus, Ohio
      • “Rady Children’s Hospital, San Diego
      • “Seattle Children’s Hospital
      • “Texas Children’s Hospital, Houston”
  • and
    • “Providers are betting on artificial intelligence to ease the pain point of prior authorization, a new survey shows.
    • “Cohere Health, which provides clinical intelligence to insurers and risk-bearing providers, polled 200 clinicians and office administrators and found that 99% of clinicians report confidence in using AI to back prior authorization. Most (96%) office administrators said the same.
    • “Two-thirds of those surveyed said a completely digital prior authorization process would significantly improve their workflows. Across the board, the respondents said the process should have real-time tracking baked into the experience, allowing them to track the status of key requests.
    • “Providers are speaking loud and clear: they want and deserve a prior authorization process that is smarter, simpler and more transparent,” said Brian Covino, M.D., chief medical officer of Cohere Health, in an announcement.”
  • Healthcare Dive relates,
    • “Saint Peter’s Healthcare System and Atlantic Health abandoned plans to merge on Monday, citing impacts of the “rapidly evolving healthcare landscape nationally.”
    • “The New Jersey-based health systems first announced plans to combine in January last year and signed a definitive agreement to merge in June 2024. 
    • “The systems shared scant details about why the deal fell apart. However, in a joint statement issued Monday both Atlantic President and CEO Saad Ehtisham and Saint Peter’s President and CEO Leslie Hirsch called the deal’s end disappointing.”
  • STAT News informs us,
    • “Just a decade ago, a doctor with multiple medical licenses was an anomaly. Sometimes physicians would apply for credentials from a few states if they lived near a border and wanted the flexibility to practice on either side, since a doctor needs to be licensed where their patient is physically located. In-demand specialists might get a few more if they wanted to see patients virtually. But in the years since Covid began driving patients online, the number of physicians seeking multi-state licensure has ballooned to support the growing field of telehealth.
    • “Within that group, a STAT analysis of physician licenses shows that a small but powerful cohort of physicians is accumulating licenses in all 50 states, plus the nation’s capital and its territories. These physicians don’t max out on licenses just to practice across state lines. Often, they own the medical groups that are affiliated with nationwide telehealth companies. A doctor’s full roster of medical licenses can be leveraged for online businesses that provide specialty care, build patient funnels for pharma companies seeking to sell drugs directly to consumers, prescribe compounded meds — or sometimes, all of the above. 
    • “In 2016, just nine physicians in the U.S. held active licenses in all 50 states, according to data from the Federation of State Medical Boards. By 2024, 172 doctors had filled out their bingo card, and another 356 doctors had acquired at least 45 licenses — significantly outpacing the profession’s overall growth.”
  • As we approach Open Season, the American Diabetes Association offers “Health Insurance Aid for Diabetes. Access to medical care is key to managing your diabetes. Get more information on resources available to people living with diabetes.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI, Uncategorized–

From the cybersecurity policy front,

  • Federal News Network reports,
    • “The Cybersecurity and Infrastructure Security Agency typically marks October’s awareness month with a range of public engagements and outreach campaigns. But under the ongoing government shutdown, CISA has furloughed nearly two-thirds of its staff and curtailed most public communication.
    • “CISA is not actively managing its website under the shutdown. But the agency did establish a landing webpage for cybersecurity awareness month prior to the shutdown, detailing the campaign’s theme and linking to a toolkit.
    • “CISA Director of Public Affairs Marci McCarthy said, “CISA remains fully committed to safeguarding the nation’s critical infrastructure,” as part of a statement.” * * *
    • “Chris Cummiskey, a former state chief information officer and former chief management officer at DHS, said CISA typically retains enough employees to staff the agency’s watch floor, maintain technology that monitors federal networks for cyber threats, and collaborate with cyber defenders at other federal organizations, like U.S. Cyber Command.
    • “But if a major cyber incident were to occur, CISA may not have enough staff immediately on hand to manage the event.
    • “A key concern is, do you need to start recalling people?” Cummiskey said. “You probably wouldn’t have the onsite capacity to cover a major exploit without the additional help.”
    • “In addition to the shutdown, key privacy and liability protections under the Cybersecurity Information Sharing Act of 2015 expired on Sept. 30. Those protections had been pivotal to encouraging the private companies to share cyber threat data with each other and with government agencies, including CISA.
    • “Cyber experts say companies may be more hesitant to share information about new cyber threats and vulnerabilities without the statute’s protections.”
  • Cybersecurity Dive adds,
    • “Michael Daniel, president of the Cyber Threat Alliance, an information-sharing group, predicted that some companies will “suspend some sharing activities with the government,” but he added that a lot will depend on “each company’s risk tolerance.”
    • “I think some collaboration will continue,” he said, “but likely at reduced levels and requiring more human oversight.”
    • “Ari Schwartz, managing director of cybersecurity services at the law firm Venable, said, “There will just be many more lawyers involved, and it will all go slower, particularly new sharing agreements.” Venable has advised clients on what to consider when establishing such agreements.
    • “As for companies sharing information with each other, that likely will continue for now because of a lack of near-term concern about antitrust investigations, Daniel said. But companies’ attitudes could change if the program isn’t reauthorized.”
  • The National Institute of Standards announced on September 29, 2025,
    • “As part of ongoing efforts to strengthen the protections for securing controlled unclassified information (CUI) in nonfederal systems [which includes FEHB and PSHB claims data], NIST has released the following drafts for comment:
    • “SP 800-172r3 (Revision 3) fpd (final public draft), Enhanced Security Requirements for Protecting Controlled Unclassified Information, provides new enhanced security requirements that support cyber resiliency objectives, focus on protecting CUI, and are consistent with the source controls in SP 800-53r5.
    • “SP 800-172Ar3 ipd (initial public draft), Assessing Enhanced Security Requirements for Controlled Unclassified Information, provides a set of assessment procedures for the enhanced security requirements. These procedures are based on the source assessment procedures in SP 800-53Ar5.” * * *
    • “A public comment period will be open from September 29 through November 14, 2025. Reviewers should submit comments on all or parts of the drafts to 800-171comments@list.nist.gov.”
  • Cybersecurity Dive tells us,
    • “Barely any U.S. defense contractors say they’re fully prepared to comply with the Department of Defense’s new cybersecurity assessment program.
    • “Only 1% of companies say they’re completely ready to be assessed through the Cybersecurity Maturity Model Certification (CMMC) program, which takes effect on Nov. 10, according to a report that the managed security provider CyberSheath published on Wednesday.
    • “The percentage of respondents expressing confidence in their readiness has dropped over the past two years.”

From the cybersecurity vulnerabilities and breaches front,

  • NextGov/FCW reports on September 29, 2025,
    • “A “widespread cybersecurity incident” at the Federal Emergency Management Agency allowed hackers to make off with employee data from both the disaster management office and U.S. Customs and Border Protection, according to a screenshot of an incident overview presentation obtained by Nextgov/FCW.
    • “The hack is also suspected to have later triggered the dismissal of two dozen Federal Emergency Management Agency technology employees announced late last month, according to internal meeting notes and a person familiar with the matter.
    • “The initial compromise began June 22, when hackers accessed Citrix virtual desktop infrastructure inside FEMA using compromised login credentials. Data was exfiltrated from Region 6 servers, the image says. That FEMA region services Arkansas, Louisiana, New Mexico, Oklahoma and Texas, as well as nearly 70 tribal nations.” * * *
    • “DHS security operations staff were notified of the breach on July 7, the screenshot adds. On July 14, the unnamed threat actor used an account with high-level access and attempted to install virtual networking software that could allow them to extract information. Initial remediation steps were taken on July 16. 
    • “On Sept. 5, additional remediation actions were taken, including changing FEMA Zscaler policies and blocking certain websites, the screenshot says. Those actions were previously reported by Nextgov/FCW.”
  • Following up on last Saturday’s post about the Cisco KVEs, Cybersecurity Dive lets us know,
    • “Nearly 50,000 Cisco firewall devices with recently disclosed vulnerabilities are connected to the internet, according to new data.
    • “Statistics from the Shadowserver Foundation illustrate the extent of the world’s exposure to the three flaws in Cisco’s Adaptive Security Appliance devices and Firepower Threat Defense devices, which earned a rare emergency patching directive from the Cybersecurity and Infrastructure Security Agency (CISA) after the Sept. 25 disclosure.
    • “The United States has by far the most devices that have not been patched to block exploitation of the flaws, with Shadowserver tallying more than 19,000 vulnerable U.S. devices. The U.K. ranks second, with more than 2,700 vulnerable devices, followed by Japan, Germany and Russia. Other European countries have fewer than 1,000 vulnerable devices each.
    • “Shadowserver’s records will reveal how quickly different countries are reducing their exposure as the organization continues collecting data in the coming days and weeks.
    • “A sophisticated threat actor has been using two of the new Cisco flaws, CVE-2025-20362 and CVE-2025-20333, in a stealthy cyberattack campaign that has breached multiple federal agencies and other organizations worldwide. Both vulnerabilities involve improper validation of HTTPS requests, which could allow Cisco firewalls to accept malicious requests that bypass authentication. CVE-2025-20362 could allow hackers to access restricted VPN-related URLs, while CVE-2025-20333 could let intruders run arbitrary code as root.”
  • Cyberscoop points out,
    • “Red Hat on Thursday [October, 2, 2025] confirmed an attacker gained access to and stole data from a GitLab instance used by its consulting team, exposing some customer data. The open-source software company, a subsidiary of IBM, said the breach is contained and an investigation into the attack is underway. 
    • “Upon detection, we promptly launched a thorough investigation, removed the unauthorized party’s access, isolated the instance, and contacted the appropriate authorities,” Red Hat said in a security update. “Our investigation, which is ongoing, found that an unauthorized third party had accessed and copied some data from this instance.”
    • “Red Hat said the compromised GitLab instance contained work related to consulting engagements with some customers, including project specifications, example code snippets and internal communications about the consulting services. 
    • “This GitLab instance typically does not house sensitive personal data,” Red Hat said. “While our analysis remains ongoing, we have not identified sensitive personal data within the impacted data at this time.”
  • Dark Reading informs us,
    • “The month-long outage for luxury car maker Jaguar Land Rover appears to be at an end, with the company working through a “controlled, phased restart” of its manufacturing operations this week, following a massive cyberattack that forced the company to shut down its systems.
    • “JLR said on Sept. 2 that it had “proactively” shut down operations following a cyber incident, initially stating that customer data did not seem to be stolen, but revising that statement a week later. JLR, a subsidiary of Tata Motors, likely suffered $50 million to $70 million in lost revenue per week, with the total cost of the incident estimated at a staggering $1.7 billion to $2.4 billion.
    • “The attack, and its vast impact, should be a warning for companies, says Chris Gibson, executive director of the Forum of Incident Response and Security Teams (FIRST).
    • “The outage “highlights that even large corporations with substantial resources can be completely disrupted and that critical industries may be more vulnerable than previously thought,” he says. “This was far beyond data theft; it was a complete operational outage.”
  • Security Week adds,
    • “Japanese brewing giant Asahi Group Holdings on Monday [September 29, 2025] announced that its operations in the country have been disrupted by a cyberattack.
    • “The incident, the company said, resulted in system failures that affected orders and shipments at all its subsidiaries in the country, as well as call center operations, customer service desks included.
    • “Reuters reported that production at some of Asahi’s 30 domestic factories has been suspended due to the cyberattack.
    • “At this time, there has been no confirmed leakage of personal information or customer data to external parties,” the company said in a Monday notice.
    • “Asahi said it is investigating the attack and working on restoring the affected systems but could not provide an estimated timeline for recovery.
    • “The system failure is limited to our operations within Japan,” it said.
    • “The company has not disclosed the nature of the cyberattack it fell victim to, but the system-wide outage could indicate that file-encrypting ransomware might have been used.”

From the ransomware front,

  • Cybersecurity Dive reports,
    • “Corporate executives are being targeted in an email-based extortion campaign by a threat actor claiming affiliation with the notorious Clop ransomware gang, according to security researchers from Google Threat Intelligence Group and Kroll. 
    • “The hacker claims to have data stolen from breached Oracle E-Business Suite applications and has been demanding payment from various corporate executives, according to a LinkedIn post from Austin Larsen, principal threat analyst at GTIG.
    • “While researchers have not been able to substantiate the claims of a data breach, they have confirmed important links to a financially motivated threat group tracked under the name FIN11, which has prior associations with Clop.” 
  • Cyberscoop provides us with “the email Clop attackers sent to Oracle customers. The emails, which are littered with broken English, aim to instill fear, apply pressure, threaten public exposure and seek negotiation for a ransom payment.”
  • Dark Reading adds,
    • After announcing its farewell last month, the cyber extortion group known as Scattered Lapsus$ Hunters returned on Friday with a website featuring stolen Salesforce data and a list of dozens of alleged victims.
    • Scattered Lapsus$ Hunters is an apparent combination of the Scattered Spider, Lapsus$, and ShinyHunters cybercriminal groups, which first emerged over the summer in a public Telegram channel. However, just a few weeks later, the collective published a goodbye letter on Telegram and the Dark Web marketplace BreachForums, saying the three groups, as well as other threat actors, had “decided to go dark.”
    • “But Scattered Lapsus$ Hunters burst back into the limelight this week with a Dark Web leak site devoted to the recent spate of Salesforce data thefts; one of the two distinct campaigns targeting Salesforce environments recently has been attributed to a threat group tracked by Google as UNC6040, which has claimed to be ShinyHunters in its extortion attempts.
    • “According to Google, UNC6040 actors used vishing calls to convince IT support personnel at targeted organizations to grant them access to or credentials for the organizations’ Salesforce environments. Mandiant researchers this week said the threat actors have impersonated third-party vendors in the vishing calls and had also targeted users in victim organizations with elevated access to other SaaS applications.’
  • The American Hospital Association points out,
    • “A Health-ISAC (Information Sharing and Analysis Center) bulletin released Oct. 1 warns of a recently released LockBit 5.0 ransomware variant that poses a threat to health care and other sectors. LockBit 5.0 is the latest version of the ransomware-as-a-service group that has previously attacked hospitals and other organizations in the U.S. and abroad. The notice said the new variant directly targets virtual environments and has improved and enhanced technical capabilities, evasion techniques and affiliate engagement. The variant is known to target Windows, Linux and VMware ESXi software. Health-ISAC said the new variant’s technical capabilities make it faster, more flexible for affiliates and harder for security to detect and analyze. LockBit was disrupted by authorities last year before resurfacing last month.
    • “This is a very technical bulletin, but it’s important to note that it addresses a new version of a well-known ransomware,” said Scott Gee, AHA deputy national advisor for cybersecurity and risk. “Hospitals should ensure that they have defensive measures in place and that those measures are tuned and working properly.”
  • HackRead reports on September 29,
    • “The Medusa ransomware group is claiming responsibility for a ransomware attack on Comcast Corporation, a global media and technology company best known for its broadband, television, and film businesses.
    • “According to the group’s dark web leak site, they exfiltrated 834.4 gigabytes of data and are demanding $1.2 million for interested buyers to download it. The same sum has been set as ransom for Comcast if the company wants the data deleted rather than leaked or sold.
    • “To back its claims, Medusa has posted around 20 screenshots allegedly showing internal Comcast files. The group also shared a massive file listing of 167,121 entries, suggesting access to actuarial reports, product management data, insurance modelling scripts, and claim analytics.” * * *
    • “Medusa ransomware is known for publishing file listings and partial screenshots as proof of compromise while holding back the bulk of the data to increase ransom pressure. In this case, the nature of the files points toward actuarial and financial datasets, some of which appear to involve insurance calculations, customer data processing, and claim management systems.”
  • HelpNetSecurity provides us background about and advice on how to avoid Akira ransomware.
  • Wired notes that “Google has launched a new AI-based protection in Drive for desktop that can shut down a [ransomware] attack before it spreads—but its benefits have their limits.”

From the cybersecurity defenses front,

  • Per ISACA,
    • “Cybersecurity professionals from around the world recently weighed in on some of the key findings from ISACA’s latest State of Cybersecurity survey report. Aparna Achanta, security leader, IBM (US); Simon Backwell, head of information security, Benefex (UK); Donavan Cheah, senior cybersecurity consultant, Thales (Singapore); Jenai Marinkovic, vCISO/CTO, Tiro Security, and CEO & chairman of the board, GRCIE (US); Kannammal Gopalakrishnan, cybersecurity and GRC professional (India), and Carlos Portuguez, Sr. Director BISO, Concentrix (Costa Rica)—all of whom are also members of ISACA’s Emerging Trends Working Group—reflect on how these stats show up for them in the profession.”
  • and
    • “Phishing has escalated beyond masquerading techniques. Traditional attacks depended on typos, being in a rush and not so well-disguised social engineering. But hackers today use generative AI, such as WormGPT or FraudGPT, and even deepfakes, to create perfect messages with contextual background that can effortlessly be mixed with everyday corporate messages. Cofense has noted that it receives an AI-enhanced malicious email every 42 seconds, with that pace expected to accelerate in the months to come. This hypergrowth is an indication that phishing is not an outlying issue anymore but a mainstream cyber-crime, now with AI-driven precision. 
    • “The next pivot is neuro-phishing, which can tie in the details of biometric and psycho-physiological indicators, like the EEG, micro-hesitation spikes, blink frequency, and the focus of the eyes, to see the response of the user in real-time and work a different approach. Previous and extensive studies have already established the reliability of finding recognition and stress using the EEG, when users are stimulated with phishing. This is not passive baiting anymore, but a dynamic, cognitive feedback loop, which transforms human users into interactive targets.”
    • The article offers advice on creating resilience against neuro-phishing.
  • Dark Reading adds,
    • “Email security has long dominated the enterprise security conversation — and rightfully so. It remains a key vector for phishing, credential theft, and social engineering. But in 2025, the threat landscape has shifted. Quietly yet decisively, attackers increasingly are bypassing the inbox and expanding their reach across multiple channels. 
    • “Recent data from TechMagic shows that 41% of phishing incidents now employ multichannel tactics, including SMS (smishing), voice calls (vishing), and QR codes (quishing). The trend is clear: While email still matters, adversaries are shifting to mobile-first platforms like text, iMessage, WhatsApp, and social direct messages. These attacks are harder to spot, more difficult to control, and more likely to succeed, because they target the most vulnerable point in the chain: the human behind the screen.
    • “To address this growing threat to mobile platforms, new security approaches are emerging that leverage AI-driven defenses to identify and prevent social engineering attacks in real-time. By training large language models (LLMs) to understand the content and intent behind messages, these systems can flag suspicious activity and enforce protective measures before users fall victim. Whether it’s a text message posing as IT support or impersonating a vendor, these next-generation solutions focus on stopping threats at the human layer — not just at the device.”
  • Infosecurity Magazine explains how “AI-Generated Code Used in Phishing Campaign Blocked by Microsoft.”
  • Per CISO Online,
    • “A surge in vulnerabilities and exploits leaving overloaded security teams with little recourse but to embrace risk-based approaches to patching what they can.
    • “Enterprise attack surfaces continue to expand rapidly, with more than 20,000 new vulnerabilities disclosed in the first half of 2025, straining already hard-pressed security teams.
    • “Nearly 35% (6,992) of these vulnerabilities have publicly available exploit code, according to the Global Threat Intelligence Index study by threat intel firm Flashpoint.
    • “The volume of disclosed vulnerabilities has more than tripled while the amount of exploit code has more than doubled since the end of February 2025 alone.
    • “These increases make it no longer feasible for most organizations to triage, remediate, or mitigate every vulnerability, Flashpoint argues, suggesting enterprises need to apply a risk-based patching framework. But some experts quizzed by CSO went further — arguing a complete operational overhaul of vulnerability management practices is needed.
    • The article delves into that approach.
  • Per the National Institute of Standards,
    • “The NIST National Cybersecurity Center of Excellence (NCCoE) has finalized a guide, NIST Special Publication (SP) 1334, Reducing the Cybersecurity Risks of Portable Storage Media in Operational Technology (OT) Environments, to help organizations protect their industrial control systems from cybersecurity threats when using removable media devices.
    • “Portable storage media devices, like USB flash drives, are commonly used to transfer data between computers. However, using them in OT environments and industrial control systems, such as those used in power plants or manufacturing facilities, can pose a cybersecurity risk. If a USB device is infected with malware, it can spread to the industrial control system and cause problems, such as disrupting operations or compromising safety.
    • “This NCCoE resource suggests implementing physical and technical controls to limit access to these devices and ensure they are used securely.”
  • Here is a link to Dark Readings’ CISO Corner.

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front,

  • Health ISAC reminds us,
    • “Despite widespread public and private interest in reauthorizing the U.S. Cybersecurity Information Sharing Act of 2015 (“CISA 2015”)[i], we are rapidly approaching September 30th, the date when the Act is set to expire barring congressional action to extend it. With time running short, let’s assess the options still being considered and breakdown how and why reauthorization is going down to the wire.” * * *
    • “The current most likely path for a CISA 2015 reauthorization is not a simple standalone bill that is quickly passed by both chambers. Instead, the most likely path runs through a short term extension as part of a continuing resolution (“CR”) and then through the National Defense Authorization Act (“NDAA”).
    • “For those who are unfamiliar, a CR is a “temporary spending [bill] that [allows] federal government operations to continue when final appropriations have not been approved by Congress and the President. Without final appropriations or a CR, there could be a lapse in funding that results in a government shutdown.”[ii] The NDAA is an annual end of year bill that provides appropriations for the Department of Defense (“DOD”). It is generally considered to be a “must pass” piece of legislation that lawmakers attempt to add otherwise unrelated policy matters.”
  • Nextgov/FCW tells us,
    • “Greg Barbaccia, the federal chief information officer, says that the Office of Management and Budget is backing the General Services Administration’s overhaul of FedRAMP, the government’s cloud security assessment and authorization program. 
    • “GSA launched FedRAMP 20x — meant to use more automation in place of annual assessments, cut red tape and speed up authorizations — in March. It announced its phase two pilot on Wednesday.
    • “Barbaccia acknowledged the past problems with FedRAMP at a Wednesday event held by the Alliance for Digital Innovation. 
    • “I have done FedRAMP in my past life,” said Barbaccia, who previously worked at Palantir and more recently at a machine-learning enabled asset manager. “What a pain in the butt.”
    • “The FedRAMP program is planning on pursuing 10 pilot authorizations at the Moderate security level as part of the new phase of FedRAMP 20x, said FedRAMP Director Pete Waterman.”
  • Per a Cybersecurity and Infrastructure Security Agency (“CISA”) news release,
    • Today [September 23, 2025], the Cybersecurity and Infrastructure Security Agency (CISA) announced the appointment of Stephen L. Casapulla as the Executive Assistant Director for Infrastructure Security.
    • “I am pleased to have Steve expand his role on CISA’s leadership team,” said Acting Director Madhu Gottumukkala. “With his extensive experience in critical infrastructure security and working with stakeholders, he is perfectly poised to lead our efforts in securing the nation’s critical infrastructure. I look forward to working with him on this important mission.”
    • Prior to joining CISA, Casapulla served as the Director for Critical Infrastructure Cybersecurity in the Office of the National Cyber Director. He previously spent over thirteen years at CISA and its predecessor, holding a variety of senior roles. His prior federal service includes work at the Small Business Administration and at the Department of State in Iraq. He also serves as an officer in the U.S. Navy Reserve, with over twenty years of service and multiple overseas deployments.

From the cybersecurity vulnerabilities and breaches front,

  • Cybersecurity Dive reports,
    • “The Cybersecurity and Infrastructure Security Agency on Thursday [September 25, 2025,] ordered U.S. government agencies to patch multiple vulnerabilities in Cisco networking products, saying an “advanced threat actor” was using them in a “widespread” campaign.
    • “This activity presents a significant risk to victim networks,” CISA said in an emergency directive that laid out a mandatory timeline for agencies to identify, analyze and patch vulnerable devices.
    • “The hacking campaign — an extension of the sophisticated “ArcaneDoor” operation that Cisco first revealed in April 2024 — has compromised multiple federal agencies, two U.S. officials told Cybersecurity Dive. Both officials requested anonymity to discuss a sensitive and evolving investigation.”
  • Cyberscoop adds,
    • “Cisco said it began investigating attacks on multiple government agencies linked to the state-sponsored campaign in May. The vendor, which attributes the attacks to the same threat group behind an early 2024 campaign targeting Cisco devices it dubbed “ArcaneDoor,” said the new zero-days were exploited to “implant malware, execute commands, and potentially exfiltrate data from the compromised devices.” 
    • “Cisco disclosed three vulnerabilities affecting its Adaptive Security Appliances — CVE-2025-20333, CVE-2025-20363 and CVE-2025-20362 — but said “evidence collected strongly indicates CVE-2025-20333 and CVE-2025-20362 were used by the attacker in the current attack campaign.” 
    • “The Cybersecurity and Infrastructure Security Agency said those two zero-days pose an “unacceptable risk” to federal agencies and require immediate action.”
  • Dark Reading points out,
    • “The Cybersecurity and Infrastructure Security Agency (CISA) this week disclosed that threat actors breached a federal agency last year by exploiting a critical vulnerability in the open source GeoServer mapping server.
    • “In the advisory, CISA said it conducted incident response at a large, unnamed federal civilian executive branch (FCEB) agency after malicious activity was flagged by the agency’s endpoint detection and response (EDR) platform, but found the agency’s response playbook to be lacking; so lacking in fact that it hampered CISA’s investigation and allowed the attackers to burrow deeper into the network unchecked.
  • Cybersecurity Dive adds,
    • “[On September 23, 2025,] the Cybersecurity and Infrastructure Security Agency urged security teams to monitor their systems following a massive supply chain attack that struck the Node Package Manager ecosystem. 
    • “The attack, tracked under the name Shai-Hulud, involved a self-replicating worm that compromised more than 500 software packages, according to StepSecurity. 
    • “After gaining access, a malicious attacker injected malware and scanned the environment for sensitive credentials. The credentials included GitHub Personal Access Tokens and application programming interface keys for various cloud services, including Amazon Web Services, Google Cloud Platform and Microsoft Azure. 
    • “The stolen credentials were uploaded to an endpoint controlled by the attacker and then uploaded to a public repository called Shai-Hulud. 
    • “Researchers at Palo Alto Networks said the attacker used an LLM to write the malicious script, according to an updated blog post released Tuesday.” 
  • Cybersecurity Dive relates,
    • “Hackers are conducting brute force attacks against the MySonicWall.com portal in order to access the company’s cloud backup service for firewalls, SonicWall and federal authorities warned in advisories released Monday [September 22, 2025].
    • “SonicWall said its investigation found that hackers gained access to 5% of backup firewall preference files. The company warned that while credentials inside the files were encrypted, the files contained other information that could help attackers exploit the firewall, according to the advisory.  
    • “SonicWall also released a video explaining the scope of the incident. 
    • “In an advisory on Monday, the Cybersecurity and Infrastructure Security Agency urged customers to log into their accounts to determine whether their devices are at risk.” 
  • Cyberscoop reports,
    • “The Secret Service said Tuesday [September 23, 2025] that it disrupted a network of electronic devices in the New York City area that posed imminent telecommunications-based threats to U.S. government officials and potentially the United Nations General Assembly meeting currently underway.
    • “The range of threats included enabling encrypted communications between threat groups and criminals or disabling cell towers and conducting denial-of-service attacks to shut down cell communications in the region. Matt McCool, special agent in charge of the Secret Service’s New York field office, said the agency’s early analysis of the network indicated “cellular communications between foreign actors and individuals that are known to federal law enforcement.”
    • “In all, the agency said it discovered more than 300 servers and 100,000 SIM cards spread across multiple sites within 35 miles of the U.N. meeting. The Secret Service announcement came the same day President Donald Trump was scheduled to deliver a speech to the General Assembly.
    • “The potential for disruption to our country’s telecommunications posed by this network of devices cannot be overstated,” U.S. Secret Service Director Sean Curran said in a news release.”
  • Cyberscoop warns,
    • “Ambitious, suspected Chinese hackers with a slew of goals — stealing intellectual property, mining intelligence on national security and trade, developing avenues for future advanced cyberattacks — have been setting up shop inside U.S. target networks for exceptionally long stretches of time, in a breach that the researchers who uncovered it said could present problems for years to come.
    • “Mandiant and Google Threat Intelligence Group (GTIG) researchers described the campaign as exceptionally sophisticated, stealthy and complex, calling those behind it a “next-level threat.” But they don’t yet have a full handle on who the hackers are behind the malware they’ve dubbed Brickstorm, or how far it stretches. A blog post the company posted Wednesday sheds light on the group.
    • “The primary targets are legal services organizations and tech companies that provide security services, the researchers said. But the hackers aren’t limiting their interest to the primary targets, since they’ve used that access to infiltrate “downstream” customers. The researchers declined to describe those downstream customers or say whether U.S. federal agencies are among those targeted. A great many of them don’t know yet that they’re victims, they said.
    • “By stealing intellectual property from security-as-a-service (SaaS) firms, the hackers aim to find future zero-day vulnerabilities, a kind of vulnerability that is previously unknown and unpatched and thus highly prized, in order to enable more attacks down the line, the researchers from Mandiant and its parent company Google said.”
  • Per Dark Reading,
    • “Salesforce Web forms can be manipulated by the company’s “Agentforce” autonomous agent into exfiltrating customer relationship management (CRM) data — a concerning development as legacy software-as-a-service (SaaS) providers race to integrate agentic AI into their platforms to zhuzh up the user experience and generate buzz among investors.
    • “Agentforce is an agentic AI platform built into the Salesforce ecosystem, which allows users to spin up autonomous agents for most conceivable tasks. As the story often goes though, the autonomous technology appears to be the victim of the complexity of AI prompt training, according to researchers at Noma Security. 
    • “To wit: The researchers have identified a critical vulnerability chain in Agentforce, carrying a 9.4 out of 10 score on the CVSS vulnerability-severity scale. In essence it’s a cross-site scripting (XSS) play for the AI era — an attacker plants a malicious prompt into an online form, and when an agent later processes it, it leaks internal data. In keeping with all of the other prompt injection proofs-of-concept (PoCs) coming out these days, Noma has named its trick “ForcedLeak.”

From the ransomware front,

  • Cybersecurity Dive reports,
    • “RTX Corp., the parent firm of Collins Aerospace, confirmed that ransomware was used in the hack of its airline passenger processing software, in a filing with federal regulators. 
    • “The attack, discovered on Sept. 19, has disrupted flights across Europe since last week, including at London’s Heathrow Airport, Brussels Airport, and airports in Berlin and Dublin. 
    • “The Multi-User System Environment software, known as MUSE, is used by multiple airlines to check-in and board passengers and is also used to track baggage, according to the filing with the U.S. Securities and Exchange Commission. 
    • “Virginia-based RTX said the MUSE system operates on a customer-specific network outside of the company’s enterprise network.
    • “U.K. authorities said Wednesday that a man in his 40s had been arrested on suspicion of violating the Computer Misuse Act. The police investigation is ongoing.” 
  • Dark Reading points out,
    • “Volvo Group North America (Volvo NA) has been breached via a third-party human resources (HR) software provider.
    • “At the root of the story is Miljödata, a Swedish company specializing in occupational software-as-a-service (SaaS), whose cloud infrastructure was breached in August. Thanks to its centralized, multi-tenant arrangement, hundreds of customers and millions of individuals have been affected. In a recent letter to its staff, Volvo NA, whose parent company is based in Sweden, revealed itself to be one such victim.
    • “Like other Miljödata customers, Volvo NA’s systems were untouched by the attack. Still, its employees’ names and Social Security numbers (SSNs) were stolen, and potentially published to the Dark Web. According to its website, Volvo NA employs just shy of 20,000 people.
    • “For municipalities, universities, and even big corporations like Volvo, this isn’t just a security issue, it’s an integrity issue,” says Anders Askasen, vice president of product marketing at Radiant Logic. “People suddenly wonder whether the systems handling their most sensitive data are fit for the purpose, and with good reason. That loss of confidence is as damaging as the leak itself.”
  • Industrial Cyber tells us,
    • “The Rhysida ransomware gang claimed responsibility for a late-August data breach at the Maryland Transit Administration. Exposed data includes names, surnames, dates of birth, driver’s licenses, SSNs, passports, and confidential information.
    • “The group is said to have demanded a ransom of 30 bitcoin, around US $3.4 million at the time of writing, to be paid within seven days. To support its claim, Rhysida posted images of documents allegedly stolen from the MTA, including scans of a Social Security card, driver’s license, passport, and several other records.
    • “Comparitech identified that to prove its claim, Rhysida posted images of what it says are documents stolen from the MTA. They include scans of a Social Security card, driver’s license, passport, and several other documents. 
    • “The Maryland Transit Administration is a division of the state’s Department of Transportation. It operates buses, light rail, subways, commuter trains, taxis, and a paratransit system. The MTA specifically mentioned the paratransit system, MobilityLink, being disrupted by the cyber attack.”
  • Per the Record,
    • “Ransomware hackers stole Social Security numbers, financial information and more during a recent cyberattack on Union County in Ohio. 
    • “The county government began sending out breach notifications to 45,487 local residents and county employees this week. The letters say ransomware was detected on the county’s network on May 18, prompting officials to hire cybersecurity experts and notify federal law enforcement agencies.  
    • “The hackers stole documents that had names, Social Security numbers, driver’s license numbers, financial account information, fingerprint data, medical information, passport numbers and more.  
    • “No ransomware gang has taken credit for the attack publicly, and the letters said the county has been monitoring internet sources but have not found any indication the stolen information was released or offered for sale.  
    • “The county has about 71,000 residents and is 45 minutes outside of Columbus — which dealt with its own ransomware attack one year ago.” 
  • HIPAA Journal lets us know,
    • “There’s good and bad news on the ransomware front. Attacks are down year-over-year; however, successful attacks are proving even costlier to mitigate, according to the Mid-Year Risk Report from the cyber risk management company Resilience. The company saw a 53% reduction in cyber insurance claims in the first half of the year, which indicates organizations are getting better at preventing attacks; however, when ransomware attacks succeed, they have been causing increased financial harm, with losses 17% year-over-year. While ransomware accounted for just 9.6% of claims in H1, 2025, ransomware attacks accounted for 91% of incurred losses.
    • “On average, a successful ransomware attack causes $1.18 million in damages, up from $1.01 million in 2024, and the cost is even higher in healthcare. Resilience’s healthcare clients suffered average losses of $1.3 million in 2024, and in the first half of 2025, some healthcare providers faced extortion demands as high as $4 million. While it is too early to tell what the severity of claims will be in 2025 until claims are settled, Resilience said there are indications that the average severity of incurred losses for healthcare ransomware attacks this year could be $2 million, up from an average of $705,000 in 2024 and $1.6 million in 2023.”

From the cybersecurity defenses front,

  • Cyberscoop advises,
    • “Artificial intelligence is no longer a future concept; it is being integrated into critical infrastructure, enterprise operations and security missions around the world. As we embrace AI’s potential and accelerate its innovation, we must also confront a new reality: the speed of cybersecurity conflict now exceeds human capacity. The timescale for effective threat response has compressed from months or days to mere seconds. 
    • “This acceleration requires removing humans from the tactical security loop. To manage this profound shift responsibly, we must evolve our thinking from abstract debates on “AI safety” to the practical, architectural challenge of “AI security.” The only way to harness the power of probabilistic AI is to ground it with deterministic controls.”
  • A Dark Reading commentator recommends that “With the emergence of AI-driven attacks and quantum computing, and the explosion of hyperconnected devices, zero trust remains a core strategy for security operations.”
  • Per a CISA news releases,
    • “In today’s increasingly interconnected industrial landscape, operational technology (OT) systems are no longer isolated islands of automation—they’re deeply entwined with information technology and business networks, making them prime targets for cyber threats. Recognizing this growing risk, the Cybersecurity and Infrastructure Security Agency (CISA) collaborated with three U.S. federal agencies and five international partners and received contributions from twelve private sector stakeholders to develop and publish, “Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators”.
    • “This key resource helps owners and operators of OT systems create stronger, more secure infrastructures by building a clear inventory and classification of their assets. By identifying, organizing, and managing OT assets effectively, organizations can not only improve cybersecurity but also enhance operational reliability, safety, and resilience.”
  • Per National Institute of Standards news releases,
    • “NIST has released Special Publication (SP) 800-88r2 (Revision 2), Guidelines for Media Sanitization.
    • “Media sanitization is a process that renders access to the target data on media infeasible for a given level of effort. This guide will assist organizations and system owners in setting up a media sanitization program with proper and applicable methods and controls for sanitization and disposal based on the sensitivity of their information.”
  • and
    • “NIST has released Special Publication (SP) 800-90C, Recommendation for Random Bit Generator (RBG) Constructions. It is the final document in the SP 800-90 series, which supports the generation of high-quality random bits for cryptographic and non-cryptographic use.
    • “SP 800-90C specifies constructions for implementing random bit generators (RBGs) that include deterministic random bit generator (DRBG) mechanisms as specified in SP 800-90A and use entropy sources as specified in SP 800-90B.”
  • Here is a link to Dark Reading’s CISO Corner.

Thursday report

David Ermer–CMS, Congress, FDA, Generative AI, Medicare, OPM, U.S. Healthcare–

From Washington, DC,

  • The Wall Street Journal reports,
    • “The U.S. government is hurtling toward a shutdown in a matter of days with no exit ramp in sight, as Republicans and Democrats latch onto starkly different positions and the White House threatens to lay off more federal workers.
    • “Republicans are seeking a seven-week extension in federal funding at current levels, and they have dismissed Democrats’ demands for hundreds of billions of dollars in healthcare spending. In a move to raise the political pressure, President Trump’s budget chief late Wednesday vowed to use any lapse in funding to make deeper cuts in the federal workforce, a threat Democrats rejected as blackmail.
    • “Democrats see the funding deadline as a rare opportunity to shape legislation, and the party’s base voters are desperate for elected representatives to show more fight after months of demoralizing political defeats. Republicans are loath to offer any concessions, putting both parties on a collision course ahead of the Oct. 1 deadline.
    • “Democrats have “asked us to do something that’s totally unreasonable,” President Trump told reporters on Thursday. Asked about the possibility of a shutdown, he said: “Could be. Because the Democrats are crazed. They don’t know what they are doing.”
    • “Senate Minority Leader Chuck Schumer (D., N.Y.) has said he plans to stand firm this time and demand bipartisan talks, rather than acquiesce to a Republican plan to keep the government open, like he did in March. He said Democrats won’t be intimidated by the latest threat of federal layoffs.
    • “This is one of their threats, and their threats are not going to succeed,” Schumer said in an interview. “A lot of my colleagues who I’ve talked to today are very angry about this.”
  • Per Roll Call,
    • “Sources on both sides of the aisle and nonpartisan analysts agreed that, beyond the tough talk, top congressional Democrats have a weak hand to play and no discernible strategy for extracting the concessions from President Donald Trump and GOP leaders that they want on health care policy.
    • “A shutdown for the sake of a shutdown doesn’t help anyone,” a former Democratic congressional aide granted anonymity to speak candidly said. “If there is a shutdown, there also needs to be a plan to get out of it — and it will require a deal on all sides to end it, at a time when tensions would be even higher. It’s hard to turn back to bipartisan negotiations after that.”
  • Federal News Network adds,
    • “The Trump administration is taking a more aggressive approach than usual to what would happen in a government shutdown, after a White House memo Wednesday night told agencies to plan for further reductions in force if government funding lapses early next week.
    • “But with just days left before a government shutdown, many are questioning the ability for agencies to put together further RIF plans at all, since the reduction-in-force process is typically complicated and time-consuming, often taking months or longer.”
  • Bloomberg reports,
    • “The US will impose a 100% tariff on branded or patented pharmaceuticals, President Donald Trump announced Thursday.
    • “Starting October 1st, 2025, we will be imposing a 100% Tariff on any branded or patented Pharmaceutical Product, unless a Company IS BUILDING their Pharmaceutical Manufacturing Plant in America,” Trump said in a social media post.
    • “Trump said there would be no tariffs on pharmaceutical products if companies have broken ground on a US manufacturing plant, or if such a plant is under construction.”
  • and
    • “Pharmacy middlemen are working on a proposal to voluntarily change some of their business practices to avoid new regulation from the Trump administration.
    • “The proposals under discussion include ensuring patients don’t pay more than a pharmacy would charge to someone without insurance and increasing the use of lower-cost versions of expensive biologic drugs.
    • “The Pharmaceutical Care Management Association has drafted proposals to bring to the Centers for Medicare and Medicaid Services, according to a document viewed by Bloomberg News.”
  • The American Medical Association adds,
    • “The Department of Commerce Sept. 24 released a notice seeking public comment on an investigation it launched Sept. 2 on imports of personal protective equipment, medical consumables and medical equipment under Section 232 of the Trade Expansion Act of 1962. The provision authorizes the president to impose tariffs or other trade restrictions if an investigation determines that the importation of particular goods affects national security. The department is seeking comment on a range of criteria, including the current and projected demand for PPE, medical consumables and medical equipment; the extent to which production can meet demand; the role of foreign supply chains in meeting U.S. demand; the concentration of U.S. imports of those products and more. Comments are being accepted for 21 days following publication in the Sept. 26 Federal Register.”
  • Bloomberg tops it off with this,
    • “Three hours inland from Chennai, India, traffic crawls on a half-finished road past rice fields and cow crossings until it reaches a newer complex of neat white buildings. Among them is the cancer wing of a hospital founded over a century ago by American missionaries.
    • “By morning, the line of people waiting to be seen at Christian Medical College Vellore’s Ranipet Campus snakes from the parking lot to the front door. In a basement treatment room one day in May, several of those who’ve made it inside sit in beds getting an intravenous drip of a Bristol Myers Squibb Co. drug called Opdivo or a competing Merck & Co. drug, Keytruda. A single infusion might cost at least $7,000 at the standard dose in the US, and a year’s treatment more than $200,000. Here, by financial necessity, most of the patients are getting as little as one-sixth of that.  
    • “The remarkable thing is that the radically low doses may also be effective at keeping cancer sufferers alive, doctors here and in other hospitals across India say. The science isn’t settled, but hospitals in Israel, France, the Netherlands, Canada and the UK are all testing or implementing more modest dose reductions. A small trial in the US also found some benefits. The consequences could be dramatic, expanding access to cancer treatment in poor countries and bending the curve of skyrocketing drug prices in the developed world. Smaller doses could also help limit the serious side effects many patients endure, from diarrhea to thyroid problems.
    • “A broad reevaluation of dosing has the potential to benefit hundreds of thousands of people in developing countries who otherwise wouldn’t be able to afford the drugs. One obstacle has stood in the way: the drugmakers themselves. Paid per dose, they stand to lose billions of dollars if doctors prescribe less medicine to their patients.”
  • From ARPA-H news releases
    • The Advanced Research Projects Agency for Health (ARPA-H), an agency within the U.S. Department of Health and Human Services (HHS), today announced a new research and development opportunity through its Treating Hereditary Rare Diseases with In Vivo Precision Genetic Medicines (THRIVE) program. THRIVE intends to develop integrated platform technologies to accelerate precision genetic medicines (PGMs) and provide single-intervention precision treatments to slow, reverse, or prevent diseases at the genetic level. The program is designed to optimize affordability, scalability, and sustainability of lifesaving PGMs for patients through existing regional treatment centers and virtual clinics. This will allow patients to be seen and treated where they live.” * * *
    • “Learn more about THRIVE on its program page, including information about the solicitation and Proposers’ Day.” 
  • and
    • “The Advanced Research Projects Agency for Health (ARPA-H), an agency within the U.S. Department of Health and Human Services (HHS), today announced a new funding opportunity through its Genetic Medicines and Individualized Manufacturing for Everyone (GIVE) program. With cutting-edge production technologies, the program seeks to establish the U.S. as a frontrunner in advanced manufacturing methods for high-quality genetic medicines.” * * *
    • “Learn more about GIVE on its program page, including information about the ISO solicitation and Proposers’ Day registration.”
  • Per a U.S. Office of Personnel Management news release,
    • The U.S. Office of Personnel Management (OPM) today announced record levels of engagement and leadership from the Chief Human Capital Officers Council (CHCOC) under the Trump Administration, underscoring the Council’s critical role in driving forward personnel policy and workforce reform across the federal government. The Chief Human Capital Officers Council is the principal interagency forum for federal human capital leaders, bringing together the Chief Human Capital Officers from across the Executive Branch to coordinate policy, share best practices, and advance government-wide workforce initiatives.
    • Since January of this year, the Council has held 71 sessions, an increase of almost double compared to the 40 sessions held last year. These sessions cover everything from discussing the Deferred Resignation Program and return-to-office policies to SES performance and collective bargaining. Between January and March alone, the Council convened 34 times in just 50 workdays. Alongside these sessions, the Council has distributed more than 200 communications to federal agencies this fiscal year, including official memos, weekly updates, and special notices.
  • OPM also recently posted Benefits Administration Letter 25-102 about FEHB Enrollment Coordination for Married Federal Employees and Annuitants.
  • Avalere Health discusses an upcoming meeting at which new ICD-10 codes for 2026 will be selected.

From the Food and Drug Administration front,

  • BioPharma Dive relates,
    • “Capricor Therapeutics executives came out of a meeting with Food and Drug Administration officials confident that they can reverse a rejection of their experimental cell therapy for Duchenne muscular dystrophy. 
    • “The FDA turned down Capricor’s application for the drug, deramiocel, in July after questioning the research supporting its effectiveness. At the time, Capricor CEO Linda Marbán said the rejection was a surprise and that no major issues had been raised during the review.
    • “Now, FDA officials are indicating that they will reconsider the application with new data from a clinical trial called Hope-3 that’s already been completed, Capricor said Thursday. That’s important because Capricor won’t have to start all over with a new submission. “This is a giant win for us,” Marbán said during a conference call with analysts. Initial trial results are expected in the middle of the fourth quarter.”
  • and
    • “The Food and Drug Administration on Thursday approved a new medicine for breast cancer, clearing Eli Lilly’s Inluriyo for people with a specific genetic mutation.
    • “Previously known as imlunestrant, the drug has been cleared for use in a subgroup of adults whose metastatic, estrogen receptor-positive, HER2-negative breast cancer has progressed after at least one hormone therapy. The approval makes the treatment available specifically to people who fit that criteria and have mutations to a gene called ESR1 — an alteration Lilly believes to occur in about half of people with that form of the disease either during, or after, exposure to hormone therapy.
    • “The clearance was based on results published in the New England Journal of Medicine last year. Those findings, from a study called EMBER-3, showed that Inluriyo helped reduced the risk of disease progression or death among those with ESR1 mutations by 38% when compared to standard hormone-suppressing therapies. Inluriyo delayed tumor progression by a median of 5.5 months, or close to 2 months longer than those on typical drugs.”  
  • and
    • “Heartflow has received 510(k) clearance for an updated version of its plaque analysis algorithm, the company said Monday.
    • “The updated algorithm shows a 21% improvement in plaque detection, compared to the original version of the technology, the company said. 
    • “Heartflow disclosed the clearance alongside news that Cigna has become the second national insurer after UnitedHealthcare to update its policies to cover the plaque analysis product.”
  • MedPage Today points out,
    • “A risk evaluation and mitigation strategies (REMS) program is no longer required for the thyroid cancer therapy vandetanib (Caprelsa), the FDA announced on Thursday.
    • “The agency had required the safety program for vandetanib to ensure appropriate heart rhythm monitoring and safe use since its approval in 2011opens in a new tab or window as treatment for medullary thyroid cancer in patients whose disease has spread or cannot be surgically removed.
    • The approval of vandetanib was based on results from the phase III randomized ZETA trial in which patients randomized to receive vandetanib experienced a 65% reduction in the risk of disease progression compared to patients on placebo. A REMS was required for vandetanib due to potential for QT prolongation and reported cases of torsades de pointes and sudden death in patients taking the drug.
  • Fierce Pharma informs us,
    • “After nearly two decades in the endocrine scene, Crinetics is making its commercial debut with the approval of a game-changing treatment for the rare growth disorder acromegaly.
    • “The FDA on Thursday signed off on Crinetics’ paltusotine—now christened Palsonify—as a first-line treatment for adults with acromegaly for whom surgery didn’t work or isn’t an option.
    • “The drug is a selectively targeted somatostatin receptor type 2 (SST2) agonist. Unlike other somatostatin drugs that make up the bulk of current acromegaly care options, Palsonify is a small molecule, non-peptide therapy that can be taken orally, freeing up patients from frequent and often painful injections.
    • “The treatment marks the “next level of care for patients with acromegaly,” Scott Struthers, Ph.D., co-founder and CEO of Crinetics, said in a recent interview with Fierce Pharma, staking that claim on the drug’s ability to both help control patients’ hormone levels and address their symptoms in a once-daily treatment option.”
  • Per FDA news release,
    • “Today, the U.S. Food and Drug Administration authorized marketing of the Essilor Stellest eyeglass lenses to correct myopia, commonly referred to as nearsightedness, with or without astigmatism and to slow the progression of the disease in children 6 to 12 years old at the initiation of treatment.”

From the judicial front,

  • Modern Healthcare reports,
    • “A federal court has tossed a rule outlining how auditors must review Medicare Advantage insurance companies for overpayments, adding uncertainty to the federal government’s plan to audit every plan annually.
    • “On Thursday, Judge Reed O’Connor, of the U.S. District Court for the Northern District of Texas in Fort Worth, vacated the 2023 Medicare Risk Adjustment Data Validation, or RADV, rule, on the grounds that regulators violated the Administrative Procedure Act of 1946.”
    • “Under the rule, which was finalized in January 2023, the Centers for Medicare and Medicaid Services eliminated a key statistical tool, the fee-for-service adjuster, used to compare error rates in traditional Medicare versus Medicare Advantage. Regulators planned to apply the new audit method retroactively to insurers’ risk-adjustment code reviews dating back to 2018. When the rule was finalized, CMS estimated that the more stringent reviews would result in insurers returning $4.7 billion to the agency between 2023 and 2032. 
    • “Humana sued over the rule in September 2023, alleging the new audit methodology held private Medicare insurers to a higher standard than the fee-for-service program. 
    • “O’Connor sided with the insurer.  In a Thursday order, he ruled that CMS failed to adequately notify the industry that actuarial equivalence between traditional and Medicare Advantage plans no longer applied.
    • “Because there was no meaningful notice of defendants’ ultimate finding that actuarial equivalence does not apply to RADV audits, there was no meaningful dialogue regarding the costs and benefits of the surprise changes,” O’Connor wrote in the order.” 

From the public health and medical / Rx research front,

  • MedPage Today lets us know,
    • “Women who missed their first screening mammogram had a 53% higher risk of stage III breast cancer over the next 25 years and almost a fourfold higher risk of stage IV breast cancer.
    • “Breast cancer mortality was 40% higher among screening nonparticipants.
    • “Breast cancer incidence was nearly identical, suggesting the increased risk of later-stage diagnosis and breast cancer mortality resulted from delayed detection.”
  • Per Health Day,
    • “During August 2021 to August 2023, only 36.4 percent of U.S. adults had no cardiovascular disease (CVD) risk factors, according to a September data brief published by the National Center for Health Statistics.
    • “Catharine A. Couch, Ph.D., R.D., from the National Center for Health Statistics in Baltimore, and colleagues presented prevalence estimates for none, one, or two or more CVD risk factors (uncontrolled high blood pressure, uncontrolled high blood lipids, uncontrolled high mean blood glucose, and high body mass index) in U.S. adults from August 2021 to August 2023.
    • “The researchers found that 36.4, 34.9, and 28.7 percent of U.S. adults had no, one, and two or more CVD risk factors, respectively. More men than women had two or more CVD risk factors (31.7 versus 25.8 percent). With age, there was a decrease in the percentage of adults with no CVD risk factors, while a higher percentage of older adults had one or two or more CVD risk factors. Those with family income 350 percent or more of the federal poverty level had the highest percentage of adults with no CVD risk factors and the lowest percentage with two or more CVD risk factors. The percentage of adults with two or more CVD risk factors increased from 2013 to 2014 to August 2021 to August 2023.”
  • and
    • “Physical frailty may contribute to the development of dementia, according to a study published online Sept. 17 in Neurology.
    • “Xiangying Suo, from the School of Public Health of Zhengzhou University in China, and colleagues conducted a prospective cohort study based on U.K. Biobank participants without dementia to examine the link between physical frailty and dementia. Five criteria were used to define physical frailty (weight loss, exhaustion, physical inactivity, slow walking speed, and low grip strength).
    • “A total of 8,900 dementia cases were documented during a median follow-up of 13.58 years among 489,573 participants. The researchers found that the risk for dementia was significantly higher in those with prefrailty and frailty compared with nonfrail individuals (hazard ratios, 1.50 and 2.82, respectively). Compared with those with low genetic risk and nonfrailty, the highest risk for dementia was seen for participants with frailty and high genetic risk (hazard ratio, 3.87 for high polygenic risk score; 8.45 for APOE-ε carriers). A potential causal relationship was seen between physical frailty and dementia in the forward Mendelian randomization (MR) analysis (odds ratio, 1.79), while a null causal association was suggested in the reverse MR. Potential underlying mechanisms linking physical frailty to dementia include genetic background and neurologic and immunometabolic function.”
  • BioPharma Dive considers “Cancer patients are living longer than ever. Pain drugmakers haven’t kept up. Decades of slow-moving research, along with broader failures of the healthcare system, have left millions of people in daily pain. Doctors fear that’s bound to continue.”
  • BioPharma Dive also notes,
    • “Eli Lilly has canceled one clinical trial of an experimental muscle-sparing obesity drug, citing “strategic business reasons,” according to a federal database. The study was one of two Phase 2 trials testing the drug, known as bimagrumab, alone or with Lilly’s marketed medicine in people with obesity. The now-halted study included Type 2 diabetics as well.
    • “In an email to BioPharma Dive, a Lilly spokesperson said company executives “routinely evaluate our clinical development programs to optimize the potential for each product” and noted that a separate trial involving non-diabetic people with obesity is still underway. The trial stoppage was first reported by Bloomberg.
    • “Bimagrumab is among the drugs designed to preserve muscle in people taking weight loss drugs like Zepbound and Novo Nordisk’s Wegovy, which can cut lean mass as well as fat. But at least one biotech has said that additive weight loss effects are an approval requirement, suggesting higher clearance standards have been established by the Food and Drug Administration.”
  • The Washington Post explains why the brain hangs on to some memories but allows others to fade. Tying “fragile” memories to emotional events could help people remember them better in the future, researchers at Boston University believe.”
  • Per a National Institutes of Health news release,
    • “Today, the National Institutes of Health (NIH) announced the award of contracts for launching the Standardized Organoid Modeling (SOM) Center, a national resource that will be dedicated to using cutting-edge technologies to develop standardized organoid-based new approach methodologies (NAMs) that deliver robust, reproducible, and patient-centered research findings. With contracts totaling $87 million for the first three years, the center will be housed at the Frederick National Laboratory for Cancer Research (FNLCR), a facility supported by NIH’s National Cancer Institute (NCI). The center’s goal will be to leverage the latest technologies to enable real-time optimization of organoid protocols.
    • “This groundbreaking initiative will transform how we conduct biomedical research through innovative approaches to advancing human-based technologies,” said NIH Director Dr. Jay Bhattacharya. “By creating standardized, reproduceable, and accessible organoid models, we will accelerate drug discovery and translational science, offering more precise tools for disease modeling, public health protection, and reducing reliance on animal models.”

From the AI front,

  • STAT New reports,
    • “Artificial intelligence may help radiologists spot disease, but throwing the technology at millions of CT scans or mammograms is not without risks to patients and may drive up costs without showing much benefit. Katie Palmer reports on two efforts to prove out the potential.
    • “A large randomized controlled trial will explore the value of AI-aided mammography in screening for breast cancer. The technology is already widely used in the U.S., but the best evidence that it’s useful comes from Europe. The $16 million trial is funded by the Patient-Centered Outcomes Research Institute. Read more on what researchers may find here.
    • “Next month, NYU Langone Health will begin checking bone density in CT scans of people over 65 for osteoporosis, a condition that often goes undetected until someone breaks a bone. The health system may expand the work if it’s proven to help. This kind of opportunistic screening, which repurposes otherwise acquired scans, could be used to identify many treatable conditions. Katie’s interview is worth a read.”

From the U.S. healthcare business front,

  • Fierce Healthcare reports,
    • “CommonSpirit Health closed another fiscal year with operations in the red, with the large Catholic nonprofit pointing to expenses growth outpacing revenues “despite strong volume, salary cost management and higher productivity.”
    • “The 138-hospital system reported an as-recorded operating loss of $687 million (-1.8% operating margin) for the fiscal year ended June 30, 2025, as compared to the prior year’s $581 million operating loss (-1.5% operating margin).
    • “However, after adjustments to normalize delayed income from the California Provider Fee Program, CommonSpirit somewhat improved its stature with a $225 million operating loss (-0.6% adjusted operating margin) as opposed to fiscal 2024’s $875 million operating loss (-2.4% adjusted operating margin).
    • “Net income in fiscal 2025 was $1.1 billion as recorded and nearly $1.6 billion as adjusted, both increases over the prior year’s respective $797 million and $503 million.”
  • and
    • “Value-based cancer care navigation company Thyme Care raised $97 million in series D funding backed by major strategic investors across payers, employers, health systems and retail health.
    • “The latest funding propels Thyme Care’s valuation to north of $1 billion, a 2x increase from its valuation in July 2024 when it raised $95 million, according to a company spokesperson.
    • “The company plans to use the new funding to expand its business across verticals and to take on more breaking points in the oncology journey that drive up costs and cause friction in the patient experience, Robin Shah, CEO and co-founder of Thyme Care, told Fierce Healthcare.
    • “Thyme Care is now focused on tackling treatment denials, high drug costs and “the barriers that delay or prevent access to timely, affordable and appropriate care,” Shah said.’
  • and
    • “Medicare Advantage (MA) has been a consistent earnings booster for insurers, but recent challenges in this space are likely to ding profitability, according to a new report.
    • “Analysts at AM Best found that elevated utilization trends beginning in 2023 led to a $5.7 billion underwriting loss in 2024 for MA plans, while insurers reported gains in the previous five years. Underwriting gains in MA accounted for 40% of total gains from 2019 to 2022, but that dropped to 20% in 2023.
    • “The report found that close to three-quarters of companies with a significant concentration in MA reported underwriting losses in 2024.
    • “Medicare Advantage enrollment and premium continue to grow as more people are aging into the program. However, plans have experienced an increase in utilization and medical trends that have persisted longer than expected,” said Jason Hopper, associate director for industry research and analysis at AM Best, in a press release.“
    • “Changes to the risk-adjustment payment model by the Centers for Medicare and Medicaid Services, as well as lower Star Ratings across the industry, also have contributed to recent underwriting losses,” Hopper said.
  • MedTech Dive informs us,
    • “Guardant Health and Quest Diagnostics will collaborate to offer Guardant’s Shield blood-based colorectal cancer test through Quest’s distribution network, the companies said Wednesday.
    • “Physicians will be able to order the test through their Quest accounts and electronic health record starting in the first quarter of 2026.
    • “In an investor day presentation, Guardant Co-CEO AmirAli Talasaz also revealed plans to expand Shield to include multi-cancer detection. The multi-cancer offering will be available nationally in October.”
  • Modern Healthcare reports,
    • “As more upstarts strive to make a splash in the pharmacy benefit manager sector, RxBenefits CEO Robert Gamble thinks his company has devised something truly novel.
    • “Like other companies seeking to disrupt a market dominated by CVS Health subsidiary CVS Caremark, UnitedHealth Group division Optum Rx and Cigna unit Express Scripts, Illuminate Rx promises pharmacy benefits without spread pricing or hidden fees, and with transparency and a focus on generic and biosimilar drugs. The company launched Illuminate Rx this month.
    • “What Gamble said differentiates this offering is that RxBenefits has added an in-house PBM to its marketplace platform, where self-funded employers, brokers and benefits consultants can select among Illuminate Rx and other PBMs for the best deals.”
    • “RxBenefits, which serves 3 million insurance members and manages $3 billion in annual pharmacy spending, named veteran executive Gamble as CEO last December following Wendy Barnes’ departure to become president and chief executive of the pharmaceutical discount vendor GoodRx.”

Tuesday report

David Ermer–CDC, Congress, COVID-19 vaccine, FDA, Generative AI, Medical / Rx research, Medicare, Rx coverage, U.S. Healthcare–

From Washington, DC

  • Roll Call reports,
    • “President Donald Trump abruptly canceled his meeting with top Democratic leaders that had been planned for Thursday to search for a deal that might avert a partial government shutdown next week.”
  • The American Hospital Association News tells us,
    • ‘The Department of Homeland Security today released a proposed rule to amend the process for selecting among prospective applicants — known as registrants — for H-1B visas that are subject to statutory numerical caps. The rule would change the agency’s current process of conducting random selections to a weighted selection process. Weighted selections would be based on an individual’s wage level, with higher wage levels weighted more heavily. The rule would also apply the process to registrations subject to the regular cap and to those asserting eligibility for the H-1B advanced degree exemption. The proposal would require the use of additional wage level information, including the Occupational Employment and Wage Statistics wage level, Standard Occupational Classification code and the area of intended employment.”
  • and
    • “The Food and Drug Administration yesterday announced that Olympus issued a global recall of its ViziShot 2 FLEX needles manufactured prior to May 12 following reports of device components detaching during procedures. The company was alerted to incidents resulting in one patient death and one injury. The product is designed to be used with ultrasound endoscopes for lung cancer biopsies. In response to the reports, Olympus has implemented an automated inspection procedure during assembly to help improve the detection of device damage, which is a step that was previously done through a visual inspection. The FDA said health care personnel treating patients with the product must ensure it is not from an affected lot.”
  • Milliman delves into why “many Medicare beneficiaries will spend less than expected to reach the IRA’s new $2,000 out-of-pocket spending limit.”
    • “Among other changes to the standard Part D benefit design, the IRA introduces a hard MOOP—once the beneficiary attains $2,000 in TrOOP costs in 2025, they are no longer responsible for any cost sharing—aligning the TrOOP more closely with the typical definition of a MOOP.5 Another important change introduced by the IRA is that cost sharing for basic Part D coverage counts toward the MOOP, even if that basic coverage is reduced by certain other payers.6 Federal regulators refer to the amount of drug cost that accumulates (or counts) toward the MOOP in Part D as “TrOOP eligible cost.”7 For enhanced plans,8 TrOOP eligible cost is based on the greater of defined standard benefit cost sharing and the actual patient out-of-pocket (including any cost-sharing subsidies), such that actual patient out-of-pocket will never be higher than TrOOP eligible costs.9 This regulatory guidance has been referred to as the “greater of” logic.
    • “This “greater of” provision is impactful because the defined standard benefit is frequently leaner (i.e., has higher cost sharing) than the benefit a beneficiary may actually have. In fact, around 90% of non-low-income (unsubsidized) beneficiaries are enrolled in plans with enhanced benefits.10 Enhanced plans generally offer fixed copays on generic tiers, either coinsurance or copays on brand tiers, and coinsurance on specialty tiers. Plans are considered “enhanced” if they are meaningfully richer than the defined standard benefit. Other plans are considered “basic” and are roughly equivalent in richness to the defined standard benefit.11
    • “The IRA’s accumulation logic means many beneficiaries who satisfy their MOOP will do so without spending $2,000 out-of-pocket—i.e., their specific MOOP will be less than their $2,000 limit in TrOOP eligible costs. Assuming enhanced benefits similar to 2024, we expect roughly half of non-low-income beneficiaries who reach MOOP will spend less than $1,200 out-of-pocket in 2025.12
    • “Most likely, the only beneficiaries who will pay the full $2,000 to satisfy their MOOPs in 2025 will be non-low-income beneficiaries who are enrolled in a plan with basic Part D coverage13 or who are in an enhanced plan but exclusively utilize drugs with cost sharing greater than or equal to what is under (i.e., leaner than) the defined standard benefit. The most common instance of the latter occurs for specialty drugs on tier 5, which are almost always subject to a coinsurance greater than or equal to the defined standard coinsurance amount. In some cases, this could also occur for non-preferred brand (tier 4) drugs, where the plan offers a coinsurance benefit (typically 40% to 50%, compared to the defined standard 25%).”
  • The HHS Inspector General released a report
    • “Congress appropriated $178 billion to HHS to provide funds to eligible providers for health care-related expenses or lost revenue attributable to COVID-19 under the Provider Relief Fund (PRF) program. HHS was responsible for initial PRF program oversight and policy decisions, and HRSA administered the PRF program.
    • “Under the PRF terms and conditions, if a patient had health insurance and sought COVID-19 treatment from an out-of-network provider that received PRF payments, the provider would not seek to collect out-of-pocket payments greater than what the patient would have otherwise been required to pay if the care had been provided by an in-network provider. (We refer to this as the “balance billing requirement.”)
    • “This audit assessed whether selected hospitals that received PRF payments complied with the balance billing requirement for COVID-19 inpatients.
    • “Of the 25 selected hospitals, 17 billed patients an amount that did not comply or may not have complied with the balance billing requirement. For example, one hospital billed a patient $6,000 when the patient’s insurance carrier had waived all patient cost-sharing responsibility.
    • “Hospitals stated that they were uncertain how to comply with the requirement because HRSA did not provide sufficient guidance. If HRSA developed and provided early and detailed guidance, hospitals might not have improperly billed selected patients a total of $637,035 for services provided.”
  • Per a Justice Department news release,
    • “The Justice Department’s Criminal Division today announced the expansion of its Health Care Fraud Unit’s New England Strike Force to the District of Massachusetts. This expansion brings enhanced federal enforcement resources to one of the nation’s most significant health care and life sciences hubs.
    • “The U.S. Attorney’s Office for the District of Massachusetts has a national reputation in health care enforcement and has developed a significant record of success in investigating and prosecuting health care fraud, including complex cases involving pharmaceutical and medical device companies, providers, and executives. In FY 2025 alone, working together on health care fraud enforcement, the U.S. Attorney’s Office’s Health Care Fraud Unit and Affirmative Civil Enforcement Unit recovered more than $450 million in fraudulently obtained funds. Building on the U.S. Attorney’s Office’s historic track record and the success of the Criminal Division’s Health Care Fraud Unit’s specialized prosecutors and data-driven, multi-agency Strike Force model, the Department is deploying a powerful force multiplier, allowing it to accelerate the detection, investigation, and prosecution of complex fraud schemes throughout the District of Massachusetts.”

From the public health and medical/Rx research front,

  • NBC News reports,
    • “One of the largest measles outbreaks in the U.S. is now centered in bordering areas of southwestern Utah and Arizona. 
    • “In Southwest Utah, all but one of the 23 confirmed cases are among unvaccinated, school-age kids, the Southwest Utah Public Health Department reported. In Mohave County, Arizona, which health officials believe is connected to the Utah outbreak, there have been 42 confirmed cases of the highly contagious virus.
    • “An NBC News investigation, done in collaboration with Stanford University, has found that much of the United States doesn’t have the vaccine protection to prevent outbreaks of communicable diseases such as measles.”
  • Cardiovascular Business informs us,
    • “Approximately 6.7 million Americans over the age of 20 have heart failure, according to a new data-driven analysis published by the Heart Failure Society of America (HFSA). That number is expected to rise, the group added and could hit approximately 11.4 million by 2050.
    • “Those were just some of the eye-opening statistics included in a new HFSA report published in the Journal of Cardiac Failure.[1] In addition, the group wrote, approximately one in four Americans will develop HF in their lifetime. And the odds are even greater for Black individuals than those from other racial and ethnic groups.”
  • The Washington Post points out what researchers suspect may be fueling cancer among millenials.
  • Genetic Engineering and Biotechnology News notes,
    • “Neurological disorders, such as schizophrenia and bipolar disorder, remain challenging to diagnose due to the absence of objective biomarkers. Current assessments largely rely on subjective clinical evaluations. 
    • “In a new study published in APL Bioengineering titled, “Machine Learning-Enabled Detection of Electrophysiological Signatures in iPSC-Derived Models of Schizophrenia and Bipolar Disorder,” researchers from Johns Hopkins University (JHU) present a computational analysis pipeline designed to identify disease-specific electrophysiological signatures from patient-derived cerebral organoids and two-dimensional cortical interneuron cultures. The findings may help reduce human error when diagnosing mental health disorders that currently only rely on clinical judgement.”
  • Health Day lets us know,
    • “Tattoos might protect against melanoma
    • “People with more tattoos were less likely to develop melanoma
    • “They might take better care of their skin, or the tats might provide some sort of screen from UV rays, researchers say.”
  • Per the American Journal of Managed Care,
    • “Colorectal cancer (CRC) screening rates remain lower in rural areas compared with urban communities, according to a new analysis of more than 535,000 adults in the US. Although education, income, insurance coverage, and provider access explain part of the disparity, more than 70% of the gap remains unaccounted for, pointing to deeper structural and cultural barriers that require equity-focused interventions.
    • ‘This analysis is published in Cancer Causes & Control.“
  • Per Fierce Pharma,
    • “Moderna has early in-human data showing its next-generation COVID-19 vaccine, mNEXSPIKE, has the potential to offer strong immune protection against the latest rapidly spreading SARS-CoV-2 virus.
    • “Moderna’s updated mNEXSPIKE vaccine showed an average greater-than-16-fold increase in neutralizing antibodies against the LP.8.1 sublineage in individuals 12 years of age or older, the company said Tuesday. The result comes from a postmarketing clinical study of the latest 2025-26 formula of mNEXSPIKE, which is designed to target LP.8.1.
    • “By comparison, the company’s first-generation mRNA vaccine, Spikevax, generated a greater-than-eightfold increase in LP.8.1-neutralizing antibodies across the same age groups, Moderna said.”
  • Per BioPharma Dive,
    • “A drug combination involving Bristol Myers Squibb’s experimental medicine iberdomide met one of its main goals in a Phase 3 clinical trial, helping to eliminate signs of multiple myeloma in significantly more enrollees than a standard regimen, the company said Tuesday.
    • “The data are from an interim analysis of a study that will continue so trial investigators can measure other goals like an impact on disease progression and survival. Bristol Myers will submit the results to health regulators, although executives have previously said an approval would probably only come if iberdomide meets its other objectives.
    • “Iberdomide is one of three protein-degrading drugs Bristol Myers is positioning as successors to blockbuster blood cancer drugs like Revlimid and Pomalyst, which it acquired through its merger with Celgene. Many of the products in its large portfolio of cancer drugs have either plateaued or are in decline.”
  • Per Medscape,
    • “A compound comprising five agonists that together tackle weight loss, glucose reduction, insulin sensitization, and blood fat normalization has shown promise in mouse models of obesity.
    • “The compound under investigation is called a quintuple agonist because, together with GLP-1 and glucose-dependent insulinotropic polypeptide (GIP) receptor agonists, it contains lanifibranor, a molecule that activates three different peroxisome proliferator-activated receptors (PPARs) — the alpha, delta, and gamma variants — all of which are involved in energy regulation.
    • “Notably, this is not a combination therapy — the five agonists are included in a single molecule.
    • “Daniela Liskiewicz, PhD, Institute for Diabetes and Obesity, Helmholtz Zentrum München, Neuherberg, and the German Center for Diabetes Research, both in Munich, Germany, discussed the development of the novel agonist at the European Association for the Study of Diabetes (EASD) 2025 Annual Meeting.”
  • Here’s a link to the National Institutes of Health’s Research Matters newsletter.
  • Beckers Hospital Review identifies “six new drug shortages and discontinuations, according to drug supply databases from the FDA and the American Society of Health-System Pharmacists.” 
  • Per MedTech Dive,
    • “Multi-cancer blood tests, with the promise of detecting many cancer types from a single sample, have the potential to transform cancer screening.
    • “However, evidence is lacking to support broad use of the tests in people who do not have symptoms, according to research commissioned by the Agency for Healthcare Research and Quality and published last week in Annals of Internal Medicine.
    • “Researchers identified no completed, controlled studies reporting benefits in cancer detection, mortality or quality of life from screening with multi-cancer detection tests. They also found insufficient evidence on the accuracy and potential harm of the tests, mostly due to study limitations and unknown or inconsistent findings.
    • “Researchers from the RTI International – University of North Carolina Evidence-based Practice Center and The Ohio State University College of Medicine conducted the review.”

From the AI front,

  • The Wall Street Journal relates,
    • “AI models are being designed to predict a woman’s near-future risk of breast cancer using mammograms.
    • “Clairity’s AI model received FDA authorization and can predict a woman’s five-year breast-cancer risk.
    • “AI models outperform older risk-score calculators, but some doctors want more evidence of long-term impact.”

From the U.S. healthcare business front,

  • The Wall Street Journal reports,
    • “Eli Lilly LLY said it plans to build a $6.5 billion facility in Houston to make active pharmaceutical ingredients, including for a new oral weight-loss drug.
    • “The plant will bring 615 jobs to the area, including engineers and lab technicians, as well as 4,000 construction jobs while it is being built, the company said Tuesday.
    • “Eli Lilly plans to manufacture orforglipron, its first oral, small molecule GLP-1 receptor agonist, at the facility. The company expects to submit orforglipron to global regulatory agencies as a treatment for people with obesity by the end of this year.”
  • Per Fierce Healthcare,
    • “Compared to their peers, hospitals acquired by private equity reduced salary spending, cut staffing levels and experienced higher mortality rates within their emergency departments, according to a Medicare claims analysis published this week in Annals of Internal Medicine.
    • “The research, which reviewed data from 2009 to 2019, also found salary and staffing cuts among the acquired hospitals’ intensive care units, but, unlike EDs, there was no significant difference in mortality compared to other hospitals. Patient transfer rates increased in both settings among the private-equity-acquired hospitals, particularly among sicker patients, and ICU length of stay decreased.
    • “The analysis from University of Chicago, Harvard Medical School and University of Pittsburgh researchers is the latest contribution to a body of peer-reviewed evidence critical of private equity’s increasing presence among healthcare providers. It also follows a similar analysis from 2023 conducted by many of the same authors that spotted a rise in hospital-acquired adverse events among inpatients receiving care at a private-equity-acquired facility.”
  • and
    • “Pharmacy benefit manager Capital Rx has secured $400 million in fresh funding and announced a rebrand to better reflect its expansion beyond the pharmacy space.
    • “The investments include a $252 million series F round and other funding toward its securities, which is expected to close in October. Wellington Management and General Catalyst led the round, and additional supporters include Generation Investment Management, Growth Equity at Goldman Sachs Alternatives, 9Yards Capital, B Capital, Edison Partners, Prime Health Investments and Transformation Capital.
    • “With the infusion of cash, Capital Rx said it plans to lean more into its broader capabilities as a health benefits technology provider and will rebrand as Judi Health, the name of its proprietary tech stack. The company said the shift “marks a pivotal moment in addressing the fundamental inefficiencies of health benefits administration and the rising cost of care in the U.S.”
    • “The funding will also support the expansion of its PBM operations, Capital Rx said.”
  • and
    • “Health insurance startup Sidecar Health inked a partnership with Carrum Health to bring its specialty care network onto its platform.
    • “Carrum Health, a Fierce 15 of 2025 honoree, launched 10 years ago to develop value-based Centers of Excellence for employers, with the aim to revamp how the healthcare industry pays for and delivers specialty care. 
    • “Sidecar Health members will now have access to more than 1,200 vetted COE providers for surgical, cancer and substance use treatment—accessible to 90% of Americans within 50 miles of a Carrum provider, according to the companies. 
    • “Carrum’s solution makes specialty care services available at bundled prices and connects members to dedicated care navigation. The service also includes a 30-day warranty on surgery and two years on cancer care.”
  • Beckers Hospital Review relates,
    • “Walmart has expanded same-day pharmacy services to include refrigerated and reconstituted medications. 
    • “The expansion includes refrigerated access for medications such as insulin, GLP-1s and pediatric amoxicillin, according to a Sept. 22 news release from the company. Refrigerated medications make up over 30% of Walmart pharmacy sales and the company is the first retailer to deliver refrigerated prescriptions alongside everyday orders. 
    • “Once a prescription is filled, customers are notified through their Walmart pharmacy account and from there, can choose same-day scheduled delivery, on-demand delivery and express delivery with insurance applied.” 
  • BioPharma Dive tells us “why Xoma, a drug royalty firm, is hunting biotech ‘zombies.’ Distressed biotechs are facing rising investor pressure to close down, giving firms like Xoma an opportunity to step in and liquidate them for a profit.”
  • MedTech Dive explains “how SS Innovations is expanding robotic surgery’s reach. Heart surgeon Sudhir Srivastava saw a global need for less-invasive surgical care at an affordable price. His company, SS Innovations, built a robot that has now been used in over 5,000 surgeries.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front,

  • The Wall Street Journal reports,
    • “The collapse on Friday [September 19] of an emergency federal funding bill leaves the fate of cybersecurity legislation that provides legal protection for companies sharing cyber-threat intelligence up in the air.
    • Without a reprieve of the expiring cyber legislation that had been included in the funding bill, companies face uncertainty on how to communicate about cyber threats as competing reauthorization bills work through a divided House and Senate.
    • “Both the private sector and the government need certainty, including the ability to allocate resources for long-term cybersecurity planning and implementation,” said Matthew Eggers, vice president of cybersecurity policy at the U.S. Chamber of Commerce. 
    • The 2015 Cybersecurity Information Sharing Act, or CISA, is set to expire at the end of September. Friday’s scuttled emergency funding measure, which applied to a number of federal programs and sought to avert a government shutdown, would have given lawmakers more time [until November 21] to iron out critical differences between House and Senate versions of CISA renewal bills. * * *
    • “A notable difference in the House bill is the forward-thinking inclusion of artificial intelligence in the renewal,” said Justine Phillips, a partner and co-chair of the data and cyber practice group at law firm Baker McKenzie. Despite these updates, she said, “the House bill is the functional equivalent of extending the act as is, because it leaves the legal liability protections intact.”
    • “The cyber bill’s renewal by the Senate may prove more problematic, cybersecurity experts say.”
  • Cyberscoop informs us,
    • “Federal agencies are increasingly incorporating artificial intelligence into the cyber defenses of government networks, and there’s more still to come, acting Federal Chief Information Security Officer Michael Duffy said Thursday.
    • “We’re at an exciting time in the federal government to see that we’re not only putting AI in production, but we’re finding ways to accelerate emerging technology across the government, across all missions and all angles,” Duffy said at FedTalks, produced by Scoop News Group. In his “role overseeing federal cybersecurity policy,” he said, he is “able to see these at the ground level, as agencies bring excitement and enthusiasm and hope for what they can optimize through artificial intelligence.”
    • “Cyber attackers are moving faster than ever, and on a much larger scale than before, he said. They’re also using technology in new ways. But it’s not all “doom and gloom” when it comes to the cybersecurity of federal networks, especially because of feds’ move toward AI, Duffy said.
    • “I’m pleased to say that the advancements that we’ve made over the past decade in the federal government have brought us to this point: Agencies are poised now, postured, positioned, to take advantage of new capabilities, bring them into federal agencies and make them work for the mission,” he said.”
  • In related news, Cybersecurity Dive tells us,
    • “The National Institute of Standards and Technology on Thursday [September 18] published guidance describing how implementation of post-quantum cryptography (PQC) both supports and relies on the safeguards in the agency’s major cybersecurity publications.
    • “The draft NIST document, derived from the output of the agency’s PQC migration project, is designed to illustrate the connections between the tools required for adopting quantum-resistant encryption and the security practices that NIST recommends in its Cybersecurity Framework and other guidance.
    • “The capabilities demonstrated in the project support several security objectives and controls identified” in other NIST guidance documents, the agency said in its new publication. “At the same time, responsible implementation of the demonstrated capabilities is dependent on adherence to several security objectives and controls identified in these risk framework documents.”
    • “Collecting information about which technologies use cryptography supports the Cybersecurity Framework practices of creating hardware and software inventories, the document notes. Similarly, analyzing cryptographic weaknesses supports the CSF practice of identifying vulnerabilities in technology assets.”
  • A September 19, 2025, NIST news release adds,
    • “To help organizations protect their data against possible future attacks from quantum computers, the National Institute of Standards and Technology (NIST) has released a publication offering guidelines for implementing a class of post-quantum cryptography (PQC) algorithms known as key-encapsulation mechanisms, or KEMs.
    • “A KEM is a set of algorithms that can be used by two parties to securely establish a shared secret key over a public channel — a sort of first handshake between parties that want to exchange confidential information. Recent examples of KEMs include ML-KEM and HQC.
    • The new publication, Recommendations for Key-Encapsulation Mechanisms (NIST Special Publication 800-227), describes the basic definitions, properties and applications of KEMs and provides recommendations for implementing and using KEMs securely.
  • Cyberscoop reports,
    • “Two teenagers were arrested in the United Kingdom this week, accused of associating with the sprawling criminal collective known as The Com, and participating in many high-profile and damaging cyberattacks on critical infrastructure globally.
    • “Thalha Jubair, 19 of London, and Owen Flowers, 18 of Walsall, England, were arrested at their residences Tuesday and charged with crimes related to the cyberattack on the Transport for London in September 2024, the U.K.’s National Crime Agency said.
    • “Jubair and Flowers were allegedly highly involved in many other cyberattacks attributed to Scattered Spider, a nebulous offshoot of The Com that commits ransomware and data extortion. The Com is composed of thousands of members, splintered into three primary subsets of interconnected networks that commit swatting, extortion and sextortion of minors, violent crime and various other cybercrimes, according to the FBI.
    • “The Justice Department on Thursday unsealed charges against Jubair, a U.K. national, accusing him of participating in at least 120 cyberattacks as part of Scattered Spider’s sweeping extortion scheme from May 2022 to September 2025, including 47 U.S.-based organizations. Victims of those attacks paid at least $115 million in ransom payments, authorities said.”

From the cybersecurity vulnerabilities and breaches front,

  • While CISA did not add any known exploited vulnerabilities to its catalog this week, SC Media lets us know,
    • “The Cybersecurity and Infrastructure Security Agency (CISA) on Sept. 18 issued a malware analysis report on two sets of malicious code from an organization compromised by threat actors exploiting two bugs in the Ivanti Endpoint Manager Mobile (EPMM) tool.
    • “CISA said the malware exploited two CVEs – CVE-2025-4427 and CVE-2025-4428. After exploitation, the malware let the threat actors inject and run arbitrary code on the compromised server.
    • “Lawrence Pingree, technical evangelist at Dispersive Holdings, said malware that’s instrumented to target specific vulnerabilities in centralized endpoint management solutions like these Ivanti tools is incredibly important to defend against.
    • “Isolating and microsegmenting sensitive systems like this is essential. Patching rapidly, ideally with an automated process, is essential in defending against vulnerabilities,” said Pingree.”
  • Per Dark Reading,
    • “Security vendor SonicWall suffered a data breach that exposed customer firewall configuration file backups.
    • “On Sept. 17, SonicWall, a vendor best known for its network security appliances, published a knowledge base article disclosing what it described as a “cloud backup file incident.” The company said its security teams recently detected “suspicious activity targeting the cloud backup service for firewalls” and confirmed it to be a security event in the past few days.
    • “Unidentified threat actors accessed backup firewall preference files stored in the cloud representing “fewer than 5% of our firewall install base,” according to SonicWall. Attackers were able to access encrypted credentials as well as firewall configuration files “that could make it easier for attackers to potentially exploit the related firewall.”
    • “We are not presently aware of these files being leaked online by threat actors,” SonicWall said in its disclosure. “This was not a ransomware or similar event for SonicWall, rather this was a series of brute force attacks aimed at gaining access to the preference files stored in backup for potential further use by threat actors.”
  • Per Cyberscoop,
    • “Researchers warned that a maximum-severity vulnerability affecting GoAnywhere MFT bears striking similarities with a widely exploited defect in the same file-transfer service two years ago.
    • “Fortra, the cybersecurity vendor behind the product, disclosed and released a patch for the vulnerability — CVE-2025-10035 — Thursday. The deserialization vulnerability “allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection,” the company said in a security advisory.
    • “File transfer services are a valuable target for attackers because they store a lot of sensitive data. If cybercriminals exploit these services, they can quickly access information from many users at once, making these services especially attractive for large-scale attacks. 
    • “Fortra didn’t provide any evidence of active exploitation and researchers from multiple security firms said they haven’t observed exploitation but expect that to change soon. “We believe that it’s just a matter of time and are monitoring the situation closely,” Ryan Dewhurst, head of proactive threat intelligence at watchTowr, said in an email.
    • “The vulnerability, which has a CVSS rating of 10, is “virtually identical to the description for CVE-2023-0669,” a zero-day vulnerability exploited by Clop, resulting in attacks on more than 100 organizations, and at least five other ransomware groups, Caitlin Condon, vice president of security research at VulnCheck, said in a blog post.”
  • and
    • “Apple’s latest operating systems for its most popular devices — iPhones, iPads and Macs — include patches for multiple vulnerabilities, but the company didn’t issue any warnings about active exploitation. 
    • “Apple patched 27 defects with the release of iOS 26 and iPadOS 26 and 77 vulnerabilities with the release of macOS 26, including some bugs that affected software across all three devices. Apple’s new operating systems, which are now numbered for the year of their release, were published Monday as the company prepares to ship new iPhones later this week.
    • “Users that don’t want to upgrade to the latest versions, which adopt a translucent design style Apple dubs “liquid glass,” can patch the most serious vulnerabilities by updating to iOS 18.7 and iPad 18.7 or macOS 15.7. Most Apple devices released in 2019 or earlier are not supported by the latest operating systems.
    • “None of the vulnerabilities Apple disclosed this week appear to be under active attack, Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, told CyberScoop.”
  • Cybersecurity Dive points out,
    • “Most companies worry their networks aren’t safe against cyberattacks powered by artificial intelligence.
    • “Only 31% of IT leaders are at least somewhat confident that they can defend their organizations against AI-powered attacks, according to a Lenovo report published on Thursday.
    • “The report delves into why IT and security leaders are worried about hackers’ use of AI — and why they see their companies’ own use of AI systems as vulnerable.”
  • and
    • “The number of healthcare organizations that have lost more than $200,000 to cyberattacks has quadrupled this year compared with the same period in 2024, data security firm Netwrix said in a report published Thursday [September 19].
    • “Nearly half of all healthcare organizations (48%) experienced at least one intrusion between March 2024 and March 2025, the report found.
    • “Healthcare organizations experienced more cyberattack-related losses of at least $500,000 than critical infrastructure firms did, on average: 12% of healthcare organizations, compared with 6% of all organizations.”

From the ransomware front,

  • Infosecurity Magazine reports,
    • “Fifteen well-known ransomware groups, including Scattered Spider, ShinyHunters and Lapsus$, have announced that they are shutting down their operations.
    • “The collective announcement was posted on Breachforums, where the groups claimed they had achieved their goals of exposing weaknesses in digital infrastructure rather than profiting through extortion.
    • “In their statement, the gangs said they would now shift to “silence,” with some members planning to retire on the money they had accumulated, while others would continue studying and improving the systems people rely on daily.” * * *
    • “Organizations should take these announcements with a pinch of salt,” Nivedita Murthy, senior staff consultant at Black Duck, said.
    • “It could be possible that some of these groups may have decided to step back and enjoy their payday, [but] it does not stop copycat groups from rising up and taking their place.”
  • IT Pro discusses the “top ransomware trends for businesses in 2025. A splintering of top groups and changing attitudes toward payments are changing attacker tactics at speed.”
  • Morphisec calls attention to “The Top Exploited Vulnerabilities Leading to Ransomware in 2025 — and How to Stay Ahead.” 

From the cybersecurity defenses front,

  • The American Hospital Association News reports,
    • “Microsoft Sept. 16 announced it had disrupted a growing phishing service that had targeted at least 20 U.S. health care organizations. The company said it used a court order granted by the U.S. District Court for the Southern District of New York to seize 338 websites associated with RaccoonO365, a cyber threat group known for stealing Microsoft 365 credentials through phishing tactics. RaccoonO365 offers subscription-based phishing kits that allow individuals to steal Microsoft credentials by mimicking official Microsoft communications. The company said the phishing kits use Microsoft branding to create fraudulent emails, attachments and websites. Since July 2024, the kits have stolen at least 5,000 Microsoft credentials from individuals in 94 countries. The group was recently observed offering a new artificial intelligence-powered service in an attempt to scale their operations.
    • “Credentials stolen through RaccoonO365 enabled ransomware attacks against hospitals, posing a direct threat to patient and community safety,” said John Riggi, AHA national advisor for cybersecurity and risk. “This operation also highlights a disturbing trend — cybercriminals’ increased use of ‘initial access brokers’ to steal credentials and AI to accelerate the effectiveness, sophistication and impact of cyberattacks. The need for continued and evolving social engineering training for staff is essential to defend against the latest deception tactics used by hackers.”
  • Cybersecurity Dive tells us,
    • “Preemptive cybersecurity solutions will account for about half of all IT security spending by the year 2030, a significant increase from its 5% share in 2024, Gartner said in a report published Thursday.
    • “Preemptive cybersecurity will effectively replace standard detection and response technologies as the preferred defense against malicious hacking, Gartner predicted.
    • “The technology uses artificial intelligence and machine learning to anticipate threats and then neutralize them before they can compromise their targets, according to researchers.”
  • Security Week reflects on the fifteen anniversary of the Zero Trust strategy.
    • “The implementation of zero trust is essential for cybersecurity: but after 15 years, we’re still not there. Implementation is like the curate’s egg: good in parts.
    • “Zero Trust turned fifteen years old on September 14, 2025. Its invention was announced with Forrester’s publication of John Kindervag’s paper, No More Chewy Centers: Introducing The Zero Trust Model of Information Security, on that date in 2010 (archived here).
    • “Zero trust recognizes that treating cybersecurity like an M&M (a hard crunchy shell impenetrable to hackers protecting a soft chewy center where staff can work freely and safely) simply doesn’t work. “Information security professionals must eliminate the soft chewy center by making security ubiquitous throughout the network, not just at the perimeter,” wrote Kindervag.
    • “This is the basis of zero trust (or ZT): abandon the old concept of a barrier between two separate networks (one untrusted: the internet; and one trusted: the enterprise). Instead, trust nothing and verify everything, regardless of source or destination. The concept is sound and rapidly gained approval, culminating in EO14028 mandating that federal agencies must move toward a zero trust architecture while private companies should do similar – but never defining how it could be achieved.
    • “There’s the rub. Zero trust is fundamentally a concept where implementation will depend on individual different corporate ecospheres.”
  • Dark Reading recommends “Transforming Cyber Frameworks to Take Control of Cyber-Risk.”
  • Here’s a link to Dark Reading’s CISO Corner.

Thursday report

David Ermer–ACA, CDC, CMS, Congress, COVID-19 vaccine, FDA, Federal employment benefits, Generative AI, Medical / Rx research, Medicare, NCQA, Obesity, OPM, U.S. Healthcare–

From Washington, DC

  • Roll Call reports,
    • “Top Senate Republicans and Democrats reached a deal Thursday night to tee up two votes on Friday on the two parties’ competing approaches to averting a partial government shutdown when current agency funding expires at the end of the month.
    • “Under the agreement announced by Senate Majority Leader John Thune, R-S.D., and Minority Leader Charles E. Schumer, D-N.Y., assuming the House passes the GOP-drafted, seven-week continuing resolution, then the Senate would take up Democrats’ alternative proposal first. That would be subject to a 60-vote threshold for passage.
    • “If Democrats can’t get 60 votes for their bill — which they aren’t expecting — then the chamber would proceed to a vote on the House-passed CR, also with a 60-vote threshold. That vote is also not expected to succeed.”
    • “However, the idea is for the two sides to head home for the weekend armed with proof that they have to start talking to each other about a compromise that can get 60 votes and get to President Donald Trump’s desk in time to prevent a shutdown.
    • “Schumer had proposed the arrangement earlier in the day, with an eye toward getting the initial votes over with in time for senators to attend conservative activist Charlie Kirk’s funeral in Arizona on Sunday.”
  • Roll Call adds,
    • “Democratic and Republican congressional leaders were engaging in a game of shutdown chicken Thursday, the day before the House’s expected vote on a seven-week stopgap bill due Sept. 30 to prevent a lapse in federal agency funding.
    • “House GOP leaders were feeling good about their odds of getting the bill through their chamber Friday morning, although they still had a little work to do on their side shoring up concerns about added member security funds in the continuing resolution being too skimpy, at $30 million. 
    • “Optimistic, but not certain,” House Appropriations Chairman Tom Cole, R-Okla., responded Thursday when asked for his outlook on passage.”
  • Per Congressional news releases
    • “U.S. Senator Bill Cassidy, M.D. (R-LA), chair of the Senate Health, Education, Labor and Pensions (HELP) Committee, highlighted the importance of delivering President Trump and Secretary Kennedy’s mission to restore radical transparency at the U.S. Centers for Disease Control and Prevention (CDC) to protect children’s health.
    • “This comes after the HELP Committee held a hearing with former CDC officials Susan Monarez, PhD, and Debra Houry, M.D., about the recent high-profile departures from the agency. To deliver on the President’s mission of radical transparency, the Committee is inviting U.S. Department of Health and Human Services (HHS) Secretary Robert F. Kennedy Jr. and HHS officials to respond by speaking with Committee members.”
  • and
    • “U.S. Senator Bill Cassidy, M.D. (R-LA), chair of the Senate Health, Education, Labor, and Pensions (HELP) Committee, released a statement following the U.S. Senate passage of the SUPPORT for Patients and Communities Reauthorization Act, which bolsters prevention, treatment, and recovery services for Americans with substance use disorders and mental illness. Earlier this year, the U.S. House of Representatives passed the bill with strong bipartisan support. The SUPPORT Reauthorization Act now heads to President Trump’s desk for signature.
    • “The opioid and mental health crisis is tearing apart families,” said Dr. Cassidy. “The SUPPORT Act equips communities with vital tools to combat this scourge and save lives. I’m grateful to my colleagues for their work to pass this bill and look forward to it being signed into law.”
  • MedTech Dive tells us,
    • “A House of Representatives committee has advanced a bill that would give eligible breakthrough devices four years of Medicare coverage.
    • “The House Ways and Means Committee debated the bill Wednesday, revealing concerns about the risk of fraud, the type of evidence required and the weakening of the Centers for Medicare and Medicaid Services’ authority.
    • “Despite the concerns, the bill received bipartisan support and was passed in a 38 to 3 vote. Two medtech trade groups welcomed progress on a topic that they have lobbied about for years.”
  • Beckers Payer Issues notes,
    • “Senate and House [Democrat] lawmakers have introduced a bill that would bar health insurers from buying independently owned clinics and require existing conglomerates to divert their provider businesses.  
    • “The Patients Over Profits Act would:
      • “Prohibit insurance companies or their subsidiaries from owning Medicare Parts B and C providers 
      • “Require insurers and their subsidiaries who also own Parts B or C providers to divest, and if they do not, a civil lawsuit can be brought by the Federal Trade Commission, state attorneys general, HHS inspector general or the Justice Department’s antitrust division. 
      • “Bars the HHS secretary from contracting with a Medicare Advantage organization that also owns a Part B or C provider.” 
  • and
    • “Three Medicare Advantage plans scored a full five stars in this year’s health plan rankings from the National Committee for Quality Assurance.
      • Kaiser Foundation Health Plan in Southern California – HMO
      • Kaiser Foundation Health Plan in Northern California – HMO
      • Network Health in Wisconsin – PPO
    • “An additional 17 plans, including six more Kaiser Foundation Health Plans from around the country, scored 4.5 stars in 2025.”
  • The Wall Street Journal reports,
    • Health secretary Robert F. Kennedy Jr.’s handpicked slate of vaccine advisers voted [8-3] to no longer recommend a combined shot for measles, mumps, rubella and varicella [chickenpox (MMRV)] for children under age 4. 
    • The move came as some states, insurers, public health leaders and a U.S. senator called into question whether Americans should rely on the committee’s decisions.
  • The FEHBlog listened to a good chunk of today’s meeting, and the ACIP decision was based on a concern about children under age 4 suffering febrile seizures as a result of the MMRV shot.
  • Per an HHS press release,
    • “The U.S. Department of Health and Human Services (HHS) today announced it is moving to decertify a major organ procurement organization (OPO) after an investigation uncovered years of unsafe practices, poor training, chronic underperformance, understaffing, and paperwork errors. In one 2024 case, a mistake led a surgeon to decline a donated heart for a patient awaiting transplant surgery.
    • “CMS’s decertification of the Life Alliance Organ Recovery Agency, a division of the University of Miami Health System, is part of Secretary Robert F. Kennedy, Jr.’s reform initiative announced in July. At that time, an HHS investigation into another OPO found that at least 28 patients may not have been deceased at the time of organ preparation, 73 patients showed neurological signs incompatible with donation, and the Biden administration had closed its own investigation without action.”
  • OPM Director Scott Kupor added to his blog last Monday September 15 with a post titled “Sorry, Not Everyone Gets an A.” In a related news release, OPM explains Director Kupor’s latest blog post explains why an OPM final rule published September 15 “promotes excellence and accountability.”
  • Federal News Network informs us,
    • “The Office of Personnel Management is putting a pause on plans to relocate some of its employees, but said “new efforts” to do so are underway.
    • “In February, OPM gave remote employees more than 50 miles away from the office an ultimatum: Agree to a “management-directed reassignment” (MDR) and relocate to office space in another geographic region, or face termination.
    • “OPM said it would cover relocation expenses for employees who accept reassignment and gave employees until March 7 to make their decision.
    • “But in a new memo, obtained by Federal News Network, the agency states “relocation efforts for OPM employees are on pause.”
    • “The memo said all employees should continue to work at their current duty station, and that “there is no longer an expectation that the first cohort of employees will be relocated to their new duty station by December 2025.”
    • “The memo suggests OPM is taking a fresh look at relocation plans under OPM Director Scott Kupor, who took office in July.“
  • Tammy Flanagan writing in Govexec, follows up on her article from last week about picking the best date for federal retirement in 2026.

From the Food and Drug Administration front,

  • MedPage Today points out,
    • “The FDA gave premarket approval to the first medical device for the treatment of women with symptomatic moderate-to-severe intrauterine adhesions, known as Asherman syndrome, maker Womed announced on Tuesday.
    • “The resorbable adhesion barrier device (Womed Leaf) is intended for women undergoing hysteroscopic surgery for Asherman syndrome.
    • “Asherman syndrome is caused by scarring of the uterus after procedures such as dilation and curettage or fibroid removal and can occur in 20% to 45% of those procedures. The condition can cause female infertility, pelvic pain, and recurrent miscarriages. Current treatment options for intrauterine adhesions have high recurrence rates.” * * *
    • “Womed said the device will be available in the U.S. in early 2026.”
  • The American Hospital Association News reports,
    • “The Food and Drug Administration released a final rule Sept. 18 that rescinds one from 2024 that applied medical device rules to laboratory-developed tests. The final rule is in response to a March 31 federal district court decision that also vacated the FDA’s 2024 final rule. The AHA previously urged the FDA to not apply the 2024 final rule to hospital and health system LDTs when it was proposed. 
    • “The AHA appreciates that FDA and the federal district court have acknowledged the unique value and safety of laboratory tests developed by hospitals and health systems for direct use in patient care,” said Roslyne Schulman, AHA director of outpatient payment, emergency readiness and public health policy. “The return to enforcement discretion for LDTs rightly recognizes that applying the device regulations to these tests would likely prompt many hospital laboratories, particularly small ones, to stop offering safe and effective tests upon which patients and their communities rely. This action will help to assure patient access to innovative and targeted diagnostic tests while reducing regulatory burden and costs for both hospitals and the federal government.”
    • “Today’s final rule will become effective following official publication in the Federal Register Sept. 19.”

From the public health and medical/Rx research front,

  • The Wall Street Journal relates,
    • “Novo Nordisk’s daily Wegovy pill led to similar weight loss as the weekly injection in a late-stage trial.
    • “The Wegovy pill, already under review, could be the first GLP-1 pill approved for weight loss.
    • “Trial results showed improved cardiovascular risk factors and increased daily activity for patients.
    • “Currently, less than 2% of individuals with obesity in the U.S. receive obesity medication and Wegovy in a pill may also address patient preference for oral treatment,” Martin Holst Lange, chief scientific officer and head of research & development at Novo Nordisk, said.
    • “Pending FDA approval, ample supply will be available to meet the expected U.S. demand as we hope to set a new treatment benchmark for oral weight loss medications,” he added.”
  • and
    • “Lilly and Novo Nordisk haven’t disclosed specific pricing plans for their pills, but some analysts expect them to be priced at a discount to the injectables.
    • “The leading weekly injected medicines, Novo Nordisk’s Wegovy and Lilly’s Zepbound, have been highly effective at helping people lose significant weight. Zepbound’s highest dose has been shown to help people lose an average of more than 22% of their body weight after more than a year of treatment, while Wegovy can help people lose about 17%. 
    • “Yet their manufacturers have struggled to make enough to meet demand, partly because of limited manufacturing capacity for the complex task of making sterile injectable drugs packaged in an auto-injector device. Making pills is less complex, and there is more global capacity. And, pills don’t require cold-chain distribution and storage, while the injectables need to be kept refrigerated.” * * *
    • “Novo Nordisk may be constrained in how much of its new weight-loss pill it can manufacture because it must cram a lot of the main ingredient into each pill to ensure each person absorbs enough by ingestion, analysts have noted. That is because, like injected semaglutide, the pill is made up of peptides, which are larger than the small molecules that pills are traditionally made of.” * * *
    • Lilly took a different approach than Novo Nordisk. The main ingredient for its GLP-1 pill, orforglipron, is a small molecule, meaning the pills can be manufactured in a more traditional way.
  • Fierce Pharma adds,
    • “Over the last six years, three GLP-1 drugs have been approved for children aged 10 and older with type 2 diabetes. Now this rapidly growing patient population is a step closer to gaining access to Eli Lilly’s dual-action GLP-1/GIP treatment Mounjaro, as its effectiveness in controlling blood sugar has been demonstrated in a phase 3 trial of kids ages 10-17.
    • “The SURPASS-PEDS study—which enrolled 99 children with type 2 diabetes who do not get adequate blood sugar control with metformin, insulin or a combination of both—achieved its primary and secondary endpoints. After 30 weeks of treatment, Mounjaro provided improvements over placebo in the blood sugar measurement, A1C, and in patients’ body mass index (BMI).
    • “The study’s primary endpoint was accomplished, with Mounjaro-treated patients experiencing an average A1C reduction of 2.2% versus .05% for those on placebo from a mean baseline of 8.05%.
    • “Lilly said that it has submitted the results to regulators in a bid to gain an expanded indication for the juggernaut diabetes medication.”
  • Genetic Engineering and Biotechnology News lets us know,
    • “Researchers led by a team at INSERM and King’s College London have shown how stretching the skin stimulates immune cells and increases the skin’s ability to absorb large molecules, including those present in vaccines.
    • “Using a device that applies suction pressure to stretch the skin, the researchers reported that skin stretching activated a local immune response and increased skin permeability without tissue damage via the opening of hair follicles. They also reported that applying vaccines topically while stretching the skin resulted in more effective immunization than subcutaneously injecting the vaccine in mice.”
    • “Just stretching the skin was more effective than delivering the same vaccine with a needle, which shows the practical relevance of this immune activation,” said Stuart Jones, PhD, at King’s College London. “This new pathway into the skin could be used in lots of different ways—we showed its potential for vaccine delivery, but we’re also starting to think about delivering cell therapies and whether it could be used for diagnostics.”
  • Per Healio,
    • “People with obesity and diabetes who undergo bariatric surgery face a significantly lower risk for several adverse health outcomes vs. those treated with GLP-1s, new data show.
    • “Surgery should not be reserved as a last resort; it should be part of early, shared decision-making for patients with type 2 diabetes and obesity,” Ali Aminian, MD, director of Cleveland Clinic’s Bariatric and Metabolic Institute, told Healio. “Evidence shows that surgery provides added, durable benefits beyond medications alone.”
  • Per MedPage Today,
    • “Oral bacteria and fungi may help reshape the pancreatic microbiome and promote carcinogenesis.
    • “Earlier research has connected periodontal disease and clinical candidiasis with greater pancreatic cancer risk.
    • “Altogether, the study identified a more than threefold increase in cancer risk for everyone standard deviation rise in a microbial risk score comprised of 27 bacteria and fungi.”
  • and
    • “One in 10 childhood blood cancers may result from medical imaging-associated radiation exposure.
    • “Cancer risk increased with cumulative radiation dose, ranging from 1.41 times higher to 3.59 times higher.
    • “Children exposed to at least 30 mGy had 25.6 excess blood cancers per 10,000 by age 21.”

From the U.S. healthcare business front,

  • Fierce Healthcare reports,
    • “Ascension wrapped its 2025 fiscal year with a $490.9 million operating loss (-1.9% operating income) but a $917.7 million net income, an improvement over the prior year it attributed to greater volumes, improved labor productivity and a tighter rein on non-labor spending.
    • “The major Catholic nonprofit is coming off of a $1.8 billion operating loss in fiscal 2024 and a $3 billion operating loss in fiscal 2023, though those dip to $1.4 billion and $1.5 billion, respectively, when removing impairment and nonrecurring losses. It’d also suffered a major cybersecurity incident at the end of fiscal 2024, the recovery from which leadership said spanned multiple quarters and included consistent volume recovery.
    • “We have been intentional in directing resources toward initiatives that generate measurable impact, from service line growth to process redesign, while also ensuring both stewardship and sustainability,” Saurabh Tripathi, executive vice president and chief financial officer, said in a statement. “This combination of operational discipline and strategic investment increases our flexibility to expand access, enhance services, and ensure the commitment to our mission.”
    • Ascension, which owns or has interests in about 120 hospitals and other healthcare facilities across 16 states, logged $25.3 billion of total operating revenue in fiscal 2025, a roughly $3.2 billion decline (-11.3%) largely reflecting the system’s recent divestments.”
  • The Wall Street Journal relates,
    • “Roche ROG Holding said it agreed to buy 89bio ETNB for up to $3.5 billion, seeking to bolster its drug pipeline by adding an experimental treatment for a liver disease linked to obesity.
    • “The Swiss drugmaker has been looking to enter the weight-loss drug field, a key target of its recent dealmaking activity. With Eli Lilly and Novo Nordisk ahead in the race due to approved drugs that are generating billions of dollars in sales, Roche is betting that a new generation of treatments and potential drug combinations for adjacent conditions can help it to carve out a future role in the market.
    • “The main asset in the pipeline of San Francisco-based 89bio is a drug candidate for a fatty liver disease known as MASH, or metabolic dysfunction-associated steatohepatitis, that is mostly due to obesity.
    • “We intend to be a leader in the cardiovascular space going forward, and being a player in the obesity space is important to make that happen,” Teresa Graham, chief executive of Roche Pharmaceuticals said in an interview.”
  • Per Modern Healthcare,
    • “Cigna aims to strengthen its grip on the specialty pharmacy market through a recent deal with Shields Health Solutions.
    • “The company’s Evernorth Health Services subsidiary, which includes the pharmacy benefit manager Express Scripts and the specialty pharmacy Accredo, announced a $3.5 billion investment into Shields Health Solutions on Sept. 2.
    • “The move shores up a slice of the specialty pharmacy market Cigna wanted to bolster, President and Chief Operating Officer Brian Evanko said during the Morgan Stanley Global Healthcare Conference Sept. 10.” * * *
    • “What caught a lot of people off guard by the [Cigna] transaction is it’s not intuitively the best fit with a retail-oriented PBM,” said Aryeh Sand, a partner at investment banking firm Solomon Partners. “Shields historically is more aligned with health systems.”
  • and
    • “Ten Wisconsin rural hospitals formed a clinically integrated network, following dozens of rural providers that have joined similar initiatives over the past two years. 
    • “The Wisconsin High Value Network looks to pool the expertise and scale of the independent rural hospitals, which have combined $880 million in net revenue, to improve care and lower costs. The Cibolo Health-backed network, announced Thursday, will give providers the data infrastructure and bargaining power to hone primary care services and expand alternative payment models, said David Hartberg, CEO of Vernon Health in Viroqua, Wisconsin, and board chair of the Wisconsin High Value Network.
    • “Cibolo, a rural hospital advisory firm, helped launch similar coalitions in North Dakota, Minnesota, Ohio, Montana and Nebraska. Cibolo will manage daily operations of the Wisconsin High Value Network.”
  • Per BioPharma Dive,
    • “Biogen is buying Alcyone Therapeutics after working with the company for more than two years on a better delivery system for neurological medicines built around antisense oligonucleotides.
    • “Under terms announced Thursday, Biogen will spend $85 million upfront to acquire the privately held company and promise additional payments to Alcyone investors if certain development and regulatory goals are reached. Biogen will gain all rights to ThecaFlex DRx, an implantable subcutaneous port and catheter device it’s been developing with Alcyone since 2023.
    • “The companies have two studies underway testing the system’s delivery of Biogen’s Spinraza drug for spinal muscular atrophy, Biogen said. Lowell, Massachusetts-based Alcyone has been developing ThecaFlex DRx since 2019 and manufactures the product locally.”
  • Per MedTech Dive,
    • “Siemens Healthineers and Stryker are partnering to develop a robotic system that can perform a range of elective and emergency neurovascular procedures, including treatment for strokes and aneurysms, the companies said Wednesday.
    • “The collaboration includes system design, access device and implant integration, imaging for robotic navigation and procedural workflow optimization. The project will combine Siemens Healthineers’ expertise in robotics and imaging with Stryker’s experience in neurovascular technologies.
    • “Carsten Bertram, head of advanced therapies at Siemens Healthineers, said the partnership will focus on creating an ecosystem of image guidance, robotics and devices to help physicians provide faster and more precise care to patients.”
  • Per Fierce Pharma,
    • “With both companies on an upward trajectory, argenx and its manufacturing partner Fujifilm Biotechnologies are taking a logical next step by expanding their collaboration.
    • “In addition to manufacturing drug substance for argenx’s autoimmune blockbuster Vyvgart at its facility in Hillerød, Denmark, Fujifilm will also make the product at its large-scale complex in Holly Springs, N.C. The CDMO will initiate production of Vyvgart at the plant in 2028.
    • “Fujifilm’s Holly Springs is slated to become operational this year and has already secured contracting work from several large drugmakers.” * * *
    • “Fujifilm began building the $2 billion Holly Springs campus in 2021, billing it then as the largest end-to-end biologics production plant in the world, with the expectation to employ roughly 725 at the facility.
    • “Then, in April of last year, Fujifilm upped its ante on the site, earmarking an additional $1.2 billion for its construction and increasing its expected headcount at the facility to 1,400 by 2031.” 

From the artificial intelligence front,

  • Beckers Payer Issues reports,
    • “Hawaii Medical Service Association and Blue Cross and Blue Shield of Kansas joined Blue Shield of California as co-founders of Stellarus, according to a Sept. 18 news release from the technology company. 
    • “Stellarus said it aims to help health plans of all sizes integrate AI and fresh technology to expedite prior authorization, reduce administrative costs and elevate member experience.
    • “Given Hawaii’s size and geographic position, we are better off if we enhance our ability to innovate and grow our technological capacities by investing in Stellarus with like-minded, mission-driven, not-for-profit health plans that are trying to accomplish the same things and solve the same problems,” said President and CEO of Hawaii Medical Service Association Mark Mugiishi, MD.” 
  • Beckers Hospital Review lets us know,
    • “Rochester, Minn.-based Mayo Clinic nurses and informatics teams have developed a [patent pending] in-house AI tool to help streamline clinical workflows.
    • “The tool, called the Nurse Virtual Assistant, integrates directly into Mayo’s EHR and provides a nurse-specific patient summary with links to resources including Lippincott guidelines, intravenous administration protocols and a clinical policy library, according to a Sept. 17 news release.
    • “Mayo Clinic said the tool is designed to reduce the time nurses spend navigating multiple systems, allowing them to focus more on patient care. It was tested and validated in a research study approved by Mayo’s institutional review board before being expanded to more than 9,600 nurses across inpatient and emergency department units.”
  • Per AHA News,
    • “The Joint Commission and the Coalition for Health AI released guidance Sept. 17 on the responsible use of artificial intelligence in health care, the first installment from their partnership that launched in June. The guidance includes recommendations on AI policies, local validation, monitoring and use for interpretation and integration into new or existing processes. CHAI and the Joint Commission plan to release further guidance and a playbook by year’s end.”

Tuesday report

David Ermer–Congress, FDA, Generative AI, Medical / Rx research, Medicare, NCQA, NIH, Obesity, OPM, Rx coverage, U.S. Healthcare–

From Washington, DC,

  • An OPM news release tells us,
    • U.S. Office of Personnel Management (OPM) Director Scott Kupor joined the Ruthless Podcast to discuss a number of wide-ranging topics including OPM’s ongoing efforts to bring top talent into the federal workforce and enhance operational efficiency across government.
    • WATCH HERE
  • The American Hospital Association News informs us,
    • “The House Appropriations Committee today released bill text for a continuing resolution to fund the government through Nov. 21. The bill also extends key health care programs set to expire Sept. 30 through the length of the CR. They include extending the Medicare-dependent Hospital and low-volume adjustment programs, telehealth and hospital at home flexibilities, delaying Medicaid Disproportionate Share Hospital cuts, and extending the Cybersecurity Information Sharing Act. The House is expected to vote on the measure this week. The Senate will follow in an attempt to avert a government shutdown by Sept. 30.”
  • Politico adds,
    • “A group of GOP senators are working on legislation to extend Affordable Care Act subsidies with policy changes designed to win over conservatives, according to four people granted anonymity to disclose private discussions.
    • “This group has gotten “technical assistance” from the Senate Finance Committee, which has jurisdiction over the subsidies, according to two of the sources. The Obamacare subsidies are set to expire at the end of this year.”
  • Per the AHA News,
    • “The House Ways and Means Oversight Subcommittee today hosted a hearing on tax-exempt hospitals. The AHA submitted a statement for the hearing, highlighting the amounts that tax-exempt hospitals spend annually on community benefits and where those funds are spent. The AHA also highlighted its analysis released Sept. 10 that found tax-exempt hospitals provided nearly $150 billion in total benefits to communities in 2022, marking a nearly 50% increase in community benefit spending from 2017. Additionally, the AHA explained why a flexible community benefit approach is best for communities as opposed to suggestions for a definition and evaluation from the Internal Revenue Service.” 
  • Per a Congressional news release,
    • Sens. Chuck Grassley (R-Iowa) and Ben Ray Luján (D-N.M.) reintroduced bipartisan legislation bolstering pharmacists’ ability to serve older Americans in communities that lack easy access to doctors or where pharmacists can provide certain basic medical services.
    • The Pharmacy and Medically Underserved Areas Enhancement Act encourages pharmacists to offer health care services (like health and wellness screenings), immunizations and diabetes management by authorizing Medicare payments for those services where pharmacists are already licensed under state law to provide them. Many states already allow pharmacists to provide these services. However, there is currently no way for pharmacists to receive Medicare reimbursement for providing them. * * *
    • “Grassley and Luján also requested feedback from stakeholders on pharmacists providing services for chronic care needs, given the unique pressing challenges of chronic care among seniors. Text of the request-for-information (RFI) can be found HERE.
    • “The full text of the legislation is available HERE.”
  • Healthcare Dive reports,
    • “Doctors — especially specialists — are pushing back against proposed changes to Medicare payment that would tamp down on reimbursement next year.
    • “Medicare’s proposed physician fee schedule for 2026 includes a base rate hike of 2.5%. But it also includes an efficiency adjustment that would reduce payment by 2.5% for thousands of procedures and changes to how regulators calculate practice expense that would lower reimbursement for services performed in facilities like hospitals.
    • “The reforms are meant to account for increased efficiency in procedures that doctors perform frequently, realign payment for primary and specialty care, and recognize larger indirect costs for doctors in office-based settings.
    • “Many physicians support those goals. But the policy changes themselves are a bad idea, doctors are warning the CMS.”
  • Fierce Healthcare points out,
    • “In its annual health plan ratings, the National Committee for Quality Assurance (NCQA) found that 11 out of 998 rated plans earning top marks, more than double last year’s total. 
    • “Of the 11 plans to achieve a 5-star rating, eight were commercial plans and three were Medicare plans. They included Blue Cross and Blue Shield of Massachusetts, UPMC Health Plan and several Kaiser Foundation Health Plans.  An additional 55 plans earned a 4.5-star rating. Most plans ranked between 3 and 4 stars, same as in 2024. The NCQA says its ratings help consumers and regulators assess the quality and effectiveness of health plans. 
    • “The report found year-over-year improvements in coordination and continuity of care in Medicare. The NCQA also identified progress across nearly all six diabetes-related measures. The Kidney Health Evaluation for Patients with Diabetes metric showed an average increase of over 5% across all product lines. 
    • “Additionally, the NCQA found improved adult and adolescent immunization rates. Though childhood immunization rates continued to decline, they did so at a slower pace than last year.”

From the Food and Drug Administration front,

  • Cardiovascular Business relates,
    • “A safety issue with certain Boston Scientific defibrillation leads has resulted in a series of new Class I recalls, according to the U.S. Food and Drug Administration (FDA). Unlike some recalls, these do not require a product to be immediately removed from the market. However, there are specific recommendations all clinicians should follow. 
    • “The FDA first shared details with the public about these concerns in early August, noting that some of Boston Scientific’s single- and double-coil Reliance defibrillation leads coated with expanded polytetrafluoroethylene (ePTFE) were associated with a potential risk of rising low-voltage shock impedance (LVSI). If this occurs, it can make the leads less effective over time. 
    • “The most common harm is early lead replacement, and the most serious harm is death or need for cardiac resuscitation due to non-conversion of a sustained ventricular arrhythmia from a reduced shock energy due to high impedance,” the agency said at the time.”
  • The AHA News adds,
    • “The Food and Drug Administration has identified a Class I recall for Mo-Vis BVBA R-net Joysticks due to a firmware error that causes the wheelchair to ignore its neutral setting and allows it to move unexpectedly. The FDA said there has been one reported injury and no deaths related to the issue.” 
    • “In addition, the FDA issued an early alert for certain Medline convenience kits containing Medtronic DLP Left Heart Vent Catheters due to issues found with certain lots of cannula products where the catheter may not retain its shape. Medline sent a notice to affected customers that recommended they destroy any affected product after completing the list of recall actions.” 

From the public health and medical/Rx research front,

  • The Wall Street Journal reports,
    • “Novo Nordisk’s Wegovy weight-loss drug helps patients stop thinking about food, according to a new study.
    • “According to results of the study, which were presented at a medical conference in Austria, patients taking Wegovy for weight-loss experienced a substantial drop in so-called “food noise”—unwanted and intrusive thoughts about food—alongside improvements in their mental well-being and lifestyle.
    • “Novo Nordisk said the number of people who reported experiencing constant thoughts about food throughout the day declined by 46% after starting treatment with Wegovy, while 64% of respondents reported improved mental health and 80% reported healthier habits while taking the drug.
    • “It is very encouraging to see these new data from people using Wegovy that, in addition to weight-loss, Wegovy may help quiet disruptive thoughts about food, support improved mental well-being and help enable people to live healthier lives,” said Filip Knop, incoming chief medical officer at Novo Nordisk.
    • “The U.S.-based Inform study released Tuesday surveyed 550 people taking Wegovy for weight-loss to assess the impact of the drug on mental well-being and eating habits relating to food noise.”
  • MedPage Today adds,
    • “A higher 7.2 mg dose of semaglutide led to significantly greater weight loss compared with placebo in adults with obesity, with or without type 2 diabetes.
    • “Participants across two randomized trials also had improvements in cardiovascular risk factors.
    • “Secondary and exploratory analyses suggested that the 7.2 mg dose led to a greater change in body weight versus the currently approved highest dose of 2.4 mg.”
  • Per a National Institutes of Health news release,
    • ‘The National Institutes of Health (NIH) has launched effort aimed at reducing the rate of preventable stillbirths in the United States. Investigators will develop tools, devices and other technologies that have the potential to affect diagnosis and prevention efforts relevant to stillbirth, which occurs in 1 in 160 deliveries in the U.S. About 23,600 stillbirths at 20 weeks or greater gestation are reported annually.
    • “More than 60% of stillbirth cases remain unexplained even after exclusion of common causes, such as congenital abnormalities, genetic factors, and obstetric complications. NIH will fund the Stillbirth Research Consortium for more than $37 million over five years, pending the availability of funds, with $750,000 in co-funding from the Department of Health and Human Services.
    • “This consortium will provide an integrated, collaborative program to support cutting edge research to identify the root causes of stillbirth and inform evidence-based strategies to address stillbirth risks,” said Alison Cernich, Ph.D., acting director of NIH’s Eunice Kennedy Shriver National Institute of Child Health and Human Development. “Too many families needlessly face the grief of stillbirth.”
    • “People who have experienced stillbirth are almost five times as likely to experience another stillbirth or other pregnancy associated complication. The rate of stillbirth is considerably higher among Black, American Indian, and Alaska Native people. About 40% of stillbirths that occur during labor and birth are considered potentially preventable.” 
  • Genetic Engineering and Biotechnology News reports,
    • “A novel strategy developed by scientists at Rice University allows scientists to zoom in on tiny segments of proteins inside living cells, revealing localized environmental changes that could indicate the earliest stages of diseases such as Alzheimer’s, Parkinson’s, and cancer. The study results could offer promise for drug screening that targets protein aggregation diseases.
    • “The research team engineered a fluorescent probe known as AnapTh into precise subdomains of proteins, creating a tool that monitors microenvironmental shifts in real time. Unlike conventional techniques that provide only broad signals, this approach reveals how distinct regions of the same protein behave differently during the aggregation process. The work, led by Han Xiao, PhD, professor of chemistry and director of Rice’s SynthX Center, enhances the basic understanding of disease mechanisms and lays the groundwork for identifying drug targets and screening potential therapeutics at an earlier stage.
    • “We essentially built a molecular magnifying glass,” Xiao said. “This allows us to visualize subtle environmental changes that previously went unnoticed, and those early changes often hold the key to understanding protein-related diseases.” Xiao and colleagues reported on their findings in Nature Chemical Biology, in a paper titled, “Real-time imaging of protein microenvironment changes in cells with rotor-based fluorescent amino acids,” in which they concluded: “These results demonstrate that the technology reported in this paper provides a versatile tool for exploring microenvironment changes of protein substructures at high spatial resolution, enabling direct visualization of the local environment around specific amino acid residues.”

From the U.S. healthcare business front,

  • The Wall Street Journal reports,
    • “Eli Lilly LLY unveiled plans to build a $5 billion manufacturing facility in Virginia as part of the drugmaker’s pledge to bolster its domestic medicine production with four new pharmaceutical manufacturing sites.
    • “Eli Lilly said the new plant, located just west of Richmond in Goochland County, will be the first dedicated, fully integrated active pharmaceutical ingredient and drug product facility for its emerging bioconjugate platform and monoclonal antibody portfolio.
    • “The Indianapolis company said the site also will boost its domestic manufacturing of antibody-drug conjugates.
    • “Eli Lilly said the new plant will create more than 650 new company jobs, along with 1,800 construction jobs.
    • “Eli Lilly in February said it would invest $27 billion to build four new pharmaceutical manufacturing sites in the U.S., more than doubling its U.S. capital expansion commitments since 2020 to more than $50 billion.”
  • and
    • “So far this year, more than a dozen drugmakers [, including Lilly,] have pledged to spend more than $350 billion collectively by the end of this decade on manufacturing, research and development and other functions in the U.S., a Wall Street Journal tally of company announcements showed.
    • “The vast majority of our products going into the U.S. are manufactured in the U.S.,” GSK Chief Executive Emma Walmsley said in an interview Tuesday when the company announced its $30 billion U.S. investment in research and development and supply-chain infrastructure over the next five years. “This of course adds to it, and it’s about the new pipeline that’s going through.”
  • Modern Healthcare informs us,
    • “Health systems are revamping pediatric care to fight emergency department overcrowding before Medicaid funding cuts further endanger access. 
    • “Many emergency rooms are full, leading to care delays and provider burnout. Hospital operators have responded by tasking social workers with triage duties and setting up virtual consultations with specialists. They are also consolidating emergency services and asking data analytics companies to better track and predict capacity and utilization trends, health system executives said. 
    • “Health systems have crafted many of these strategies around pediatric patients, who may bear the brunt of the Medicaid cuts authorized by the “One Big Beautiful Bill,” among other federal policy changes, experts said.
    • “The population that will get hit the hardest in emergency medicine will be pediatrics,” said Dr. Ken Heinrich, chief medical officer of emergency medicine at staffing company SCP Health. 
    • “Providers are facing a surge in pediatric mental health issues, fueling care backlogs across hospital emergency departments. Providers have enlisted social workers and adjusted their emergency department layouts to meet that demand.”
  • and
    • “Labcorp has completed its acquisition of BioReference Health’s oncology diagnostic testing assets for up to $225 million. 
    • “The independent laboratory company paid $192.5 million at closing and and could pay up to $32.5 million more in an earn-out tied to the assets’ performance, according to a Monday news release.
    • “Labcorp previously acquired select clinical, reproductive and women’s health diagnostic assets from BioReference last September for more than $237 million.”
  • MedCity News notes,
    • “Berry Street, a nutrition therapy company, has launched its GLP-1 Nutrition Pathway Program, which is meant to provide nutrition support for those starting, taking and getting off of GLP-1s.
    • “The New York City-based company works with health plans and connects patients in need of nutrition support to a network of registered dietitians. It provides personalized treatment plans for patients struggling with weight management, diabetes, heart health, kidney disease and numerous other conditions.”
  • Per a UHC press release,
    • “Building on our March announcement committing to modernize pharmacy payment models, Optum Rx has increased reimbursement minimums for brand drugs for approximately 2,300 independent pharmacies – those not affiliated with a pharmacy services administrative organization (PSAO), chain or other entity – across the country. This move, which went into effect on September 1, 2025, will support the long-term sustainability of pharmacies, which play a critical role in patient care. 
    • “This is the latest announcement from Optum Rx, which continues to expand on initiatives to transform how pharmacies are reimbursed for drugs. Optum Rx first launched improved reimbursement earlier this year, with Epic Pharmacy Network, a PSAO representing more than 1,000 independent pharmacies, being the first PSAO to partner with us.”
  • BioPharma Dive lets us know,
    • “Novartis is broadening its bet on drugs that can destroy disease-causing proteins, agreeing Monday to a new deal with biotechnology company Monte Rosa Therapeutics.
    • “Through the collaboration, the companies will work to develop multiple novel protein “degrading” drugs for immune conditions. Monte Rosa will conduct discovery and early testing before Novartis takes over development for programs it chooses to license. The biotech will get $120 million in upfront cash per deal terms. It could also receive as much as $5.7 billion overall should various development and sales milestones be met, plus royalties on sales of any eventual products.”
    • Monte Rosa is among the many companies pursuing “molecular glue” drugs, which force together a target protein with an enzyme that flags it for destruction by the cell’s waste disposal system. The approach is seen as a way to access tough-to-reach drug targets, and is one of several strategies biotechs are using to degrade harmful proteins, rather than bind and block them as traditional drugs do.
  • Per Beckers Hospital Review,
    • “Amazon has added Fay, a dietitian platform, as the first nutrition care service available through its Health Benefits Connector.
    • “The collaboration allows eligible Amazon customers to discover and enroll in Fay’s insurance-covered nutrition services while browsing for wellness and health benefits, according to a Sept. 16 news release.
    • “Fay connects individuals with registered dietitians based on their goals, health history and insurance eligibility. Services include counseling, preventive care and coaching, which the company said are often available at no cost to patients.”

From the artificial intelligence front,

  • Fierce Healthcare reports,
    • “Healthcare accreditation body URAC is rolling out the nation’s first accreditation program for users and developers of healthcare artificial intelligence. 
    • “The first-in-the-nation program will evaluate risk management, business management and performance monitoring with specific modules for users and developers. URAC accredits organizations ranging from small pharmacies to multistate payer organizations. 
    • The organization, which has been accrediting healthcare organizations for decades, hopes the URAC gold star will help promote trust in AI.
    • “We think that this is a great opportunity to give people that seal of approval, that gold star, that someone independent has gone in behind the scenes and audited to make sure that this is trustworthy,” Shawn Griffin, M.D., CEO and president of URAC, said in an interview.”
  • and
    • “Aegis Ventures’ digital consortium gained three new members as health systems look to collaborate to develop and scale artificial-intelligence-powered health tech solutions and tackle common pain points.
    • “Yale New Haven Health System, Keck Medicine of USC and Hartford HealthCare joined the collaborative, expanding its reach to 14 regional health systems. The consortium, which includes Northwell Health, UPMC, Stanford Health Care and Vanderbilt Health, will codevelop, invest in and deploy health tech solutions alongside Aegis Ventures. 
    • “The partnerships with the three new health systems will accelerate the consortium’s pipeline of companies with two startups set to launch this fall, according to John Beadle, co-founder and managing partner of Aegis Ventures.
    • “Next year, I think we could be more aggressive, just given that the model of the blueprint worked well. We have the right set of partners, the right team, the resources are in place to do it, but I think we’re most focused on seeing this year out really strong,” Beadle said.”
  • and
    • “Healthcare technology and AI company Innovaccer has acquired Story Health, a digital specialty care platform with health system inroads.
    • “Financial terms of the deal, announced Tuesday, were not disclosed. Innovaccer said the deal adds to its scalable Healthcare Intelligence Cloud offering, which in recent months was bolstered by the company’s other strategic acquisitions.
    • “Healthcare doesn’t change through dashboards alone,” Abhinav Shashank, co-founder and CEO of Innovaccer, said in the announcement. “It changes when data and AI power completely new clinical models. Story Health has proven that in specialty care; and we’re excited to bring this technology and clinical expertise to our health system customers nationwide.”
    • “Cupertino, California-based Story Health, a Fierce 15 2024 honoree, launched in late 2020 and has raised about $27 million in funding from backers such as Northpond Ventures, B Capital Group, LRVHealth, Define Ventures and General Catalyst. Its approach combines virtual coaching, biometric monitoring and care team alerts to support patients with chronic conditions between clinical visits.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front,

  • Nextgov/FCW reports,
    • “A top Cybersecurity and Infrastructure Security Agency official said the agency is prepared to accept any extension Congress authorizes for a fundamental cybersecurity threat intelligence-sharing law, which is set to expire Sept. 30 unless renewed by lawmakers.
    • “We’ll take whatever the Congress decides to authorize us, wherever they see fit within their purview, to authorize and to give us our authorities to be able to use,” Nick Andersen, CISA’s executive assistant director for cybersecurity, told reporters Thursday [September 11] on the sidelines of the Billington Cyber Summit.
    • “The Cybersecurity Information Sharing Act of 2015 lets private sector providers freely transmit cyber threat information to government partners with key liability protections in place, shielding firms from lawsuits and regulatory penalties when sharing threat data with the government.
    • “So at this point, I think my primary concern is if it lapses,” Andersen added. “Give us 30 days for the Congress to do what they need to do. Give us two years. Give us ten years. Give us 50. Whatever you take, we’ll take it. Obviously, we love stability for the organization and stability for our partners to understand how we’re going to protect and exchange information. But really, that’s up to Congress.”
  • Cyberscoop tells us,
    • “The Cybersecurity and Infrastructure Agency is delaying finalization of a rule until May of next year that will require critical infrastructure owners and operators to swiftly report major cyber incidents to the federal government, according to a recent regulatory notice.
    • “Under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022, CISA was supposed to produce a final rule enacting the law by October of this year. But last week, the Office of Management and Budget’s Office of Information and Regulatory Affairs published an update that moved the final rule’s arrival to May 2026.
    • “A CISA official told CyberScoop that the move would give the agency time to consider streamlining and reducing the burden on industry of a previously proposed version of the rule, citing public comments in response to that version, as well as harmonizing the law with other agencies’ cyber regulations.”
  • Cybersecurity Dive lets know,
    • “National Cyber Director Sean Cairncross said [on September 9] the Trump administration plans a whole-of-nation approach in order to combat the threat of malicious cyberattacks from the U.S.’s top geopolitical rivals. 
    • “Cairncross delivered the opening keynote at the Billington Cybersecurity Summit, saying the administration will push forward an aggressive new posture to counter the risks presented by authoritarian regimes like China.” * * *
    • “The Billington keynote marks the first major public remarks by Cairncross since he won Senate confirmation to lead the Office of the National Cyber Director in August.” 
  • FedScoop informs us,
    • “The U.S. government’s acting chief information security officer outlined his three priorities for federal cyber officials over the next year at a cybersecurity event in Washington on Tuesday [September 9], emphasizing the need for collaboration across the government.  
    • “During a fireside chat at the Billington Cybersecurity Summit, acting cyber chief Michael Duffy said focusing enterprise cyber defense, increasing operational resilience, and securing a modern U.S. government are the areas he’s outlined as priorities for the next year in conversations with the federal cyber leaders on the CISO Council. 
    • “He also previewed an upcoming tabletop exercise the CISO Council will be doing in the next month to address operational resilience.” 
  • Cybersecurity Dive points out,
    • “The Cybersecurity and Infrastructure Security Agency said it remains firmly committed to supporting and further enhancing the Common Vulnerabilities and Exposures program, which is a critical program for identifying and mitigating software flaws that can expose computer systems to exploitation. 
    • “Nick Andersen, the new executive assistant director for cybersecurity at CISA, expressed staunch support for the CVE program during a discussion on Thursday at the Billington Cybersecurity Summit in Washington, D.C. 
    • “CISA on Wednesday [September 10] released a road map that outlined its priorities for the CVE program, with the full intention to further develop the program and create a plan for robust funding and wider participation. 
    • Andersen told reporters after the presentation that it’s “exceedingly important” for CISA to be able to grow and expand the program.
    • “The feedback that we’ve gotten consistently is people are looking for somebody to call objective balls and strikes out there,” Andersen said. 
  • Per Federal News Network,
    • “The Pentagon will soon issue more details on its much-hyped effort to “blow up” the Risk Management Framework used to accredit software.
    • “Katie Arrington, who is performing the duties of the Defense Department chief information officer, said DoD will unveil the “10 commandments” of the “new RMF” in the next couple of weeks. DoD’s work to revamp how it accredits software has been a top discussion point in federal technology circles in recent months.
    • “It’s the 10 tenants of the new RMF,” Arrington said at the Billington Cyber Summit on Thursday.
  • Cyberscoop notes,
    • “The Department of Justice unsealed an indictment against a Ukrainian national alleged to be central to a ransomware campaign affecting hundreds of companies worldwide. 
    • “Volodymyr Viktorovych Tymoshchuk, known online as “deadforz,” “Boba,” “msfv,” and “farnetwork,” is accused of developing and deploying ransomware variants Nefilim, LockerGoga, and MegaCortex, all of which have been used in attacks on prominent organizations in the United States, Europe, and elsewhere since at least 2018.
    • “According to the indictment, filed in the Eastern District of New York, Tymoshchuk and his alleged co-conspirators are believed to have extorted more than 250 companies across the U.S. and hundreds more globally, generating tens of millions of dollars in damages. Victims suffered not just the loss of data and disabling of business operations, but high mitigation and recovery costs. * * *
    • “Additionally, the State Department announced rewards totaling up to $10 million for information leading to the arrest or conviction of Tymoshchuk, with a separate reward of up to $1 million for information on other key leaders of the groups deploying the ransomware variants.”

From the cybersecurity vulnerabilities and breaches front,

  • CISA added one known exploited vulnerability to its catalog this week.
  • Cybersecurity Dive reports,
    • “A sophisticated phishing-as-a-service operation has been targeting Google and Microsoft accounts and can bypass traditional defense mechanisms, including multifactor authentication, researchers at Okta Threat Intelligence warned in a blog post on Thursday, 
    • “The phishing operation, dubbed VoidProxy, uses adversary-in-the-middle techniques to bypass normal authentication flow. 
    • “Researchers first learned of attacks linked to the operation in January, but Dark Web advertisements for VoidProxy appear to have begun as early as August 2024, according to Okta researchers. The attacks are ongoing, and Okta said they have targeted valuable accounts.”  * * *
    • “Google agrees with recommendations in the Okta report that users should adopt passkeys as a strong method to protect against phishing, the spokesperson added.
    • “Microsoft declined to comment, however a spokesperson provided a link with general mitigation guidance.”
  • Dark Reading adds,
    • “A recent phishing campaign that used the Salty2FA phishing kit demonstrates how the cybercriminal enterprise continues to evolve to the point where adversarial tools are nearly on par with enterprise-grade software, experts said.
    • “Researchers from Ontinue tracked a campaign using the phishing kit that shows various technical innovations in which cybercriminals are approaching phishing infrastructure “with the same methodical planning that enterprises use for their own systems,” Rhys Downing, an Ontinue threat researcher, wrote in a blog post published Tuesday.”
  • CSO tells us,
    • “Attackers are increasingly exploiting generative AI by embedding malicious prompts in macros and exposing hidden data through parsers.
    • “The switch in adversarial tactics — noted in a recent State of File Security study from OPSWAT — calls for enterprises to extend the same type of protection they already apply to software development pipelines into AI environments, according to experts in AI security polled by CSO.
    • “Broadly speaking, this threat vector — ‘malicious prompts embedded in macros’ — is yet another prompt injection method,” Roberto Enea, lead data scientist at cybersecurity services firm Fortra, told CSO. “In this specific case, the injection is done inside document macros or VBA [Visual Basic for Applications] scripts and is aimed at AI systems that analyze files.”
    • “Enea added: “Typically, the end goal is to mislead the AI system into classifying malware as safe.”
  • Per InfoSecurity Magazine,
    • “People are often described as one of the biggest security threats to any organization. At first glance, it would be hard to argue with such a sweeping statement.
    • “Whether the result of malice or negligence, the ‘human element’ featured in around 60% of data breaches over the past year, according to Verizon. A recent spate of attacks targeting corporate Salesforce instances highlights the evolving nature of the social engineering threat – and just what’s at stake.
    • “The challenge for CISOs is that insider risk is not just about negligence. Those intent on wrongdoing are usually harder to spot and exact a much heavier toll on their employer. To coincide with International Insider Threat Awareness Month, we take a look at what CISOs can do to push back the tide.”
    • Check it out.

From the ransomware front,

  • Per Security Week,
    • “Ransomware remains the primary digital threat to business. Phishing, often the initial point of failure, further expands into voice triggered transfer fraud.
    • “An analysis of risk based on cyberinsurance claims history provides an accurate overview of the true risk of cybercrime. It doesn’t provide a full global picture of risk since it can only be drawn from known cyberinsurance claims. Resilience is a cyberinsurance provider with a deep knowledge of cybersecurity.
    • “There are three major takeaways from the 2025 Midyear Cyber Risk Report produced by Resilience: vendor-related risk is down but still significant; ransomware remains the main threat; and phishing has leapt to clear prominence as the most common point of failure (aided in scale and sophistication by AI).
    • “The report notes a reduction in vendor-related risk (down from 22% of incurred losses in 2024 to 15% in H1 2025), but stresses that the downstream loss to affected companies remains high. “While incidents dropped in frequency, clients who experienced business interruption from a vendor-related incident had significant losses that rivaled losses from companies directly affected by ransomware.” This is an unseen risk that can only be addressed by continuously monitoring the vendors’ security posture.”
  • Per Check Point Research,
    • “First observed on September 5, Yurei is a newly emerged ransomware group that targeted a Sri Lankan food manufacturing company as its first leaked victim. The group follows a double-extortion model: they encrypt the victim’s files and exfiltrate sensitive data and then demand a ransom payment to decrypt and refrain from publishing the stolen information.
    • “Check Point Research (CPR) determined that Yurei’s ransomware is derived with only minor modifications from Prince-Ransomware, an open-source ransomware family written in Go. This highlights how open-source malware significantly lowers the barrier to entry for cybercriminals, enabling even less-skilled threat actors to launch ransomware operations.
    • “Yurei’s ransomware contains a flaw that may allow partial recovery through Shadow Copies, but the group primarily relies on data-theft-based extortion. As they stated on their blog, the fear and implications of data leakage are their main pressure point to get victims to pay the ransom.
    • “Since the first victim was listed on September 5, the number of victims has risen to three so far, pointing to a fast-growing operation.
    • “The investigation revealed hints that the threat actor’s origins may be in Morocco.”
  • Per Cyberscoop,
    • “Researchers and authorities are warning that Akira ransomware attacks involving exploits of a year-old vulnerability affecting SonicWall firewalls are on the rise. 
    • “A burst of about 40 attacks linked to CVE-2024-40766 hit SonicWall firewalls between mid-July and early August. Researchers have since observed another wave of ransomware attacks linked to active exploits of the defect, which affects the secure sockets layer (SSL) VPN protocol in multiple versions of SonicWall firewalls, and configuration errors. 
    • “Rapid7 has responded to a “double-digit number of attacks” related to the vulnerability and a series of misconfigurations in victim environments, the company said, expanding on a blog it published earlier this week.
    • “The Australian Cyber Security Centre also issued an advisory Wednesday noting that it, too, is responding to a recent increase in active exploitation of the defect. “We are aware of the Akira ransomware targeting vulnerable Australian organizations through SonicWall SSL VPNs,” the agency said.”
  • Per PC World,
    • “It’s a story almost as old as time: malware is wreaking havoc on Android devices again. Usually, Android malware aims to steal sensitive data and passwords in order to gain access to online accounts. Less commonly, it installs ransomware to extort large sums of money from users.
    • “A particularly dangerous malware variant that combines both techniques has now been discovered by security experts at ThreatFabric. Known as RatOn, the Trojan infiltrates an Android phone, accesses data, empties bank accounts, then locks the device to blackmail the owner.” * * *
    • “In the case of RatOn, the Trojan likely lands on Android devices through fake apps. Users are redirected to pages that imitate the Google Play Store, where attackers offer applications disguised as common social media apps like TikTok—except it’s malware.: * * *
    • To protect yourself, you should always check whether an app comes from a trustworthy provider. You should also always activate Google Play Protect in the Google Play Store so that apps are scanned for viruses and malware before they’re installed on your device.
  • Bleeping Computer warns,
    • “A recently discovered ransomware strain called HybridPetya can bypass the UEFI Secure Boot feature to install a malicious application on the EFI System Partition.
    • “HybridPetya appears inspired by the destructive Petya/NotPetya malware that encrypted computers and prevented Windows from booting in attacks in 2016 and 2017 but did not provide a recovery option.
    • “Researchers at cybersecurity company ESET found a sample of HybridPetya on VirusTotal. They note that this may be a research project, a proof-of-concept, or an early version of a cybercrime tool still under limited testing.
  • Cyberscoop adds,
    • “Researchers at New York University have taken credit for creating a piece of malware found by third-party researchers that uses prompt injection to manipulate a large language model into assisting with a ransomware attack.
    • “Last month, researchers at ESET claimed to have discovered the first piece of “AI-powered ransomware” in the wild, flagging code found on VirusTotal. The code, written in Golang and given the moniker “PromptLock,” also included instructions for an open weight version of OpenAI’s ChatGPT to carry out a series of tasks — such as inspecting file systems, exfiltrating data and writing ransom notes.
    • “ESET researchers told CyberScoop at the time that the code appeared to be unfinished or a proof of concept. Other than knowing it was uploaded by a user in the United States, the company had no further information about the malware’s origin. 
    • “Now, researchers at NYU’s Tandon School of Engineering have confirmed that they created the code as part of a project meant to illustrate the potential harms of AI-powered malware.”
    • In a corresponding academic paper, the researchers call the project “Ransomware 3.0” and describe it as a new attack method. This technique “exploits large language models (LLMs) to autonomously plan, adapt, and execute the ransomware attack lifecycle.”

From the cybersecurity business and defenses front,

  • Cyberscoop informs us,
    • “Major cyber intrusions by the Chinese hacking groups known as Salt Typhoon and Volt Typhoon have forced the FBI to change its methods of hunting sophisticated threats, a top FBI cyber official said Wednesday.
    • “U.S. officials, allied governments and threat researchers have identified Salt Typhoon as the group behind the massive telecommunications hack revealed last fall but that could have been ongoing for years. Investigators have pointed at Volt Typhoon as a group that has infiltrated critical infrastructure to cause disruptions in the United States if China invades Taiwan and Americans intervene.
    • “Those hacks were stealthier than in the past, and more patient, said Jason Bilnoski, deputy assistant director of the FBI’s cyber division. The Typhoons have focused on persistent access and gotten better at hiding their infiltration by using “living off the land” techniques that involve using legitimate tools within systems to camouflage their efforts, he said. That in turn has complicated FBI efforts to share indicators of compromise (IOCs).
    • “We’re having to now hunt as if they’re already on the network, and we’re hunting in ways we hadn’t before,” he said at the Billington Cybersecurity Summit. “They’re not dropping tools and malware that we used to see, and perhaps there’s not a lot of IOCs that we’d be able to share in certain situations.”
  • The Wall Street Journal reports,
    • “Japanese industrial giant Mitsubishi Electric said Tuesday that it intends to acquire U.S. cybersecurity company Nozomi Networks in a deal valued at about $1 billion.
    • “Nozomi will become a wholly owned subsidiary of Mitsubishi Electric under the terms of the deal and operate independently. The transaction value includes $883 million in cash as well as previous equity.
    • “Nozomi raised $100 million in a 2024 Series E funding round that included several heavyweights in operational technology, such as Mitsubishi Electric and Schneider Electric. Previous investors included Honeywell; the U.S. Central Intelligence Agency’s venture arm, In-Q-Tel; and Johnson Controls. 
    • “Nozomi Chief Executive Edgard Capdevielle said the company will continue to provide services to those prior investors and other companies after the acquisition, which is expected to close in the fourth quarter. 
    • “The fact that we’re now a wholly owned subsidiary of Mitsubishi does not change the fact that we will continue to be vendor-agnostic,” he said.”
  • Dark Reading adds,
    • “F5, a software company that improves application speed and security, today announced its plans to acquire CalypsoAI, a provider of adaptive artificial intelligence (AI) security capabilities. CalypsoAI’s technology will be integrated into the F5 Application Delivery and Security Platform (ADSP), F5 said.
    • Founded in 2018, CalypsoAI focuses on real-time protection against threats targeting AI applications and models, such as prompt injection and jailbreaking. The platform brings threat defense, red teaming at scale, and data security to businesses preparing to launch or adopt generative and agentic AI. CalypsoAI came in second place at RSAC Conference’s Innovation Sandbox earlier this year as a company that protects models and agents with prompt firewalls.
    • “By integrating CalypsoAI features into ADSP, F5 hopes to build modern firewalls and point solutions that can secure AI models, agents, and data flows. Traditional options “can’t keep up,” said François Locoh-Donou, president and CEO of F5, in a statement.”
  • Here’s a link to Dark Reading’s CISO Corner.

Thursday report

David Ermer–CDC, CMS, Congress, FDA, Federal employment benefits, Generative AI, Medical / Rx research, Medicare, OPM, U.S. Healthcare–

From Washington, DC,

  • The Washington Post reports,
    • “Republicans moved Thursday to speed up Senate confirmation of President Donald Trump’s nominees by changing the chamber’s rules over the objections of Democrats.
    • “Senators voted 53-45 to allow themselves to change the rules with a simple majority instead of 60 votes — a move known as the “nuclear option.”
    • “The rules change will allow the Senate to confirm multiple people at once, helping to clear a backlog of nearly 150 nominees awaiting floor votes. Republicans argue it is necessary because Democrats have held up the confirmation process by forcing time-consuming votes on each nominee rather than allowing some of them to be confirmed by voice votes, which is faster.
    • “The change excludes Cabinet officials, Supreme Court justices and federal judges, who must be confirmed one by one.”
  • Per an OPM news release,
    • “The U.S. Office of Personnel Management (OPM) announces the 2025 Combined Federal Campaign (CFC), running from October 1, 2025, to December 31, 2025. The CFC provides federal employees and military personnel opportunities to support charitable causes.
    • “OPM supports the generosity of federal employees but is reviewing the program’s administrative costs and declining participation for potential changes in 2026. Read more in OPM Director Scott
    • “Kupor’s latest blog here and read the memo to agencies here.”
  • OPM Director Scott Kupor explains in his blog,
    • “Over the years, participation in the program has continued to decline from its peak – donations have been hovering around $65-70 million over the past few years. At the same time, the costs to administer the program have continued to increase. This year, the Office of Personnel Management (OPM) estimates the program will consume $22 million in outside contractor fees and listing fees to administer the program.
    • “This means for every $1 a federal employee donates, about $0.33 (or 33%) does not reach the charity for which it was intended. Rather, dollars that could be deployed to help sick children, help veterans in need, or help victims of natural disasters get back on their feet, are instead diverted to overhead. * * *
    • “Despite all of this, we at OPM will shortly launch the 2025 CFC, only because many charities have already spent time and money preparing for this over the course of this year. We hope 2025 will be a successful campaign.
    • “But, at the same time, OPM is concerned about excessive administrative costs associated with the CFC, along with steadily declining participation, and it is evaluating changes to the CFC for 2026 (including whether to continue the program).
    • “We believe strongly in charities and in the generosity that Americans continue to show in donating in support of charities – roughly 50% of American households donate. But we also believe donors expect their dollars to benefit the very causes they intend to support and not to lose the effectiveness of their donations because of excessive administrative costs.”      
  • Tammy Flanagan, writing in Govexec, explains what to know before setting your 2026 retirement date.
  • CNBC reports,
    • “Millions of Social Security beneficiaries may see a 2.7% to 2.8% increase to their monthly checks in 2026, according to new estimates based on the latest government inflation data.
    • “A 2.8% Social Security cost-of-living adjustment may go into effect next year, estimates Mary Johnson, an independent Social Security and Medicare policy analyst. That increase would push the average retirement benefit up by about $54.70 per month, she said. * * *
    • “Those estimated increases would be up from the 2.5% boost to benefits that went into effect in 2025. The COLA has averaged 2.6% over the past 20 years, according to the Senior Citizens League.”
    • “The COLA projections are based on new consumer price index data for the month of August that was released Thursday.
    • “The official Social Security cost-of-living adjustment will include one more month of inflation data.”
  • The American Hospital News tells us,
    • “The Federal Trade Commission announced yesterday that it sent letters to many large health care employers and staffing firms, urging them to review their employment agreements — including any noncompete agreements — to ensure they are in compliance. The commission’s announcement follows one from Sept. 5, when it moved to vacate a 2024 noncompete final rule, voting 3-1 to dismiss appeals initiated by the previous administration attempting to uphold it. On Sept. 4, the FTC issued a request for information on noncompete agreements, seeking to “better understand the scope, prevalence, and effects of employer noncompete agreements, as well as to gather information to inform possible future enforcement actions.”
    • The public comment deadline is November 3, 2025.
  • Healthcare Dive informs us,
    • “The 340B drug discount program incentivizes hospitals to purchase outpatient clinics and prescribe more and higher-cost drugs — behaviors that tend to increase costs for the federal government and commercial health plans, according to a new report from the nonpartisan Congressional Budget Office.
    • “Only one-third of the sharp growth in 340B spending since 2010 is due to rising drug costs and higher prescribing of more expensive drugs, the CBO estimates. Instead, the growth has mostly been fueled by hospitals acquiring off-site clinics and contracting with more independent pharmacies, along with more providers becoming eligible for 340B.
    • “Though the CBO stressed it doesn’t have enough data to quantify the influence of each factor individually, the agency believes that the biggest driver of snowballing 340B growth is probably hospital-clinic M&A.”

From the Food and Drug Administration front,

  • BioPharma Dive tells us,
    • “Senior Food and Drug Administration official Vinay Prasad has reclaimed a role as the agency’s top doctor and scientist six weeks after his dramatic departure and one month after his surprising return to lead the regulator’s biologics medicine division.
    • “On the FDA’s website, Prasad, a physician and prolific researcher, is now listed as the agency’s chief medical and scientific officer in addition to his role as director of the Center for Biologics Evaluation and Research, or CBER. A spokesperson for the Department of Health and Human Services, the FDA’s parent agency, confirmed via email Prasad’s reappointment to his former role.
  • MedTech Dive adds,
    • “Patient groups called for substantial changes to medical device user fees in comments submitted to the Food and Drug Administration. Negotiations recently kicked off for the medical device user fee amendments, which will determine how much funding the FDA’s device center can collect from the industry in fiscal years 2028 through 2032.
    • “After a public hearing last month, clinicians and patient groups submitted comments calling for an increase to user fees, bolstering FDA staffing and more emphasis on product safety. They also called for greater transparency around negotiations and for patients to have more input on the final agreement. 
    • “The FDA received a total of 27 comments by Sept. 4, including several submissions from patients and medical groups. Two large medtech industry lobbying firms, Advamed and the Medical Device Manufacturers Association, which had opposed user fee hikes in the public hearing, had not posted comments as of Thursday.”
  • Beckers Hospital Review provides us with an update on State actions to expand access to the Covid vaccine.

From the public health and medical/Rx research front,

  • The New York Times reports,
    • “Chronic diseases like heart disease, cancer and diabetes are some of the leading causes of death around the world. A new global study shows that deaths from such “noncommunicable” conditions have been declining in most countries — but the pace of that decline, including in high-income countries like the United States, has slowed in recent years.
    • “The probability of dying from a chronic disease between birth and age 80 dropped in about 150 countries from 2010 to 2019, the study, published Wednesday in The Lancet, found. But compared to the previous decade, there was a widespread slowdown — in some cases, even a reversal — in progress.
    • “In the United States, the overall probability of dying from a chronic disease fell markedly between 2001 and 2010 but remained nearly flat over the following nine years. Among younger adults (20 to 45 years old), this probability increased — a rarity among high-income countries. The chance of dying specifically from neuropsychiatric conditions like Alzheimer’s disease and alcohol and drug use disorders also rose in the United States during this period.””
  • Cardiovascular Business notes,
    • “Diets that prioritize plant-based foods while limiting meat and dairy products are associated with reduced risks of all-cause mortality, cardiovascular disease (CVD), coronary heart disease, stroke and diabetes. 
    • “That was the primary takeaway from a new study of more than 3.4 million adults who participated in the National Health and Nutrition Examination Survey (NHANES), UK Biobank or one of 37 different clinical trials. The full analysis was published in Science Advances.” * * *
    • Click here to read the full study.
  • The Hill points out,
    • A DermaRite Industries hand soap recall has been expanded to more than 30 products, including deodorant, lotions, shampoo, hand sanitizer and more.
    • The recall was initiated in July and was expanded recently over concerns that more of its products may include Burkholderia cepacia complex. Exposure to the bacterium could “result in serious and life-threatening infections,” the company said in a release.”
    • “For healthy individuals with minor skin lesions, the use of the product may result in local infections, whereas in immunocompromised individuals the infection could spread into the blood stream, potentially leading to life-threatening sepsis,” the release noted.
    • “Symptoms of bacteria exposure include fever, fatigue and possible respiratory infections for patients with compromised immune systems, according to the Centers for Disease Control and Prevention (CDC).
    • “The products were distributed nationwide in the U.S., including Puerto Rico.”
  • The Wall Street Journal reports,
    • “More women are using cannabis during pregnancy, driven by fears about prescription drugs and beliefs it’s safe for conditions like nausea.
    • “Research on cannabis use during pregnancy is limited, but recent studies suggest potential risks to fetal brain development.
    • “Dispensary practices and conflicting advice from various sources add to confusion, highlighting the need for more research.”
  • BioPharma Dive relates,
    • “Capsida Biotherapeutics has suspended a recently begun clinical trial of an experimental gene therapy after the first participant in the study died following treatment.
    • “Capsida disclosed the death in a letter Wednesday to the patient community for the rare neurodevelopmental disease its gene therapy is designed to treat. In it, the biotechnology company noted it has informed the Food and Drug Administration and will soon provide regulators a full report of the patient’s death.
    • “We understand this devastating news will raise questions and uncertainty, and we are working with urgency to gather information and find answers,” Capsida wrote in its letter.”
  • Per Fierce Pharma,
    • “Approved 15 months ago as a pneumococcal disease vaccine for adults—and billed as the first shot designed for seniors—Merck’s Capvaxive now has data supporting its potential in children and adolescents.
    • “In a phase 3 study of 882 participants aged 2 through 17 who have completed a primary pediatric pneumococcal vaccination regimen and have one or more chronic medical conditions that put them at an increased risk of the respiratory disorder, Capvaxive made the grade in three key measures.”
  • Per Medscape
    • Pavani Chalasani, MD, MPH, is professor of medicine and director of the Division of Hematology/Oncology at The George Washington University. In this interview, Chalasani discusses how liquid biopsies are used to guide therapy in breast cancer and reviews the role of antibody-drug conjugates in current practice.

From the U.S. healthcare business front,

  • The Wall Street Journal relates,
    • “AbbVie has struck a deal with generic drugmakers aimed at extending patent protection for its blockbuster autoimmune drug Rinvoq well into the next decade.
    • “AbbVie on Thursday said it has settled litigation with all generic manufacturers that have filed applications with the Food and Drug Administration for generic versions of Rinvoq, which is approved for use in several autoimmune diseases.
    • “The North Chicago, Ill., biopharmaceutical company said it now doesn’t expect any U.S. generic entry for Rinvoq prior to April 2037, given the settlement and license agreements and assuming the company wins pediatric exclusivity.
    • “Analysts at William Blair, who had previously assumed a 2033 loss of U.S. patent exclusivity for Rinvoq, said the settlements are a big win for AbbVie that support longer-term protection for the franchise.”
  • STAT News reports,
    • “Consumers can now purchase Exact Sciences’ liquid biopsy early detection test, Cancerguard, and get an indication of whether they might have one of 50 different cancers included in the test’s analysis. The biotechnology company launched the test on Wednesday, and Tom Beer, Exact’s chief medical officer, relayed the news with elation.
    • “I am feeling fantastic. This is what I came to Exact to do,” Beer said. A practicing oncologist, Beer said that he’s reminded every Friday in clinic of the world of difference that catching cancer early can make. The promise of liquid biopsy tests is to do that for dozens of cancers, not just breast, prostate, colorectal, lung, and cervical cancer.”
  • Per Modern Healthcare,
    • “CVS Health has named Jon Thiboutot as president of retail health, effective immediately.
    • “Thiboutot was most recently vice president of operations at CVS MinuteClinic. He succeeds Dr. Creagh Milford, who had served as interim president of retail health since May and will continue to lead primary care provider Oak Street Health, CVS said Thursday.
    • “A CVS spokesperson declined to say whether the company will fill Thiboutot’s former role.”
  • and
    • “The American Medical Association released nearly 300 new Current Procedural Terminology billing codes Thursday as part of its proposed 2026 code set.
    • “Two other codes can be used to report remote monitoring treatment management after 10 minutes of services per calendar month, down from 20 minutes, according to an AMA news release. 
    • “Several augmented and artificial intelligence services were also included in the new code updates, ranging from tools that assess coronary disease to burn wound classification, according to the release. 
    • “The updates signal potential broader acceptance and reimbursement for digital health services in standard billing codes.
    • “The AMA’s CPT Editorial Panel organizes the association’s CPT code system, which is used in billing and reimbursement by the Centers for Medicare and Medicaid Services, as well as other payers and providers. CMS and others have the option to adopt the changes and put them into effect starting Jan. 1.” 
  • Beckers Hospital Review informs us
    • “The District of Columbia holds the highest ratio of nurses to population, to a significant degree, at 7.14 per 100 residents, while Utah has the lowest, at 1.38, according to a Becker’s analysis. [The full list is displayed in the article.]
    • “The analysis is based on U.S. Census Bureau state population estimates as of July 1, 2024, and active registered nurse and practical nurse license counts from the National Council of State Boards of Nursing database. The number of nurses per 100 residents was calculated by dividing the total number of active licenses in each state by its population and multiplying by 100. In California, the total reflects RN and vocational nurse licenses, rather than PN.”
  • and
    • “Landmark Hospital of Cape Girardeau (Mo.), a long-term acute care facility, has shared plans to close “in the coming weeks,” according to a Sept. 10 news release.
    • “The hospital has been open since early 2006 and is part of Cape Girardeau-based Landmark Holdings of Florida, which operates six long-term acute care hospitals across the U.S. The hospital operator sought Chapter 11 protection in early March and plans to find buyers for its facilities to relieve mounting financial challenges.”