Search

The Advanced Research Projects Agency for Health, an agency under the U.S. Department of Health and Human Services (HHS), has launched a new cybersecurity program called UPGRADE. The program aims to protect hospitals from cyber threats by investing over $50 million to develop a software suite that can automatically scan hospital environments for vulnerabilities and deploy fixes. The healthcare sector has experienced an increase in cyberattacks, which can disrupt patient care and pose risks to patient safety. The UPGRADE project seeks to address the challenge of keeping internet-connected devices in hospitals up to date with security patches. The federal government has also shown a growing focus on healthcare cybersecurity, with proposed budgets and regulations aimed at improving defenses and penalizing non-compliance. [Extracted from the article]

More than 50 organizations, including the American Medical Association and the College of Healthcare Information Management Executives, have sent a letter to the US Department of Health and Human Services (HHS) urging clarification on whether providers will be responsible for reporting or notifying patients about data breaches resulting from the cyberattack against Change Healthcare. Change Healthcare, a major claims processor, experienced a breach earlier this year. UnitedHealth Group, Change's parent company, has stated that it will handle reporting for affected customers. The breach potentially affects a significant number of individuals in the US, and some hospital groups have already requested clarification on breach notification requirements. Provider groups are seeking confirmation that UnitedHealth will handle breach reporting. [Extracted from the article]

Black Basta ransomware has been targeting healthcare and other critical infrastructure providers, affecting over 500 organizations worldwide. The FBI, Cybersecurity and Infrastructure Security Agency, HHS, and MS-ISAC have issued a joint advisory warning about the ransomware. Black Basta has targeted 12 out of the 16 government-designated critical infrastructure sectors and has been linked to the exploitation of vulnerabilities in ConnectWise ScreenConnect. The ransomware group is using a social-engineering campaign to target users of managed detection and response security tools. The attacks come amidst a series of escalating attacks on hospitals and public health organizations. [Extracted from the article]

According to a report from the Medicare trustees, the insolvency date for the key trust fund supporting the Medicare program has been extended to 2036, five years later than previously predicted. This is due to increased revenue from higher wages and reduced spending on hospital and home health services. However, concerns about the long-term sustainability of Medicare remain, and action from Congress is needed. The report also highlights the impact of Medicare insolvency on seniors' access to care and physicians' reimbursement rates. Lawmakers have been hesitant to address the issue, but President Joe Biden has proposed a plan to keep the trust fund solvent. [Extracted from the article]

The Federal Trade Commission (FTC), Department of Justice (DOJ), and Department of Health and Human Services (HHS) have launched a portal called HealthyCompetition.gov, where anyone can submit complaints about anticompetitive practices in healthcare. The goal is to ensure quality care, fair wages, and market competition in the healthcare industry. However, experts are divided on whether relying on consumers to identify anticompetitive behavior is effective, as most people may not have the necessary information to make such judgments. The portal could potentially provide valuable tips for investigations, but there are concerns about overwhelming the already resource-strapped agencies with unhelpful complaints. The FTC has been making efforts to involve consumers in antitrust issues, and the portal could also serve as a resource for courts reviewing potential challenges to deals. However, there are concerns about the potential strain on agency resources and the effectiveness of the portal in combating anticompetitive behaviors in healthcare. [Extracted from the article]

Medical research is undergoing a significant shift towards the use of mass data collection and artificial intelligence-driven analytics, which have the potential to revolutionize scientific breakthroughs. However, outdated data privacy laws, such as the Health Insurance Portability and Accountability Act (HIPAA), do not adequately address the challenges posed by these advancements. Patients have limited control over their health data collected through technologies like smart watches and apps, which can be sold to data brokers without their consent. The U.S. should collaborate with relevant agencies and stakeholders to establish a framework that protects patient privacy and fosters a healthy marketplace. Additionally, blockchain technology could provide a solution by allowing patients to give or reject consent for their data to be used in medical research while maintaining anonymity. It is crucial for Congress to update existing health privacy laws to ensure that Americans have ownership of their own health information while promoting innovation and the development of life-saving treatments. [Extracted from the article]

The Biden administration has finalized a rule that protects the privacy of patients seeking reproductive care, such as abortion and birth control. The rule prohibits providers, health plans, and other entities covered by HIPAA from disclosing protected health information that could be used to investigate abortions. The goal is to ensure that patients feel safe and comfortable disclosing important medical details without fear of their information being shared with law enforcement or other state agencies. The rule requires entities to obtain a signed attestation that information requests related to reproductive care won't be used for prohibited purposes. However, the rule is limited and primarily aimed at women traveling from states where reproductive care is banned. The final rule will go into effect two months after it is published in the federal register. [Extracted from the article]

The Biden administration has finalized a rule that changes the dispute resolution process for the 340B drug discount program, leading to disagreements between providers and drugmakers. The rule aims to make the resolution process more accessible and efficient, requiring parties to make a good faith effort to resolve disputes before going to arbitration. Provider groups support the rule, stating that it will streamline the process and protect the integrity of the program, while pharmaceutical lobby PhRMA opposes it, claiming that it favors hospitals and ignores drugmakers' concerns. The 340B program provides discounts on outpatient drugs to hospitals caring for low-income populations, but drugmakers argue that it cuts into their profits. [Extracted from the article]

The Biden administration has proposed a 2.6% increase in Medicare payment for inpatient care at hospitals next year, which is the lowest rate since 2019. Hospital groups argue that the increase is insufficient to cover the rising costs of care and have concerns about policies that could lower payments for long-term care facilities. The proposed rate reflects a 3% increase to the market basket, reduced by a 0.4% productivity adjustment. Rates could still increase in the final rule, which will be released in August. [Extracted from the article]

The Biden administration has implemented a rule that caps the compensation brokers receive from Medicare Advantage (MA) plans in an effort to prevent predatory marketing. The rule expands Medicare's definition of compensation to include all actions related to the sale or enrollment of beneficiaries in an MA plan. This means that insurers can no longer pay brokers additional fees that are not subject to the government's compensation cap. The rule also increases fixed compensation amounts for brokers who enroll beneficiaries in plans by $100. The goal of the rule is to prevent brokers from steering beneficiaries towards certain plans for higher reimbursement, while also providing them with more predictable compensation. This is important because many Medicare enrollees rely on brokers when selecting coverage. The rule also prohibits contracts between MA plans and marketing middlemen that result in volume-based bonuses for enrollment into certain plans, and it requires MA plans to provide research supporting the effectiveness of supplemental benefits for chronically ill enrollees. The rule is part of the CMS' efforts to address misconduct in MA marketing and ensure that taxpayer dollars are not solely used for marketing purposes. [Extracted from the article]

The release of a final rule by the U.S. Department of Education intended to simplify the process of obtaining parental consent for Medicaid school-based health services has been delayed due to concerns over negative impacts on students' out-of-school public insurance benefits. The Education Department is working with the U.S. Department of Health and Human Services' Centers for Medicare and Medicaid Services to address these concerns. Some commenters opposed the proposed rule, fearing that children could lose access to public healthcare services outside of school. Education administration groups support the proposed rule, citing confusion and paperwork burdens in the current parental consent process. The proposed rule seeks to eliminate a provision that requires one-time parental consent before schools file their first invoices for school-based specialized services. The Education Department has also provided resources and supports for school-based Medicaid billing programs. [Extracted from the article]

The Biden administration has finalized a rule that reduces the duration of short-term health plans, which are exempt from consumer protections. The new rule limits the length of these plans to three months, with the option of a one-month extension. The rule also addresses concerns about fixed indemnity plans, which provide cash payments for specific medical events, by requiring issuers to publish notices to help consumers distinguish them from more comprehensive coverage. While some critics argue that the rule will harm consumers and increase the uninsured rate, patient advocacy groups have praised the steps taken to restrict the duration and marketing of short-term plans. [Extracted from the article]

The HHS' Office of the National Coordinator for Health Information Technology has released a draft plan outlining their health IT strategy for the coming years. The plan, developed in collaboration with over 25 federal agencies, emphasizes areas such as artificial intelligence, public health, and health equity. It aims to prioritize resources, coordinate efforts, and assess progress in health IT initiatives. The plan aligns with the HHS' focus on cybersecurity and preparedness in the healthcare sector, and addresses challenges such as the expansion of AI and increased cyber threats. The draft plan is divided into four categories, focusing on improving experiences and outcomes for health IT users, promoting health and wellness, improving care delivery, and using health IT for research and innovation. It also discusses plans to promote data sharing, improve broadband infrastructure, and provide guidance on cybersecurity. The previous health IT plan, published in 2020, made significant progress in accelerating access to electronic health information, and the new plan aims to build upon that work by modernizing public health infrastructure, addressing health disparities, and managing the use of AI in healthcare. The ONC has implemented oversight measures for AI tools, requiring developers to provide information on maintenance, monitoring, risks, and inappropriate uses. [Extracted from the article]

The Centers for Medicare and Medicaid Services (CMS) has released flexibilities for state Medicaid agencies to provide financial relief to healthcare providers affected by the cyberattack on Change Healthcare. The CMS is urging states to submit Medicaid state plan amendments so that they can make interim payments to providers who are unable to submit claims while Change Healthcare restores its systems. The cyberattack has had a significant impact on hospitals, with 94% reporting financial effects and more than half experiencing serious consequences. The CMS is allowing states to make retroactive interim payments and offering flexibilities through the end of June. The American Hospital Association has called this cyberattack the most significant and consequential in the industry's history. [Extracted from the article]

Hospitals, tech companies, and government agencies are grappling with how to govern artificial intelligence (AI) in healthcare. The lack of comprehensive supervision from the federal government has raised concerns about the industry having too much freedom in building and implementing AI technologies. Hospitals and developers are implementing internal controls and standards groups to ensure the accuracy and fairness of AI tools. However, the complexity of algorithms and the potential for bias pose challenges to oversight. Washington is working on creating a strategy to oversee AI, but technology companies and hospitals warn against policies that could stifle innovation. Private sector efforts are being made to share best practices and create guidelines for AI adoption. While some experts believe that governance should come from the healthcare sector itself, others argue that regulation is necessary to ensure safety and accountability. The government's role in overseeing AI is a topic of debate, with concerns about stifling innovation while balancing the need for regulation. The rapid advancement of AI technology and its implementation in healthcare present challenges for regulators. The government is expected to develop a regulatory structure to assess AI and monitor its performance and quality. AI developers are open to regulation but caution against overly burdensome oversight that could impede progress. Transparency and continuous monitoring of AI tools are suggested as ways to build trust and ensure accountability. Regulators face the difficult task of overseeing a constantly evolving technology that is already in use by healthcare professionals. The government will need to address various questions and considerations, such as regulating different types of AI technologies, accommodating different workflows, ensuring accessibility and [Extracted from the article]

The US Department of Health and Human Services (HHS) has launched an investigation into a cyberattack on Change Healthcare, a technology firm and subsidiary of UnitedHealth Group. The HHS Office for Civil Rights will examine whether protected health information was breached and if UnitedHealth complied with privacy and security regulations. Change Healthcare is a major insurance claims processing center, and the attack has caused significant disruptions in the healthcare sector, including difficulties with payment, coverage verification, and record exchange. The HHS has emphasized the importance of cybersecurity in the healthcare industry and urged organizations to enhance their protections. [Extracted from the article]

The U.S. Department of Health and Human Services (HHS) is forming a task force to develop regulations for the use of artificial intelligence (AI) in healthcare. President Joe Biden's executive order directed the HHS to create a plan for assessing AI before it goes to market and monitoring its performance and quality. The task force, composed of senior members of the HHS and various working groups, will focus on issues such as drugs and devices, research and discovery, biosecurity, and ethics and responsibility. The HHS also plans to engage with the private sector for input. The U.S. lags behind the European Union in AI regulations, but federal agencies have taken some steps to oversee AI in healthcare. [Extracted from the article]

Officials from the White House and the Department of Health and Human Services (HHS) met with UnitedHealth and other industry groups to discuss the cyberattack at Change Healthcare, which has disrupted the healthcare sector for three weeks. The HHS Secretary and White House Domestic Policy Advisor emphasized the need for collaboration between the government and healthcare industry to support providers facing financial strain. The Centers for Medicare and Medicaid Services (CMS) will provide guidance to states on supporting Medicaid providers during the outage. Providers expressed concerns about gaps in response from payers and called for immediate payment options and relaxed billing requirements. The American Medical Association urged regulators to address provider concerns and build upon existing payment programs. The HHS has released a strategy to enhance cybersecurity in the healthcare sector, and the White House deputy national security advisor encouraged the industry to implement voluntary cybersecurity performance goals. The Biden administration's proposed budget for fiscal year 2025 includes funds for hospitals to strengthen their cyber protections and penalties for non-compliance. [Extracted from the article]

The Biden administration has released its proposed budget for the Department of Health and Human Services (HHS) for fiscal year 2025. The budget includes funds to boost cybersecurity in the healthcare sector and make enhanced premium tax credits for Affordable Care Act (ACA) marketplace plans permanent. The proposed budget aims to strengthen cybersecurity in healthcare organizations and at the HHS, with investments in cyber safeguards and the establishment of a Medicare incentive program for hospitals to adopt cyber protections. Additionally, the budget proposes the permanent extension of enhanced premium tax credits for ACA marketplace plans and the provision of "Medicaid-like" coverage to low-income individuals in states that have not expanded Medicaid. The budget also calls for the expansion of Medicare's drug price negotiation program. [Extracted from the article]

The federal government is investigating the increasing influence of private equity firms and other corporate owners in the healthcare industry. The Federal Trade Commission, Justice Department, and the Department of Health and Human Services have requested public comment to understand how these firms prioritize profits over patient care quality, worker safety, and healthcare affordability. This investigation is part of the Biden administration's efforts to address corporate consolidation in healthcare. The probe covers a wide range of transactions, including those involving dialysis clinics, nursing homes, hospice providers, primary care providers, hospitals, and home health agencies. Studies have shown that private equity ownership can lead to decreased care quality and increased prices for payers and patients. The government is seeking comments on the impact of these corporate deals until May 6. [Extracted from the article]

Provider groups are calling on the federal government to assist in mitigating the damage caused by a cyberattack on UnitedHealth Group's Change Healthcare. The American Medical Association has requested emergency funds from the Department of Health and Human Services (HHS) to support physicians who have been unable to submit claims and receive payment due to the outage. The American Hospital Association has also urged Congress to press the HHS for support, including speeding up Medicare payments and implementing a financial assistance program. The attack on Change Healthcare has had a significant financial impact on providers, costing them over $100 million each day. The outage has also led to labor-intensive and time-consuming workarounds for critical operations. The HHS has been asked to issue guidance and facilitate communication between Change Healthcare and the healthcare sector. This cyberattack comes at a time when the industry is facing increased cyber threats, with a significant rise in data breaches and ransomware attacks. [Extracted from the article]

The Centers for Medicare and Medicaid Services (CMS) has implemented several measures to assist healthcare providers facing financial challenges due to the cyberattack on Change Healthcare. The CMS has instructed Medicare administrative contractors to expedite provider requests to switch to new clearinghouses, and is encouraging Medicare Advantage plans, Part D sponsors, and Medicaid and Children's Health Insurance Program managed care plans to relax prior authorization requirements or offer advance funding. Providers can also submit requests for accelerated payment for individual consideration. The cyberattack has caused significant disruptions in the healthcare sector, and industry groups are urging the government to provide further assistance, including financial aid for physician practices. The CMS has also contacted Medicare administrative contractors to ensure they can accept paper claims and has provided information on exceptions, waivers, and extensions for filing claims. [Extracted from the article]

This brief essay will begin to address the feasibility of operating a Catholic healthcare system without reimbursement from government healthcare programs such as Medicare and Medicaid. This question stems from the recent ACA/HHS “Nondiscrimination in Health Programs and Activities” final rule. Summary: The average hospital in the United States receives 40-50 percent of its net revenues from governmental sources. Participation in Medicare is contingent upon the hospital having a Medicare provider agreement. Participation in other governmental programs (Medicaid) as well as most commercial insurance is also contingent upon that agreement. Hospitals, including “Catholic” hospitals, cannot survive without a Medicare provider agreement. That agreement may be terminated for non-compliance with Medicare and other governmental regulations such as the recent ACA/HHS “Nondiscrimination in Health Programs and Activities” final rule, which could require “Catholic” hospitals to provide services which violate moral principals of the Church. [ABSTRACT FROM PUBLISHER]

The U.S. Department of Health and Human Services (HHS) has reached its second-ever settlement related to a ransomware attack. Maryland-based Green Ridge Behavioral Health has agreed to pay $40,000 and implement a corrective action plan after an investigation found potential violations of the HIPAA rule and lax protections following an attack in 2019. Ransomware attacks have become a growing threat to healthcare organizations, with a 264% increase in large breaches reported to the HHS involving ransomware. The HHS has released voluntary goals for healthcare organizations to boost their cyber protections and plans to propose enforceable standards in the future. [Extracted from the article]

A report by the HHS' Office of Inspector General found that providers generally followed Medicare rules when delivering care via telehealth during the COVID-19 pandemic. The audit examined a sample of evaluation and management services provided from March to November 2020 and found that physicians and other practitioners complied with Medicare requirements for 105 out of 110 services. Payments that didn't meet requirements were largely due to clerical errors or the inability to access records. The report also noted that telehealth utilization increased significantly during the pandemic, and legislators are considering making some pandemic-era flexibilities for telehealth permanent. [Extracted from the article]

Alabama health system, Baptist Health, has filed a lawsuit against Humana, alleging that the insurer underpaid for outpatient drugs provided under the 340B drug discount program to Medicare Advantage patients. Baptist Health claims that the reimbursements were determined by an invalidated payment model, resulting in underpayments that Humana continues to benefit from. This lawsuit comes after the CMS finalized a rule to address illegal payment cuts in the 340B program, which hospitals argued did not consider the financial benefits for Medicare Advantage insurers. The 340B program requires pharmaceutical companies to provide discounts to providers serving low-income communities, and the CMS had previously cut Medicare payments for certain drugs acquired under the program in 2018. To fix the underpayments, regulators decided to provide a lump sum to each hospital in the 340B program, but this required cutting payments to all hospitals for non-drug items and services over 16 years. The American Hospital Association raised concerns about this plan, as many Medicare Advantage insurers pay hospitals based on traditional Medicare rates. In response, regulators stated that they could not interfere in the payment rates set by Medicare Advantage organizations. Baptist Health has contacted Humana multiple times about retroactive adjustments and remedy payments, but the insurer has disputed any obligation to make those payments. Humana has declined to comment on the ongoing litigation. [Extracted from the article]

The Department of Health and Human Services (HHS) has released voluntary cybersecurity performance goals (CPGs) for the healthcare industry to protect against cyberattacks. The goals cover safeguards such as email security, multifactor authentication, and basic cybersecurity training. The HHS 405(d) Task Group, a collaboration between the public-private partnership Healthcare and Public Health Sector Coordinating Council and the federal government, offers resources and tools to prepare healthcare organizations for cyber threats. The healthcare industry is experiencing a rise in cyberattacks due to its valuable information and the potential impact on patient lives. The HHS is working to establish minimum cybersecurity standards that may become mandatory in the future. The next steps include revising the Health Insurance Portability and Accountability Act (HIPAA) Security Rule to include the CPGs and determining the regulations and funding needed to implement them. [Extracted from the article]

Montefiore Medical Center, based in New York City, has agreed to pay $4.75 million to settle allegations that data security failures allowed an employee to steal and sell the protected health information of thousands of patients. The employee had taken data from over 12,500 patients two years prior and sold it to an identity theft ring. The Office for Civil Rights (OCR) found that Montefiore had multiple potential violations of the HIPAA Security Rule and lacked key safeguards to detect or prevent the attack. The settlement highlights the growing concern about cybersecurity in the healthcare sector, with the OCR reporting a significant increase in large breaches affecting millions of people. The OCR will monitor Montefiore for two years and the medical center will implement a corrective action plan. Montefiore has already taken steps to improve security, including increased staff training and expanded monitoring capabilities. [Extracted from the article]

The U.S. Department of Health and Human Services (HHS) has finalized a rule that allows opioid treatment programs to use telehealth for medication treatment. Providers will be able to initiate treatment with buprenorphine through audio-only or audio-visual telehealth, and methadone treatment through an audio-visual platform. The rule aims to address the opioid epidemic and expand access to care, particularly for those in rural areas or with low income. Telehealth has been shown to increase access to mental healthcare and opioid use disorder treatment, potentially preventing overdoses. The rule also includes other changes to treatment and delivery standards at opioid treatment programs. [Extracted from the article]

According to new data released by federal regulators, accountable care organizations (ACOs) in traditional Medicare are thriving, with a 3% increase in participation from 2023. Roughly 13.7 million Medicare patients, almost half of beneficiaries on traditional Medicare, are now in ACOs, and the number of participating providers has also increased. ACOs have been shown to produce better outcomes and savings for Medicare's trust fund. However, while progress has been made towards the Biden administration's goal of bringing all 34 million beneficiaries into value-based arrangements by 2030, growth in Medicare Shared Savings, the flagship accountable care program, has been stagnant. The CMS has made efforts to revitalize interest among providers, but participation has not increased as expected. The CMS also reported increased participation in other programs, such as Kidney Care Choices and ACO REACH, which aims to improve care for underserved populations. The National Association of ACOs expressed satisfaction with the growth in CMS programs but emphasized the need for further improvements, including less strenuous quality reporting requirements. [Extracted from the article]

The U.S. Department of Health and Human Services (HHS) has released voluntary cybersecurity goals for healthcare and public health organizations. The goals are aimed at helping organizations prevent cyberattacks, improve their response to incidents, and minimize risk. Healthcare data breaches have been on the rise, exposing sensitive personal information and posing risks to patient safety. The HHS goals aim to help organizations build layered protection against cyberattacks and create a more resilient sector. The goals include essential safeguards such as email security and basic cybersecurity training, as well as enhanced protections like cybersecurity testing and addressing threats at vendors. The American Hospital Association supports the goals but has concerns about mandated cybersecurity standards tied to funding. [Extracted from the article]