Tuesday Tidbits

Generative AI

Tuesday Tidbits

David Ermer–Congress, FDA, Generative AI, Medical / Rx research, Rx coverage, U.S. Healthcare–
Photo by Patrick Fore on Unsplash

From Washington, DC,

  • BioPharma Dive tells us,
    • Novo Nordisk’s top executive vowed to reopen price negotiations with insurers covering the company’s obesity and diabetes drugs at a congressional hearing on Tuesday in which lawmakers pressed Novo to lower the cost of the fast-selling medicines.
    • At the hearing, Novo CEO Lars Fruergaard Jørgensen said the company would consider new talks with insurers about the list prices of Wegovy and Ozempic if they follow through on a pledge to keep the medicines on their formularies. Novo has claimed that insurers have previously pulled coverage of its other medicines — such as insulins — once the company lowered list prices, because it resulted in less revenue for payers afterwards.
    • “If it works in a way where patients get access to a more affordable medicine, and we have certainty that it actually happens and not like when we lowered prices in prior rounds — that less people got access to our medicine — we will be positive towards it,” Jørgensen said.” * * *
    • [Senate HELP Committee Chair Bernie] Sanders [I VT] came to the hearing with, what he claimed, is a commitment from Cigna [Express Scripts], UnitedHealth Group [/ Optum Rx] and CVS Health [/ Caremark] to commit to covering the two drugs even if lower list prices lead to lower rebates. The initiative for doing so was the difference in list and after-rebate prices for Wegovy and Ozempic in the U.S. compared to other countries.”
  • Here is a link to the Federal Trade Commission’s public administrative complaint against Express Scripts, Caremark, and Optum Rx over insulin rebates.
  • Per Healthcare Dive,
    • “The chair of the powerful Senate Finance Committee is pressing hospitals on their compliance with federal emergency care law amid mounting reports that patients who need lifesaving abortions are being turned away.
    • “Sen. Ron Wyden, D-Ore., sent letters to eight hospitals in states with abortion restrictions on Monday, asking about policies and procedures they have in place around the Emergency Medical Treatment and Active Labor Act, or EMTALA.
    • “Wyden also asked for a list of personnel involved in deciding when terminating a pregnancy is the appropriate course of treatment, and what legal and human resource support is offered to them by the hospital.”
  • CMS has created a website for its new civil monetary penalty program applicable to Section 111 reporting that will take effect on October 5, 2024, and will hold a compliance webinar on October 15, 2024, at 1 pm ET.
  • Per HHS press releases,
    • “Today, the U.S. Department of Health and Human Services (HHS), through the Administration for Strategic Preparedness and Response (ASPR), announced actions to increase the supply of mpox vaccine, supporting the U.S. Government commitment to make over a million combined doses of mpox vaccines available to the global mpox response. This is the largest international donation of the JYNNEOS mpox vaccine to date, which just received regulatory approval from WHO last week.”
  • and
    • “Today, the Health Resources and Services Administration (HRSA), an agency of the U.S. Department of Health and Human Services (HHS), announced nearly $75 million to support health care services in rural America. Funding will launch new opioid treatment and recovery services in rural communities, strengthen maternal health care in the South, and help rural hospitals stay open. HRSA Administrator Carole Johnson attended an event yesterday in Wilson, North Carolina, where she discussed the impact of this investment in rural health care.” * * *
    • “For a list of the awards, visit: https://www.hrsa.gov/about/news/fy24-rural-award-announcements“
  • Bloomberg reports,
    • “The Biden administration issued a final rule Tuesday designed to address suspicious billing for durable medical equipment that may have cost the Medicare program more than $2 billion.
    • “The problem involving urinary catheters has disproportionately affected accountable care organizations, the groups of doctors, clinicians, and hospitals that provide coordinated care for beneficiaries in traditional Medicare. 
    • “After detecting the spike in billing in early 2023, the Centers for Medicare & Medicaid Services stopped payment on almost all of the claims and began an investigation.
    • “They found the activity “was attributed to a small group of durable medical equipment supply companies,” and “determined that the beneficiaries did not receive catheters and were not billed directly, physicians did not order these supplies, and supplies were not needed,” said a CMS fact sheet. Since then, the top 15 billers of suspicious catheter claims have had their Medicare enrollment revoked.
    • “The CMS rule (RIN 0938-AV20) excludes payments involving certain billing codes for durable medical equipment from calculations used to assess an ACO’s financial performance in 2023.”

From the public health and medical research front,

  • BioPharma Dive tells us
    • “Obesity drug startup Metsera on Tuesday reported its first clinical data since launching in April with $290 million in venture funding. The data come from a Phase 1 trial of a drug, MET-097, that’s designed to have longer-lasting effects than injectable GLP-1 therapies like Novo Nordisk’s Wegovy. The results show that a weekly administration of the highest dose tested stimulated weight loss of 7.5% over 36 days, “matching, or potentially exceeding,” currently marketed and investigational anti-obesity medications, Metsera chief medical officer Steve Marso said in a statement. Metsera claimed the findings are supportive of once-monthly dosing and will start mid-stage trials in the fourth quarter, with results expected next year.” 
  • Per a National Institutes of Health press release,
    • “Cancer incidence trends in 2021 largely returned to what they were before the COVID-19 pandemic, according to a study by researchers at the National Institutes of Health (NIH). However, there was little evidence of a rebound in incidence that would account for the decline in diagnoses in 2020, when screening and other medical care was disrupted. One exception was breast cancer, where the researchers did see an uptick in diagnoses of advanced-stage disease in 2021. The study appears Sept. 24, 2024, in the Journal of the National Cancer Institute.
    • “A previous study showed that new cancer diagnoses fell abruptly in early 2020, as did the volume of pathology reports, suggesting that many cancers were not being diagnosed in a timely manner. To determine whether these missed diagnoses were caught in 2021, possibly as more advanced cancers, researchers from NIH’s National Cancer Institute (NCI) compared observed cancer incidence rates for 2021 with those expected from pre-pandemic trends using data from NCI’s Surveillance, Epidemiology, and End Results Program.”
    • “A full recovery in cancer incidence should appear as an increase over pre-pandemic levels (also known as a rebound) to account for the missed diagnoses. The researchers looked at cancer overall, as well as five major cancer types that vary in how they are typically detected: through screening (female breast and prostate cancer), due to symptoms (lung and bronchus and pancreatic cancer), or incidentally during other medical procedures (thyroid cancer).
    • “Cancer incidence rates overall and for most specific cancers approached pre-pandemic levels, with no significant rebound to account for the 2020 decline. However, in addition to an uptick in new diagnoses of advanced breast cancer in 2021, the data also provided some evidence of an increase in diagnoses of advanced pancreatic cancer. Also, new diagnoses of thyroid cancers in 2021 were still below pre-pandemic levels.
    • “The researchers concluded that 2021 was a transition year that was still affected by new variants and new waves of COVID-19 cases, which continued to impact medical care. They said the findings highlight the need for ongoing monitoring to understand the long-term impacts of the pandemic on cancer diagnoses and outcomes.”
  • CNN reports,
    • “The US government plans to make more at-home Covid-19 tests available for free this month as the country heads into respiratory virus season with high levels of the coronavirus already circulating.
    • “Each household will be able to order another round of four free at-home test kits starting at the end of September at COVIDTests.gov.
    • “More than 900 million test kits have been delivered directly to US residents through the COVIDTests.gov program, according to the US Department of Health and Human Services.
    • “COVID-19 testing can help you know if you have COVID-19 so you can decide what to do next, like getting treatment to reduce your risk of severe illness and taking steps to lower your chances of spreading the virus to others,” the agency said.
    • “This next set of tests – the program’s seventh round of distribution – will be able to detect currently circulating variants and can be used as people prepare for year-end holiday gatherings.”
  • The Washington Post reports that “Doctors and patients struggle with starting and stopping GLP-1 medications with little guidance.”
  • Per Fierce Pharma,
    • “The FDA is having second thoughts about the broad labels it has granted PD-1 inhibitors in newly diagnosed stomach cancer, questioning whether restrictions should be placed on products from Bristol Myers Squibb and Merck & Co. plus a stomach cancer hopeful from BeiGene.
    • “In a briefing document prepared for an Oncologic Drugs Advisory Committee meeting slated for Thursday, the FDA suggested that PD-1 inhibitors may not be suitable for certain patients with HER2-negative gastric cancer who have low PD-L1 expression, even though these immunotherapies have shown life-extension benefits in broad study populations.”

From the U.S. healthcare business front,

  • The American Hospital Association News reports,
    • “An EY report prepared for the AHA shows that tax-exempt hospitals and health systems delivered $10 in benefits to their communities for every dollar’s worth of federal tax exemption in 2020, the most recent year for which comprehensive data is available. It represents an increase from $9 in benefits from the prior year despite efforts in battling the COVID-19 pandemic.”  
  • Per Business Insurance,
    • “Prudential Financial is re-entering the U.S. stop-loss insurance market, targeting employers with at least 100 employees, offering coverage for medical, prescription drug, dental, vision, and short-term disability claims, BenefitsPro reports. Prudential aims to leverage its experience under the leadership of Jessica Gillespie, who is head of Prudential’s group insurance products. The stop-loss market has seen significant price hikes, with some competitors dissatisfied with their financial outcomes.”
  • and
    • “Health insurance companies are increasingly covering prescriptions written by pharmacists as states expand pharmacists’ prescribing authority through “test to treat” legislation, Forbes reports. This shift aims to improve access to medications amid a shortage of primary care physicians. Major insurers like Cigna and Blue Cross and Blue Shield of Illinois are adapting their coverage policies accordingly.”
  • The New York Times reports
    • “Every day, patients send hundreds of thousands of messages to their doctors through MyChart, a communications platform that is nearly ubiquitous in U.S. hospitals.
    • “They describe their pain and divulge their symptoms — the texture of their rashes, the color of their stool — trusting the doctor on the other end to advise them. 
    • “But increasingly, the responses to those messages are not written by the doctor — at least, not entirely. About 15,000 doctors and assistants at more than 150 health systems are using a new artificial intelligence feature in MyChart to draft replies to such messages.
    • “Many patients receiving those replies have no idea that they were written with the help of artificial intelligence. In interviews, officials at several health systems using MyChart’s tool acknowledged that they do not disclose that the messages contain A.I.-generated content.
    • “The trend troubles some experts who worry that doctors may not be vigilant enough to catch potentially dangerous errors in medically significant messages drafted by A.I.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy and law enforcement front,

  • Federal News Network tells us
    • “A record number of federal agencies and their chief information officers are getting top marks on how they manage IT and cybersecurity.
    • “A total of 13 agencies [including the U.S. Office of Personnel Management] received an overall A letter grades on a semiannual Federal IT Acquisition Reform Act (FITARA) scorecard.
    • “Another 10 agencies got a B grade for their overall IT and cybersecurity management. Only one agency, the Energy Department, received a C grade. No agencies received a D or an F.
    • “Agencies generally saw lower scores in the previous FITARA scorecard released in February.”
  • KFF Health News gives low marks to the federal agencies responsible for protecting healthcare organizations against cyberattacks.
  • Per a CISA press release,
    • “The Cybersecurity and Infrastructure Security Agency (CISA) published the Federal Civilian Executive Branch (FCEB) Operational Cybersecurity Alignment (FOCAL) Plan today. As the operational lead for federal cybersecurity, CISA uses this plan to guide coordinated support and services to agencies, drive progress on a targeted set of priorities, and align collective operational defense capabilities. The end result is reducing the risk to more than 100 FCEB agencies.
    • “Each FCEB agency has a unique mission, and thus have independent networks and system architectures to advance their critical work. This independence means that agencies have different cyber risk tolerance and strategies. However, a collective approach to cybersecurity reduces risk across the interagency generally and at each agency specifically, and the FOCAL Plan outlines this will occur. CISA developed this plan in collaboration with FCEB agencies to provide standard, essential components of enterprise operational cybersecurity and align collective operational defense capabilities across the federal enterprise.” * * *
    • “The FOCAL Plan was developed for FCEB agencies, but public and private sector organizations should find it useful as a roadmap to establish their own plan to bolster coordination of their enterprise security capabilities. 
    • “The Plan is not intended to provide a comprehensive or exhaustive list that an agency or CISA must accomplish. Rather, it is designed to focus resources on actions that substantively advance operational cybersecurity improvements and alignment goals.”
  • Dark Reading reports,
    • “The Justice Department today [September 19] announced a court-authorized operation to disrupt a botnet affecting 200,000 devices in the United States and abroad.
    • “According to unsealed documents, the botnet, known as Raptor Train, is operated by People’s Republic of China (PRC) state-sponsored hackers working for a company based in Beijing. Known publicly as Integrity Technology Group, it is also known as the advanced persistent threat (APT) group Flax Typhoon in the private sector.
    • A variety of connected and Internet of things (IoT) devices have been affected by the botnet malware, including small-office/home-office (SOHO) routers, Internet protocol cameras, digital video recorders, and network-attached storage (NAS) devices.”

From the cyber vulnerabilities and breaches front,

  • Cybersecurity Dive lets us know,
    • “Ivanti warned Thursday of a critical path traversal vulnerability in Cloud Service Appliance, which is currently facing exploitation attempts by hackers. The vulnerability, listed as CVE-2024-8963, has a CVSS score of 9.4 and allows an unauthenticated hacker to gain access to restricted functionality.
    • “Ivanti previously issued a patch for CSA on Sept. 10., but the company said the path traversal vulnerability was discovered while investigating exploitation linked to an OS command injection vulnerability, listed as CVE-2024-8190. 
    • “The company warned that when the two vulnerabilities are used in conjunction with each other, a hacker can bypass admin authentication and execute arbitrary commands.” 
  • Dark Reading tells us “Security Firm’s North Korean Hacker Hire was not an Isolated Incident; What happened to KnowBe4 also has happened to many other organizations, and it’s still a risk for companies of all sizes due to a sophisticated network of government-sponsored fake employees.” Check out the article.

From the ransomware front,

  • Dark Reading informs us,
    • “Inc ransomware is on the rise, with one well-known threat actor recently using it to target American healthcare organizations.
    • “Vice Society, which Microsoft tracks as Vanilla Tempest, has been active since July 2022. In that time, the Russian-speaking group has made use of various families of ransomware to aid its double extortion attacks, including BlackCat, Hello Kitty, Quantum Locker, Rhysida, Zeppelin — including its own variant — and its own, eponymous program.
    • “In a series of posts on X, Microsoft Threat Intelligence Center (MSTIC) flagged the group’s latest weapon: Inc ransomware.”
  • Per Cybersecurity Dive,
    • “A special legislative committee in Suffolk County, New York, found officials ignored repeated warnings and failed to prepare ahead of a September 2022 ransomware attack that disrupted essential government services for months, in a report released last week.
    • “Officials blamed the ransomware attack on a failure of leadership, including the lack of an incident response plan and a failure to respond to FBI warnings of potential infiltration. 
    • “Suffolk County operated using a variety of IT teams and had no CISO, resulting in a lack of coordination on how to prepare for potential cyber threats. The attack has so far cost the county more than $25 million in remediation costs and other expenses.”
  • Cyberscoop reports on a debate of experts at the 2024 mWISE conference about what more could be done to stop ransomware attacks in the wake of police action and tens of millions in ransom payments over the past year. 

From the cyber defenses front,

  • Cyberscoop points out,
    • “UnitedHealth Group is still in the recovery process months after a ransomware attack on its Change Healthcare subsidiary, with its chief information security officer saying the company has essentially “started over” with regard to its computer systems. 
    • “When I say start over, I really, truly mean start over,” Steven Martin said Thursday at the Mandiant Worldwide Information Security Exchange (mWISE). “The only thing that we kept from the old environment into the new environment was the cables. New routers, new switches, new compute infrastructure, deployed everything from a safe environment, truly started over. I felt like that was the only way that we could really ensure that we ended up with something that we could stand behind for the health care space, because it’s what it deserved.” 
  • Cybersecurity Dive adds,
    • “CEOs and company boards often ask Kevin Mandia, founder and former CEO of Mandiant, how to determine the strength of their CISOs. Above all else, Mandia advises executives to assess their CISO’s disposition.
    • “Do you have a CISO with a security mindset?” “If they don’t have that, you’re probably not going to have a great security program,” Mandia said Wednesday during his opening keynote at the Mandiant Worldwide Information Security Exchange conference in Denver.” * * *
    • “Over the past couple decades Mandia’s crafted a series of five questions designed to help executives and board members test their confidence in a CISO’s ability to excel in their job.
    • “The questions on Mandia’s CISO confidence test include:
      • How would you break into us? What is our weak spot?
      • What is our worst-case scenario?
      • What would you do if the worst-case scenario occurred?
      • How resilient are we? How long would it take to recover our systems and applications?
      • What do you need?
    • “Mandia, who now serves in a strategic security advisor role at Google Cloud, said CEOs should focus on their CISO’s response to these questions as a measure of their demeanor.
    • “I tell CEOs, you don’t even care what the answer is to these questions as long as your CISO actually has one, because at least that means you have the mindset,” Mandia said.”
  • Health Tech offers five steps to follow after a breach.
  • Per Bleeping Computer,
    • “Microsoft announced today that Hotpatching is now available in public preview for Windows Server 2025, allowing installation of security updates without restarting.
    • “Hotpatching deploys Windows security updates without requiring a reboot by patching the in-memory code of running processes without restarting them after each installation.
    • “Among the benefits of Windows Hotpatching, Redmond highlights faster installs and reduced resource usage, lower workload impact because of fewer reboots over time, and improved security protection because it reduces the time exposed to security risks.
    • “Instead of 12 mandatory reboots a year on ‘Patch Tuesday,’ you’ll now only have quarterly scheduled reboots (with the rare possibility of reboots being required in a nominal Hotpatch month),” said Windows Server Director of Product Hari Pulapaka on Friday [September 20].”

Weekend Update

David Ermer–Congress, Employee Wellness Programs, Generative AI, Medical / Rx research, Medicare, U.S. Healthcare–

From Washington, DC,

  • The Hill reports,
    • “Rep. Andy Harris (R-Md.) predicted on Friday [September 13] that a government shutdown will be avoided as one looms.
    • “Do you believe that Republicans will be able to avoid a government shutdown?” NewsNation’s Blake Burman asked Harris on “The Hill.” “And do you think shutdowns are useful tools, or not?”
    • “There will not be a government shutdown, you know, one month before an election, that I can tell you,” Harris responded. 
    • “Lawmakers are racing to avoid a shutdown before the end-of-the-month deadline.”
  • Sen. Tim Kaine (D VA) has signed onto a bill as a co-sponsor to mandate FEHB coverage of IVF procedures. The Senate Majority Leader reportedly plans to bring up an IVF mandate bill this coming week.  
  • The American Medical Association’s public website explains various Medicare payment reform laws for its members.

From the public health and medical research front,

  • The AMA points out the top preventive health tips that your internist wants you to know.
  • The New York Times identifies “Three Medical Practices That Older Patients Should Question. Some treatments and procedures become routine despite lacking strong evidence to show that they’re beneficial. Recent studies have called a few into question.”
  • The Washington Post reports,
    • “More than 5 percent of women who get their tubes tied later become pregnant, a new analysis suggests — and researchers say the failure of tubal sterilization procedures, which are widely considered permanent, “may be considerably more common than many expect.”
    • “The study, published in NEJM Evidence, used data from the National Survey of Family Growth, which looks at contraception use, pregnancy and birth outcomes among a representative sample of U.S. women aged 15 to 44. The data was assembled during four waves of data collection from about 4,000 women who had tubal ligations between 2002 and 2015. * * *
    • “When choosing what birth control will work best for them, people consider many different things, including safety, convenience, and how fast they can start to use the method,” says Eleanor Bimla Schwarz, chief of the UCSF Division of General Internal Medicine at Zuckerberg San Francisco General and the study’s first author, in a news release.
    • “This study shows that tubal surgery cannot be considered the best way to prevent pregnancy. People using a contraceptive arm implant, or an IUD are less likely to become pregnant than those who have their tubes tied.”
    • “The researchers call for more inquiry into the “real-world effectiveness” of different forms of contraception.”
  • STAT News informs us from a Barcelona, Spain, oncology conference held this weekend,
    • “An AstraZeneca immunotherapy, given both before and after surgery, improved survival rates in patients with bladder cancer, results that could reshape how muscle-invasive bladder tumors are treated. 
    • “The regimen using Imfinzi, the company’s anti-PD-L1 checkpoint inhibitor, cut the risk of death by 25% compared to treating patients before surgery with chemotherapy alone, researchers reported Sunday. It also lowered the risk of disease recurrence by about a third. 
    • “It really is offering a curative-intent regimen and improving the cure rate in the disease,” Susan Galbraith, AstraZeneca’s head of oncology R&D, told STAT at the European Society for Medical Oncology meeting in Barcelona, using the word “transformative” several times. The results of the Phase 3 NIAGARA trial were presented in a presidential session at the conference and simultaneously published in the New England Journal of Medicine.
    • “Galbraith said the company would talk with regulators about the data, but experts will be watching to see if an ongoing debate about clinical trial design could pose a problem in this case.”
  • and
    • “Patients with advanced cancers often develop a secondary condition that causes them to shed weight, making it even harder to tolerate their cancer treatments. Called cachexia, it’s an under-recognized syndrome that researchers are still trying to tease out, and one that’s attracting more interest from drugmakers.
    • “On Saturday, Pfizer reported that an experimental antibody not only helped cancer patients with cachexia regain some weight versus placebo, but that it also seemed to increase their muscle mass and activity levels, signaling that the added weight translated into meaningful benefits.”
  • and
    • “A targeted immunotherapy being developed by the biotech iTeos Therapeutics and GSK delivered promising response rates in patients with a type of lung cancer, propelling the treatment into a pivotal Phase 3 trial and adding fuel to a broader debate about the validity of the target.
    • “The companies reported on Saturday that their combination of a TIGIT-targeting antibody and GSK’s Jemperli increased the percentage of patients who saw their tumors shrink versus those who received Jemperli alone, meeting the goals of the Phase 2 trial and the expectations that analysts had set for the study to be considered a success.”

From the U.S. healthcare business front,

  • Healthcare Dive tells us,
    • “Health systems are a large market for artificial intelligence startups, but companies selling to insurers or life sciences firms create value more quickly, according to an analysis by venture capital firm Flare Capital Partners.
    • “Most AI startups selling their products to health systems haven’t progressed past early-stage investment rounds. Just over 5% of those companies have reached a Series C raise or later, compared with nearly 10% of startups in life sciences and about 16% of companies selling to health plans. 
    • “The gap suggests AI startups in the life sciences and health plan markets have been able to create more value for their customers, according to Flare. But those sectors also have higher operating margins and can likely devote more resources — and time — to scale AI products.”\ 

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy front,

  • Federal News Network tells us,
    • “White House officials are contemplating a new cybersecurity executive order that would focus on the use of artificial intelligence.
    • “Federal cybersecurity leaders, convening at the Billington Cybersecurity Conference in Washington this past week, described AI as both a major risk and a significant opportunity for cyber defenders.
    • ‘White House Deputy National Security Advisor Anne Neuberger called AI a “classic dual use technology.” But Neuberger is bullish on how it could improve cyber defenses, including analyzing logs for cyber threats, generating more secure software code, and patching existing vulnerabilities.
    • “We see a lot of promise in the AI space,” Neuberger said. “You saw it in the president’s first executive order. As we work on the Biden administration’s potentially second executive order on cybersecurity, we’re looking to incorporate some particular work in AI, so that we’re leaders in the federal government in breaking through in each of these three areas and making the tech real and proving out what’s possible.”
  • Per a Labor Department Employee Benefit Security Administration press release,
    • “In its continuing effort to protect U.S. workers’ retirement and health benefits, the U.S. Department of Labor today updated current cybersecurity guidance confirming that it applies to all types of plans governed by the Employee Retirement Income Security Act, including health and welfare plans, and all employee retirement benefit plans.
      • “The new Compliance Assistance Release issued by the department’s Employee Benefits Security Administration provides best practices in cybersecurity for plan sponsors, plan fiduciaries, recordkeepers and plan participants. The release updates EBSA’s 2021 guidance and includes the following:
      • “Tips for Hiring a Service Provider: Helps plan sponsors and fiduciaries prudently select a service provider with strong cybersecurity practices and monitor their activities, as ERISA requires.
      • “Cybersecurity Program Best Practices: Assists plan fiduciaries and recordkeepers in mitigating risks. 
      • “Online Security Tips: Offers plan participants who check their online retirement accounts with rules for reducing the risk of fraud and loss.”
  • Cybersecurity Dive lets us know,
    • “The White House Office of the National Cyber Director launched a program Wednesday to help fill the gap of about 500,000 available cybersecurity jobs across the country. 
    • “Service for America, a program developed alongside the Office of Management and Budget and the Office of Personnel Management, is a recruitment and hiring push that will help connect Americans with available jobs in cybersecurity, technology and artificial intelligence. 
    • “The program’s major emphasis is to reach job candidates without traditional qualifications, such as computer science or engineering backgrounds. 
    • “Many Americans do not realize that a cyber career is available to them,” National Cyber Director Harry Coker Jr. said in a blog post released Wednesday. “There is a perception that you need a computer science degree and a deeply technical background to get a job in cyber.”
    • “In reality, Coker said people of all backgrounds can find well-paying jobs in cybersecurity, and the White House has been promoting efforts to connect a new generation of prospective candidates into those positions.”
  • and
    • “Marsh McLennan and Zurich Insurance Group on Thursday [September 5] issued a call for government intervention to help resolve the growing risk of catastrophic cyber events and a multibillion dollar gap in terms of what the current insurance market can absorb. 
    • “The cyber insurance market has seen significant growth in recent years, and is expected to exceed $28 billion in gross written premiums in 2027, more than double the amount written in 2023, according to a whitepaper released by the firms Thursday.  
    • “However, the companies warn a risk protection gap of about $900 billion exists between insured losses and economic losses due to cyberattacks. Many small- to medium-sized businesses are either underinsured or carry no coverage to protect against such losses.” 

From the cyber vulnerabilities and breaches front,

  • Per a Centers for Medicare Services press release,
    • “The Centers for Medicare & Medicaid Services (CMS) and Wisconsin Physicians Service Insurance Corporation (WPS) are notifying people whose protected health information or other personally identifiable information (PII) may have been compromised in connection with Medicare administrative services provided by WPS. WPS is a CMS contractor that handles Medicare Part A/B claims and related services for CMS.  
    • “The notification comes following discovery of a security vulnerability in the MOVEit software, a third-party application developed by Progress Software and used by WPS for the transfer of files in providing services to CMS. WPS is among many organizations in the United States that have been impacted by the MOVEit vulnerability. The security incident may have impacted PII of Medicare beneficiaries that was collected in managing Medicare claims as well as PII collected to support CMS audits of healthcare providers that some individuals who are not Medicare beneficiaries have visited to receive health care services.
    • “CMS and WPS are mailing written notifications to 946,801 current people with Medicare whose PII may have been exposed, informing them of the breach and explaining actions being taken in response.”
  • Cybersecurity Dive reports,
    • “Federal authorities in the U.S. and nine other countries warn that threat groups affiliated with Russia’s military intelligence service are targeting global critical infrastructure and key resource sectors, according to a joint cybersecurity advisory released Thursday. 
    • “Threat groups affiliated with a specialist unit of the Russian General Staff Main Intelligence Directorate have targeted government services, financial services, transportation systems, energy, and healthcare sectors of NATO members and countries in Europe, Central America and Asia, officials said in the advisory.
    • “To date, the FBI has observed more than 14,000 instances of domain scanning across at least 26 NATO members and several additional EU countries,” authorities said in the advisory. The attackers have defaced victim websites, scanned infrastructure, and exfiltrated and leaked stolen data.”
  • The Cybersecurity and Infrastructure Security Agency added three known exploited vulnerabilities to its catalog:
  • Dark Reading adds,
    • “This week the US Cybersecurity and Infrastructure Security Agency (CISA) warned about two new industrial control systems (ICS) vulnerabilities in products widely used in healthcare and critical manufacturing — sectors prone to attract cybercrime.
    • “The vulnerabilities affect Baxter’s Connex Health Portal and Mitsubishi Electric’s MELSEC line of programmable controllers. Both vendors have issued updates for the vulnerabilities and recommended mitigations that customers of the respective technologies can take to further mitigate risk.”
  • Per Cybersecurity Dive,
    • “Just over half of businesses in the U.S. and U.K. have been targets of a financial scam powered by “deepfake” technology, with 43% falling victim to such attacks, according to a survey by finance software provider Medius.
    • “Of the 1,533 U.S. and U.K. finance professionals polled by Medius, 85% viewed such scams as an “existential” threat to their organization’s financial security, according to a report on the findings published last month. Deepfakes are artificial intelligence-manipulated images, videos, or audio recordings that are bogus yet convincing.
    • “More and more criminals are seeing deepfake scams as an effective way to get money from businesses,” Ahmed Fessi, chief transformation and information officer at Medius, said in an interview. These scams “combine phishing techniques with social engineering, plus the power of AI.”

From the ransomware front,

  • Tech Radar points out,
    • “Research from Searchlight Cyber has shown the number of ransomware groups that operated in the first half of 2024 rose to 73, up from 46 in the same period of 2023. The findings suggest law enforcement’s efforts to curb cyber criminal groups have seen some success, especially in disrupting the operations of notorious group BlackCat, which has since dissolved.
    • “Groups were targeted by law enforcement in ‘Operation Cronos’, which facilitated the arrests of two people, took down 28 servers, obtained 1,000 decryption keys, and froze 200 crypto accounts – all linked to the infamous LockBit organization.
    • “Although the number of groups has risen, the number of victims has fallen, which indicates a potential diversification rather than growth of ransomware groups. Other Ransomware as a Service (RaaS) groups such as RansomHub and BlackBasta have become more active, complicating the landscape for cyber security.
  • Tripwire fills us in about Cicada ransomware.
  • ‘Per Cybersecurity Dive,
    • “A previously disclosed cyberattack at Halliburton disrupted parts of its operations and information was stolen in connection with the incident, the company said in a filing with the Securities and Exchange Commission Tuesday. 
    • “Halliburton discovered the attack in late August and immediately shut off certain services as a proactive measure. It continues to offer its products and services across the globe, the company said.
    • “The Houston company has incurred and will continue to incur certain expenses related to the attack. However, it does not expect the attack to have a material impact on its financial condition or results of operations.”

From the cybersecurity defenses front,

  • The Wall Street Journal reports,
    • “Cybersecurity professionals are reporting modest budget increases amid the need to defend against new hacking threats and secure emerging technologies such as artificial intelligence.
    • “Spending on cybersecurity is rising 8% this year, compared with 6% in 2023, according to a survey of chief information security officers published Thursday by cybersecurity consulting firm IANS and recruiting company Artico Search. The survey polled 755 CISOs from April into August, with 681 completing its budget section.
    • “Despite the small improvement, security spending is growing at a lower rate than the 17% increase in 2022. Still, the shift indicates a gradual recovery after companies slowed cyber spending and in some cases froze hiring after the pandemic, said Steve Martano, an Artico partner and IANS faculty member. 
    • “People are feeling more optimistic than they were six months ago,” Martano said, adding that more cybersecurity leaders are seeing small budget increases and there are signs the security job market will improve.”
  • Dark Reading offers a commentary on “How CISOs Can Effectively Communicate Cyber-Risk. A proximity resilience graph offers a more accurate representation of risk than heat maps and risk registers,and allows CISOs to tell a complex story in a single visualization.”
  • ISACA offers a commentary on “The Never-ending Quest: Why Continuous Monitoring is Crucial for Cybersecurity.”
  • If you work for or represent a small or medium sized HIPAA covered entity or business associate, you may want to “register for an introductory webinar [to held on September 10 at noon ET and September 11 at 3 pm] on the free Security Risk Assessment Tool (SRA Tool) hosted by Altarum with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) and the Assistant Secretary for Technology Policy (ASTP). The webinar will also feature changes in SRA Tool version 3.5, available in September 2024.”
  • Security Week shares a discussion between CSOs Jaya Baloo from Rapid7 and Jonathan Trull from Qualys about the route, role, and requirements in becoming and being a successful CISO.

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy front,

  • Cybersecurity Dive reports,
    • “The Cybersecurity and Infrastructure Security Agency introduced an online portal Thursday [August 29] for organizations to voluntarily report malicious cyberattacks, vulnerabilities and data breaches. 
    • “The CISA services portal is a secure platform that provides enhanced functionality and collaboration features, including the ability to save and update incident reports, share submitted reports with colleagues or clients and search for reports. Users can also have informal discussions with CISA through the portal.
    • “An organization experiencing a cyberattack or incident should report it — for its own benefit, and to help the broader community,” Jeff Greene, executive assistant director for cybersecurity at CISA, said in a statement. “CISA and our government partners have unique resources and tools to aid with response and recovery, but we can’t help if we don’t know about an incident.”
  • Per FedScoop,
    • “Federal agencies are counting down the days until September 30 to meet a combination of zero-trust cybersecurity requirements. The requirements are part of a multi-year strategy by the Office of Management and Budget (OMB) to apply various cybersecurity techniques to safeguard federal agency users, networks, devices and data.
    • “One of the more vexing requirements, according to a new report, includes provisions to inventory and monitor the increasingly complex IT landscape involving not just traditional IT but also an ever-expanding array of operating technologies (OT) and the Internet of Things (IoT). The convergence of data and applications linked to IT, OT and IoT devices has introduced a new era of security risks that OMB has tasked agencies to address.
    • “The widespread adoption of OT devices not only expands the number and diversity of assets agencies must manage but also the range of vulnerabilities they need to address,” explains a new report commissioned for FedScoop and underwritten by Asc3nd Technologies Group. “More to the point: Linking OT data and devices to IT systems creates new pathways for cyberattacks that adversaries are exploiting with increasing frequency.”
    • “To address those and related risks, OMB directive M-24-04 requires agencies, among other things, to put tools and measures in place that provide a comprehensive understanding of all devices connected to their networks. They must also be prepared to provide detailed asset reports to the Cybersecurity and Infrastructure Agency (CISA) within 72 hours.”
  • The Wall Street Journal adds,
    • As cyberattacks plague companies across all industries and cause headaches for consumers, regulators are demanding that victims report hacks in short time periods—and the rules are rarely consistent, creating a compliance nightmare.
    • In addition to widely publicized rules such as those brought into force by the U.S. Securities and Exchange Commission in December 2023, many companies must also comply with other federal demands, rules from state regulators and industry-specific requirements. * * *
    • “Health insurer Blue Cross Blue Shield Association, for instance, said in its response [to CISA proposed Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule] that healthcare companies may need to report incidents under the Health Insurance Portability and Accountability Act, the Federal Trade Commission’s rules on data privacy, the SEC’s rules and CIRCIA, once that rule is final.  
    • “Four separate standards with similar but slightly different compliance expectations would impose an unreasonable burden with marginal benefit towards improving cybersecurity as compared to having a single, harmonized standard,” said Kris Haltmeyer, the association’s vice president of policy analysis.”

From the cyber vulnerabilities and breaches front,

  • Dark Reading points out,
    • “Multiple exploit campaigns linked to a Russian-backed threat actor (variously known as APT29, Cozy Bear, and Midnight Blizzard) were discovered delivering n-day mobile exploits that commercial spyware vendors have used before.
    • “According to Google’s Threat Analysis Group (TAG), the exploit campaigns were delivered “from a watering hole attack on Mongolian government websites,” and each one is identical to exploits previously used by commercial surveillance vendors (CSVs) Intellexa and NSO Group. That suggests, as the researchers at Google TAG note, that the authors and/or providers are the same. * * *
    • “The researchers go on to add that though there are still outstanding questions as to how the exploits were acquired, this does highlight how exploits developed first by the commercial surveillance industry become even more of a threat as threat actors come across them.” 
  • Cyberscoop adds,
    • “Online scam cycles have gotten significantly shorter and more effective over the past four years, as cybercriminals increasingly favor smaller, simpler, faster and more targeted campaigns that can yield higher revenues over the long term.
    • “The findings, from a mid-year cybercrime report released Thursday by Chainalysis, show that scammers are refreshing their online and blockchain-based infrastructure faster than ever before.
    • “For instance, a huge chunk of all scam revenues being tracked by Chainalysis on the blockchain (43%) were sent to wallets that only became active over the past year — something the company said suggests a surge of newly created scamming campaigns.
    • “That’s significantly larger than any other observed year — the previous high was 29.9% in 2022 — and it has coincided with what Chainalysis described as a concerted effort by criminals to dramatically shrink the time they spend on one spam campaign before moving onto another.”

From the CrowdStrike outage front,

  • Cybersecurity Dive informs us,
    • “The financial impact from last month’s ill-fated CrowdStrike Falcon sensor update that caused a global IT network outage will continue through the first half of 2025, company executives said Wednesday during an earnings call.
    • “Executives warned investors of temporary delays in its sales pipeline generation, longer sales cycles due to increased scrutiny from new and existing customers and muted upsell potential.
    • “CrowdStrike expects an impact of about $60 million in net new annual recurring revenue and subscription revenue due to what it dubbed its “customer commitment packages,” discounts it’s offering some customers through the second half of this year, CFO Burt Podbere said during the Wednesday earnings call for the company’s fiscal 2025 second quarter, which ended July 31. “When we get to the back half of next year, we’ll start to see an acceleration in the business.”

From the ransomware front,

  • The American Hospital Association News reports,
    • “The FBI, Cybersecurity and Infrastructure Agency and the Department of Defense Cyber Crime Center Aug. 29 issued a joint advisory to warn of Iranian-based cyber actors leveraging unauthorized network access to U.S. organizations, including health care organizations, to facilitate, execute and profit from future ransomware attacks by apparently Russian-affiliated ransomware gangs. The Iranian group, which is associated with the Government of Iran, has conducted a high volume of cyberattack attempts on U.S. organizations since 2017 and as recently as August 2024. Based on an FBI assessment, the cyber actors obtain network access for espionage reasons then collaborate with ransomware groups, including the notorious Russian-linked ransomware groups RansomHub and APLHV aka BlackCat, to execute ransomware attacks against the espionage target. BlackCat was responsible for the 2024 Change Healthcare ransomware attack, the largest and most consequential cyberattack in U.S. history. The advisory does not indicate if the Iranian actors had any role in the Change Healthcare attack but does state that the Iranian group’s ransomware activities are not likely sanctioned by the Government of Iran.
    • “The joint advisory provides tactics, techniques, procedures, and indicators of compromise obtained from FBI investigations and third-party reporting. The federal agencies urge organizations to apply the recommendations in the mitigations section of the advisory to reduce the likelihood of compromise from these Iranian-based cyber actors and other ransomware attacks.
    • “This alert demonstrates the close ‘international cooperation’ between hackers to exploit cyber espionage campaigns for criminal profit,” said John Riggi, AHA national advisor for cybersecurity and risk. “This alert also demonstrates the nation-state level sophistication and expertise of the ransomware groups that target U.S. health care. No health care organization, regardless of their cybersecurity preparedness, can be expected to fully defend against a group of nation-state-trained hackers collaborating with sophisticated ransomware gangs. Clearly, the initial access leading to a subsequent ransomware attack, sanctioned or not, is state-sponsored. We strongly encourage the U.S. government to treat these attacks as national security threats, by policy and action, and impose significant risk and consequences on our cyber adversaries. Offense is the best defense.”
    • “Although there is no specific threat information at this time, the field is reminded to remain especially vigilant over the holiday weekend, as we have historically seen increased targeting of health care around the holidays.”
  • Bleeping Computer adds,
    • “The RansomHub ransomware gang is behind the recent cyberattack on oil and gas services giant Halliburton, which disrupted the company’s IT systems and business operations.
    • “The attack caused widespread disruption, and Bleeping Computer was told that customers couldn’t generate invoices or purchase orders because the required systems were down.
    • “Halliburton disclosed the attack last Friday in an SEC filing, stating they suffered a cyberattack on August 21, 2024, by an unauthorized party.
  • Cybersecurity Dive reports,
    • “Volt Typhoon, a prolific state-linked threat actor, is exploiting a zero-day vulnerability in Versa Director servers in a campaign targeting internet service providers, managed service providers and other technology firms, researchers from Black Lotus Labs warned in a blog post Tuesday.
    • “The vulnerability, listed as CVE-2024-39717, allows users to upload files that are potentially malicious and gives them advanced privileges. 
    • “Black Lotus Labs researchers identified a custom webshell, which they call VersaMem, that is designed to intercept and harvest credentials and allow an attacker to gain access to a downstream computer network as an authenticated user. 

From the cybersecurity defenses front,

  • Per a NIST press release,
    • “[On August 29], the U.S. Artificial Intelligence Safety Institute at the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) announced agreements that enable formal collaboration on AI safety research, testing and evaluation with both Anthropic and OpenAI.
    • “Each company’s Memorandum of Understanding establishes the framework for the U.S. AI Safety Institute to receive access to major new models from each company prior to and following their public release. The agreements will enable collaborative research on how to evaluate capabilities and safety risks, as well as methods to mitigate those risks. 
    • “Safety is essential to fueling breakthrough technological innovation. With these agreements in place, we look forward to beginning our technical collaborations with Anthropic and OpenAI to advance the science of AI safety,” said Elizabeth Kelly, director of the U.S. AI Safety Institute. “These agreements are just the start, but they are an important milestone as we work to help responsibly steward the future of AI.”
    • “Additionally, the U.S. AI Safety Institute plans to provide feedback to Anthropic and OpenAI on potential safety improvements to their models, in close collaboration with its partners at the U.K. AI Safety Institute.” 
  • Per Dark Reading, “Ransomware attacks and email-based fraud account for 80% to 90% of all claims processed by cyber insurers, but a handful of cybersecurity technologies can help prevent big damages.” Check it out.

Tuesday’s Tidbits

David Ermer–CDC, CMS, Congress, COVID-19, Federal employment benefits, Generative AI, Medical / Rx research, Medicare, NIH, OPM, Rx coverage, U.S. Healthcare–
Photo by Patrick Fore on Unsplash

From Washington, DC,

  • Fedweek lets us know,
    • “Another report to Congress has estimated an annual $1 billion cost to the FEHB program from ineligible persons being covered as family members, a cost that is passed on to both enrollees and the government in the form of higher premiums.
    • “The Congressional Budget Office estimate—agreeing with one last year from the GAO—was done in an analysis of S-4035, which is pending a vote in the full Senate after Congress reconvenes September 9. A counterpart bill, HR-7868, has cleared the House committee level, as well.
    • “The bills would require agencies to verify the eligibility of dependents enrolled in the FEHB when the employee or annuitant starts or changes a dependent’s enrollment; require OPM to audit dependents’ enrollment in the program; and expand fraud risk assessments of the program to include information on ineligible enrollees. * * *
    • “CBO expects that implementing the bill would cause enrollment to decline by about 100,000 people, on average, in each year over the 2025-2034 period. Verifications of eligibility during open season would cause a decline of about 10,000 people, on average, in each year over the same period,” it says.
    • However, that estimate “is subject to significant uncertainty because no similar verification audit of the FEHB program has been undertaken,” it added.
  • FEHBlog sermonette — About ten years ago, OPM added a provision to the FEHB standards contracts providing that the carriers would foot the bill for any family member eligibility audits. OPM never has performed a verification audit due to the FEHB program’s size. However, audits are based on sampling, and surely a sample-based audit of various geographic regions where federal and postal employees live (e.g., Washington, DC and nearby counties, Texas, Florida, etc.) would have told OPM whether or not it has a family member eligibility problem.
  • OPM does have a more glaring enrollment problem because OPM separately reports enrollment and premiums to carriers. Consequently, carriers, which carry the insurance risk, do not have the opportunity to confirm that enrollees in their records (based on OPM’s data) are paying the proper premiums for selected self only or other than self only coverage. What is the sense of nailing down family member coverage when no one knows whether the enrollee is paying the proper or any premium?
  • For close to twenty years, CMS, which implements HIPAA’s electronic standards, has made available an electronic enrollment roster transaction known as the HIPAA 820, which would allow FEHB carriers to reconcile enrollment and premiums at the individual level using computer systems. That’s a massive gap in internal controls that needs to be corrected without further delay, in the FEHBlog’s humble opinion. All that OPM has to do is tell the payroll offices to use the HIPAA 820. End of sermonette.
  • Per a company press release,
    • Maximus has been awarded a $20 million contract from the Office of Personnel Management (OPM) to serve as the Contact Center Services Provider for the agency’s new Postal Service Health Benefits Program. This program will provide health insurance to eligible Postal Service employees, annuitants, and their eligible family members starting in 2025.
    • Maximus will be leading the customer support effort to answer calls and emails for OPM’s new, enhanced customer service platform dedicated to assisting eligible individuals access health insurance benefits. Maximus will leverage offerings from its Total Experience Management (TXM) solution, including state-of-the-art telephony, customer relationship management, and call quality reporting tools to provide best-in-class customer service.
    • “The Postal Service Health Benefits Program is an invaluable benefit for the U.S. Postal Service workforce, and Maximus is uniquely positioned to develop this new contact center and Customer Experience (CX) approach based on more than 30 years of experience working with OPM,” said Larry Reagan, Senior Managing Director, Federal Civilian Market, Maximus. “Our senior team has vast experience standing up new customer service programs at scale for federal agencies to deliver a range of services, including disaster recovery, education, and health benefit services.”
  • Healthcare Dive tells us,
    • “An expensive drug for weight loss could become one of Medicare’s costliest medications, even if the majority of patients are ineligible for coverage, according to a study published on Monday in the Annals of Internal Medicine.
    • “The analysis found 3.6 million people are highly likely to be eligible for semaglutide like Wegovy, a GLP-1 that’s effective at treating obesity. More liberal definitions of eligibility could increase that number to 15.2 million patients.
    • “If all newly eligible patients received semaglutide, spending in Medicare’s Part D prescription drug benefit could increase by $34 billion to $145 billion each year, according to the study. Even if the government narrowly defined eligibility, federal spending on the medicine could still exceed $10 billion annually.”
  • Medscape adds,
    • “Now that the U.S. government has negotiated prices for some Medicare program drugs effective in 2026, Wall Street analysts are betting on a 2027 list that will include Novo Nordisk’s blockbuster Ozempic for diabetes and have a limited impact on Big Pharma. [FEHBlog note — Wegovy is the weight loss version of Ozempic. Medicare by statute does not cover weight loss drugs.]
    • “Other possible 2027 candidates include Pfizer’s cancer drugs Ibrance and Xtandi, GSK’s asthma and chronic obstructive pulmonary disease (COPD) treatment Trelegy Ellipta, Teva’s Huntington’s disease treatment Austedo and Abbvie’s irritable bowel syndrome drug Linzess, according to five analysts as well as researchers and company executives.”
  • Per an HHS press release,
    • “Today, the U.S. Department of Health and Human Services (HHS) announced more than $558 million in funding to improve maternal health, building on the Biden-Harris Administration’s commitment to reducing the nation’s high maternal mortality rate through the White House Blueprint for Addressing the Maternal Health Crisis. The Health Resources and Services Administration (HRSA), an agency of HHS, is awarding more than $440 million in funding to expand voluntary, evidence-based maternal, infant, and early childhood home visiting services for eligible families across the country. In addition, the Centers for Disease Control and Prevention (CDC) announced a new investment of $118.5 million, over five years, to 46 states, six territories, and freely associated states to continue building the public health infrastructure to better identify and prevent pregnancy-related deaths.” * * *
    • “For a complete list of Maternal, Infant, and Early Childhood Home Visiting Program awardees, visit https://mchb.hrsa.gov/programs-impact/programs/home-visiting/maternal-infant-early-childhood-home-visiting-miechv-program/fy24-awards.”
  • A Federal News Network Data Dive tells us, “USPS improves on-time delivery in delay ‘hotspots’, but faces year-end challenges. Postal experts say USPS improvements to on-time delivery are needed, and must continue, for Congress to allow these plans to keep moving forward.”

From the public health and medical research front,

  • Beckers Hospital Review reports on an August 23, 2024, press conference that leaders of the CDC, HHS and FDA held to discuss the upcoming respiratory virus season.
  • The American Medical Association informs us about what doctors wish their patients knew about lung cancer screening.
    • “Lung cancer causes about 160,000 U.S. deaths a year, which is greater than the toll of the next three most common cancers—colon, breast and prostate—combined. Yet only about 30% of lung cancer cases are diagnosed early. Most patients are diagnosed at a far less treatable, later stage of the disease. And with about 20% of lung cancer deaths preventable, evidence-based screening recommendations for high-risk patients offers the best hope to catch the disease early and provide the best chance for effective treatment.”
  • Medscape looks into how old is too old to undergo a screening colonoscopy.
  • The National Institutes of Health (NIH) issued a medical research report this afternoon.
  • Per an NIH press release,
    • “So-called low-intensity blood stem cell transplants, which use milder conditioning agents than standard stem cell transplants, do not appear to damage the lungs and may help improve lung function in some patients with sickle cell disease (SCD), according to a three-year study of adults who underwent the procedure at the National Institutes of Health (NIH).
    • “Damage to lung tissue and worsened lung function is a major complication and leading cause of death in people with sickle cell disease, a debilitating blood disorder. The new study, published today in the Annals of the American Thoracic Society, helps answer whether less intensive types of transplants, which tend to be better tolerated by many adults, by themselves either cause or promote further harm to the lungs.
    • “By using a low-intensity blood stem cell transplant for sickle cell disease, we may be able to stop the cycle of lung injury and prevent continued damage,” said study lead Parker Ruhl, M.D., an associate research physician and pulmonologist at NIH. “Without the ongoing injury, it’s possible that healing of lung tissue might occur, and this finding should help reassure adults living with sickle cell disease who are considering whether to have a low-intensity stem cell transplant procedure that their lung health will not be compromised by the transplant.”
  • Per Fierce Healthcare,
    • “UnitedHealth Group’s philanthropic arm has released a new deep dive into maternal and infant health, underscoring socioeconomic disparities in women’s health.
    • “The study found that American Indian/Alaska Native, Black and Hawaiian/Pacific Islander women had maternal mortality rates that were between 2.5 and 4.5 times higher than other ethnic groups. Severe maternal morbidity was, in 2020, two times higher among Black mothers than white mothers, and 1.5 times higher among Black mothers compared to Hispanic mothers.
    • “There were also racial disparities identified in low-birth weight, according to the study. Low birth weight rates were 2.1 times higher among babies born to Black mothers compared to infants born to white mothers.
    • “There were some bright spots in the data, however. Between 2008 and 2011 and 2018 to 2021, there were improvements to infant mortality rates among some racial groups. The study found improvements of 15% among infants born to white mothers, 12% among babies born to Black mothers and 9% for babies born to Hispanic mothers.
    • “Lisa Saul, M.D., national medical director of maternal child health at UnitedHealthcare, said in a press release that analyses like this are critical to developing targeted solutions to key challenges.”
  • Beckers Hospital Review informs us,
    • “After about 18 months since the FDA greenlit preventive COVID-19 medication Pemgarda for emergency use, the agency has tweaked its decision. 
    • “The agency has narrowed the medicine’s emergency use authorization. It is now OK to use when “the combined national frequencies of variants with substantially reduced susceptibility to Pemgarda is less than or equal to 90%,” the FDA said in an Aug. 26 letter to the drug’s maker, Invivyd. 
    • “Pemgarda (pemivibart) is authorized for the pre-exposure prophylaxis of COVID-19 in some adults and children older than 12. Eligible patients are those who have a moderate-to-severe immune compromise and are unlikely to have an adequate response to a COVID-19 vaccine.
    • “Early data indicate that COVID-19 variant KP.3.1.1 may have substantially reduced susceptibility to Pemgarda. As of Aug. 17, the variant accounted for 36.8% of COVID-19 infections, according to CDC data. If this percentage surpasses 90%, Pemgarda’s emergency use authorization could be revoked.”
  • Per MedTech Dive,
    • “Insulet received U.S. clearance Monday for its Omnipod 5 system for Type 2 diabetes management — a first for the industry — making automated insulin delivery to control blood sugar available to millions of additional people living with diabetes.
    • “The system’s tubeless pump automatically adjusts insulin levels based on data from a continuous glucose monitor (CGM), replacing manual dosing. Since its approval for Type 1 patients in 2022, Omnipod 5 has become the most prescribed insulin pump in the U.S. and has more than 250,000 users globally, Insulet Chief Medical Officer Trang Ly said in an interview with MedTech Dive.
    • “Ly discussed the product’s launch for Type 2 diabetes patients, partnerships with other device makers and how the company is working to win over doctors reluctant to prescribe insulin pump therapy.”
    • Check out the interview.

From the U.S. healthcare business front,

  • BioPharma Dive tells us,
    • Eli Lilly is now distributing a single-dose vial form of its popular weight loss medicine Zepbound that it says people with a valid prescription can obtain for a cash price that’s 50% less than the current cost of other GLP-1 drugs for obesity.
    • The single-dose vials are available through Lilly’s online service LillyDirect as a self-pay option, which could appeal to people without employer insurance coverage or those who don’t qualify for the company’s savings card program, Lilly said.
    • A four-week supply of Zepbound single-dose vials at a 2.5 milligram dose will cost $399, while the 5 milligram dose will cost $549. While those prices are well below the $1,060 monthly list price of Zepbound’s injector pen formulation, they’re not far from the drug’s estimated net price after accounting for rebates and discounts to insurers, according to a client note from Evercore ISI analyst Umer Raffat.
  • Per Healthcare Dive,
    • “Pfizer on Tuesday launched a direct-to-consumer service it claims will help people schedule telehealth appointments, fill prescriptions and access savings programs for the company’s migraine, COVID-19 or influenza medicines.
    • “Dubbed PfizerForAll, the online service will provide resources for people looking to obtain treatment for migraine, COVID or the flu, or to schedule vaccinations for diseases like pneumococcal pneumonia and respiratory syncytial virus.
    • “The platform aims to “streamline the path for those seeking better health,” Aamir Malik, Pfizer’s chief U.S. commercial officer, said in a statement. The company said it is working with partners UpScriptHealth, Alto Pharmacy and Instacart.”
  • MedCity News notes,
    • “Waltz Health, a digital health company focused on prescription drugs, launched Waltz Connect on Monday. The new solution aims to reduce the cost of specialty medications.
    • “Chicago-based Waltz Health was founded in 2021 and serves payers and pharmacies. It has a product called Marketplace Search, which allows users to search for any prescription and see the range of prices available at their pharmacy. It also works with health plans to bring its marketplace solutions into their pharmacy benefit.
    • “The company’s Waltz Connect product supports payers and focuses on specialty medications. When a specialty prescription is submitted for a member, Waltz Connect redirects it to the most suitable pharmacy, regardless of the pharmacy’s network status with the payer. This routing is based on the member’s benefit design and several factors, including price, turnaround time, fulfillment accuracy, member experience and adherence rates. These factors can be customized by drug class or specific drugs. Health plans also receive information on the member’s condition, prescription onboarding, the selected pharmacy’s contact information, expected fulfillment turnaround time and the number of refills.”
  • and discusses the pros and cons of artificial intelligence for health insurers. “With so much hinging on technology that is the subject of so much hype, it is important to understand where AI actually helps at present — and where it most definitely does not.”
  • Beckers Hospital Review points out,
    • “Boston-based Mass General Brigham’s Home Hospital program has expanded to 70 beds, making it the largest home hospital in the country, according to a news release shared with Becker’s.
    • “The capacity increase was accompanied by expanded clinical care teams and the creation of dedicated roles within Home Hospital created. The system has also incorporated medical assistants into the care model and expanded the ambulance services to meet growing demand.
    • “Since its launch in January 2022, the program has had more than 4,000 patient admissions and saved more than 20,000 acute care hospital-based bed days. The average patient stays in a Home Hospital bed is 5 days.”
  • and
    • Where Steward’s 31 hospitals stand
      • From seeking Chapter 11 protection on May 6 to sharing plans to close four of its hospitals across Massachusetts and Ohio that would result in a combined 2,187 layoffs, Dallas-based Steward Health Care has experienced a great deal of turbulence over the last year.
      • As the for-profit health system continues to push back bid deadlines and sale hearings for many of its hospitals, the status of each facility remains in question, leaving community members, healthcare workers and state and local lawmakers concerned.
      • Below, Becker’s has provided a list of Steward’s 31 hospitals by state, per the health system’s website, and the most recent information regarding each facility. [FEHBlog note — Beckers plans to keep this list updated.]
  • Per Fierce Healthcare,
    • “Aetna will cover intrauterine insemination as a medical benefit for eligible plans, a move the insurer called a “landmark policy change.” 
    • “Intrauterine insemination, or IUI, is usually only covered if employers offer a separate fertility benefit plan, according to an Aug. 26 news release from Aetna. 
    • “The change will apply to fully insured Aetna commercial plans. * * *
    • “Expanding IUI coverage is yet another demonstration of Aetna’s commitment to women’s health across all communities, including LGBTQ+ and unpartnered people,” Cathy Moffitt, MD, Aetna’s chief medical officer, said in the news release. “This industry-leading policy change is a stake in the ground, reflecting Aetna’s support of all who need to use this benefit as a preliminary step in building their family.”
  • Medscape adds,
    • “In a move that acknowledges the gauntlet the US health system poses for people facing serious and fatal illnesses, Medicare will pay for a new class of workers to help patients manage treatments for conditions like cancer and heart failure.
    • “The 2024 Medicare physician fee schedule includes new billing codes, including G0023, to pay for 60 minutes a month of care coordination by certified or trained auxiliary personnel working under the direction of a clinician.
    • :A diagnosis of cancer or another serious illness takes a toll beyond the physical effects of the disease. Patients often scramble to make adjustments in family and work schedules to manage treatment, said Samyukta Mullangi, MD, MBA, medical director of oncology at Thyme Care, a Nashville, Tennessee-based firm that provides navigation and coordination services to oncology practices and insurers.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the CrowdStrike outage front,

  • TechTarget offers lessons learned from the CrowdStrike outage.
  • Cybersecurity Dive includes an opinion piece from Deepak Kumar, the founder and CEO of Adaptiva.
    • “Patching remains a top priority for every organization, but slow, manual, and reactive patching presents far more risk than benefit. Automated patching without the capability to pause, cancel, or roll back can be reckless and lead to disruptions or worse. 
    • “Automated patching, with the necessary controls, is undoubtedly the best path forward, offering the speed needed to thwart bad actors and the control required to prevent an errant update from causing widespread issues.”

From the cybersecurity policy front,

  • Cyberscoop informs us,
    • “Federal contractors would be required to implement vulnerability disclosure policies that align with National Institute of Standards and Technology guidelines under a bipartisan Senate bill introduced last week.
    • “The Federal Contractor Cybersecurity Vulnerability Reduction Act of 2024 from Sens. Mark Warner, D-Va., and James Lankford, R-Okla., is a companion to legislation from Rep. Nancy Mace, R-S.C., which was advanced by the House Oversight Committee in May.
    • “The bill from Warner and Lankford on vulnerability disclosure policies (VDPs) aims to create a structure for contractors to receive reports of vulnerabilities in their products and then act against them before an attack occurs.
    • “VDPs are a crucial tool used to proactively identify and address software vulnerabilities,” Warner said in a statement. “This legislation will ensure that federal contractors, along with federal agencies, are adhering to national guidelines that will better protect our critical infrastructure, and sensitive data from potential attacks.”
  • Cybersecurity Dive reports from the Black Hat cybersecurity conference held at Las Vegas in the first week of August,
    • Despite a stream of devastating cyberattacks or mistakes that halt or disrupt large swaths of the economy, Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency, says the war against malicious activity is not lost.
    • It is possible to elevate organizations’ ability to repel or mitigate attacks and place a greater emphasis on vendors’ responsibilities, Easterly said Wednesday during a media briefing at Black Hat. “We got ourselves into this, we have to get ourselves out,” she said.
    • Easterly’s optimism isn’t the result of blind trust. “We have made enormous progress, even just over the past several years,” she said.” * * *
    • “We have to recognize that the cybersecurity industry exists because technology vendors for decades have been allowed to create defective, flawed, insecure software that prioritizes speed to market features over security,” Easterly said. 
    • “There is more we can do but that’s where the war will be won,” Easterly said. “If we put aside the threat actors and we put aside the victims and we talk about the vendors.”
  • and
    • It’s time to stop thinking of threat groups as supervillains, experts say
    • “These villains do not have superpowers. We should not treat them like they do,” * * *
    • “The vast majority of organizations don’t have the time or resources to keep up with the chaos of tracking cybercriminal groups, Andy Piazza, senior director of threat intel at Palo Alto Networks Unit 42, said in an interview at Black Hat.
    • “You as a defender shouldn’t care about that,” Piazza said. Defenders can better serve their organizations by developing capabilities to detect and respond to malicious tactics, techniques and procedures, Piazza said.
    • “It’s hard to ignore the drama when groups are given names like Scattered Spider, Midnight Blizzard and Fancy Bear, but mythologizing the criminals responsible for cyberattacks can diminish defenders’ ability to detect and thwart malicious activity.”
  • FedScoop lets us know,
    • “The National Institute of Standards and Technology has officially released three new encryption standards that are designed to fortify cryptographic protections against future cyberattacks by quantum computers.
    • “The finalized standards come roughly eight years after NIST began efforts to prepare for a not-so-far-off future where quantum computing capabilities can crack current methods of encryption, jeopardizing crucial and sensitive information held by organizations and governments worldwide. Those quantum technologies could appear within a decade, according to a RAND Corp. article cited by NIST in the Tuesday announcement.
    • “Quantum computing technology could become a force for solving many of society’s most intractable problems, and the new standards represent NIST’s commitment to ensuring it will not simultaneously disrupt our security,” Laurie E. Locascio, director of the Department of Commerce’s NIST and undersecretary of commerce for standards and technology, said in a statement. “These finalized standards are the capstone of NIST’s efforts to safeguard our confidential electronic information.”
    • “The new standards provide computer code and instructions for implementing algorithms for general encryption and digital signatures — algorithms that serve as authentication for an array of electronic messages, from emails to credit card transactions.”
  • Federal News Network adds,
    • “CISA Director Jen Easterly said in a keynote at The White House Office of Management and Budget will soon direct agencies to map out plans for adopting post-quantum encryption to protect their most sensitive systems and data.
    • “Federal Chief Information Office Clare Martorana said the new guidance will help agencies begin to adopt new cryptographic standards from the National Institute of Standards and Technology.
    • “We will be releasing guidance directing agencies to develop a prioritized migration plan to ensure that the most sensitive systems come first,” Martorana said during an event hosted by the White House today. “We can’t do it alone. It’s critical that we continue to foster robust collaboration and knowledge sharing between public and private sectors, which is why conversations like the one we’re having today are so incredibly critical.”

From the cybersecurity vulnerabilities and breaches front,

  • The Cybersecurity and Infrastructure Security Administration (CISA) added seven known exploited vulnerabilities (KEV) to its catalog this week. NIST initially identifies the KEVs, which explains the Senate bill discussed above, and then CISA publicizes those KEVs in its catalog
  • Cybersecurity Dive notes,
    • “A vulnerability in the common log file system of Microsoft Windows can lead to the blue screen of death, impacting all versions of Windows 10 and Windows 11, researchers from Fortra said Monday.  
    • “The vulnerability, listed as CVE-2024- 6768, is caused by improper validation of specified quantities of input data, according to a report by Fortra. The vulnerability can result in an unrecoverable inconsistency and trigger a function called KeBugCheckEx, leading to the blue screen. 
    • “A malicious hacker can exploit the flaw to trigger repeated crashes, disrupting system operations and the potential loss of data, according to Fortra.”
  • TechTarget explains why “recent cyberattacks against OneBlood and McLaren Health Care shed light on the operational challenges that targeted organizations face.”

From the ransomware front,

  • A Dark Reading commentator explains that to avoid losing the ransomware battle, companies that are “institutionalizing and sustaining fundamental cybersecurity practices” also must “commit to ongoing vigilance, active management, and a comprehensive understanding of evolving threats.”
    • “The challenge of institutionalizing and sustaining fundamental cybersecurity practices is multifaceted. It requires a commitment to ongoing vigilance, active management, and a comprehensive understanding of evolving threats. However, by addressing these challenges head-on and ensuring that cybersecurity practices are implemented, measured, and maintained with rigor, organizations can better protect themselves against the ever-present threat of ransomware attacks. Focusing on the basics first — such as implementing foundational controls like 2FA, fostering maintenance skills to integrate IT and security efforts, and adopting performance management practices — can lead to significant improvements in cybersecurity, providing robust protection with less investment.”
  • Cybersecurity Dive points out,
    • “Cyber risk company Resilience said in a report unveiled Tuesday that ransomware has remained a top threat since January 2023, with 64% of related claims in its portfolio resulting in a loss during that period.
    • “Increased merger-and-acquisition activity and reliance on ubiquitous software vendors created new opportunities for threat actors to unleash widespread ransomware campaigns by exploiting a single point of failure, the report said.
    • “Now more than ever, we need to rethink how the C-suite approaches cyber risk,” Resilience CEO Vishaal Hariprasad said in a press release. “Businesses are interconnected like never before, and their resilience now depends on that of their partners and others in the industry.”
  • Per Bleeping Computers,
    • “RansomHub ransomware operators are now deploying new malware to disable Endpoint Detection and Response (EDR) security software in Bring Your Own Vulnerable Driver (BYOVD) attacks.
    • “Named EDRKillShifter by Sophos security researchers who discovered it during a May 2024 ransomware investigation, the malware deploys a legitimate, vulnerable driver on targeted devices to escalate privileges, disable security solutions, and take control of the system.
    • “This technique is very popular among various threat actors, ranging from financially motivated ransomware gangs to state-backed hacking groups.”
  • and
    • “Background check service National Public Data confirms that hackers breached its systems after threat actors leaked a stolen database with millions of social security numbers and other sensitive personal information. 
    • “The company states that the breached data may include names, email addresses, phone numbers, social security numbers (SSNs), and postal addresses.”

From the cybersecurity defenses front,

  • The American Hospital Association’s National Advisor for Cybersecurity and Risk, John Riggi, explains how healthcare entities should prepare for third party cyber risk.
  • The Wall Street Journal shares remarks from a June 2024 WSJ conference on what can be learned from the Change Healthcare cyber-attack. “Two security experts explain why the hack affected so many institutions and people—and what could be done to protect the healthcare system.”
  • For several months, the FEHBlog has not been able to access the HHS 405(d) program website. Magically this week, he regained access. Here is a link to the program’s July 2024 post which concerns the urgent need for data security in healthcare AI.

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the CrowdStrike outage front,

  • Dark Reading reports,
    • The CrowdStrike update that hobbled businesses, disrupted consumer travel plans, and took French and British broadcasters offline has predictably led to a host of lawsuits filed by investors and customers of both CrowdStrike and other affected companies.
    • Yet the incident could lead to another destination: software liability.
    • The overall consensus among legal experts is that CrowdStrike is likely protected by its terms and conditions from reimbursing customers for more than they paid for the product, limiting its software liability in what the company now refers to as “the Channel File 291 Incident.” However, the fact that affected businesses and consumers have little recourse to recover damages will likely lend momentum to legislation and state regulations to hold firms responsible for such chaos, says Chinmayi Sharma, associate professor of law at Fordham University.
  • Cybersecurity Dive lets us know,
    • “A mismatched software update in CrowdStrike’s Falcon sensor led to the crash that caused a global IT outage of millions of Microsoft Windows systems on July 19, the company said Tuesday. 
    • “CrowdStrike, in a root cause analysis report, said the Falcon sensor expected 20 input fields in a rapid response content update, but the software update actually provided 21 input fields. The mismatch resulted in an out-of-bounds memory read, leading to the system crash. 
    • “We are using lessons learned from this incident to better serve our customers,” CrowdStrike CEO George Kurtz said in a statement Tuesday. “To this end, we have already taken decisive steps to prevent this situation from repeating, and to help ensure that we – and you – become even more resilient.”
  • and
    • “CrowdStrike is in talks to acquire Action1, a Houston-based patch management and vulnerability specialist. The agreement being discussed would value the company at nearly $1 billion, according to a memo sent to Action1 employees. 
    • “Action1 Co-Founder and CEO Alex Vovk sent a memo to employees Wednesday confirming the discussions, after speculation around the talks gained within the company. A spokesperson for Action1 confirmed the authenticity of the memo to Cybersecurity Dive Friday. 
    • “This proves that Action1 is in a rapidly growing market and explains why Action1 is experiencing hypergrowth and is on track to soon reach $100M AAR,” Vovk wrote in the memo.” 

From the cybersecurity policy front,

  • Per Cybersecurity Dive,
    • “For Cybersecurity and Infrastructure Security Agency Director Jen Easterly the doomed CrowdStrike software update that took global IT systems and networks offline last month holds a “big lesson” for critical infrastructure.
    • “The CrowdStrike incident was such a terrible incident,” Easterly said Wednesday during a media briefing at Black Hat, but “it was a useful exercise, like a dress rehearsal for what China may want to do to us.”
    • “The outage was not the result of a malicious act, but rather a basic field input error that caused an out-of-bounds memory read. Yet, to Easterly, the widespread chaos it caused offers a clear example of what could occur if China-affiliated attackers make good on its efforts to cause systemic disruption to U.S. critical infrastructure.
    • “When Easterly learned of the outage, around 2 a.m. on July 19: “What was going through my mind was ‘oh, this is exactly what China wants to do.’”
  • Per Cyberscoop,
    • “Jen Easterly, the head of the Cybersecurity and Infrastructure Security Agency, told attendees at the Black Hat security conference on Thursday that delivering major improvements in computer security will require a sea change in how companies approach building software. 
    • “Amid an epidemic of breaches, Easterly laid the blame squarely at the feet of the technology industry. “We don’t have a cybersecurity problem. We have a software quality problem,” she said. 
    • “We have a multi-billion dollar cybersecurity industry because for decades, technology vendors have been allowed to create defective, insecure, flawed software,” Easterly said in her remarks.
    • “To address that issue, Easterly and CISA have launched a secure by design pledge, the signatories of which commit to a series of principles to improve the security of how products are developed and deployed. Easterly said 200 companies have now signed that pledge since its launch in March.”   
  • To that end, this week, CISA and the FBI posted their “Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem.” Here’s a link to the federal government’s Internet Complaint Center supplement guidance on this effort.
  • Cyberscoop also tells us,
    • “A year after asking the hacker community how they can better help protect the open source software that is the foundation of the digital economy, the White House is looking to better secure the ecosystem through a new office dedicated to study such components in critical infrastructure.
    • “The Office of the National Cyber Director released new details Friday on several projects aimed at securing open source software. The report comes a year after the office asked attendees at DEF CON in 2023 to contribute to a request for information around how to better focus on securing open source software.
    • “The new office runs out of the Department of Homeland Security and will examine the prevalence of open source software present in critical infrastructure and how to secure it, said Nasreen Djouini, senior policy advisor at the Office of the National Cyber Director. The program will have the support of the Department of Energy’s national labs, including at Los Alamos and Lawrence Livermore.”

From the cybersecurity vulnerabilities and breaches front,

  • Again, per Cyberscoop,
    • “An Israeli cybersecurity firm has identified a zero-day vulnerability affecting major web browsers that could allow attackers to bypass normal browser security measures and potentially breach local networks.
    • “The flaw, discovered by Oligo Security, was found in how browsers handle network requests. 
    • “In summary, devices read IP addresses to connect users to websites, with 0.0.0.0 serving as a placeholder until a real address is assigned. Oligo researchers found that a would-be attack can exploit how browsers like Apple’s Safari, Google’s Chrome and Mozilla’s Firefox handle queries to 0.0.0.0, redirecting them to other addresses such as ‘localhost,’ which is typically private. 
    • “This exploit allows attackers to access private data by sending requests to 0.0.0.0. Attackers could then perform all types of nefarious actions, gaining unauthorized access and executing remote code on locally running programs, which could impact development platforms, operating systems and internal networks.
    • Oligo has dubbed the vulnerability “0.0.0.0 day,” and wrote in a blog post that it considers it to be “far-reaching, affecting individuals and organizations alike.”
  • Here are the known exploited vulnerabilities that CISA added to its catalog this week,
  • Security Week points out,
    • The US cybersecurity agency CISA on Thursday informed organizations about threat actors targeting improperly configured Cisco devices.
    • The agency has observed malicious hackers acquiring system configuration files by abusing available protocols or software, such as the legacy Cisco Smart Install (SMI) feature. 
    • This feature has been abused for years to take control of Cisco switches and this is not the first warning issued by the US government. 

From the ransomware front,

  • Per a CISA press release,
    •  “CISA—in partnership with the Federal Bureau of Investigation (FBI)—released an update to joint Cybersecurity Advisory #StopRansomware: Royal Ransomware, #StopRansomware: BlackSuit (Royal) Ransomware. The updated advisory provides network defenders with recent and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with BlackSuit and legacy Royal activity. FBI investigations identified these TTPs and IOCs as recently as July 2024.
    • “BlackSuit ransomware attacks have spread across numerous critical infrastructure sectors including, but not limited to, commercial facilities, healthcare and public health, government facilities, and critical manufacturing.
    • “CISA encourages network defenders to review the updated advisory and apply the recommended mitigations. See #StopRansomware for additional guidance on ransomware protection, detection, and response. Visit CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including additional recommended baseline protections.”
  • Per Bleeping Computer,
    • ‘​On Tuesday (August 6], IT and phone systems at McLaren Health Care hospitals were disrupted following an attack linked to the INC Ransom ransomware operation.
    • “McLaren is a non-profit healthcare system with annual revenues of over $6.5 billion, which operates a network of 13 hospitals across Michigan supported by a team of 640 physicians. It also has over 28,000 employees and works with 113,000 network providers throughout Michigan, Indiana, and Ohio.
    • “While McLaren Health Care continues to investigate a disruption to our information technology system, we want to ensure our teams are as prepared as possible to care for patients when they arrive,” a statement on the health system’s website reads.”

From the cybersecurity defenses front,

  • Dark Reading writes about how
    • “Enterprises are implementing Microsoft’s Copilot AI-based chatbots at a rapid pace, hoping to transform how employees gather data and organize their time and work. But at the same time, Copilot is also an ideal tool for threat actors.
    • “Security researcher Michael Bargury, a former senior security architect in Microsoft’s Azure Security CTO office and now co-founder and chief technology officer of Zenity, says attackers can use Copilot to search for data, exfiltrate it without producing logs, and socially engineer victims to phishing sites even if they don’t open emails or click on links.
    • The article explains how to avoid such attacks.

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the CrowdStrike front,

  • Dark Reading explains why the CrowdStrike outage should be a wakeup call for cybersecurity experts. “The incident serves as a stark reminder of the fragility of our digital infrastructure. By adopting a diversified, resilient approach to cybersecurity, we can mitigate the risks and build a more secure digital future.”
  • Cybersecurity Dive reports,
  • and
    • Federal officials said the global IT outage stemming from a faulty CrowdStrike software update is raising prior concerns about the security of the software supply chain. 
    • The U.S. Government Accountability Office released a report Tuesday [July 30] noting the July 19 outage, which led to the disruption of 8.5 million Microsoft Windows systems. The CrowdStrike incident resurrected concerns raised during the state-linked supply chain attack against SolarWinds in 2020, according to the GAO. 
    • The CrowdStrike incident highlights specific warnings about memory safety issues in software development, the White House said on Thursday. The remarks build on a February report that raised questions about the link between memory safety issues and software vulnerabilities. 
  • and
    • “The global IT outage stemming from a faulty CrowdStrike software update will lead to cyber insurance losses primarily driven by business interruption claims, Moody’s Ratings said in a report released Monday. 
    • “Businesses are expected to make claims under “systems failure” provisions, coverage that is becoming standard for cyber insurance policies, because the incident was not considered a malicious attack. Moody’s said insured organizations will link claims to direct business losses as well as contingent losses of third-party vendors. 
    • “The outage is likely to spur larger reviews of underwriting, with a focus on systems failure, according to Moody’s. The outage has already raised concerns about the risk of single points of failure, as lone organizations with a vast footprint can bring down operations across so many critical industries.”

From the cybersecurity policy front,

  • Cyberscoop lets us know,
    • “Cybersecurity legislation aimed at unscrambling regulations, strengthening health system protections and bolstering the federal workforce sailed through a key Senate committee Wednesday [July 31], moving the trio of bipartisan bills to future consideration before the full chamber.
    • “The Senate Homeland Security and Governmental Affairs Committee voted first on the Streamlining Federal Cybersecurity Regulations Act, a bill co-sponsored by committee Chair Gary Peters, D-Mich., and Sen. James Lankford, R-Okla., that seeks to streamline the country’s patchwork of federal cyber rules. 
    • “The bill would harmonize federal cyber requirements for the private sector, which has long been critical about conflicting rules imposed by agencies. A committee made up of the national cyber director, the chief of the Office of Management and Budget’s Office of Information and Regulatory Affairs, the heads of each federal regulatory agency and other government leaders as determined by the chair would be charged with identifying cyber regulations deemed “overly burdensome, inconsistent, or contradictory” and recommending updates accordingly.
    • “Also moving forward Wednesday was the Healthcare Cybersecurity Act from Sens. Jacky Rosen, D-Nev., Todd Young, R-Ind., and Angus King, I-Maine. The legislation, which came in the aftermath of the February ransomware attack on the payment processor Change Healthcare, calls on the Cybersecurity and Infrastructure Security Agency to collaborate with the Department of Health and Human Services on cyber defenses, providing resources to non-federal entities connected to threat indicators.” * * *
    • “The final cyber bill headed to the full Senate is the Federal Cyber Workforce Training Act, which tasks the national cyber director with coming up with a plan to create a centralized resource and training center for federal cybersecurity workforce development.” 
  • Fedscoop tells us,
    • “Lisa Einstein, the Cybersecurity and Infrastructure Security Agency’s senior adviser for artificial intelligence, has been tapped to serve as the agency’s first chief AI officer.
    • “A Stanford and Princeton graduate who joined CISA in 2022 as executive director of its Cybersecurity Advisory Committee, Einstein will assume the CAIO role at a time when the agency is attempting to leverage the technology to advance cyber defenses and more effectively support critical infrastructure owners and operators.
    • “I care deeply about CISA’s mission — if we succeed, the critical systems that Americans rely on every day will become safer, more reliable, and more capable. AI tools could accelerate our progress,” Einstein said in a statement. “But we will only reap their benefits and avoid harms from their misapplication or abuse if we all work together to prioritize safety, security, and trustworthiness in the development and deployment of AI tools.” 
  • and
    • “The White House issued final FedRAMP modernization guidance Friday [July 26, 2024] as a response to cloud market changes and agency needs for more diverse mission delivery.
    • “The final guidance, previewed by FedScoop before its official release, aims to reform the cloud security authorization program by increasing focus on several strategic goals, such as enabling FedRAMP to conduct “rigorous reviews” and requiring cloud service providers (CSPs) to quickly mitigate any security architecture weaknesses to protect federal agencies from the most “salient threats.” The Office of Management and Budget began accepting public comments on a draft version of the guidance last fall.
    • “The memo places particular emphasis on a program to establish an automated process for intaking, using and reusing security assessments and reviews to reduce the burden on participants and speed up the implementation process for cloud solutions.” 
  • The National Institute of Standards and Technology published on July 30, 2024,
    • “NIST Special Publication (SP) 800-231, Bugs Framework (BF): Formalizing Cybersecurity Weaknesses and Vulnerabilities, is now available. It presents an overview of the Bugs Framework (BF) systematic approach and methodologies for the classification of bugs and faults per orthogonal by operation software and hardware execution phases, formal specification of weaknesses and vulnerabilities, definition of secure coding principles, generation of comprehensively labeled weakness and vulnerability datasets and vulnerability classifications, and development of BF-based algorithms and systems.” * * *
    • Visit the Bugs Framework site at https://usnistgov.github.io/BF/.
  • and announced on August 1, 2024,
    • “The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and the National Institute of Standards and Technology (NIST) Information Technology Laboratory (ITL) are excited to announce the return of the “Safeguarding Health Information: Building Assurance through HIPAA Security” conference for October 2024. After a 5-year absence, the conference is now returning to Washington, D.C. at the HHS Headquarters.
    • “The conference will explore the current healthcare cybersecurity landscape and the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. This event will highlight the present state of healthcare cybersecurity, and practical strategies, tips, and techniques for implementing the HIPAA Security Rule. * * *
    • “Virtual registration for the event is now open and costs $50 per person. 
    • “Please visit the event web page for more details and to register for virtual attendance to the conference.

From the cybersecurity vulnerabilities and breaches front,

  • Cybersecurity Dive points out,
    • “Data breaches are painfully expensive and the cost for impacted businesses has grown every year since 2020. The global average cost of a data breach is nearly $4.9 million this year, up nearly 10% from almost $4.5 million in 2023, IBM said Tuesday in its annual Cost of a Data Breach report.
    • “U.S. organizations led the world with the highest average data breach cost of almost $9.4 million, a dubious distinction it has earned for the 14th straight year. Businesses in the Middle East, the Benelux countries, Germany and Italy rounded out the top five.
    • “Healthcare was far and away the costliest industry for data breaches — as it’s been since 2011 — with an average breach cost of almost $9.8 million, the report found. That’s a decrease from last year’s $10.9 million for the sector.”  
  • Security Weeks notes,
    • “HealthEquity is notifying 4.3 million individuals that their personal and health information was compromised in a data breach at a third-party vendor.
    • “The incident, the company said in a regulatory filing with the Maine Attorney General’s Office, was identified on March 25 and required an “extensive technical investigation”.
    • “Through this work, we discovered some unauthorized access to and potential disclosure of protected health information and/or personally identifiable information stored in an unstructured data repository outside our core systems,” HealthEquity said.
    • “According to the company, the data was exposed after attackers compromised a vendor’s user accounts that had access to the online repository, gaining access to the information stored there.”
  • Per Cybersecurity Dive,
    • “Microsoft said a DDoS attack led to an eight-hour outage Tuesday [July 30] involving its Azure portal, as well as some Microsoft 365 and Microsoft Purview services. 
    • “Microsoft said an unexpected spike in usage led to intermittent errors, spikes and timeouts in Azure Front Door and Azure Content Delivery Network. An initial investigation showed an error in the company’s security response may have compounded the impact of the outage. 
    • “Microsoft said it will have a preliminary review of the incident in 72 hours and a final review within two weeks, to see what went wrong and how to better respond.”
  • CISA added the following known exploited vulnerabilities to its catalog this week.
    • “July 29, 2024
      • CVE-2024-4879 ServiceNow Improper Input Validation Vulnerability
      • CVE-2024-5217 ServiceNow Incomplete List of Disallowed Inputs Vulnerability
      • CVE-2023-45249 Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability
    • “July 30, 2024

From the ransomware front,

  • Cybersecurity Dive relates,
    • “Nearly one-third of companies that suffered a ransomware attack paid a ransom four or more times in the past 12 months to regain access to their systems, according to the 2024 Ransomware Risk Report released Tuesday by Semperis, a cybersecurity software company.
    • “This decision to pay multiple times involved 32% of attacked companies in France, Germany, the U.K. and U.S. across multiple industries, according to the survey of 900 IT and security executives.  
    • “Nearly half of the German companies queried paid four or more ransom payments, compared to one-fifth of companies in the U.S.
    • “More than a third of companies that paid the extortion demand either did not receive the decryption keys from attackers or were given corrupted keys, according to the report.”
  • Per TechTarget,
    • “Blood donation nonprofit OneBlood is actively responding to a ransomware attack that is affecting its ability to operate and provide blood to hospitals at its typical volume. According to a notice posted on OneBlood’s website on July 31, 2024, the company is operating at a “significantly reduced capacity, which impacts inventory availability.”
    • “OneBlood provides blood to more than 250 hospitals in Alabama, Florida, North Carolina, South Carolina and Georgia.
    • “OneBlood is continuing to collect, test and distribute blood to hospitals at a reduced capacity. Due to these limitations, OneBlood urged eligible donors to donate blood immediately, with an urgent request for O positive, O negative and platelet donations.”
  • Dark Reading notes,
    • “A Fortune 50 company paid $75 million to its cyberattackers earlier this year, greatly exceeding any other confirmed ransom payment in history. The beneficiary of the payout is an outfit called Dark Angels. And Dark Angels isn’t just effective — in some ways, the gang turns so much of what we thought we knew about ransomware on its head.
    • “Sure, there have been other big amounts forked over in the past: In 2021, Illinois-based CNA Financial was reported to have paid a then unprecedented $40 million ransom in order to restore its systems after a ransomware attack (the company never confirmed that figure). Later that year, the meat manufacturer JBS admitted to paying $11 million to end a disruption affecting its factories. Caesars Palace last year paid $15 million to make its ransomware disruption problems go away.
    • “But those figures pale in comparison against the $75 million in equivalent Bitcoin paid by the aforementioned large organization, which Zscaler chose to keep anonymous in its 2024 annual ransomware report, where the payout was first recorded. The dollar amount has also been corroborated by Chainalysis.”
  • and considers whether making ransom payments illegal would result in fewer attacks?
    • “Frustration is understandable as ransomware attacks continue around the globe, but simply denying victim organizations the option of paying the ransom is neither realistic nor practical. There will always be exceptions to the law, and unanticipated repercussions could make the cure worse than the disease. Instead, an effective response will require organizations to take greater responsibility for cybersecurity and government agencies to engage in good old-fashioned police work. This strategy may not be as straightforward as a ban on ransom payments, but the war against ransomware is winnable through a comprehensive, nuanced approach.
  • Security Week alerted us on July 29, 2024,
    • “Less than a week after VMware shipped patches for a critical vulnerability in ESXi hypervisors, Microsoft’s threat intel team says the flaw is being exploited by ransomware groups to gain full administrative access on domain-joined systems. 
    • “The flaw, tagged as CVE-2024-37085 with a CVSS severity score of 6.8, has already been abused by multiple known ransomware groups to deploy data-extortion malware on enterprise networks, according to a new warning from Redmond’s threat hunting teams.
    • “Strangely, Broadcom-owned VMware did not mention in-the-wild exploitation when it released patches and workarounds last week alongside warnings that it could be used by hackers to gain unauthorized access and control over ESXi hosts.”

From the cybersecurity defenses front,

  • An ISACA expert discusses “Navigating the Modern CISO Landscape: Practical Strategies for Cybersecurity Success.”
  • Dark Reading explains how to implement identity continuity with the NIST Cybersecurity Framework. “Having a robust identity continuity plan is not just beneficial but essential for avoiding financially costly and potentially brand-damaging outages.”
  • McKinsey & Co. delves into “Generative AI in healthcare: Adoption trends and what’s next.”

Midweek Update

David Ermer–AHRQ, CDC, COVID-19, FDA, Generative AI, Medical / Rx research, Mental health care, Obesity, OPM, U.S. Healthcare–
Photo by Manasvita S on Unsplash

From Washington, DC,

  • The Wall Street Journal adds,
    • “A summer Covid wave is hitting the country, but there’s one consolation: Your chances of developing long Covid have fallen since the start of the pandemic. 
    • “That’s the finding from a new study in the New England Journal of Medicine. It concluded that about 10% of people infected with the virus’s original strain developed long Covid. By contrast, the risk of developing long Covid dropped to 3.5% with the virus’s Omicron variant among vaccinated people. For the unvaccinated, the risk was 7.7.%.
    • “Researchers defined long Covid as people who experienced persistent and debilitating symptoms such as a racing heartbeat or brain fog, or other new health problems linked to the initial illness, a month or more after their infection.
    • “About 70% of the drop in long Covid cases was due to vaccination and 30% because of changes in the virus itself, the study determined. 
    • “Four years since the start of the pandemic, we’re getting used to periodic waves of Covid cases, including the uptick we’re seeing now, driven by Omicron subvariants. The threats of severe illness and lingering health problems have significantly subsided, though they haven’t disappeared.”
  • Beckers Hospital Review reports,
    • “As the House Committee on Oversight and Accountability investigates pharmacy benefit managers regarding alleged anticompetitive practices, the committee scheduled a hearing with leaders of the top three PBMs. 
    • “On July 23, [at 10 am ET], members of the House Committee on Oversight and Accountability plan to ask executives at Express Scripts/Evernorth, CVS Caremark and OptumRx about the alleged anticompetitive policies, which committee members say raise prescription drug costs, harm independent pharmacies and obstruct patient care. 
    • “The three PBMs account for about 80% of the market share. 
    • “The called witnesses are Adam Kautzner, PharmD, president of Evernorth Care Management and Express Scripts; David Joyner, executive vice president of CVS Health and president of CVS Caremark; and Patrick Conway, MD, CEO of OptumRx.”
  • The FEHBlog discovered today that on July 11, 2024, Rep. Gary Palmer (R Ala.) introduced House Jt. Resolution 187 which reads,
    • “Resolved by the Senate and House of Representatives of the United States of America in Congress assembled, That Congress disapproves the rule submitted by the Office of Personnel Management relating to Postal Service Reform Act; Establishment of the Postal Service Health Benefits Program (89 Fed. Reg. 37061), and such rule shall have no force or effect.”
  • The cited rule is the OPM’s May 2024 supplemental rule implementing the PSHBP. In the FEHBlog’s opinion, the provision of the rule which offends Rep. Palmer (and the FEHBlog) for that matter is found in an OPM FAQ:
    • “While the proposed rule reflects that Medicare Part D-eligible annuitants and their Part D-eligible family members would be automatically group enrolled into the Part D EGWP, it reflects that they may choose to opt out of receiving prescription drug coverage through the PSHB Part D EGWP. This proposed rule provides, consistent with the statute, that the Part D EGWP offered by their PSHB plan is the only PSHB prescription drug benefit available for Part D-eligible PSHB annuitants and their Part D-eligible covered family members. As proposed, Medicare Part D-eligible annuitants and their family members who choose to opt out of or disenroll from the PSHB plan’s Part D EGWP would not have access to prescription drug benefits through their PSHB plan and would not pay a lower premium than those enrolled in the Part D EGWP.“
  • Nothing in the Postal Service Reform Act suggests that Congress intended to impose such a penalty. It’s a penalty because OPM does not reduce the premium for members who are deprived of their plan’s prescription drug benefits. Furthermore, when Congress included a mandate for PSHBP annuitants to enroll in Part B, it also provided grandfathering protections and exemptions. The Part D penalty applies across the board.
  • In any case, because Part D benefits will feature improvements such as a $2,000 out of pocket cost maximum for 2025, the carrot approach to incenting Part D EGWP enrollment should be tried first.
  • The American Hospital Association News lets us know,
    • “The Administration for Strategic Preparedness and Response July 16 announced it will work with the Department of Commerce on an assessment of the active pharmaceutical industrial base to better understand the pharmaceutical supply chain and how it has changed since the COVID-19 pandemic. The assessment is based on a survey conducted last winter. The study will inform federal strategies and funding decisions related to the API supply chain and raise awareness of potential supply chain issues, such as the current limited domestic manufacturing capabilities and other potential issues. The study will survey more than 200 companies, including manufacturers, distributors, suppliers and customers. A Bureau of Industry and Security webpage answers FAQs about the project.”

From the public health and medical research front,

  • STAT News tells us,
    • “The Centers for Disease Control and Prevention just released a trove of data on Americans with disabilities that found that more than a quarter of U.S. adults have a disability — over 70 million people, a bump from prior years. This slice of the population was also much more likely to report long Covid symptoms such as chronic fatigue and brain fog. This comorbidity looms large for many disabled communities as another surge in Covid cases sweeps the country.
    • “The data, gathered in 2022, is part of the agency’s Disability and Health Data System, which has annual state and national-level data stretching back to 2016. This is the first year that the agency has released long Covid data, finding that 11% of people with disabilities had long Covid symptoms while only 7% of people without disabilities reported symptoms.
    • “For many disabilities, the highest populations exist in a swath that extends from the Deep South and Louisiana up to Appalachian communities in West Virginia and Ohio. Disability benefits claims are typically highest in these areas, but for long Covid, the geography shifted west. Idaho and other states along the Continental Divide saw much higher rates of symptoms, with Montana recording the highest prevalence at 18%.”
  • The New York Times adds,
    • “A large new study provides some of the strongest evidence yet that vaccines reduce the risk of developing long Covid.
    • “Scientists looked at people in the United States infected during the first two years of the pandemic and found that the percentage of vaccinated people who developed long Covid was much lower than the percentage of unvaccinated people who did. 
    • “Medical experts have previously said that vaccines can lower the risk of long Covid, largely because they help prevent severe illness during the infection period and people with severe infections are more likely to have long-term symptoms.
    • “But many individuals with mild infections also develop long Covid, and the study, published Wednesday in The New England Journal of Medicine, found that vaccination did not eliminate all risk of developing the condition, which continues to affect millions in the United States.”
  • STAT News also informs us,
    • “A study published Wednesday in the Journal of Clinical Oncology found that certain unmatched donors, or people whose bone marrow does not as closely resemble that of the patient’s, provided similar outcomes to matched donors so long as patients receive a key drug called cyclophosphamide to prevent dangerous complications. That suggests that patients who need a transplant might be able to safely consider both matched and some unmatched donors, vastly expanding the pool of potential acceptable donors for all patients, though particularly those of African, Latino, or Asian ancestry.
    • “It’s much harder to find a match for most of my patients. Looking to people who are donor unrelated and aren’t a perfect match for my patients has become the norm,” said Sekeres, who is the chief of hematology at Sylvester Cancer Center at the University of Miami and did not work on the study. “That’s why this study really resonated with me. The classic teaching is you want a perfect match as opposed to less than perfect. What this study suggests is, if you use the right drugs after transplant, it may not be as big of a deal.”
    • “If so, up to roughly 84% of African American patients might have a potential donor in the national registry. Currently, less than 30% of African American patients have a potential match in the NMDP registry, previously called the National Marrow Donor Program.”
  • Per BioPharma Dive,
    • “A closely watched obesity pill being developed by Roche helped people in a small Phase 1 trial lose 7.3% of their body weight over four weeks when taken once daily — 6.1 percentage points more than those given a placebo, the company said Wednesday.
    • “The data comes two months after the Swiss drugmaker disclosed trial results from another obesity drug in its pipeline, which showed the once-weekly injection helped reduce body weight by 19% over six months. Roche disclosed more detailed data for that drug, indicating none of the trial participants stopped taking it due to side effects — a reason users might quit taking Wegovy or Zepbound.
    • “The two drugs came from Roche’s $2.7 billion acquisition of biotechnology startup Carmot Therapeutics in December. The deal was part of a rush by pharmaceutical companies to enter a market estimated to be worth more than $100 billion annually by early next decade.”
  • Beckers Hospital Review interviews NYU Langone’s bariatric surgery chief about the first GLP-1 generic and other GLP-1 issues.
  • Per a National Institutes of Health press release,
    • “A neuroimaging study of young people who exhibit a persistent pattern of disruptive, aggressive, and antisocial behavior, known as conduct disorder, has revealed extensive changes in brain structure. The most pronounced difference was a smaller area of the brain’s outer layer, known as the cerebral cortex, which is critical for many aspects of behavior, cognition and emotion. The study, co-authored by researchers at the National Institutes of Health (NIH), is published in The Lancet Psychiatry.
    • “Conduct disorder has among the highest burden of any mental disorder in youth. However, it remains understudied and undertreated. Understanding brain differences associated with the disorder takes us one step closer to developing more effective approaches to diagnosis and treatment, with the ultimate aim of improving long-term outcomes for children and their families,” said co-author Daniel Pine, M.D., chief of the Section on Development and Affective Neuroscience in NIH’s National Institute of Mental Health. “Critical next steps are to follow children over time to determine if differences in brain structure seen in this study are a cause of conduct disorder or a long-term consequence of living with the disorder.”
  • The National Cancer Institute posted its latest cancer information highlights.
  • The Institute of Clinical and Economic Review “released a Draft Evidence Report assessing the comparative clinical effectiveness and value of acoramidis (BridgeBio Pharma, Inc.), tafamidis (Vyndamax®/Vyndaqel®, Pfizer Inc.), and vutrisiran (Amvuttra®, Alnylam Pharmaceuticals, Inc.) for the treatment of transthyretin amyloid cardiomyopathy (ATTR-CM).”
  • AHRQ’s Patient Safety Network informs us,
    • “Patients presenting to the emergency department (ED) are triaged to prioritize care based on level of illness. In this study, 2,543 patients presenting to an ED in Switzerland were asked to self-triage using an electronic symptom-checker. (Patients were triaged and treated based on standard-of-care nurse triage.) Recommendations were given regarding time to treat (e.g., emergency) and point-of-care (e.g., self-care) and subsequently evaluated by three panels of experts. Fifty of the 2,543 patients were judged as undertriaged, but none were judged as potentially hazardous.”

From the U.S. healthcare front,

  • Healthcare Dive points out,
    • “Elevance reported solid second-quarter results on Wednesday — including $2.3 billion in profit — but the company still lowered long-term revenue growth guidance for its health insurance business. That disconnect raised red flags for analysts.”
    • “Changing revenue growth forecasts for health benefits in the middle of the year “is unusual,” commented Jefferies analyst David Windley in a Wednesday note. “We can’t identify a single, large item that would compel [the reduction] off-cycle.”
    • “During a call with investors Wednesday, Elevance management cited several factors for dropping the guidance, including significant member losses from Medicaid redeterminations and Medicare Advantage bids for 2025 that could slow growth.”
  • Fierce Pharma reports,
    • “As myriad pharma industry attempts to challenge the Inflation Reduction Act (IRA) fall flat, Johnson & Johnson is settling into a reality of pricing rebates and Medicare drug cost negotiations.”
    • “While J&J is “not in alignment” with IRA or its price setting process, the company has accepted the reality of the situation and baked assumptions about the future costs of its drugs into its growth projections through the end of the decade, Jennifer Taubert, EVP, worldwide chairman, innovative medicine at J&J, said on an analyst call Wednesday.
    • “As it stands, J&J currently expects to grow its business by 3% next year and then 5% to 7% out through 2030, Taubert said.”
  • Per Fierce Healthcare,
    • “Electronic health record messages to patients drafted by generative AI were of similar quality and accuracy to those written by healthcare professionals, according to a newly published study conducted using queries from NYU Langone Health patients.”
    • “The analysis, headed by researchers at the system’s affiliate NYU Grossman School of Medicine, had 16 primary care physicians rate AI and human drafts without knowing how each was written.
    • “Among a sample of 334 AI-drafted messages and 169 from professionals (both physicians and non-physicians), the raters found both sets to be on par regarding informational content, completeness and whether the grader would use the draft or start again from scratch.”
    • “The findings “suggest chatbots could reduce the workload of care providers by enabling efficient and empathetic responses to patients’ concerns,” study lead William Small, M.D., of the medical school, said in a release.”