Cybersecurity Saturday

Generative AI

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy front,

  • FedScoop tells us,
    • “A new bipartisan House bill aims to bolster the U.S. cybersecurity workforce by creating two training programs within the federal government, building on companion legislation introduced in the Senate earlier this year.
    • “The Federal Cybersecurity Workforce Expansion Act, co-sponsored by Reps. Chrissy Houlahan, D-Pa., and Mike Gallagher, R-Wis., would establish a cybersecurity registered apprenticeship program in the Cybersecurity and Infrastructure Security Agency and a Department of Veterans Affairs pilot program that would provide cybersecurity training to veterans.
  • The Cybersecurity and Infrastructure Security Agency (“CISA”) announced,
    • “In the fast-paced world of cybersecurity, staying ahead of threats is essential. And while security is without a doubt a priority for businesses of all sizes, it is easy to feel overwhelmed by all the information available. At CISA, we have been diligently developing a solution aimed at simplifying the way our partners and potential collaborators understand their cyber risk and prioritize their investments, ensuring they can quickly navigate this complexity with ease. Our focus has been on making the process of working with us more intuitive and user-friendly so that every organization can spend more time meeting business goals and less time sifting through cybersecurity resources. We believe this approach will be especially helpful for smaller to medium sized stakeholders with fewer resources, who need help prioritizing actions to help them to reduce the likelihood and impact of damaging intrusions.
    • “In early 2024, we look forward to launching a new way for organizations to understand their cyber risk and receive targeted, straightforward guidance built around our Cybersecurity Performance Goals. This new tool is called ReadySetCyber. While we’re not quite ready to unveil all the details just yet, we are excited to share a glimpse of what’s on the horizon.”
    • That glimpse is available here.
  • The Wall Street Journal reports,
    • “A cyberattack that disrupts everyday life in the U.S. will likely cost more than the insurance industry can afford to cover, requiring government intervention, insurers and brokers said.
    • “The idea of a federal backstop to help insurers cope in the event of a catastrophic cyberattack has been examined by the government in recent years, but has gained momentum with tandem efforts at the Treasury Department, the Office of the National Cyber Director and the Cybersecurity and Infrastructure Security Agency over the past year. Government officials and the insurance industry plan to meet in April to work out exactly what such a program would look like.
    • “Federal support in the event of a catastrophic attack would undoubtedly be necessary, said John Keogh, president and chief operating officer of insurer Chubb.
    • “While the industry could absorb a major natural disaster, the effects of a cyberattack on a similar scale would quickly overwhelm its capacity to cover losses.”

From the cybersecurity vulnerabilities and breaches front,

  • Cybersecurity Dive points out last Monday,
    • A cyberattack targeting Fidelity National Financial led to disruptions across its services, including title insurance and mortgage transactions, after it was forced to block access to certain systems, the company said last week in a filing with the Securities and Exchange Commission. 
    • An investigation showed an unauthorized third party gained access to some of its systems and stole certain credentials, the company said.
    • The threat group known as AlphV/BlackCat claimed responsibility for the attack, according to security researcher Dominic Alvieri.
  • CISA added two more known exploited vulnerabilities to its catalog on November 30, 2023, and removed one on December 1, 2023.

From the ransomware front, here’s a link to the latest Bleeping Computer’s Week in Ransomware.

From the cybersecurity defenses front,

  • Technopedia identifies the top nine cybersecurity trends for 2024.
  • Cybersecurity Dive informs us,
    • “Technology like generative AI can address some key security challenges confronting organizations, but professionals that overemphasize those capabilities miss the fundamental need to put people and their unique talents first.
    • “Security is a people issue,” Amazon CSO Stephen Schmidt said Monday during a presentation at AWS re: Invent in Las Vegas. “Computers don’t attack each other. People are behind every single adversarial action that happens out there.”
    • “For Schmidt, winning in security is akin to playing chess — focusing on the board, how the pieces move and interact — while practicing psychology. Security professionals need to understand the human elements at play, including their own tendencies and opponents’ motivations.
    • “You’re not playing just one chess match,” Schmidt said. “You are playing dozens or hundreds of games at the same time, because you have a variety of adversaries with different motivations who are going after you.”
    • “This cybersecurity scrum can feel overwhelming, but many defenders view generative AI as an ally that can automate repetitive tasks. Cybersecurity vendors across the landscape have released security tools infused with the technology, and more are in the pipeline.”
  • Tech Republic adds that Open AI first released ChatGPT on November 30, 2022. The site explains how the technology has evolved.

Monday Roundup

David Ermer–CMS, Congress, FDA, Federal employment benefits, Generative AI, Medical / Rx research, Medicare, U.S. Healthcare–
Photo by Sven Read on Unsplash

From Washington, DC,

  • Roll Call offers a preview of Congress’s actions over the next month, after which point the first session of this 118th Congress will come to a close.
  • Bloomberg provides an update on ongoing efforts to revamp the Nation’s organ transplant system. Here are the highlights:
    • “First contract bid solicitations from HHS expected this fall, and
    • “Multiple vendors to run transplant system for first time.”
  • The Centers for Medicare and Medicaid Services published in today’s Federal Register corrections to its Section 111 reporting civil monetary penalty rule which was issued on October 11, 2023. CMS asserts that the corrections fix “typographical and technical errors in the final rule, and it does not make substantive changes to the policies or the implementing regulations that were adopted in the final rule.”
  • The Department of Health and Human Services announced,
    • “As part of the inaugural meeting of the White House Council on Supply Chain Resilience, President Biden and Secretary of Health and Human Services Xavier Becerra today announced new efforts to bolster the domestic supply chain for essential medicines and medical countermeasures.
    • “President Biden will issue a Presidential Determination broadening HHS’ authorities under Title III of the Defense Production Act (DPA) to enable investment in domestic manufacturing of essential medicines, medical countermeasures, and other critical inputs that have been deemed by the President as essential to the national defense. In addition, HHS will designate a new Supply Chain Resilience and Shortage Coordinator for efforts to strengthen the resilience of critical medical product and food supply chains, and to address related shortages.”
  • The Food and Drug Administration announced,
    • “approv[ing] Ogsiveo (nirogacestat) tablets for adult patients with progressing desmoid tumors who require systemic treatment. Ogsiveo is the first drug to be approved for the treatment of patients with desmoid tumors, a rare subtype of soft tissue sarcomas.
    • “Desmoid tumors are non-cancerous but can be locally aggressive. The tumors may invade into surrounding structures and organs, resulting in pain, issues with being able to move, and decreased quality of life. Although surgical removal has historically been the treatment of choice, there is a high risk that the tumor will return or that other health challenges will occur after removal; therefore, systemic therapies (cancer treatment targeting the entire body) are being increasingly evaluated in clinical trials.” 
  • The HHS Inspector General concluded that “The Risk of Misuse and Diversion of Buprenorphine for Opioid Use Disorder in Medicare Part D Continues to Appear Low: 2022.”
  • Govexec tells us,
    • “The U.S. Postal Service is planning to hire just 10,000 temporary employees during the current holiday season as part of a new approach that management has acknowledged comes with some risks. 
    • “The seasonal hiring marks a 64% reduction from the employees brought on in 2022 during what USPS calls its “peak season” when the agency made 28,000 temporary hires. The agency had said it would bring on just 20,000 seasonal workers that year, but a recent USPS inspector general report found it reached a higher tally. 
    • “This will mark the second consecutive year in which the Postal Service significantly reduces its seasonal hiring. In 2021, USPS added 45,000 non-permanent staff for the holiday rush. Postmaster General Louis DeJoy has said additions to the permanent, career workforce has lessened the need for such a surge. In the last two years, the agency has converted 150,000 employees from part-time workers to full-time, career personnel.”
  • Federal News Network informs us,
    • “Participants in [OPM’s] Thrift Savings Plan felt less content with the TSP this year, according to the latest results of the Federal Retirement Thrift Investment Board’s annual satisfaction survey.
    • “Currently, 82% of TSP participants are satisfied with the plan, compared with an 87% satisfaction rate in 2022, the board’s survey of tens of thousands of TSP participants showed.
    • “The slumping satisfaction scores may not come as a surprise after the TSP’s tumultuous transition to a new recordkeeper in June 2022. The 2023 survey, conducted between March and May of this year, was the first time the major update was reflected in the annual participant satisfaction survey.”

From the public health and medical research front,

  • Precision Vaccinations points out,
    • “The World Health Organization (WHO) today reported that the multi-country mpox outbreak continues at a low transmission level in the European Region and the Americas.
    • “The 30th WHO Situation Report, published on November 25, 2023, offers insights regarding the latest epidemiology and a particular focus on the ongoing and evolving epidemiology of mpox in the Democratic Republic of the Congo (DRC).
    • “The WHO confirmed that from January 2022 through October 31, 2023, a cumulative total of 91,788 laboratory-confirmed cases of mpox, including 167 deaths, have been reported from 116 countries/territories/areas.
    • “The countries that have reported the highest cumulative number of mpox cases are the United States (30,771), Brazil (10,967), and Spain (7,647).”
  • Healio notes,
    • “Eating disorder claims in the United States rose 65% as a percentage of all medical claims over the last 5 years, according to a report from FAIR Health, a health care claims repository.
    • “Researchers at FAIR Health evaluated more than 43 billion private health care claims records to investigate trends in eating disorders from 2018 to 2022 based on regional and national levels, demographic and socioeconomic factors and other health conditions. * * *
    • “Key takeaways:
      • “Patients aged 14 to 18 years accounted for most eating disorder claims in 2022.
      • “Overall, 72% of patients with eating disorders were diagnosed with at least one co-occurring mental illness.”
  • Beckers Hospital Review lets us know,
    • “Eli Lilly’s Mounjaro helped patients lose weight more effectively than Novo Nordisk’s Ozempic, according to a preprint study that included more than 40,000 patients. 
    • “The research evaluated 41,223 EHRs of overweight or obese patients taking Mounjaro (tirzepatide) or Ozempic (semaglutide) for Type 2 diabetes. The cohort was restricted to patients with available weight data and those who had not received a glucagon-like peptide-1 receptor agonist prior to May 2022.
    • “Although about 77% of the patients took Ozempic, those who took Mounjaro “were significantly more likely to achieve 5%, 10% and 15% weight loss and experience larger reductions in weight at 3, 6, and 12 months,” the study found.
    • “Truveta, a healthcare data company that collects EHR information from more than 30 systems, conducted the research. It is the first real-world comparative effectiveness study between Mounjaro and Ozempic, Truveta said in a Nov. 27 news release.” 
  • STAT News reports,
    • “The inflammation-targeting therapy Dupixent succeeded in a Phase 3 trial in patients with the chronic lung disease COPD, its developers said Monday, results that could propel the blockbuster medicine into a massive new market.
    • “Dupixent, which is jointly developed by Sanofi and Regeneron Pharmaceuticals, has already racked up approvals for several indications, including asthma, atopic dermatitis, and eosinophilic esophagitis. If approved for COPD, it would be the first biologic treatment for the condition.
    • “The trial, dubbed Notus, was the second Phase 3 trial for Dupixent in COPD, with the companies announcing similarly positive results from the Boreas trial earlier this year. The full data from Boreas were published in the New England Journal of Medicine.”

From the U.S. healthcare business front,

  • Employee Benefit News offers tips on PBM contracting.
  • Per Fierce Healthcare,
    • “Mark Cuban Cost Plus Drug Company has inked its latest partnership, joining forces with Expion Health to address the rising cost of specialty drugs.
    • “Cost Plus Drugs’ pricing model will integrate into Expion’s dynamic pricing technology, harnessing the power of both for speciality medications. Expion’s tool and Cost Plus Drugs’ approach together “equips payers with a sophisticated tool for navigating this modern landscape,” the companies said in the announcement.”
  • and
    • “Ayble Health, a digital health platform for patients with chronic gastrointestinal conditions, has announced a new collaboration with the Mayo Clinic.
    • “Ayble is working with the Mayo Clinic Complex Care Program to offer a hybrid care model that matches patients with the appropriate virtual and in-person care based on acuity and need.
    • “By matching the right care for a patient at the right time, the two hope to improve outcomes and costs for digestive diseases. The collaboration is available for large employers and health plans.” 
  • MedCity News calls to our attention,
    • “AI startup Hoppr teamed up with AWS to launch a new foundation model to help bring more generative AI solutions into medical imaging, the companies announced on Sunday at RSNA 2023, the annual radiology and medical imaging conference in Chicago.
    • “The new product, named Grace, is a B2B model designed to help application developers build better AI solutions for medical images — and to build them more quickly. Along with the launch of Grace, Hoppr also announced that it received “a multi-million dollar investment” from Health2047, the American Medical Association’s venture studio.”
  • Per Healthcare Dive,
  • “Advocate Health’s financial performance dipped in the third quarter despite rising patient volumes as the major nonprofit health system navigated higher expenses and declining investment returns.
  • “The operator reported a nine-month operating income of $79.4 million, down from the $85.7 million Advocate recorded through the first half of the year.
  • “Advocate’s investment income also took a hit, falling more than a third from midyear. Overall, the nonprofit’s bottom line dropped to $721.2 million, 28% lower than midyear. * * *
  • “Formed out of a merger between Illinois-based Advocate Aurora Health and North Carolina-based Atrium Health last year, the health system is comprised of three divisions: Advocate Aurora Health, Atrium Health’s Charlotte-Mecklenburg Hospital Authority and Atrium Health Wake Forest Baptist. Together, the divisions operate more than a thousand care sites, including 67 hospitals.”

Happy Thanksgiving!

David Ermer–Congress, COVID-19 testing, Federal employment benefits, Generative AI, Medical / Rx research, OPM, U.S. Healthcare–
Photo by Priscilla Du Preez 🇨🇦 on Unsplash

Following this post, The FEHBlog will reappear on Saturday for Cybersecurity Saturday. The FEHBlog wishes his readers a Happy Thanksgiving.

From Washington DC

  • Thanks to Bloomberg, the FEHBlog learned about this Congressional Research Service report on FY 2024 USPS Appropriations. To wit,
    • “On September 30, 2023, Congress passed the Continuing Appropriations Act, 2024 and Other Extensions Act (H.R. 5860; P.L. 118-15), which provides continuing FY2024 appropriations to federal agencies through November 17,
    • “Section 126 of the act increases the rate of funding for the Office of Personnel Management (OPM) to approximately $219.1 million, which is about $28.3 million above its FY2023 funding.
    • “The additional OPM funding is provided for the implementation of the Postal Service Health Benefits Program (PSHBP), a new health benefit program for eligible postal employees and retirees. Under the PSRA, OPM is required to establish and administer the PSHBP.”
  • FEHBlog note — The Postal Service also is on the financial hook for funding implementation of the PSHBP.
  • STAT News reports,
    • “Senate Democrats, led by Sen. Bernie Sanders (I-Vt.), on Tuesday mounted a public pressure campaign to get the executives of Merck, Johnson & Johnson, and Bristol Myers Squibb to testify in a January hearing on why the United States pays more for prescription drugs than other countries.
    • “All three companies have sued the Biden administration over the new Medicare drug price negotiation that congressional Democrats passed last year. Bristol Myers Squibb’s blood thinner Eliquis; Johnson & Johnson’s blood thinner Xarelto, anti-inflammatory medicine Stelara, and blood cancer treatment Imbruvica; and Merck’s diabetes drug Januvia were selected as part of the first 10 drugs to go through the negotiation process.
    • “It’s unclear whether the executives will agree to testify at the hearing, which is titled “Why “Does the United States Pay, By Far, The Highest Prices In The World For Prescription Drugs?” Sanders also put out a fundraising email just before the letter was announced, with the subject line: “The greed of the pharmaceutical industry is out of control.” It featured an op-ed he wrote for the Guardian Monday.”

In FEHB Open Season and federal retirement news,

  • Fedweek provides Reg Jones’ observations on FEHBP and Medicare Parts A and B. The Federal Times offers articles titled “A Procrastinator’s Checklist for Choosing Open Season Benefits” and “What’s driving rate hikes for federal employee health premiums?”
  • The second Federal Times article is a topic that the FEHBlog follows throughout the year. In that regard, Mercer Consulting released the following survey findings last week:
    • “Mercer, a business of Marsh McLennan (NYSE: MMC), released the findings of its 2023 National Survey of Employer-Sponsored Health Plans, which found the average per-employee cost of employer-sponsored health insurance rose by 5.2% in 2023 to reach $15,797. * * *
    • “In 2022, cost rose by 3.2%, well below general inflation, which averaged 8% that year. Because healthcare providers typically have multi-year contracts with health plans, employers did not feel the full brunt of inflation last year. “Rather, inflation-driven cost increases are phasing in as contracts are renewed,” says Sunit Patel, Chief Health Actuary, Mercer. The survey shows employers project another sharp increase of 5.2% for 2024.
    • “It may take another couple of years for price increases stemming from higher healthcare sector wages and medical supply costs to be felt across all health plans,” Mr. Patel says.
    • “At the same time, inflation is only one factor behind this year’s higher cost increases. In 2023, spending on prescription drugs rose sharply. “While the effects of inflation may be relatively short-lived, new and ongoing developments in the pharmaceutical market seem likely to have a longer-term impact on health benefit cost.”
  • The Federal Times adds,
    • “Federal employees’ retirement applications take almost twice as long to process when they contain errors, leading to further delays in processing and dispensing annuities, according to a watchdog report published Monday.
    • “The Office of Personnel Management’s inspector general found that “healthy” application packages took on average 53 days to process, and “unhealthy” ones containing errors took more than 108 days, according to a random sample of applications the inspector general studied.
    • “That discrepancy needs be reflected in the data OPM reports monthly to accurately monitor whether retirement processing is improving, the IG report said.
    • “The lack of transparency for healthy versus unhealthy ‘incomplete’ application packages limits the quality of information being provided to external parties as the main cause for why Retirement Services has not met its goal for processing retirement application packages within 60 days,” according to the report.”

From the public health and medical research front,

  • Beckers Clinical Leadership tells us,
    • “Hospital and public health officials are urging people to take precautions and be mindful of where they seek care to limit capacity strain on emergency departments as respiratory virus activity heats up heading into the holiday season. 
    • “Since early September, COVID-19 metrics had mostly been trending downward or remained flat. Now they are on the rise again, though they remain far below levels seen in previous surges. There were 16,239 new admissions for the week ending Nov. 11, up 8.6% from the previous week. 
    • “Meanwhile, most of the country is seeing an uptick of flu and respiratory syncytial virus cases. Hospitalizations associated with the two infections are also ticking up, particularly among children and older adults. 
    • “The more concerning thing is the severity of some of the illness,” Hany Atallah, MD, chief medical officer Jackson Memorial Hospital in Miami, told ABC affiliate WPLG. “And we are also seeing some patients come in with more than one viral infection, so they may have RSV and flu, for example. We’re constantly trying to follow the science and encourage people to get vaccines.” 
  • The Wall Street Journal points out,
    • “Ozempic, Wegovy and their counterparts have exploded in popularity over the past year, earning billions for the drugs’ makers, transforming the American approach to weight-loss, and sparking widespread cultural discussion in a country that is already obsessed with weight. 
    • “That conversation lands on Thanksgiving tables this week, where some people say the drugs have boosted their confidence around food, and others say they are worried about facing questions about what they’re eating, what they’re not eating, and changes in their appearance.
    • “It’s a hot topic, and people have a lot of judgments,” says Dr. Gauri Khurana, a psychiatrist in private practice in New York City and a clinical instructor at Yale University who has prescribed the medications and helped patients manage them. * * *
    • “Doctors advise people to listen to their bodies—not their family members—when it comes to serving sizes. A balanced plate that gives priority to protein and high-fiber foods over carbohydrates and fatty foods, which tend to sit in the stomach and exacerbate the medication’s effects of delayed gastric emptying, can help patients avoid filling up too quickly or feeling nauseous.”
  • The New York Times reports,
    • “Just in time for the holiday season, the Biden administration is offering Americans a fresh round of free at-home coronavirus tests through the Postal Service.
    • “The administration revived the dormant program in September, announcing then that households could order four free tests through a federal website, covidtests.gov.
    • “Beginning Monday, households may order an additional four tests. Households that have not placed an order since the program resumed can submit two orders, for eight tests in total.”
  • The University of Minnesota informs us,
    • “A new survey of 158 hospital executives, conducted by the Sepsis Alliance, found that 90% see antimicrobial resistance (AMR) as a threat, and 88% think the problem is getting worse. The survey, conducted by Sage Growth Partners on behalf of the Sepsis Alliance, also dug into executives’ views on other related AMR issues. An 11-page report on the findings was published on the Sepsis Alliance websiteon November 17.
    • “Another top concern is the public’s lack of knowledge about AMR, with 59% of executives saying that public education of clinicians as well as patients is the largest barrier to antibiotic stewardship. Respondents recommend public service announcements covering the need for early treatment, the importance of completing treatment, and storing the drugs properly.”

From the U.S. healthcare business front,

  • Healthcare Dive asks “Where are all the nurses? Hospitals, advocates disagree on crisis; Hospitals and nursing unions disagree about what’s driving sluggish application rates for open registered nurse positions — a lack of qualified candidates or a lack of interest.”
  • BioPharma Dive notes,
    • “Roche’s Genentech unit is partnering with computing giant Nvidia in a multiyear deal that highlights the pharmaceutical industry’s growing hopes of using artificial intelligence to speed up the process of designing and developing new drugs. 
    • “By collaborating with Nvidia, Genentech expects to “significantly enhance” its existing AI research and potentially improve on the chip designer’s own software, such as its “BioNemo” platform for drug discovery. 
    • “Our teams will be continuously exchanging expertise on the advancement of science and the state-of-the-art methods emerging in accelerated computing, AI and simulation across this entire drug discovery process,” said Kimberly Powell, vice president of healthcare at Nvidia, in a briefing with reporters.” 

Monday Roundup

David Ermer–CDC, COVID-19, COVID-19 vaccine, Generative AI, Medical / Rx research, U.S. Healthcare–
Photo by Sven Read on Unsplash

From Washington, DC (note the FEHBlog is back in Texas after a productive week in DC)

  • The Society for Human Resource Management tells us,
    • “The National Labor Relations Board (NLRB) announced it will extend the effective date of its joint employer rule to Feb. 26, 2024, to facilitate resolution of legal challenges to the rule.
    • “The NLRB released the final rule on Oct. 26 with an implementation date of Dec. 26. The rule was published in the Federal Register on Oct. 27.
    • “U.S. Sen. Bill Cassidy, R-La., sent a letter informing the NLRB that it was out of compliance with the Congressional Review Act’s 60-day threshold rule, which mandates that the implementation of all major federal rules must be delayed 60 days from when they are received by Congress.
  • The Internal Revenue Service posted for public comment a draft version of the 2024 Employers’ Tax Guide to Fringe Benefits.

From the public health and medical research front,

  • The Associate Press reports,
    • “The U.S. flu season is underway, with at least seven states reporting high levels of illnesses and cases rising in other parts of the country, health officials say.
    • “The Centers for Disease Control and Prevention posted new flu data on Friday, showing very high activity last week in Louisiana, and high activity in Alabama, Florida, Georgia, Mississippi, New Mexico and South Carolina. It was also high in the District of Columbia and Puerto Rico, the U.S. territory where health officials declared an influenza epidemic earlier this month. * * *
    • “Traditionally, the winter flu season ramps up in December or January. But it took off in October last year, and is making a November entrance this year.”
  • STAT News offers its observations on this development.
    • “The early signals from influenza suggest the virus is settling back into the seasonal pattern it followed — to the degree the always mercurial bug follows any pattern — before the pandemic, said Alicia Budd, team lead for domestic flu surveillance at the Centers for Disease Control and Prevention. “All I can say is at this point we are at a pretty typical point in flu activity,” she told STAT.
    • “Overall, the signs to date appear to portend a winter more like what we knew before the arrival of Covid, said Megan Culler Freeman, an assistant professor of pediatrics specializing in infectious diseases at the University of Pittsburgh.
    • “Last year as early as August, children’s hospitals across the country were full to the gills … because there were so many children with respiratory distress,” Freeman said. “And I would say that this season is starting to feel a lot more normal. Only now, as we’re getting into November — even towards mid- to late- November — we’re starting to see more of our winter volume starting to begin. * * *
    • “The scientific consensus is still out about whether Covid will be a seasonal virus, transmitting primarily during cold-and-flu season. Many experts think it is heading that way, but hasn’t yet settled into that pattern.”
  • The American Medical Association explains what doctors wish their patients knew about diabetes 2. Check it out.
  • KFF informs us,
    • “Research suggests that the Novavax [Covid] vaccine is about as safe and effective as the mRNA shots. Its main disadvantage is arriving late to the scene. Vaccine uptake has plummeted since the first shots became widely available in 2021. Nearly 70% of people got the primary vaccines, compared with fewer than 20% opting for the mRNA covid boosters released last year. Numbers have dwindled further: As of Oct. 17, only 5% of people in the United States had gotten the latest covid vaccines, according to the Department of Health and Human Services.
    • “Daniel Park, an epidemiologist at George Washington University, said low rates might improve if people who felt lousy after their last mRNA shots gave Novavax a try. It protects against severe illness, but researchers struggle to specify just how effective this and other vaccines are, at this point, because studies have gotten tricky to conduct: New coronavirus variants continuously emerge, and people have fluctuating levels of immunity from previous vaccines and infections.
    • “Still, a recent study in Italy suggests that Novavax is comparable to mRNA vaccines. It remained more than 50% effective at preventing symptomatic covid four months after vaccination. Some data suggests that mixing and matching different types of vaccines confers stronger protection — although other studies have found no benefit. 
    • “Given all this, Park held out for the Novavax vaccine on account of its potentially milder side effects. “Between a demanding full-time job and two young kids at home, I wanted to stay operational,” he said. His arm was sore, but he didn’t have the 24-hour malaise accompanying his last mRNA shot.”

From the U.S. healthcare business front,

  • MedCity News notes,
    • “Eli Lilly’s cardiometabolic drug portfolio is expanding with newly approved therapies. To meet demand for those therapies and additional products to come, the company is building a new $2.5 billion manufacturing site in Germany.
    • “Construction on the new plant is on track to begin next year. Lilly expects the site will start operations in 2027, becoming its sixth manufacturing site in Europe. The company said it has invested more than $11 billion in its global manufacturing capabilities in the past three years to support the production of medicines across its portfolio.
    • “Some of Lilly’s capital investments have been closer to the Indianapolis-based drugmaker’s home. Last year, the company committed more than $2 billion to two new facilities in Lebanon, Indiana for the manufacturing of existing products and future ones, the company said in its annual report. Lilly also invested more than $1 billion in a new facility in Concord, North Carolina, for the manufacturing of injectable products and devices. Earlier this year, Lilly pledged to spend an additional $450 million to expand capacity at a site in Research Triangle Park that also makes injectable products, including new blockbuster medicine Mounjaro.”
  • Healthcare Dive points out,
    • “AstraZeneca’s new health-tech business, Evinova, launched Monday, with several big-name partnerships already in place and a goal to “better meet the needs of healthcare professionals, regulators and patients.”
    • “Evinova’s main focus will be helping to optimize their clinical trials for biotechnology companies, pharmaceutical firms and CROs, or contract research organizations, in an effort to reduce the time and costs associated with developing new medicines.
    • “Two CROs, Parexel and Fortrea, have agreed to offer Evinova’s digital health solutions to their customers. Evinova is also collaborating with Accenture and Amazon Web Services to “accelerate industry adoption and sustain and expand the global reach of its digital products.”
  • Per Fierce Healthcare,
    • “The financial outlook for major health plans is stable in the face of notable potential headwinds heading into the end of the year, according to a new report from Moody’s Investors Service.
    • “The Moody’s analysis said earnings in the third quarter were on par with reports from the second quarter and that the industry’s stability is in line with expectations. However, the researchers said they were expecting payers to face different challenges as 2023 got underway.
    • “A notable trend that emerged in the second quarter was increased utilization in Medicare Advantage (MA), which peaked in the second quarter thanks to a boost in outpatient care. While the trend did stabilize in the third quarter, “it did not get better,” the Moody’s analysts wrote.
    • “Centene was the lone exception, and it reported a lower medical loss ratio for MA in the third quarter of 2023 compared to the prior-year quarter, according to the report.”
  • and
    • “As the industry continues to debate the promise and risks of artificial intelligence in healthcare, patients are bullish on the potential for generative AI to improve access and even lower healthcare costs.
    • “More than half (53%) of U.S. consumers believe generative AI could improve access issues and shorten wait times for medical care, according to a survey by Deloitte’s Center for Health Solutions. A little less than half of consumers (46%) say it has the potential to make healthcare more affordable.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy front,

  • Cyberscoop reports,
    • “Former National Security Agency Executive Director Harry Coker is one step closer to being the next national cyber director after the Senate Homeland and Governmental Affairs Committee advanced his nomination Wednesday.
    • “Coker, also a former CIA officer, told the panel during the initial nomination hearing that he would plan on continuing the work of his potential predecessors.
    • “Coker’s nomination comes after the White House was criticized by experts and policy wonks for not nominating Kemba Walden, the current acting national cyber director, to the permanent role. The Washington Post reported that Walden’s personal debts were the White House’s rationale for declining to nominate her.
    • “Walden’s last day as the acting cyber chief is Friday, according to an ONCD spokesperson.”
  • On November 14, 2023, the Cybersecurity and Infrastructure Security Agency (CISA) released
    • “its first Roadmap for Artificial Intelligence (AI), adding to the significant DHS and broader whole-of-government effort to ensure the secure development and implementation of artificial intelligence capabilities. DHS plays a critical role in ensuring AI safety and security nationwide.”its first Roadmap for Artificial Intelligence (AI), adding to the significant DHS and broader whole-of-government effort to ensure the secure development and implementation of artificial intelligence capabilities. DHS plays a critical role in ensuring AI safety and security nationwide.
    • “Last month, President Biden issued an Executive Order that directed DHS to promote the adoption of AI safety standards globally, protect U.S. networks and critical infrastructure, reduce the risks that AI can be used to create weapons of mass destruction, combat AI-related intellectual property theft, and help the United States attract and retain skilled talent, among other missions. As part of that effort, CISA’s roadmap outlines five strategic lines of effort for CISA that will drive concrete initiatives and outline CISA’s responsible approach to AI in cybersecurity.”
  • Federal News Network observes,
    • “When federal government agencies were breached by Chinese hackers due to a Microsoft Azure vulnerability, the Cybersecurity and Infrastructure Security Agency released an advisory calling for the use of more enhanced monitoring tools to build resilience against increasingly sophisticated attacks. This latest advisory was further amplified by the National Cybersecurity Strategy, which reinforced the need to make the government’s critical infrastructure more resilient by modernizing federal networks.  
    • “Despite these measures, a recent study shows that only 26% of the public sector (compared to 40% of the private sector) have a formal approach to building resilience. Moreover, federal agencies whose mission-set centers on critical infrastructure, such as the Departments of Energy or Transportation, still face challenges to maintain legacy toolsin contrast to the public sector as a whole.   
    • “This is because federal agencies need more support to implement modern monitoring tools that help improve their threat detection and response. Without the proper technology in place to match the challenges of today’s threat landscape, it is difficult to remain resilient when faced with an attack. But how might an organization begin to achieve the resilience required for today’s cyber threats?  
    • “It starts with federal agencies prioritizing observability strategies. Despite its growing popularity, observability is a fresh concept – one that can be difficult to define and see as a path to resilience without first understanding its foundation. The roots of observability can simply be traced down to a collection of logs, metrics and traces by which monitoring systems can more proactively mitigate potential threats.”

From the cybersecurity vulnerability and breaches front,

  • The HIPAA Journal offers its October 2023 Healthcare Data Breach Report.
    • “For the second consecutive month, the number of reported data breaches of 500 or more healthcare records has fallen, with October seeing the joint-lowest number of reported data breaches this year. After the 29.4% fall in reported data breaches from August to September, there was a further 16.7% reduction, with 40 data breaches reported by HIPAA-regulated entities in October – the opposite trend to what was observed in 2022, when data breaches increased from 49 in August 2022 to 71 breaches in October 2022. October’s total of 40 breaches is well below the 12-month average of 54 breaches per month (median:52 breaches).”
  • Federal News Network reports,
    • “The Office of Personnel Management faces a tight deadline to set up a new health insurance marketplace for Postal Service employees and retirees to enroll in new plans, starting next year.
    • “Now OPM is addressing watchdog concerns about whether the IT infrastructure supporting this new USPS marketplace is following federal cybersecurity requirements.
    • “OPM’s Office of Inspector General, in a flash audit released Friday, raised concerns about the cybersecurity steps OPM took before launching the IT systems that will run the Postal Service Health Benefits (PSHB) Program. * * *
    • “The IG report focuses on the steps OPM took to launch Carrier Connect, a system OPM uses to communicate and share data with health care providers. [FEHBLog note — FFF presumably refers to sharing data with FEHB plans.]
    • “According to the report, OPM officials acknowledged the agency started the assessment and authorization process too late in the security development lifecycle — in the summer of 2023 — and knew they would have to launch Carrier Connect under a provisional authority to operate (ATO).
    • “IT security was not integrated at the beginning, and as a result, many of the required elements of an authorization to operate (ATO) package were not completed before the system was authorized to operate and placed into production,” the IG report states.”
  • HHS’s health sector Cybersecurity Coordination Center (HC3) posted a PowerPoint presentation about Emotet malware, which HC3 describes as “the enduring and persistent threat to the health sector.”
  • This week, CISA added six known exploited vulnerabilities to its catalog on November 13, then another three on November 14, and then finally another three on November 16.
  • Get a load of this Dark Reading article.
    • “The ransomware group ALPHV (aka “BlackCat”) has filed a formal complaint with the US Securities and Exchange Commission (SEC), alleging that a recent victim failed to comply with new disclosure regulations. * * *
    • “Putting aside the sheer audacity of the move, ALPHV may be out of luck with the SEC for two reasons.
    • “For one thing, in a statement provided to BleepingComputer on Wednesday, MeridianLink stated that it wasn’t yet sure if any consumer personal information was compromised, adding that “based on our investigation to date, we have identified no evidence of unauthorized access to our production platforms, and the incident has caused minimal business interruption.” Exactly what data ALPHV stole and published may affect whether the breach is “material,” per SEC language.
    • “Second, as noted in its original press release, the new SEC disclosure rule only takes effect on Dec. 18. (Smaller companies will have even more leeway, with an extra 180 days before they have to get on board).
    • “Future victims of similar attacks will have fewer breaks to count on.
    • “Using the threat of filing a ‘failure to report’ complaint against its own victim to the SEC is a compelling tactic that could weaponize a government regulation for a cybercriminal group’s benefit,” Tiquet warns. “Disciplinary action from the SEC is not to be taken lightly and fines can be very steep.”

From the ransomware front

  • Cybersecurity Dive reports,
    • “The group of threat actors claiming responsibility for major attacks against MGM Resorts, Caesars Entertainment and Clorox is composed of experts in social engineering, and federal cyber authorities are prodding more victims to come forward.
    • “Scattered Spider, which deploys AlphV ransomware in some of its attacks, uses multiple techniques and tools to gain remote access or bypass multifactor authentication, federal cyber authorities warned in a Thursday advisory.
    • “The FBI and Cybersecurity and Infrastructure Security Agency shared technical details and data gleaned from investigations as recently as this month to help organizations thwart and mitigate attacks. Yet, officials say more information is needed, as a lack of reporting hinders law enforcement’s ability to take action.
    • “Scattered Spider’s high level of activity underscores the importance of prevention and the need for more victim organizations to report cyberattacks to CISA or the FBI, agency officials said.”
  • The American Hospital Association News adds,
    • “Scattered Spider’s sophisticated technical cyberattacks begin with sophisticated psychological attacks,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “Scattered Spider employs social engineering techniques to deceive end users into providing their credentials, authentication codes or downloading ‘help desk’ tools on their computers that allow the adversary to gain and maintain persistent access to computer networks. Staff should be advised of help desk verification protocols and that help desk personnel should not be asking staff to divulge their credentials or multi-factor authentication codes. Conversely, the help desk should enhance its verification protocols and challenge questions to ensure they do not improperly reset staff credentials and to help staff distinguish valid help desk interaction from social engineering attempts.
  • On November 15, 2023, CISA issued a #StopRansomware Advisory regarding Rhysida Ransomware.
  • On November 13, 2023, CISA posted an update to its Royal Ransomware Advisory.
    • “The updated advisory provides network defenders with additional information on tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with Royal ransomware variants. FBI investigations identified these TTPs and IOCs as recently as June 2023.”
  • Bleeping Computer’s The Week in Ransomware is back this week.

From the cybersecurity defenses front,

  • On November 17, CISA posted “the Mitigation Guide: Healthcare and Public Health (HPH) Sector as a supplemental companion to the HPH Cyber Risk Summary, published July 19, 2023. This guide provides defensive mitigation strategy recommendations and best practices to combat pervasive cyber threats affecting this critical infrastructure sector. It also identifies known vulnerabilities for organizations to assess their networks and minimize risks before intrusions occur.”
  • Forta tells us about Amazon Web Services’ Six Pillars of Cybersecurity.
  • Dark Reading explains how to build a resilient incident response team.

Tuesday Tidbits

David Ermer–CDC, Congress, FDA, Federal employment benefits, Generative AI, Medical / Rx research, NIH, OPM, Rx coverage, U.S. Healthcare–
Photo by Patrick Fore on Unsplash

From Washington, DC,

  • Roll Call informs us,
    • “House Republicans are aiming to reach a consensus this week on a stopgap funding measure that would get a vote next week before the current continuing resolution runs out on Nov. 17.
    • “During a Monday night leadership meeting, Speaker Mike Johnson, R-La., floated a “laddered CR” that would extend funding for four bills through Dec. 7 and the rest through Jan. 19. Johnson said Tuesday after meeting with the GOP conference that a stopgap bill running into January “with certain stipulations” is also on the table.
    • “The new speaker said he would be revealing his spending plan “in short order” but did not share any details Tuesday morning after House Republicans met to discuss the options. However, Senate Democrats are pushing for a stopgap measure into early December, with Dec. 8 as the preferred end date, according to sources familiar with the consideration.”
  • The Washington Post reports,
    • “The Senate on Tuesday voted 62 to 36 to confirm cancer surgeon Monica M. Bertagnolli as the director of the National Institutes of Health, ensuring that America’s flagship biomedical agency will have a permanent leader following a months-long dispute involving a key senator that threatened to derail her nomination.
    • “Bertagnolli will be the second woman ever to lead the nearly $48 billion agency, which plays a central role in the U.S. scientific agenda by funding grants to hundreds of thousands of researchers, overseeing clinical trials on its Maryland campus and supporting other endeavors to develop drugs and therapeutics.”
  • The U.S. Preventive Services Task Force gave brand new “inconclusive” recommendations to the following services:
    • The USPSTF concludes that the current evidence is insufficient to assess the balance of benefits and harms of routine screening performed by primary care clinicians for oral health conditions, including dental caries or periodontal-related disease, in adults.
    • The USPSTF concludes that the current evidence is insufficient to assess the balance of benefits and harms of routine screening performed by primary care clinicians for oral health conditions, including dental caries, in children and adolescents aged 5 to 17 years.
  • Federal News Network points out,
    • “In October, 6,924 new [federal and postal retirement] claims were filed, an increase of 156 more than September. OPM also processed fewer retirement claims last month. The agency said it processed 6,098 claims, a  2,781 drop from the previous month.
    • “Initial retirement cases in October completed in less than 60 days on average took 42 days to process, up 2 days from the previous month, while initial cases that were processed in more than 60 days on average took 113 days.  That’s a 9 day improvement from September.
    • “Along with the increase of the claims backlog, the monthly average processing time in days grew from 70 to 73. But there is some good news: The fiscal year-to-date average processing time in days decreased from 77 to 73 days in October.”

In FEHBP news,

  • Per the Federal Times,
    • “Millions of federal employees and their family members will be able to shop for health benefits beginning Monday. 
    • “Open enrollment, spanning for four weeks, could overlap with a government shutdown if Congress fails to extend the current continuing resolution or pass a spending package by next Friday. More than a month into fiscal 2024, the government is still operating on last year’s funding levels after Congress passed a last-minute stopgap bill on Sept. 30.
    • “As the name implies, a shutdown means that many agency offices close and employees whose work is outside of national security, health and “life or death” services are sent home without pay. However, the office that oversees the Federal Employee Health Benefits program and open season is funded by a trust that does not rely on annual appropriations.
    • “There are sufficient amounts in these trust funds to operate them throughout the duration of any lapse in appropriations,” according to the White House’s Office of Personnel Management.
    • “Thus, employees will be able to participate in open season in the event of a shutdown. And coverage will not lapse during this time either, either for medical or dental and vision.”
  • Federal News Network considers, in consultation with Kevin Moss from Consumers’ Checkbook, “six reasons feds why should take a look [at available FEHB plans] during Open Season this year.”

From the public health and research front,

  • The American Hospital Association News tells us,
    • “Over 3,700 babies were born with syphilis in 2022, 32% more than in 2021 and 10 times more than in 2012, the Centers for Disease Control and Prevention reported Nov. 7. Almost 9 in 10 cases last year could have been prevented with timely testing and adequate treatment, the agency said, and urged emergency departments, syringe service programs, prisons/jails and maternal and child health programs to use rapid syphilis testing and treatment during pregnancy and other settings to consider immediate treatment if a patient tests positive and faces obstacles to ongoing care.
    • “The congenital syphilis crisis in the United States has skyrocketed at a heartbreaking rate,” said CDC Chief Medical Officer Debra Houry, M.D. “New actions are needed to prevent more family tragedies. We’re calling on healthcare providers, public health systems, and communities to take additional steps to connect mothers and babies with the care they need.” 
  • The National Institutes of Health announced,
    • “In a small study, researchers at the National Institutes of Health have found that positron emission tomography (PET) scans of the heart may identify people who will go on to develop Parkinson’s disease or Lewy body dementia among those at-risk for these diseases. The findings, published in the Journal of Clinical Investigation and led by scientists at the National Institute of Neurological Disorders and Stroke (NINDS), part of NIH, may advance efforts to detect the earliest changes that years later lead to Parkinson’s disease and Lewy body dementia.
    • “In 34 people with Parkinson’s disease risk factors, researchers conducted PET scans of the heart to gain insight into levels of the neurotransmitter norepinephrine. They found that the scans could distinguish individuals who would later be diagnosed with Parkinson’s or Lewy body dementia—both are brain diseases caused by abnormal deposits of the protein alpha-synuclein that form clumps known as Lewy bodies. The research was conducted at the NIH Clinical Center, currently the only location for F-dopamine PET scanning.”
  • The Wall Street Journal reports on ways to control sugar consumption
    • People assume they can build up the willpower to completely avoid sweets or restrict them to tiny amounts, but cutting them out increases the chances of overeating later, says Dr. Judson Brewer, a neuroscientist and psychiatrist at Brown University and author of a forthcoming book about eating habits. 
    • “Willpower is more myth than muscle,” says Brewer.
    • “Unsurprisingly, a fully permissive approach to sugar won’t work for kids, says Crystal Karges, a San Diego-based dietitian who works with families. Still, she doesn’t encourage restriction. One strategy she suggests is to offer sweets alongside regular meals in order to normalize the treats. 
    • “Brewer, the neuroscientist, suggests another alternative to restricting yourself: Find your “pleasure plateau.” Rather than cutting out treats entirely, train yourself to pay close attention to how a treat is tasting as you eat it and note when you stop enjoying the taste of it. 
    • “Practicing attentive eating or mindfulness over time can help your body feel the rewards of limiting sugar consumption, which can be anything from having more energy to fewer cravings to weight loss, Brewer says. 
    • “Keeping your home well-stocked with healthy snacks, alongside indulgent treats, is helpful. In her own home, [University of Minnesota professor Dianne] Neumark-Sztainer says roughly 70% of the food options are nutritious and lack added sugar, including whole grains, fruits and vegetables. 
    • “She doesn’t recommend most people count the amount of sugar they eat each day, which can increase anxiety. “Try to look at the whole picture and not to make a big deal about it,” she says.”

From the U.S. healthcare business front,

  • Per STAT News,
    • “Sage Therapeutics set the price of Zurzuvae, its recently approved treatment for postpartum depression, at $15,900 for a 14-day course of therapy. The once-daily pill will be launched in December, co-marketed with Biogen. 
    • “Eisai reported sales of 300 million yen ($2 million) for Leqembi, its treatment for Alzheimer’s disease, in the company’s fiscal second quarter. Approximately 800 people were receiving treatment with Leqembi as of Oct. 27, the company said.” 
  • Beckers Payer Issues ranks the major health insurers by third-quarter medical loss ratios.
  • Per Healthcare Dive,
    • “E-prescribing giant Surescripts has acquired ActiveRADAR, a company that aims to find cheaper medication alternatives.
    • “ActiveRADAR, formerly known as RxTE Health, evaluates drugs in 165 therapeutic categories to identify clinical equivalents, then uses health plan-specific data to determine alternative medications that could reduce costs for employers and patients, according to the company.
    • “The deal, announced on Monday, makes ActiveRADAR a wholly owned subsidiary of Surescripts, according to a company spokesperson. Terms of the deal weren’t disclosed.”
  • Forbes offers “Five considerations for health plan leaders using AI-enabled prior authorization and utilization management.”

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy front,

  • The FAR Council extended the public comment deadline for its October 3, 2023, proposed cybersecurity rules from December 4, 2023, to February 2, 2024. The FEHBlog noticed that the proposed rules (cited in the link) would be added to FAR Part 39 captioned “Acquisition of Information Technology.” In contrast, the FAR cybersecurity rules already found in the FEHB contract are found in FAR Part 4, captioned “Administrative and Information Matters.” For this reason, the FEHBlog has formed the opinion that these rules would not apply to FEHB plan contracts. In any event, the OPM FEHB contracts already include requirements for reporting data breaches and cyber incidents (Section 1.37).
  • Health IT Security tells us,
    • “HITRUST issued a response to the White House’s request for information (RFI) on the harmonization of cybersecurity regulations, suggesting that regulation alone is not a fix to the ongoing cyber challenges that critical infrastructure entities face.
    • “Rather, HITRUST recommended a shift away from further regulations in favor of a renewed focus on accountability and reciprocity within existing standards. Additionally, HITRUST emphasized the importance of reliable cybersecurity assessments and assurances.”
  • and
    • “The HHS Office for Civil Rights (OCR) released an educational video to help covered entities understand how the HIPAA Security Rule can help them defend against cyberattacks. The video was produced in recognition of National Cybersecurity Month.
    • “Hosted by Nick Heesters, senior advisor for cybersecurity at OCR, the 43-minute video explores cyberattack trends gleaned from OCR breach reports and discusses how Security Rule compliance can help covered entities combat these threats.”
  • Cyberscoop informs us,
    • “The White House announced a long-awaited executive order on Monday that attempts to mitigate the security risks of artificial intelligence while harnessing the potential benefits of the technology. 
    • “Coming nearly a year after the release of ChatGPT — the viral chatbot that captured public attention and kicked off the current wave of AI frenzy — Monday’s executive order aims to walk a fine line between over-regulating a new and potentially groundbreaking technology and addressing its risks.
    • “The order directs leading AI labs to notify the U.S. government of training runs that produce models with potential national security risks, instructs the National Institutes of Standards and Technology to develop frameworks for how to adversarially test AI models, and establishes an initiative to harness AI to automatically find and fix software vulnerabilities, among other measures. 
    • “Addressing questions of privacy, fairness and existential risks associated with AI models, Monday’s order is a sweeping attempt to lay the groundwork for a regulatory regime at a time when policymakers around the world are scrambling to write rules for AI. A White House fact sheet describes the order as containing “the most sweeping actions ever taken to protect Americans from the potential risks of AI systems.”

From the cyber vulnerabilities and breaches front,

  • Per Cybersecurity Dive,
    • “The Securities and Exchange Commission charged SolarWinds and its CISO Timothy Brown with fraud and internal control failures for allegedly misleading investors about its cybersecurity practices leading up to the Sunburst attack discovered in December 2020. 
    • “The SEC on Monday [October 29] alleged the company overstated its cybersecurity practices and failed to disclose known risks from October 2018, when the company went public, up to at least the Sunburst attack. 
    • “Public statements from the company contradicted internal assessments, including a 2018 assessment by a company engineer, shared with Brown and others, showing the company’s remote access setup was “not very secure,” the SEC complaint said.
    • “SEC officials allege SolarWinds and Brown ignored repeated red flag warning signs that put the company’s cybersecurity at risk. 
  • Security Week offers industry reaction to the lawsuit.
    • “It remains to be seen how the lawsuit against the SolarWinds CISO will unfold and what implications it will have for the cybersecurity industry as a whole. Regardless of the outcome, it serves as a stark reminder that the role of CISOs is continually evolving, and they must navigate a complex landscape of legal and regulatory challenges.”
  • HHS’s Heath Sector Cybersecurity Coordination Center (HC3) issued its October vulnerability bulletin.
    • “In October 2023, vulnerabilities to the health sector have been released that require attention. This includes the monthly Patch Tuesday vulnerabilities released by several vendors on the second Tuesday of each month, along with mitigation steps and patches. Vulnerabilities for October are from Microsoft, Google/Android, Apple, Mozilla, Cisco, SAP, VMWare, Adobe, Fortinet, Atlassian, SolarWinds, NextGen Healthcare, and F5. A vulnerability is given the classification as a zero-day when it is actively exploited with no fix available or if it is publicly disclosed. HC3 recommends patching all vulnerabilities, with special consideration to the risk management posture of the organization.”
  • Cyberscoop points out
    • “The exploitation of zero-day vulnerabilities is on the rise globally and directly impacting federal agencies, part of what a senior Cybersecurity and Infrastructure Security Agency official called a “very eventful past six months” in the cyber threat landscape.
    • “Michael Duffy, the associate director for capacity building within CISA’s cybersecurity division, said that in the past month or so, the agency has seen “a really high increase in zero-day activity, exploits that we’re seeing across the globe, really affecting the federal government networks throughout the federal government.”
    • “Duffy’s comments, made during a cybersecurity governance panel this week at ACT-IAC’s Imagine Nation ELC conference in Hershey, Pa., come following a notable decline in so-called in-the-wild zero days last year. According to a July report from Google’s Threat Analysis Group, 41 zero days were detected and disclosed in 2022, down from 69 in 2021.
    • “Despite the decline, the number of zero-day exploits observed in the wild remained the second-highest number since TAG started tracking such exploits in 2014. U.S. government officials recently have described a tendency toward growing sophistication in the state-backed hacking campaigns, one hallmark of which is the use of the previously unknown vulnerabilities known as zero days.”  
  • The Cybersecurity and Infrastructure added two known exploited vulnerabilities to its catalog on Tuesday, October 31, and another on Thursday, November 2.

From the ransomware front,

  • Health IT Security reports,
    • “The International Counter Ransomware Initiative (CRI) held its third summit in Washington, DC, with representatives from 50 countries joining together to build upon counter-ransomware projects and announce new focus areas. Among the commitments announced, at least 40 of the member countries agreed not to pay ransoms to cybercriminals, Reuters first reported.
    • “As long as there is money flowing to ransomware criminals, this is a problem that will continue to grow,” said Anne Neuberger, US deputy national security adviser for cyber and emerging technology in the Biden Administration. [see The Week in Ransomware’s observation below.]
    • “The Federal Bureau of Investigation (FBI) has long encouraged ransomware victims to avoid paying the ransom when faced with a ransomware attack. Paying the ransom can embolden cybercriminals to continue targeting other victims and does not guarantee the safe return of data. * * *
    • “In addition to the pledge, CRI members continued to expand upon the commitments they made at last year’s summit. Key deliverables at the 2023 summit were centered around “developing capabilities to disrupt attackers and the infrastructure they use to conduct their attacks, improving cybersecurity through sharing information, and fighting back against ransomware actors,” the White House noted in a press release.”
  • and
    • “The HHS Office for Civil Rights (OCR) announced a $100,000 settlement to resolve a data breach investigation with Doctors’ Management Services, a Massachusetts-based medical management company and healthcare business associate that suffered a ransomware attack in 2018. The settlement marks the first-ever ransomware agreement that OCR has reached.
    • “In April 2019, Doctors’ Management Services filed a breach report with HHS, acknowledging that 206,695 individuals were impacted by a cyberattack carried out by GandCrab ransomware actors. Although the report was filed in 2019, the initial intrusion occurred in 2017. Doctors’ Management Services only detected the breach in December 2018, when ransomware was used to encrypt its files.”
  • HC3 released an analyst note about 8Base ransomware.
    • A recent attack on a U.S.-based medical facility in October 2023 highlights the potential threat of the ransomware gang, 8Base, to the Healthcare and Public Health (HPH) sector. Active since March 2022, 8Base became highly active in the summer of 2023, focusing their indiscriminate targeting on multiple sectors, primarily across the United States.
    • This surge in operational activity included the group’s engagement in double extortion tactics as an affiliate of Ransomware-as-a-Service (RaaS) groups against mostly small- to medium-sized companies.
    • While similarities exist between 8Base and other ransomware gangs, the group’s identity, methods, and motivations remain largely unknown. What follows is an overview of the group, possible connections to other threat actors, an analysis of their ransomware attacks, their target industries and victim countries, impacts to the HPH sector, MITRE ATT&CK techniques, indicators of compromise, and recommended defenses and mitigations against the group.
  • Of course, here’s a link to Bleeping Computer’s The Week in Ransomware.

From the cybersecurity defenses front,

  • Per Cybersecurity Dive,
    • “Microsoft is overhauling its cybersecurity strategy, called the Secure Future Initiative, to incorporate key security features into its core set of technology platforms and cloud services. 
    • “The plan follows a massive government and industry backlash to Microsoft after the state-linked email theft from the U.S. State Department. Microsoft came under fierce criticism from key members of Congress and federal officials who were concerned that the company was forcing federal agencies to rely on software products that lacked the necessary security features to protect against sophisticated attackers. 
    • “The pushback related to the State Department case was that Microsoft was upcharging customers for additional, important security features. 
    • “Microsoft plans to enable secure default settings out of the box, so customers will not have to engage with multiple configurations to make sure a product is protected against hackers. 
    • For example, Microsoft will implement Azure baseline controls, which include 99 controls across nine security domains by default. 
  • An ISACA expert explains how to craft a corporate generative AI policy.
  • The Wall Street Journal reports,
    • “Economic uncertainty continues to chip away at corporate cybersecurity. 
    • “Layoffs, budget cuts and general skimping are putting more pressure on cybersecurity teams, which, in some cases, are pausing hiring and technology investment.
    • “Because of the economic pressure, there are more questions being asked about backfills or head counts,” said Diego Souza, chief information security officer at engine and generator manufacturer Cummins.
    • “Of 14,865 cyber professionals asked, 47% said there had been some form of cutbacks in cybersecurity—layoffs, budget cuts, hiring or promotion freezes—in the past 12 months, according to a survey by trade group ISC2 in collaboration with Forrester Research. Of that group, 22% said there had been layoffs on their teams, while 53% saw delays in buying or implementing technology, according to the study published Tuesday [October 31].

Cybersecurity Saturday

David Ermer–Cybersecurity, Generative AI–

From the cybersecurity policy front,

  • The Cybersecurity and Infrastructure Security Agency and the Department of Health and Human Services held
    • “a roundtable discussion on the cybersecurity challenges that the U.S. healthcare and public health (HPH) sector system faces, and how government and industry can work together to close the gaps in resources and cyber capabilities. Ahead of the roundtable, CISA and HHS released a cybersecurity tool kit that includes resources tailored for the healthcare and public health sector. * * *
    • This toolkit is easy to navigate online at www.CISA.gov/healthcare and consolidates resources like:  
      • “CISA’s Cyber Hygiene Services, which use vulnerability scanning to help secure against known vulnerabilities, reduces the risk of cyberattacks and encourages the adoption of best practices.   
      • “HHS’s Health Industry Cybersecurity Practices, which was developed with industry, outlines effective cybersecurity practices healthcare organizations of all sizes can adopt to become more cyber resilient.  
      • “HHS and the HSCC’s HPH Sector Cybersecurity Framework Implementation Guide which helps organizations assess and improve their level of cyber resiliency and provide suggestions on how to link cybersecurity with their overall information security and privacy risk management activities.” 
  • Cybersecurity Dive informs us,
    • “The Cybersecurity and Infrastructure Security Agency (CISA) on Thursday issued a request for comment on how to create a more harmonized system of software identification as part of a larger effort to make the software supply chain more secure. 
    • “Since President Joe Biden issued an executive order on improving cybersecurity in 2021, CISA and other federal agencies have been working to prioritize software security by improving vulnerability management and the use of software bill of materials (SBOMs). 
    • “The request for comment is designed to establish some uniform parameters to track critical information required to improve software security. Information on known vulnerabilities, what mitigations or security patches are available, and which software is approved for use are all part of the effort, according to a white paper released by CISA.” 
  • The Wall Street Journal tells us,
    • “President Biden is expected to sign an executive order next week addressing rapid advances in artificial intelligence, laying the groundwork for Washington’s embrace of AI as a tool in the national security arsenal while also pressuring companies to develop the technology safely.
    • “The order, which hasn’t been finalized and was described by people briefed on its expected contents, is aimed at establishing guideposts for federal agencies’ own use of AI, while also leveraging the government’s purchasing power to steer companies to what it considers best practices. 
    • “The White House began inviting people this week to an event on “safe, secure and trustworthy AI,” according to people familiar with the matter. A spokeswoman for the White House declined to comment.”

From the cybersecurity vulnerabilities and defenses front,

  • Health Exec reports,
    • “A new report reveals there have been 480 healthcare data breaches in 2023 so far, with over 25% of Americans impacted. The estimated number of patients affected is 87 million this year so far, over double the 37 million in 2022. 
    • “The report comes from Atlas VPN, which utilized publicly available data from the U.S. Department of Health and Human Services (HHS), which keeps a running list of healthcare security incidents. Federal law requires data breaches that potentially leak more than 500 patient records to be reported to the HHS.  * * *
    • “The full report can be found here.”
  • HHS’s Health Sector Cybersecurity Coordination Center issued three warnings this week. Here are the executive summaries:
    • AI-Augments Phishing — “Phishing has historically been a very successful means for cyberattackers of any motivation to compromise an organization and launch a full-fledged cyberattack to achieve their goals. Phishing attacks are frequently utilized, and this is especially true with regard to the health sector. The two most common cyberattacks targeting the health sector are ransomware and data breaches. (And usually both together!)
    • “These attacks often begin with a successful phishing attack. The advent of artificial intelligence has only made phishing attempts more effective, especially since those tools are freely available to the public.
    • In this paper, we provide a brief overview of basic artificial intelligence concepts, phishing attacks, and the application of artificial intelligence to phishing. We conclude with efforts that should be made to reduce the likeliness of all phishing attacks, including those that have been augmented by the use of artificial intelligence.”
  • and
    • QR Code Based Phishing – Phishing – the use of phony e-mails to deliver malicious code – has historically been a successful means for cyber attackers to compromise victim organizations and launch full-fledged, multi-staged cyberattacks. Phishing attacks are frequently utilized as the first stage of an attack – the infection vector – and this is especially true for the health sector. A cyberattack that begins with phishing often ends with ransomware and/or a major healthcare data breach.
    • Quick response (QR) codes were designed to quickly read and transmit legitimate data but have become increasingly abused as part of phishing attacks, called “quishing”.
    • In this paper, we provide a brief overview of QR codes, phishing attacks, and the application of both of these to cyberattacks on the health sector. We conclude this analysis with recommended defense and mitigation actions to reduce the likeliness and effectiveness of phishing attacks, including those augmented by the use of QR codes.
  • and
    • SolarWinds has published security fixes for their Access Rights Manager (ARM). This update addressed eight vulnerabilities, with three of them being rated as critical (CVE-2023-35182, CVE-2023-35185, CVE-2023-35187) and can lead to remote code execution on the “SYSTEM” of a Windows computer. This could enable an attacker to operate with the highest level of privileges available on the machine. In early 2020, the SolarWinds Orion system was targeted by an attacker(s), which led to the supply chain compromise of up to 18,000 of its customers.
    • Due to the previous malicious targeting and wide use of SolarWinds, HC3 strongly encourages users to monitor and upgrade their systems to prevent serious damage from occurring to the Healthcare and Public Health (HPH) sector.

From the ransomware front,

  • Cybersecurity Dive reports,
    • “The threat group behind some of the most high profile, identity-based cyberattacks this year is also “one of the most dangerous financial criminal groups” currently in operation, Microsoft researchers said in a Wednesday report.
    • “The group, which Microsoft identifies as Octo Tempest and other researchers identify as Oktapus, Scattered Spider and UNC3944, uses multiple forms of social engineering to gain access to organizations’ infrastructure, steal corporate data and extort victims for ransom payments, according to Microsoft Threat Intelligence.
    • “The collection of young, native English-speaking threat actors, which was initially observed in 2022 and affiliated with the ransomware-as-a-service operation ALPHV or BlackCat in mid-2023, has claimed responsibility for major attacks against MGM Resorts, Caesars Entertainment and Clorox in the past few months. * * *
    • “The threat actors engage in aggressive communications with victims, such as leaving threatening notes within a text file on a system, contacting executives via text messages and emails, and infiltrating communication channels being used by victims to respond to incidents,” Mandiant, a Google Cloud unit, said last month in a report on UNC3944.
    • “We’ve seen very young individuals break into some of the biggest organizations by leveraging these techniques that are so hard to defend against,” Mandiant Consulting CTO Charles Carmakal said during an April briefing.
    • “They are incredibly disruptive and aggressive,” Carmakal told Cybersecurity Dive via email last month following the MGM Resorts attack.”

From the cybersecurity defenses front,

  • CISA announced,
    • “A new release of Logging Made Easy, a Windows-based, free and open log management solution designed to help organizations more effectively use available security data to detect and address cyber threats.
    • “In April 2023, CISA assumed Logging Made Easy from the United Kingdom’s National Cyber Security Centre (UK-NCSC). Following a period of transition and enhancement, it is now available with step-by-step installation instructions for both legacy and new users.
    • “Logging is critical for proactive monitoring of threats and retroactive investigation and remediation in the event of an incident. Logging Made Easy is a tested and reliable solution that can help organizations with limited resources needing a centralized logging capability,” said Chad Poland, Product Manager for Cyber Shared Services. “CISA is excited to offer this shared service capability to U.S. and international organizations that can help them mitigate risk and identify vulnerabilities.” * * *
    • For more information, visit CISA’s new Logging Made Easy webpage.
  • ISACA announced its “AI Survey Results: What Do Infosec Professionals REALLY Need to Know?”
  • “The HSCC Cybersecurity Working Group has reprinted its Health Industry Cybersecurity – Securing Telehealth and Telemedicine (HIC-STAT) document.” 

Weekend update

David Ermer–Congress, FDA, Generative AI, Medical / Rx research, Medicare, Rx coverage, U.S. Healthcare–
Photo by Tomasz Filipek on Unsplash

From Washington, DC,

  • The Medicare open enrollment period began today. It ends on December 7, 2023.

From the public health and research front,

  • Fortune Well informs us
    • The medicine in the diabetes drug Mounjaro [the Godzilla of GLP-1 drugs] helped people with obesity or who are overweight lose at least a quarter of their body weight, or about 60 pounds on average when combined with intensive diet and exercise, a new study shows.
    • By comparison, a group of people who also dieted and exercised but then received dummy shots lost weight initially but then regained some, researchers reported Sunday in the journal Nature Medicine.
    • “This study says that if you lose weight before you start the drug, you can then add a lot more weight loss after,” said Dr. Thomas Wadden, a University of Pennsylvania obesity researcher and psychology professor who led the study.
    • The results, which were also presented Sunday at a medical conference, confirm that the drug made by Eli Lilly & Co. has the potential to be one of the most powerful medical treatments for obesity to date, outside experts said.
  • The FDA has approved Mounjaro as a diabetes treatment but not a weight loss treatment yet.
  • The New York Times tells us,
    • “An Oxford University researcher and her team showed that digital wearable devices can track the progression of Parkinson’s disease in an individual more effectively than human clinical observation can, according to a newly published paper.
    • “By tracking more than 100 metrics picked up by the devices, researchers were able to discern subtle changes in the movements of subjects with Parkinson’s, a neurodegenerative disease that afflicts 10 million people worldwide.
    • “The lead researcher emphasized that the latest findings were not a treatment for Parkinson’s. Rather, they are a means of helping scientists gauge whether novel drugs and other therapies for Parkinson’s are slowing the progression of the disease.”
  • The Washington Post interviews “physician Rosanne Leipzig, vice chair for education at the Brookdale Department of Geriatrics and Palliative Medicine at the Icahn School of Medicine at Mount Sinai in New York.” Dr. Leipzig is the author of “Honest Aging: An Insider’s Guide to the Second Half of Life.” The reporter described the book as “the most comprehensive examination of what to expect in later life I’ve come across in a dozen years covering aging.”
  • The Washington Post also reports,
    • “The United States faces a “bloody transfusion problem” that is fueling preventable deaths and putting national security at risk, three military and civilian physicians write in a JAMA opinion essay.
    • “The JAMA op-ed, published Oct. 12, highlights blood transfusions’ importance in emergency care. Emergency transfusions can decrease deaths, especially when given early, the physicians write. But not enough healthcare facilities and emergency vehicles are equipped for the procedures, they add, which presents a “substantial risk to our nation’s security infrastructure.”
    • “One reason is the national blood supply, which the writers call “tenuous” because of its reliance on volunteers, as well as problems with blood storage and the places where blood is collected and processed.
    • “The physicians cite a 2020 Health and Human Services report that characterized the national blood supply system as “struggling.” That report said blood availability is hindered by issues with donor recruitment, an aging donor population and problems funding collection centers.”

From the U.S. healthcare business front,

  • MedTech Dive points out,
    • “Best Buy plans to start selling continuous glucose monitors in the next few weeks, in the tech retailer’s first foray into prescription-based medical device sales.”Best Buy plans to start selling continuous glucose monitors in the next few weeks, in the tech retailer’s first foray into prescription-based medical device sales.
    • “The company plans to sell the Dexcom G7 CGM at launch and is looking to offer additional CGM systems from other manufacturers, according to the company.
    • “Customers who want to buy a CGM will be routed to the virtual care platform Wheel, where clinicians will determine a patient’s eligibility and write a prescription. Pharmacy tech provider HealthDyne will receive and process prescriptions, and consumers can then purchase the CGMs on Best Buy’s website for home delivery.”
  • BioPharma Dive notes,
    • “Pfizer said on Friday afternoon it plans to cut billions of dollars in spending and lay off staff as it adjusts to lower demand for its COVID-19 drug Paxlovid and vaccine Comirnaty. 
    • “The pharmaceutical company is also significantly revising down its revenue forecast to between $58 billion and $61 billion for the year, a $9 billion cut from its previously issued guidance. 
    • “The bulk of that adjustment is due to the return by the U.S. governmentof nearly 8 million treatment courses of Paxlovid labeled under the drug’s emergency clearance. Distribution of that product will be stopped in November as Pfizer shifts to selling Paxlovid commercially, which it now expects to begin on a wide scale in January. The antiviral treatment won full U.S. approval in May.”

Midweek Update

David Ermer–Congress, FDA, Generative AI, Medical / Rx research, OPM, Rx coverage, U.S. Healthcare–
Photo by Manasvita S on Unsplash

From Washington, DC

  • Roll Call reports
    • “House Majority Leader Steve Scalise’s bid for speaker was on shaky ground Wednesday as Republicans went back behind closed doors to figure out next steps even after selecting the Louisianan as their nominee during a morning conference meeting.
    • “Several conservatives said they won’t support Scalise on the floor, even as his top rival for the job, Judiciary Chairman Jim Jordan, R-Ohio, is supporting him and encouraging others to do so. Instead of kicking off the formal nominating speeches and votes on the floor Wednesday after coming into session at 3 p.m., Speaker Pro Tempore Patrick T. McHenry recessed the chamber.” * * *
    • “The House adjourned for the night before 7 p.m. An advisory from House Democrats said votes were “possible” Thursday, and the chamber is scheduled to gavel back into session at noon.”
  • On September 18, 2023, the Senate Health Education Labor and Pensions Committee will hold a hearing on the nomination of Dr. Monica Bertagnolli to be Director of the National Institutes of Health.
  • Govexec tells us,
    • “The Biden administration on Wednesday released a new requirement for agencies throughout government to think more carefully about expanding competition through their regulatory actions. 
    • “President Biden has targeted antitrust trends in the economy as a key part of his domestic agenda and the White House said the new guidance will help enforce those efforts through an “all-of-government approach to competition.” The Office of Information and Regulatory Affairs document creates frameworks for agencies as they develop and analyze potential regulatory actions. 
    • “OIRA noted that agencies can shape markets through their regulations and urged them to draft those rules to enhance competition.” 
  • Federal New Network explores the role of Janice Underwood, the first-ever governmentwide chief diversity officer and a senior leader at the Office of Personnel Management.

From the public health and research front,

  • KFF informs us,
    • “Sepsis, the body’s extreme response to an infection, affects 1.7 million adults in the United States annually. It stems from fungal, viral, or bacterial infections, similar to what struck Madonna this year, although the singer never said whether she was diagnosed with sepsis. Treatment delays of even a few hours can undermine a patient’s chance of survival. Yet sepsis can be difficult to diagnose because some patients don’t present with common symptoms like fever, rapid heart rate, or confusion.
    • “A Biden administration rule, finalized in August, ups the ante for hospitals, setting specific treatment metrics that must be met for all patients with suspected sepsis, which could help save some of the 350,000 adults who die of infections annually. Children, too, are affected, with some estimates that 75,000 are treated each year for sepsis, and up to 20% of them die. Hospitals that fail to meet the requirements risk losing potentially millions in Medicare reimbursement for the year.
    • “Still, because the rule applies broadly, it has triggered pushback for its lack of flexibility.
    • “Efforts to reduce sepsis deaths are welcome, but “where it gets controversial becomes ‘Is this the best way to do it?’” said Chanu Rhee, an infectious disease physician and associate professor of population medicine at Harvard Medical School.”
  • Reuters reports,
    • “Novo Nordisk (NOVOb.CO) said on Tuesday it will stop a trial studying Ozempic to treat kidney failure in diabetes patients ahead of schedule because it was clear from an interim analysis that the treatment would succeed.
    • “Novo said the trial would be halted almost a year early based on a recommendation from the independent data monitoring board overseeing the study. Independent monitors can recommend stopping a trial early if there is clear evidence that a drug is going to succeed or fail based on interim analyses. * * *
    • “The Danish drugmaker said the trial was testing whether the widely used diabetes drug, which contains the active ingredient semaglutide, could delay the progression of chronic kidney disease and lower the risk of death from kidney and heart problems.
    • “Semaglutide is also the active ingredient in Novo Nordisk’s powerful weight-loss drug Wegovy.
    • “Barclays analyst Emily Field said in a note that the company’s decision affirmed the view that GLP-1 receptor agonists like Ozempic have “therapeutic benefits far beyond their original intended purpose.”
    • FEHBlog note — Why then doesn’t Novo Nordisk lower the price of this apparent cure-all?
  • Medscape adds,
    • “People taking semaglutide or liraglutide for weight management are at a higher risk for rare but potentially serious gastrointestinal issues, compared with those taking naltrexone/bupropion, according to a large epidemiologic study.
    • “Patients” taking either of these glucagon-like peptide-1 (GLP-1) receptor agonists had nine times an elevated risk for pancreatitis. They were also four times more likely to develop bowel obstruction and over 3.5 times more likely to experience gastroparesis.
    • “The research letter was published online today in the Journal of the American Medical Association.
    • “Investigators say their findings are not about scaring people off the weight loss drugs, but instead about increasing awareness that these potential adverse outcomes can happen.
    • “* * * People taking a GLP-1 agonist to treat diabetes might be more willing to accept the risks, given their potential advantages, especially for lowering the risk for heart problems, said Mahyar Etminan, PharmD, MSc, the study’s senior author and an expert in drug safety and pharmacoepidemiology at UBC. “But those who are otherwise healthy and just taking them for weight loss might want to be more careful in weighing the risk–benefit equation.”
    • “People taking these drugs for weight loss have an approximately 1%–2% chance of experiencing these events, including a 1% risk for gastroparesis, Etminan said.”
  • The Brown & Brown consulting firm offers a four-step plan for employer action to “focus on their benefits, helping to enable employees with easy access to preventive care, early detection, navigation and support specific to breast cancer.
  • The New York Times points out,
    • “The Food and Drug Administration issued an alert on Tuesday about the dangers of treating psychiatric disorders with compounded versions of ketamine, a powerful anesthetic that has become increasingly popular among those seeking alternative therapies for depression, anxiety, post-traumatic stress disorder and other difficult-to-treat mental health problems.”
  • and
    • “A new AI tool diagnoses brain tumors on the operating table;
    • “A new study describes a method for faster and more precise diagnoses, which can help surgeons decide how aggressively to operate.”

From the U.S. healthcare business front,

  • The VTDigger lets us know that following regulatory approval, “Blue Cross Blue Shield of Vermont can now move forward with an agreement that will make the Berlin-based nonprofit a subsidiary of the much larger Blue Cross Blue Shield of Michigan.”
  • Per Fierce Healthcare
    • “Des Moines, Iowa-based UnityPoint Health and Albuquerque, New Mexico-based Presbyterian Healthcare Services are no longer working toward a merger, the systems announced Wednesday.”
  • and
    • A new analysis finds that more pharmacists are electronically prescribing medications as they assist in managing chronic disease, which offers a peek at the next evolution in primary care.
    • * * * Lynne Nowak, M.D., Surescripts’ first chief data and analytics officer, told Fierce Healthcare in an interview at HLTH that the findings highlight the potential pharmacists and other clinicians have in addressing those access gaps.
    • “We’re not saying that pharmacists should be doing the job of a physician,” Nowak said. “They’re not trying to replace them, but just looking at this broader view of a care team and ensuring they’re all connected.”
  • STAT News reports,
    • “Bruce Broussard, CEO of health insurance giant Humana, will step down next year after leading the company for more than a decade.
    • “Humana named Jim Rechtin — who is the CEO of Envision Healthcare, the controversial physician staffing firm that is working its way through bankruptcy — as Broussard’s replacement. Rechtin will serve as president and chief operating officer starting Jan. 8 and then take over as CEO in the “latter half of 2024,” the company said in a news release.”
  • Per Healthcare Dive,
    • “Walgreens has named former Cigna executive Tim Wentworth as its new chief executive officer, the retail pharmacy company announced late Tuesday.
    • “Wentworth is replacing Roz Brewer a little over a month after she announced her unexpected departure from Walgreens.
    • “Wentworth, who will become Walgreens CEO effective Oct. 23, is the former CEO of Express Scripts, the pharmacy benefit manager acquired by Cigna in 2018. At Cigna, he led the health services business Evernorth.”
  • and
    • “CVS Health wants to create a “super app” connecting multiple omnichannel modalities of the healthcare experience, including benefits, delivery and retail channels, chief medical officer Sree Chaguturu said Tuesday at the HLTH conference in Las Vegas.
    • “A super app is a widely adopted mobile or web application that combines multiple services in one platform. Super apps are ubiquitous in Asia, but haven’t taken off in the U.S. due to a fragmented app market, concerns about advertising revenue, the country’s payment system structure and a strict regulatory environment, according to the Harvard Business Review.”
  • The WTW consulting firm offers an infographic displaying the results of their employer survey of Best Practices in Healthcare.