Friday Stats and More

HIPAA Privacy and Security Rules

Friday Stats and More

David Ermer–COVID-19, HIPAA Privacy and Security Rules, Rx coverage, U.S. Healthcare, Uncategorized–

Based on the CDC’s Cases in the U.S. website, here is the FEHBlog’s chart of new weekly COVID-19 cases and deaths over the 20th through 38th weeks of this year (beginning May 14 and ending September 23; using Thursday as the first day of the week in order to facilitate this weekly update):

and here is the CDC’s latest overall weekly hospitalization rate chart for COVID-19:

For context take a look at this USA Today article on the three leading causes of death in the United States over the past 85 years (ending in 2018). COVID-19 will be taking over at least the spot for the third leading cause of death, which is currently held by accidental injuries.

In other news —

  • Forbes offers an update on Rite-Aid pharmacies and its prescription benefit manager. “Rite Aid said it will fully transition the PBM to Elixir in December and is “committed to becoming a dominant mid-market PBM, Rite Aid chief executive office Heyward Donigan said Thursday on the company’s second quarter earnings call.”
  • Benefits Pro (registration required) discusses the critical importance of educating employees about the advantages of health savings accounts. “Employers and financial advisors should discuss HSAs in the context of emergency savings and retirement planning, not just health care elections during annual enrollment.” The FEHBlog misses his ability to contribute to an HSA, an ability that he lost when he became Medicare eligible last year.
  • The Federal Times notes that Congress appears to be successfully convincing the Trump Administration to allow affected federal employees to opt out of the currently mandatory payroll tax deferral program. The article erroneously states that “The private sector does have the choice of whether to opt into the program, but feds and military members were automatically included.” Just like in the federal sector, it is the employer who makes the primary decision to participate in the payroll deferral program. It’s also the employer’s choice to allow employees to opt out of payroll deferral.
  • HHS’s Office for Civil Rights, which enforces the HIPAA Privacy and Security Rules took a big scalp today. “Premera Blue Cross (PBC) has agreed to pay $6.85 million to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules related to a breach affecting over 10.4 million people. This resolution represents the second-largest payment to resolve a HIPAA investigation in OCR history. PBC operates in Washington and Alaska, and is the largest health plan in the Pacific Northwest, serving more than two million people.” The breach dates from the bad old days of 2014-15 when Anthem and OPM announced massive data breaches due to cyberattacker gaining deep access to company information systems.
  • ZDnet reports on recent cyberattack on an unidentified federal agency system. It’s worth reading because

[While] The name of the hacked federal agency, the date of the intrusion, or any details about the intruder, such as an industry codename or state affiliation, were not disclosed, CISA officially publish[ed] an in-depth incident response (IR) report detailing the intruder’s every step. The report, which ZDNet analyzed today, reveals how the intruder gained access to the federal agency’s internal networks through different channels, such as leveraging compromised credentials for Microsoft Office 365 (O365) accounts, domain administrator accounts, and credentials for the agency’s Pulse Secure VPN server.

Midweek Update

David Ermer–Congress, COVID-19 testing, COVID-19 vaccine, HIPAA Privacy and Security Rules, Rx coverage–
Photo by Manasvita S on Unsplash

Roll Call informs us that the House of Representatives pass the compromise Fiscal Year 2021 continuing resolution (H.R. 8337) by a wide margin. The bill heads onto the Senate which is expected also to pass the bill before the end of the current fiscal year next Wednesday September 30.

In COVID-19 news —

Johnson & Johnson (J&J) has begun a 60,000-subject phase 3 assessment of its COVID-19 vaccine. The trial will enroll participants in the U.S. and other countries with a high incidence of COVID-19 with a view to generating data to support emergency use authorization early next year. * * * Unlike its rivals, J&J is evaluating the safety and efficacy of a single dose of a COVID-19 vaccine. If the one-dose regimen is successful, J&J could eliminate the logistical complexity and dropouts associated with trying to get people to return for a second shot. A one-shot regimen would also enable J&J to vaccinate 1 billion people each year. Few manufacturers of two-dose regimens can match that figure. * * *

In disclosing the start of the phase 3, J&J also called out the storage requirements of its vaccine. The candidate is expected to be stable for two years at -20°C and for upward of three months in the 2°C to 8°C range used to store many biologics. J&J said the candidate is “compatible with standard vaccine distribution channels and would not require new infrastructure to get it to the people who need it.” Pfizer’s mRNA vaccine must be kept at -70⁰C and be used within 24 hours of being thawed. Other COVID-19 vaccines have storage requirements more comparable to those of J&J’s shot.

Good news.

  • Fierce Healthcare reports that Walmart plans to use drones to deliver self-administered COVID-19 tests to single family homes within a one miles radius of one of their “pilot” stores. The recipient will need to mail the nasal sample to a lab. The gold standard will be self administered tests that can read out at home like a pregnancy test, but they are getting closer.

Fierce Healthcare also calls our attention to the fact that Optum’s latest quarterly drug pipeline report explains how health plans can prepare to cover “chimeric antigen receptor T-cell (CAR-T) therapies coming to market. CAR-T treatments for cancer are costly but are proliferating as they offer a potentially curative treatment for the disease. Through CAR-T therapy, a patient’s cells are modified in a lab and then reintroduced to the body to attack the cancer.”

The Health and Human Services Office for Civil Rights, which enforces the HIPAA Privacy and Security Rules, took another HIPAA business associate scalp today.

CHSPSC LLC, (“CHSPSC”) has agreed to pay $2,300,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to adopt a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules related to a breach affecting over six million people. CHSPSC provides a variety of business associate services, including IT and health information management, to hospitals and physician clinics indirectly owned by Community Health Systems, Inc., in Franklin, Tennessee.

Monday Roundup

David Ermer–CDC, Congress, HIPAA Privacy and Security Rules–

Photo by Sven Read on Unsplash

The House of Representatives Rules Committee issued a rule today on the FY 2021 continuing resolution (H.R. 8913) by a 7-3 vote. The House is expected to vote on the bill soon. Nothing is certain in this world but the FEHBlog considers this CR to be on track to become law.

Katie Keith writes in the Health Affairs Blog on the impact of Justice Ruth Bader Ginsburg’s death on the California v. Texas case (No. 19-840) raising the constitutionality of the Affordable Care Act (“ACA”) That case is scheduled for oral argument on November 10 one week after the national election. The FEHBlog expects the Supreme Court to preserve the ACA no matter who wins the Presidential election because the Texas case challenging the law is weak. The proof is in the pudding as the preexisting condition free ACA marketplace has kept running without the individual mandate, just like the FEHBP.

The Centers for Disease Control last week issued its 2019 U.S. maps of adult obesity prevalence. Here are the CDC’s obesity tidbits which should be useful for FEHB plans which cover the nation in particular:

  • 6 states had an obesity prevalence of 35 percent or higher among non-Hispanic White adults.
  • 15 states had an obesity prevalence of 35 percent or higher among Hispanic adults.
  • 34 states and the District of Columbia had an obesity prevalence of 35 percent or higher among non-Hispanic Black adults.
  • Obesity decreased by level of education. Adults without a high school degree or equivalent had the highest self-reported obesity (36.2%), followed by high school graduates (34.3%), adults with some college (32.8%) and college graduates (25.0%).
  • Young adults were half as likely to have obesity as middle-aged adults. Adults aged 18-24 years had the lowest self-reported obesity (18.9%) compared to adults aged 45-54 years who had the highest prevalence (37.6%).
  • All states and territories had more than 20% of adults with obesity.
  • 20% to less than 25% of adults had obesity in 1 state (Colorado) and the District of Columbia.
  • 25% to less than 30% of adults had obesity in 13 states.
  • 30% to less than 35% of adults had obesity in 23 states, Guam, and Puerto Rico.
  • 35% or more adults had obesity in 12 states (Alabama, Arkansas, Indiana, Kansas, Kentucky, Louisiana, Michigan, Mississippi, Oklahoma, South Carolina, Tennessee, and West Virginia).
  • The Midwest (33.9%) and South (33.3%) had the highest prevalence of obesity, followed by the Northeast (29.0%), and the West (27.4%).

The Health and Human Services Office for Civil Rights announced today that the “Athens [Georgia] Orthopedic Clinic PA (“Athens Orthopedic”) has agreed to pay $1,500,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to adopt a corrective action plan to settle potential violations of the HIPAA Privacy and Security Rules.” Athens Orthopedic which serves 138,000 patients annually settled allegations of widespread system violations of those rules.

Tuesday Tidbits

David Ermer–CDC, Congress, COVID-19, HIPAA Privacy and Security Rules–
Photo by Patrick Fore on Unsplash

The Hill reports on the House leadership’s strategy for the COVID-19 relief bill.

Speaker Nancy Pelosi (D-Calif.) on Tuesday sought to heighten the pressure on Republicans to move a new round of coronavirus relief, announcing that the House will return to the Capitol next month to vote on another aid package if a bipartisan agreement is struck before the elections. * * *

House Majority Leader Steny Hoyer (D-Md.) acknowledged that most lawmakers will likely return to their districts when the scheduled session ends on Oct. 2, leaving party leaders seeking to hash out an agreement with the White House. If such a deal emerges, then members would be called back to Washington. In that sense, the dynamics would look very similar to those surrounding the long August recess, when the Capitol was virtually empty.

We must remember in this regard that the House can now vote virtually.

The House Problem Solvers Caucus which is truly bipartisan has offered its own COVID-19 relief proposal. The New York Times explains that

Lawmakers had acknowledged that the plan was unlikely to become law. But in unveiling it, the group sought to signal to Ms. Pelosi and the lead White House negotiators — Mark Meadows, the chief of staff, and Steven Mnuchin, the Treasury secretary — that there was ample common ground to be found in talks that have been dormant for weeks.

Health Payer Intelligencer reports that UnitedHealthcare has teamed up with Canopy Health to offer a concierge style health plan known as the California Doctors Plan to San Francisco area employers. “The payer projects that members will save up to 25 percent compared to other health plan premiums. Also, plan members will have no copay for primary care services and urgent care.” The FEHBlog enjoys reading about creative plan designs.

The HHS Agency for Healthcare Research and Quality has announced today that

the National Steering Committee for Patient Safety released Safer Together: A National Action Plan To Advance Patient Safety, which is the result of 2 years of work by 27 steering committee members who represent a diverse group of organizations and individuals, including healthcare systems, Federal agencies, provider associations, accrediting organizations, and patient advocates. Our goal was to provide healthcare system leaders with renewed momentum and clearer direction for reducing medical harm. Especially relevant during the COVID-19 pandemic, this national action plan and a companion implementation resource guide provide the latest implementation tactics, tools, and resources in a format that’s ready for immediate implementation. These important new resources are built on four foundational areas: culture, leadership, and governance; patient and family engagement; workforce safety; and learning systems.

This worthy initiative is certainly worth a gander.

In COVID-19 news

  • The National Institutes of Health have determined that substance use disorders (SUD) are linked to COVID-19 susceptibility.

By analyzing the non-identifiable electronic health records (EHR) of millions of patients in the United States, the team of investigators revealed that while individuals with an SUD constituted 10.3% of the total study population, they represented 15.6% of the COVID-19 cases. The analysis revealed that those with a recent SUD diagnosis on record were more likely than those without to develop COVID-19, an effect that was strongest for opioid use disorder, followed by tobacco use disorder. Individuals with an SUD diagnosis were also more likely to experience worse COVID-19 outcomes (hospitalization, death), than people without an SUD.

The Centers for Disease Control and Prevention (CDC) and the EU’s Joint Research Centre (JRC) will begin working with Siemens Healthineers to help standardize international antibody tests for COVID-19. This will include defining the proper concentrations of antibodies in the bloodstream—mapped to the novel coronavirus’s specific proteins—that could one day be used to establish the clinical threshold for a test to correctly determine whether a person is immune to the disease.

Finally, HHS’s Office for Civil Rights which enforces the HIPAA Privacy and Security Rules announced four settlements with different healthcare provider organizations over allegations of their non-compliance with HIPAA Privacy Rule requirements to give individuals access to their own health records.

“Patients can’t take charge of their health care decisions, without timely access to their own medical information,” said OCR Director Roger Severino. “Today’s announcement is about empowering patients and holding health care providers accountable for failing to take their HIPAA obligations seriously enough,” Severino added.

How true.

Monday Roundup

David Ermer–Congress, COVID-19, HIPAA Privacy and Security Rules, U.S. Healthcare–

Federal News Network reports on the Postmaster General’s testimony before the House Oversight and Reform Committee today. The article explains

The Postal Service has dealt with staffing issues as a result of the coronavirus pandemic. About 40,000 postal employees have contracted COVID-19 or have shown symptoms that have required them to quarantine. Several dozen employees have died.

[Postmaster General] DeJoy said employee availability during the pandemic peaked in July, but warned that staffing has been down by about 3-4% on average. The Philadelphia and Detroit metro areas, he added, are “significantly below normal route run rates” — in some cases 20% below normal staffing rates.

The Wall Street Journal discusses new thinking on public health measures to control the infection rate without shutting down businesses. Better late than never.

The experience of the past five months suggests the need for an alternative: Rather than lockdowns, using only those measures proven to maximize lives saved while minimizing economic and social disruption. “Emphasize the reopening of the highest economic benefit, lowest risk endeavors,” said [Harvard epidemiologist] Dr. [Michael] Mina.

In other words use social distancing, good hygiene and mask wearing and avoid super spreader events.

Research by Dr. Mina and others has shown that “super-spreader” events contribute disproportionately to infections, in particular dense indoor gatherings with talking, singing and shouting, such as at weddings, sporting events, religious services, nightclubs and bars.

Dr. Mina wrote this month on the importance of is “a shift in [COVID-19 testing] strategy toward a cheap, daily, do-it-yourself test that he says can be as effective as a vaccine at interrupting coronavirus transmission — and is currently the only viable option for a quick return to an approximation of normal life [pending a vaccine]. He advocates applying the nasal or saliva sample to a paper strip that would tell you whether or not you have the COVID-19 infection. This is a step beyond this month’s saliva test advances that must be delivered to a lab. Forbes provides more background here.

Here are a couple of updates on progress being made in the COVID-19 vaccine development process from Fierce Healthcare and MedCity News.

The Department of Health and Human Services announced today that its Office for Civil Rights (“OCR”), which enforces the HIPAA Privacy and Security Rules,

issued amended guidance on how the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule permits covered health care providers (e.g., hospitals, pharmacies, laboratories) and health plans to contact their patients and beneficiaries who have recovered from COVID-19 to inform them about how they can donate their plasma containing antibodies (known as “convalescent plasma”) to help treat others with COVID-19. OCR added health plans to the June 2020 guidance that explains how HIPAA permits covered health care providers and health plans to identify and contact patients and beneficiaries who have recovered from COVID-19 for individual and population-based case management or care coordination. The guidance also emphasizes that, without individuals’ authorization, the providers and health plans cannot receive any payment from, or on behalf of, a plasma donation center in exchange for such communications with recovered individuals.

Let’s wrap up the round up with two healthcare provider survey stories —

Hospital operating margins are severely depressed, down 96% since the start of the year through July compared with the first seven months of last year, not including the financial aid from the federal government, according to the latest report from Kaufman Hall.
When factoring in federal relief funds, operating margins were down 28% for the January to July period compared with the same period last year.
However, there appear to be signs of recovery. When zeroing in on operating metrics month-over-month from June to July, operating margins did improve 24%, which the consultant group said is likely due to a backlog in patient demand.

  • A friend of the FEHBlog called to his attention this Healthcare Innovation Group report on a Physicians’ Foundation survey of physician sentiments about COVID-19.

Tuesday Tidbits

David Ermer–Congress, COVID-19, COVID-19 vaccine, Federal employment benefits, HIPAA Privacy and Security Rules, Medicare, U.S. Healthcare, Uncategorized–

Following up on last Friday’s and Sunday’s posts on the President’s executive orders on drug pricing, here for greater perspective is a link to a Fierce Healthcare article offering the positions of the health insurance and PBM industry trade associations’ positions on the orders. Essential Hospitals lets us know that the text of the fourth international pricing index executive order has not yet been made public.

The Wall Street Journal reports that “Eastman Kodak Co. has won a $765 million government loan under the Defense Production Act, the first of its kind. The purpose: to help expedite domestic production of drugs that can treat a variety of medical conditions and loosen the U.S. reliance on foreign sources. * * * Kodak’s loan has terms similar to a commercial loan and must be repaid over 25 years, [Kodak CEO Jim] Continenza said. He said Kodak will produce “starter materials” and “active pharmaceutical ingredients” used to produce generic medicines. “We have a long, long history in chemical and advanced materials—well over 100 years,” Mr. Continenza said. He added that Kodak’s existing infrastructure allows the company “to get up and running quickly.”

On the COVID-19 front —

  • Federal News Network informs us that

About 4,000 federal employees have filed workers’ compensation claims with the Labor Department due to COVID-19. 60 people have filed death claims. Labor projects COVID-19 claims among federal employees may reach 6,000 in the coming weeks. The department’s inspector general says the division that handles federal employee claims is anticipating a strain in resources due to demand and social distancing mandates. It has alternative staffing plans if COVID-19 compensation claims continue to surge. Labor says it’s accepted over 1,600 federal employees claims so far. Over 2,300 are unadjudicated.

  • The Society for Human Resource Management brings us up to date on the Senate majority’s new $1 trillion COVID-19 relief bill, the HEALS Act.
  • The Center for Medicare and Medicaid Services released “an early snapshot of the impact of the coronavirus disease 2019 (COVID-19) pandemic on the Medicare population. The data shows that older Americans and those with chronic health conditions are at the highest risk for COVID-19 and confirms long-understood disparities in health outcomes for racial and ethnic minority groups and among low-income populations.” A large cadre of the Medicare population of course is also enrolled in the FEHBP so this data is worth a gander.
  • The National Institutes of Health announced the successful results of a double blind study of the Moderna / NIAID COVID-19 vaccine on non-human primates / rhesus macaques. As noted yesterday that vaccine entered phase 3 human trials this week.

In other news —

  • Becker’s Hospital Review identifies the highest ranking hospital in each State as found in U.S. News and World Report.
  • NPR discusses two new studies suggesting that the risk of Alzheimer’s disease can be reduced by taking flu and pneumonia vaccines.
  • HHS’s Office for Civil Rights (“OCR”) which enforces the HIPAA Privacy and Security Rules announced that “Lifespan Health System Affiliated Covered Entity, a non-profit health system based in Rhode Island, has agreed to pay $1,040,000 to the OCR and to implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules related to the theft of an unencrypted laptop [thereby evidently allowing access to protected health information on over 20,000 patients in 2017].

Thursday Miscellany

David Ermer–COVID-19, HIPAA Privacy and Security Rules, U.S. Healthcare–

Modern Healthcare reports this evening that Health and Human Services (“HHS”) Secretary Alex Azar has signed a 90 day extension of the COVID-19 national health emergency. The current emergency period was otherwise set to expire on Saturday July 25. Modern Healthcare explains that

The renewal gives the healthcare industry certainty through the fall on several key policies to assist with the COVID-19 response. Some notable policies tied to the public health emergency are the 20% Medicare inpatient add-on payment for COVID-19 patients, increased federal Medicaid matching funds for states, a mandate that insurers cover medically necessary COVID-19 tests without cost-sharing, relaxed telehealth restrictions, and Section 1135 waivers that give providers additional flexibility to respond to COVID-19.

In other news,

  • Aetna is rolling out two new benefit design offerings for employer sponsored health plans per Fierce Healthcare.

The new designs, called Upfront Advantage and Flexible Five, offer members coverage for some preventive services before they meet their deductibles. In Upfront Advantage, members will have access to services worth up to $500 for an individual and $1,000 for a family for free before their deductible is met. In Flexible Five, members will instead be offered five coupons per person for these services; a family of four, for example, would receive 20 coupons that can be applied to services such as primary care visits, behavioral health visits, urgent care, lab tests or x-rays conducted during those visits and generic drugs.

  • Health Payer Intelligence informs us that Humana “has committed to mail out over a million preventive care packages that members can use in their homes. The in-home preventive care packages are designed to support chronic disease prevention for members with diabetes or colon cancer. Members can take the test in their homes to detect diabetes or colon cancer developments as early as possible.” That’s quite an investment.
  • HHS’s Office for Civil Rights announced a HIPAA Privacy Rule breach settlement with a North Carolina based healthcare provider today. It’s noteworthy that the settlement resolved issues that were touched off by a data breach in 2011.

Monday roundup

David Ermer–Congress, COVID-19, HIPAA Privacy and Security Rules, OPM, Rx coverage–

The Wall Street Journal seeks to answer a question that the FEHBlog has been pondering — “Scientists Hoped Summer Temperatures Would Tamp Down Covid-19 Cases. What Happened?” “There are three likely reasons, public-health and infectious-disease experts said. They have to do with the current [relatively low] levels of immunity in the population, how the virus is transmitted [by respiratory droplets] and how people behave [/fail to follow public health guidance].” Oh well.

The Hill reports that “The two main health insurance lobbying groups, America’s Health Insurance Plans (AHIP) and the Blue Cross Blue Shield Association, wrote a letter to congressional leaders on Friday making a [wide] range of requests for the next coronavirus response package, expected later this month.” Check it out.

HHS’s Substance Abuse and Mental Health Services Administration today finalized a revised 42 CFR Part 2 rule intended to better facilitate coordination of patient care. Part 2, which dates back to 1975, applies to substance use disorder patient records held by certain federally assisted health care providers. Here is a link to the FAQs on the final rule. The next time that SAMHSA revises this rule it will do so to align the rule with the generally applicable HIPAA Privacy Rule in accordance with the CARES Act. The statutory deadline for this action is March 27, 2021.

Fedsmith offers an article discussing whether federal annuitants with FEHB coverage also should elect to purchase Medicare Part prescription drug coverage. Here is OPM’s guidance:

Part D: There is a monthly premium for Part D coverage. Most Federal employees do not need to enroll in the Medicare drug program, since all Federal Employees Health Benefits Program plans will have prescription drug benefits that are at least equal to the standard Medicare prescription drug coverage. Still, you may want to be aware of the benefits Medicare is offering, so you can help others make informed decisions. If you have limited savings and a low income, you may be eligible for Medicare’s Low-Income Benefits. For people with limited income and resources, extra help in paying for a Medicare prescription drug plan is available. Information regarding this program is available through the Social Security Administration (SSA). For more information about this extra help, visit SSA online at www.ssa.gov, or call them at 1-800-772-1213 (TTY 1-800-325-0778).

Tuesday Tidbits

David Ermer–CDC, Congress, COVID-19 testing, HIPAA Privacy and Security Rules, OPM–

The Senate Health Education Labor and Pensions Committee held a hearing this morning on progress made in reopening schools and businesses from the great hunkering down. Fierce Healthcare reports on the hearing here.

The Department of Health and Human Services announced today the extension of “its partnership with national pharmacy and grocery retail chains CVS, Rite-Aid, Walgreens, Quest (through services at Walmart) and eTrueNorth (through services at Kroger, Health Mart, and Walmart) so they may continue to seamlessly provide Americans convenient access to COVID-19 testing. The partnership, which is part of the Community-Based Testing Program, has scaled up to more than 600 COVID-19 testing sites in 48 states and the District of Columbia. Approximately 70% of these testing sites are located in communities with moderate-to-high social vulnerability, as evidenced by their racial, and ethnic composition, and their housing, economic, language barrier, and similar considerations.” “The [partnership] contract utilizes a federal bundled payment program paid directly to retailers that receive a flat fee for each test administered, with participating retailers responsible for coordinating the full end-to-end testing.” So far the collaborative program has tested 750,000 Americans. That makes sense.

The Office of Management and Budget’s Office of Information and Regulatory Affairs issued its anxiously awaited Spring 2020 regulatory agenda. The regulatory agenda tells you what’s baking in each agency’s regulatory oven but you can rely on the oven timers’ shown in the reports. Here’s a link to OPM’s “rule list.” Nothing earth shaking to report.

The FEHBlog’s favorite healthcare quality consulting firm, Discern Health, notes the release of the National Health Quality Roadmap by the Department of Health and Human Services. “The National Health Quality Roadmap highlights not only many of the challenges that have been faced by health care stakeholders across the quality environment, but also a plan for addressing them,” Discern Health Vice President Donna Dugan said. “It will be important for stakeholders across the continuum to participate where possible in order to facilitate this transformation and aid in the realization of quality goals.”

Becker’s Hospital Review reports on a class action settlement of a phishing attack related lawsuit against UnityPoint Health which is based in Iowa. ‘The class action lawsuit alleges the health system didn’t notify [over 16,000] patients of the breach in a timely manner and told patients Social Security numbers weren’t compromised, but they were.’ The settlement is valued at $2.8 million.

For what it’s worth, Forbes reports an IRS announcement that that “the 2019 tax filing deadline remains July 15, 2020.” Forbes considers and the FEHBlog agrees that this will be the IRS’s final work on the topic. Also the Labor Department yesterday added q&a 93 to its list of frequently asked questions on the Families First Coronavirus Response Act’s paid leave program

Monday Roundup

David Ermer–COVID-19, HIPAA Privacy and Security Rules–

On the COVID-19 front

  • Researchers continue to make progress in developing a convalescent plasma treatment for COVID-19. Specifically, “Mayo Clinic researchers and collaborators have found investigational convalescent plasma to be safe following transfusion in a diverse group of 20,000 hospitalized patients transfused with investigational convalescent plasma as part of the U.S. Food and Drug Administration’s national Expanded Access Program (EAP) for COVID-19.” Testing continues on the efficacy of the treatment.
  • In view of the FEHBlog’s concern about super spreader events, he also calls attention to this Society for Human Resource Management article on thermal scanners. The scanners are an early warning device for use at “airports, sporting events, concerts or food-processing plants.” The particular article discusses the use of these devices by large and medium sized business.

For a change of pace, the FEHBlog takes note of these Wall Street Journal reports from the cybersecurity front

The health-care sector reported far less [cybersecurity] vulnerability than other areas. Health care is sometimes seen as one of the most targeted sectors. Yet, while 63% of construction and infrastructure companies admitted cybersecurity breaches on one or more occasions in the past 12 months, only 17% of health-care organizations said they had been compromised.

“We think the reduction is due to a combination of factors, including improvements in the cybersecurity posture of health-care organizations,” says Dave Wong, vice president with cyber-incident response provider Mandiant, a division of FireEye Inc., “but the behavior of attackers had also changed.”

In 2017, health care was the third-most-targeted sector, according to Mandiant’s annual threat report. By 2019, security improvements and evolution of the attackers’ tactics led to the sector dropping to eighth place. Cybercriminals follow the money, Mr. Wong says, and when fewer ransoms were being paid, they shifted their focus elsewhere. “Ransomware operators previously targeted hospitals knowing that the operational disruption could potentially cost patients’ lives,” he says. “Now, the same ransomware operators target larger companies with deeper pockets.”

  • and a list of five books “recommended by cybersecurity experts” that are accessible to all readers, just in time for the summer reading season. The FEHBlog plans to put at least one on his Kindle.