How to prevent another Change cyberattack

Mar 18, 2024

Presented by 340B Health

With Carmen Paun

Driving the Day

Inside of a computer.

The cyberattack on Change Healthcare has demonstrated the vulnerability of health care systems to more attacks. | Jenny Kane/AP Photo

CYBERATTACK FALLOUT ONGOING — The lingering service outage at Change Healthcare, the nation’s largest claims processing system, is expected to end this week.

But the investigation into how it happened and what can be done to prevent another is just beginning, POLITICO’s Robert King and Kelly Hooper report.

Calls for a probe: Since Feb. 21, a cyberattack on the medical clearinghouse has left health providers unable to submit claims and pharmacies incapacitated. While Change’s owner, UnitedHealth Group, has pledged to fully restore its claims network this week, the devastating outage has sparked calls for an investigation and questions over whether the health industry is prepared to prevent a similar attack.

“This is a watershed moment in health care, where suddenly everyone knows now how interconnected, how dependent, how fragile the bigger health care ecosystem is in the U.S.,” said Errol Weiss, the chief security officer at the Health Information Sharing and Analysis Center, a nonprofit that shares cyber threat intelligence with its members.

Cybersecurity experts say the attack has shown the need for a functional backup network that can continue to operate during an outage.

Lawmakers step in: Congress is expected to examine how and why the outage occurred and who could be responsible.

“As these companies have become so large, it is creating a systemic cybersecurity risk,” said Sen. Ron Wyden (D-Ore.) during a hearing Thursday of the Senate Finance Committee.

Imposing penalties: HHS Secretary Xavier Becerra told the committee that his agency has pressed UnitedHealth to do more to help affected health providers. He also proposed fining hospitals that don’t implement cybersecurity minimums. The proposal has gotten major pushback from hospital groups that say facilities already do a lot to prevent attacks.

“I don’t know of any hospital that takes this lightly,” said Chip Kahn, president and CEO of the Federation of American Hospitals. “There is no system in the country, except maybe the federal government, that gets attacked as much as the healthcare system does.”

On Friday, CMS announced new ways to help Medicaid providers affected by the Change cyberattack recoup payments, including allowing states to pursue the option to make retroactive payments to the date when the cyberattack disrupted payment processes.

HHS and White House officials are slated to meet with payers today to discuss the attack. Ahead of the meeting, HHS spokesperson Jeff Nesbit said in a statement that the agency expects “payers to follow HHS’ lead and provide advance payments to providers, enact appropriate flexibilities, proactively identify providers in need, and expedite claims processing.”

WELCOME TO MONDAY PULSE. The cherry blossom trees in D.C. reached peak bloom this week. In totally related news, my allergies are out of control. Send your tips, scoops and feedback to ccirruzzo@politico.com and bleonard@politico.com and follow along @ChelseaCirruzzo and @_BenLeonard_.

A message from 340B Health:

Support the 340B PATIENTS Act The 340B PATIENTS Act eliminates harmful big pharma restrictions on 340B savings that are vital for expanding health care and support for patients and rural communities in need. By restricting 340B pharmacy partnerships, drugmakers have siphoned billions from the health care safety net solely to bolster their profits. The 340B PATIENTS Act stops this damaging behavior. We call on Congress to support this vital legislation. Learn more.

In Congress

The US Capitol is seen through cherry blossoms

Congress couldn't agree on a funding bill during talks Sunday. | Daniel Slim/AFP via Getty Images

FUNDING BILL STALEMATE — A funding bill that would keep several agencies, including HHS, open didn’t materialize this weekend, giving Congress just days to come up with a funding fix before a partial government shutdown Friday.

Additionally, a package of health measures that would have impacted the pharmacy benefit managers that run drug benefit programs for health insurers, reformed hospital billing practices and added new funding for community health centers isn’t likely to be included in the eventual bill, five congressional staffers and two lobbyists told POLITICO’s Megan R. Wilson and David Lim.

Bipartisan, bicameral discussions about including the bundle of reforms have continued, but leadership is hesitant to add to the bill’s size, according to the seven people granted anonymity to discuss the negotiations, as of Saturday night.

JOIN US ON 3/21 FOR A TALK ON FINANCIAL LITERACY: Americans from all communities should be able to save, build wealth, and escape generational poverty, but doing so requires financial literacy. How can government and industry ensure access to digital financial tools to help all Americans achieve this? Join POLITICO on March 21 as we explore how Congress, regulators, financial institutions and nonprofits are working to improve financial literacy education for all. REGISTER HERE.

Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You’ll also receive daily policy news and other intelligence you need to act on the day’s biggest stories.

Around the Agencies

BIDEN’S WOMEN’S HEALTH INITIATIVE — The president will sign an executive order today directing federal agencies to prioritize women’s health research, including studying conditions like menopause.

It also asks HHS to explore ways to use artificial intelligence to advance women’s health research.

The executive order comes after President Joe Biden said in his State of the Union address that his administration wanted $12 billion to fund a women’s health research initiative. First Lady Jill Biden will lead the initiative.

The executive order also requests some agency actions, including:

— An NIH initiative to research the impact of menopause on heart, brain and bone health. The agency will also issue a notice to identify funding opportunities for women’s health research and launch research programs to diagnose and treat conditions that specifically impact women, like endometriosis.

— An FDA effort to include more women in clinical studies and to address research gaps on medical products for women.

— A CMS effort to strengthen its review process to ensure medical products work well for women before receiving Medicare coverage

— A CDC initiative to expand data collection on women to understand the link between pregnancy and postpartum high blood pressure and heart disease.

BILLIONS NEEDED TO PREP FOR NEXT PANDEMIC — An agency tasked with evaluating how prepared the U.S. is for the next public health threat said Friday that HHS would need an additional $79.5 billion over the next five years to accomplish its goals.

The report by HHS’ Administration for Strategic Preparedness and Response meets a congressional requirement to submit an annual multiyear budget forecasting the funding needed for medical countermeasures. This year’s report — covering 2023-2027 — asks for $15.5 billion more than in the fiscal 2022-2026 report.

The report outlines each agency’s funding needs for the next five years:

— $23.2 billion for the NIH to support its pathogen program

— $39.9 billion for the ASPR Biomedical Advanced Research and Development Authority, which will support the procurement of FDA-approved medical countermeasures

— $11.5 billion for the Strategic National Stockpile to restock certain therapeutics and antivirals

— $1.9 billion for the FDA to fund the review and approval of medical countermeasures

— $2.9 billion for the CDC to provide support functions on the real-world effectiveness of interventions

A message from 340B Health:

Global Health

LAST ROUND OF PANDEMIC TREATY NEGOTIATIONS — Today, representatives of WHO member countries start the last round of negotiations on a pandemic agreement meant to implement the lessons learned from Covid-19 and improve prevention, preparedness and response to a future global disease outbreak, Carmen reports.

The most recent draft negotiating text includes setting a mechanism for countries to share pathogen information in exchange for access to products developed based on that information, such as vaccines, drugs and tests. The manufacturers of those products should pay yearly contributions toward the mechanism and share 10 percent of their products for free and 10 percent at nonprofit prices in case of an international disease outbreak.

The pharma industry opposes the mechanism, asking for the pathogens and data to be shared without conditions so it can quickly develop countermeasures in an outbreak.

The draft text also calls on participating countries to facilitate or incentivize the transfer of technology and knowledge for pandemic-related, and also routine, health products with other countries, particularly poorer ones, especially if public funding is used to develop the products.

The agreement, which has a May deadline, has met opposition from numerous Republican members of Congress, who are concerned about giving too much power to the World Health Organization during an outbreak.

DON’T MISS AN IMPORTANT TALK ON ACCESS TO AFFORDABLE PRESCRIPTION DRUGS IN CA: Join POLITICO on March 19 to dive into the challenges of affordable prescription drugs accessibility across the state. While Washington continues to debate legislative action, POLITICO will explore the challenges unique to California, along with the potential pitfalls and solutions the CA Legislature must examine to address prescription drug affordability for its constituents. REGISTER HERE.

Names in the News

The Coalition to Protect America’s Health Care, a nonprofit that represents hospitals, is now known as the Coalition to Strengthen America’s Healthcare.

WHAT WE'RE READING

The Associated Press reports on state Medicaid policies to recoup the homes of dead people to pay their health care debt.

The Wall Street Journal reports that federal officials are investigating Meta for its role in illicit drug sales.

A message from 340B Health:

Support the 340B PATIENTS Act

340B hospitals are the backbone of the nation’s health care safety net, providing essential services to patients with low incomes and those living in rural America. 340B hospitals play a vital role in delivering 77% of Medicaid hospital care, providing 67% of the nation’s unpaid care, and offering comprehensive specialty services that otherwise might not be available. 340B helps lower health care costs and enable doctors, nurses, and pharmacists to provide expanded care for the benefit of their community—all at no cost to the taxpayer.

The 340B PATIENTS Act will end harmful drug company restrictions on 340B savings that are vital for protecting patients and communities. By restricting 340B pharmacy partnerships, big pharma has siphoned billions from the health care safety net solely to bolster its profits. The 340B PATIENTS Act stops this damaging behavior. We call on Congress to support this vital legislation. Learn more.