Change Healthcare Attack Sheds Light on Industry's Weak Points

Axios | By Tina Reed

The expansive impact of the Change Healthcare cyberattack was a wake-up call for a health care system that's now racing to safeguard itself against another industry-rattling hack.
 
Why it matters: There's recently been increased focused on defending individual health care organizations against bad actors as the vulnerable sector increasingly finds itself under attack. 

• But the Change Healthcare hack that disrupted payments to providers for weeks revealed the industry's heavy reliance on just a few technology companies to keep day-to-day operations running.
  
  
• That essentially creates what The Atlantic's Juliette Kayyem recently described as a "single point of failure" — and experts warn Change Healthcare likely isn't the only one.

 
What they're saying: "Change is the canary in the coal mine," said Nate Lesser, chief information security officer at Children's National Hospital.

• "We need to find out where the others are or we're just going to collapse."

 
Between the lines: Experts who spoke with Axios say there are a number of companies that offer critical infrastructure to pockets of the health care industry, creating major vulnerabilities in the event of an attack.

• Companies often create that kind of market share through mergers of smaller companies that later get acquired by bigger companies.
  
  
• "There are some of these pieces of software that have just been consolidated over and over and over, and it turns out like 50,000 pharmacies, usually within hospitals, use the same piece of software," said Kyle Hanslovan, CEO of cybersecurity firm Huntress.
  
  
• The way some of those products have been stitched together along the way, potentially pairing old and new technologies, could also introduce weaknesses that are difficult to completely engineer away, he said.

 
The Change Healthcare hack also showed how contracting practices within the industry even exposed health care providers who didn't have direct relationships with the company and initially didn't expect to be affected.

• That was the case for Children's National, which discovered that some insurers it worked with have exclusive relationships with Change Healthcare and wouldn't allow for claims to be submitted through any other vendor.
  
  
• These sort of opaque agreements can make it hard for providers to know exactly where their data is being shared, said Shawntea Gordon, a member of the Medical Group Management Association's government affairs council.
  
  
• "It made it very difficult for people to just say 'OK, let me bounce everything through somewhere else,'" Gordon said.

 
Some experts said the federal government quickly needs to do a sector wide accounting to understand where health care's biggest systemic cyber risks are and address them — before hackers beat them to it.

• The Change Healthcare attack "caught us all by surprise and shouldn't have," Lesser said.
  
  
• He pointed to actions the government took in the aftermath of the 2007-08 financial crisis to designate some banks as "systemically important," making them subject to tougher oversight and standards because their failure would jeopardize the entire banking system. 
  
  
• If nothing else, the industry needs to take its own inventory to understand where catastrophic failure would be most damaging so health systems and smaller providers can better evaluate their risks and create appropriate backup plans, Hanslovan said…
  
  

Read Full Article

Incorporating Bereavement into the Continuum of Care

Medpage | By Charles Bankhead

A new sense of urgency has emerged for healthcare organizations to develop "sustainable and accessible bereavement care" and to cultivate a "bereavement-conscious" workforce to position bereavement as an "inherent element of the duty of care," authors of a recent opinion piece asserted.

Inadequate investment in bereavement care has led to a paucity of integrated services at organizational, national, and global levels. Failure to recognize bereavement as a vital component of continuity of care can leave bereaved families without access to psychosocial support, putting them at risk of illness that exacerbates the substantial public health toll of interpersonal loss.

To develop a framework for compassionate communities requires shifting bereavement care from "an afterthought to a public health priority," wrote Wendy G. Lichtenthal, PhD, of the University of Miami Sylvester Comprehensive Cancer Center, and co-authors in Lancet Public Health.

"We need an investment in the healthcare system and in the community to build up support and grief-literate, compassionate communities," Lichtenthal told MedPage Today. "We need workplaces, schools, all institutions where people are, to be more informed and feel better about supporting grievers."

The public health toll associated with grief has been well documented, she said. Recent events have accelerated the urgency for sustainable and accessible bereavement care -- COVID-19, suicides, drug overdoses, homicides, armed conflicts, and terrorism.

Despite being integral to high-quality, family-centered healthcare, bereavement support often is poorly resourced, even described as the "poor cousin of palliative care." In an ideal setting, bereavement care begins with pre-death grief education, continues through the dying process and end of life, and transitions into community-based support and psychosocial services, as needed.

Recent reports on death, palliative care, and pain relief have highlighted the need for better bereavement care delivery infrastructure, the authors noted in their introduction. Acknowledging that "bereavement has been overlooked," the Lancet Commission on the Value of Death called for reorganizing priorities to address social determinants of death, dying, and grief. Imbalances in health and social care fostered by westernized medicine have "medicalized death and dying processes," resulting in disenfranchisement of family and community involvement throughout illness and end of life, the authors continued…

Read Full Article

The New Frontier of Healthcare: Bringing Hospital Care Home

Health Data Management | By Fred Bazzoli

Like many “new” trends in healthcare, the hospital at home movement is not new. The foundational research goes back nearly 30 years, to work by Bruce Leff, MD, of Johns Hopkins to flesh out the concept of providing acute-level care to patients in their own homes.

It seems to harken back to the notion of doctors carrying black bags into patients’ homes to do house calls, but multiple advances in technologies and trends in healthcare have thrust hospital at home programs to the forefront.

When those pressures converge, change happens. And providing hospital services in the home is gaining new attention.

Provider Realities

From the hospital side, several factors are forcing providers to get creative. Census levels are high nationwide, often near full capacity and beyond. Staff rolls are shrinking as growing numbers of clinicians quit because of burnout or unmitigated stress. There’s not enough money to build new brick-and-mortar facilities. And then, lordy, there was the pandemic – many organizations had a crash course in virtual care, forced by restrictions on in-person encounters, full COVID caseloads and nearly instantaneous changes in reimbursement policy that enabled virtual care.

And patients – well, they weren’t big fans of being in the hospital before. The pandemic opened their eyes to the possibility of virtual care, and nascent hospital-at-home programs revealed alternatives to traditional delivery of acute care services.

As one chronic care patient told Leff in his early formulation of a hospital at home strategy, “You run a great hospital, doc, but it’s a lousy hotel.” Factor in the risks of hospital-acquired infections, falls as unsteady patients exit unaccompanied from hospital beds, loneliness and disorientation in a strange clinical environment, harried hands-on caregivers managing multiple patients and … well, it’s clear that an alternative would be welcome.

And inpatient facilities are in no position to fix these ills. Capacity is strained at many hospitals, says Colleen Hole, vice president of clinical integration and chief nurse executive for Atrium Health Medical Group. “Our hospitals are running at 110 percent to 120 percent occupancy in this market,” she says. “And Charlotte is a growing market, and we really can’t afford nor spend the time to keep building brick-and-mortar beds to manage the growth. Money and time are precious, and it doesn’t make sense to keep building beds. But we can deliver hospital-level care in the home and with the same – or in some cases, better – outcomes.”…

Read Full Article

Revised Home Health Interpretive Guidelines- Chart 

On March 15, 2024, the Centers for Medicare & Medicaid Services (CMS) released revisions to the Medicare State Operations Manual, Appendix B, Also referred to as the Interpretive Guidelines for the home health Conditions of Participation(CoPs).

CMS has made conforming changes to the regulatory tags and interpretive guidelines based on several final rules that have amended the home health agency (HHA) CoPs.

See Attached