United Health Ltd.

Senate Finance Committee Chair Ron Wyden, D-Ore., and Senator Mark Warner, D-Va., have teamed up to announce legislation of "commonsense reforms" that aim to stem the wave of increased cyberattacks breaching Americans’ privacy and causing major disruptions to care nationwide. The Health Infrastructure Security and Accountability Act would not only mandate cybersecurity protocols, but also increase funding to rural and underserved hospitals to meet new cybersecurity standards, Warner said in a statement Thursday. WHY IT MATTERS If made law, the proposed reforms in the bill would result in enhanced auditing of healthcare organizations. They'd also pay higher user fees for the new regulatory services. Warner, who has been focused on improving the sector's cybersecurity posture and has urged U.S. Health and Human Services to end voluntary cybersecurity requirements , and released a 2022 policy paper calling for a healthcare cybersecurity czar, said in a statement that he believes voluntary standards lack the teeth needed to protect patients’ most private data and care continuity. The lawmakers made it clear that they believe some of the largest healthcare organizations are "ignoring cybersecurity standards." "Megacorporations like UnitedHealth are flunking Cybersecurity 101, and American families are suffering as a result," Wyden said in the statement. "The healthcare industry has some of the worst cybersecurity practices in the nation despite its critical importance to Americans’ well-being and privacy." The Health Infrastructure Security and Accountability Act, according to a fact sheet on the proposed legislation, calls for "enhanced standards" that apply to "systemically important" entities and modernizing HIPAA mandatory minimum cybersecurity standards for healthcare providers, health plans' clearinghouses and business associates. The bill would also require covered entities and business associates to submit annual independent cybersecurity audits and follow other measures that ensure they can restore services promptly after an incident – "which HHS can waive for small providers." Top executives would have to certify compliance with the requirements each year, and HHS would have to "proactively audit the data security practices of at least 20 regulated entities each year." The bill also proposes to eliminate the statutory caps on HHS’ fining authority so that mega-corporations, like United Health Group, "face large enough fines to deter lax cybersecurity." While the additional security oversight and enforcement would be paid for by user fees on all regulated entities, the legislative proposal also provides $800 million for enhanced cybersecurity standards payments at rural and urban safety net hospitals and $500 million for all hospitals. "With hacks already targeting institutions across the country, it’s time to go beyond voluntary standards and ensure healthcare providers and vendors get serious about cybersecurity and patient safety," Warner said. THE LARGER TREND Warner and Wyden's announcement noted that after the Senate Finance Committee held a hearing in May with UnitedHealth Group CEO Andrew Witty about the February cyberattack against Change Healthcare , a subsidiary of UHG, Wyden called on the Biden administration to investigate the mega-corporation and hold it accountable for its "lax cybersecurity." Witty pledged to rebuild the afflicted healthcare payments clearinghouse with cloud-based security. Change also did not have multifactor authentication in place, which left the organization vulnerable to the cyberattack. In a strategy paper released in December, HHS also called for new cybersecurity requirements for hospitals. It also outlined voluntary healthcare-specific cybersecurity performance goals. "Funding and voluntary goals alone will not drive the cyber-related behavioral change needed across the healthcare sector," the agency said in an announcement at the time. Meanwhile, the American Hospital Association pushed back on suggested strategies that it said penalized hospitals for cyberattacks. "No organization, including federal agencies, is or can be immune from cyberattacks," Rick Pollack, AHA’s president and CEO, had told Healthcare IT News . "Imposing fines or cutting Medicare payments would diminish hospital resources needed to combat cybercrime and would be counterproductive to our shared goal of preventing cyberattacks." Case in point: The Centers for Medicare and Medicaid Services recently mailed written data breach notifications to 946,801 people when it was snared, along with a multitude of companies across sectors worldwide, when a vulnerability in a third-party application used for was discovered earlier this year. CMS said in the letter that protected health information or other personally identifiable information may have been compromised in a cyber breach related to MOVEit software . ON THE RECORD "Cybersecurity remains an ever-evolving challenge in our healthcare ecosystem and more must be done to prevent cyber attacks and ensure patient safety," Andrea Palm, deputy secretary of HHS, said in a statement. "Clear accountability measures and mandatory cybersecurity requirements for all organizations that hold sensitive data are essential." Andrea Fox is senior editor of Healthcare IT News. Email: afox@himss.org Healthcare IT News is a HIMSS Media publication. The HIMSS Healthcare Cybersecurity Forum is scheduled to take place October 31-November 1 in Washington, D.C. Learn more and register .

This week brings some positives for hospitals and health systems in the southeast United States that are dependent on blood supplies with critical network systems back online after the August 1 ransomware attack shut the supplier OneBlood down. In addition, the high-pro of a Supreme Court Justice's protected health information in 2019 by an alleged insider has been heard in federal court and resulted in a conviction. In other news, the U.S. Health and Human Services accepted a breach notification from Change Healthcare indicating the minimum number of individuals affected – 500 – after ransomware caused a major nationwide outage in claims payments, disrupting care and exposing the PHI of potentially millions of patients. OneBlood's critical software online The Orlando-based blood supplier said its network has been partially restored after a ransomware attack and encouraged blood donations with Tropical Storm Debby threatening the region, according to a report from CBS News Miami on Monday. "The priority was to bring the software system used to manage the blood supply back online and the team that has been working around the clock made it happen," Susan Forbes, OneBlood's senior vice president of corporate communications and public relations, said in an update Tuesday. "At this time, our processing and distribution of blood products to hospitals is near normal output," she said. OneBlood, which distributed blood to more than 250 hospitals in the southeast United States, became the third target of ransomware attacks on blood suppliers in recent months. That prompted the American Hospital Association to warn U.S. hospitals to make contingency plans for blood supplies. "The blood supply cannot be taken for granted," Forbes said in the ransomware event update . "In an instant, any one of us can find ourselves on the receiving end of a blood transfusion." The company indicated in its FAQs that it does not yet have information on whether donors' personal information had been breached in the July 29 attack. Change reports to HHS Nearly five months after a ransomware attack shut down Change Healthcare, parent company United Health Group reported the data breach to the HHS Office for Civil Rights. UHG reported that 500 individuals had been affected. However, the required data breach report comes after the health payments clearinghouse began sending its breach notice directly to affected patients on July 31. The scale of the breach is thought to have affected millions of patients, and in June OCR said Change has the responsibility to notify affected patients of stolen information. That month the company sent notices to customers whose members’ or patients’ data were involved in the attack. While the agency previously opened an investigation into the breach, it recently said that the data analysis to understand the magnitude of the breach has been ongoing. "Change Healthcare’s breach report to OCR identifies 500 individuals as the approximate number of individuals affected," the agency said on its Change Healthcare Cybersecurity Incident FAQ page . "Change Healthcare is still determining the number of individuals affected," the agency said, noting that the information on the HHS Breach Portal would be amended if Change Healthcare updates the total number of individuals affected. On May 1, UnitedHeath Group CEO Andrew Witty told Congress why he made the decision to pay a $22 million Bitcoin ransom, adding that the company didn't have access to the exfiltrated data until the middle of March. "We are working tirelessly to uncover and understand every detail we can, which we will use to make our cyber defenses stronger than ever," he told the lawmakers. Justice for Ginsburg's data breach Last week a federal court convicted Trent James Russell of Arlington, Virginia, a former army medic who worked as an organ donor transplant coordinator, guilty of accessing and publicly exposing U.S. Supreme Court Justice Ruth Bader Ginsburg's health information in July 2019. Russell was accused of posting a screenshot of her cancer care information, including dates of radiation treatment. The screenshot first appeared on the bulletin board 4chan in a discussion that suggested Justice Ginsburg, who passed away on September 18, 2020, had died the year before in a conspiracy to prevent then-President Donald Trump from picking a new judge. The image then began circulating on the Internet. Russell pleaded not guilty and said that he never accessed her medical records at George Washington University Hospital in Washington, D.C., where she was undergoing radiation and other cancer treatments, a WRAL News report said. He testified that he and his colleagues shared passwords to get around technical requirements that slowed the donation process, according to the story . However, prosecutors said he attempted to destroy evidence after his remote access was disabled and moved to Nebraska. Russell faces a maximum sentence of 20 years in prison when he is sentenced on November 7. Andrea Fox is senior editor of Healthcare IT News. Email: afox@himss.org Healthcare IT News is a HIMSS Media publication. The HIMSS Healthcare Cybersecurity Forum is scheduled to take place October 31-November 1 in Washington, D.C. Learn more and register .

Marc Russo and Trip Hofer will help Ophelia expand network coverage and deepen partnerships with commercial and Medicaid payors to drive growth Board expansion coincides with pivotal traction for Ophelia, which saw 40% growth in the first quarter of 2024 In the past year, Ophelia joined eight new health plan networks on value-based contracts and was named an OUD Center of Excellence (COE) by the state of Pennsylvania, increasing access to Medicaid beneficiaries statewide NEW YORK, June 4, 2024 /PRNewswire/ -- Ophelia, a next-generation opioid addiction treatment provider, today announced the appointment of Marc Russo and Trip Hofer to its board. With their extensive experience and proven track record in the healthcare industry, Russo and Hofer bring invaluable insights and strategic guidance to Ophelia as it continues to grow its commercial payer and Medicaid business. Ophelia uses a virtual-first care model to improve access and retention in evidence-based treatment for opioid use disorder (MOUD) by lowering barriers to care for rural, underserved, and historically stigmatized patient populations. Ophelia works with 27 health insurance plans across Medicaid, Medicare, and commercial lines of business, with roughly 70% of its patients covered by Medicaid due to the disproportionate need within this population. In March, Ophelia published a study in Health Affairs Scholar, which found that patients using in-network insurance benefits had six-month retention rates that were 50% higher than those required to pay cash. Since retention rates correlate with positive treatment outcomes, including survival and long-term quality of life, the study highlights the importance of insurance coverage in driving treatment success rates, not just treatment access. The addition of Russo and Hofer to Ophelia's board will help expand these benefits to more Americans, focusing on rural populations with inadequate access to alternative options. "Ophelia is redesigning opioid addiction treatment from first principles, with the goal of making evidence-based care easy to opt in to and stick with. In order to be easy, it must also be affordable, and our partnerships with forward-thinking payors make that possible," said Zack Gray, founder and CEO of Ophelia. "We're thrilled that Trip and Marc have chosen to put their experience and expertise to work on this mission with us." Marc Russo brings over 25 years of leadership experience at payors to Ophelia, including deep expertise in Medicaid. Most recently, Russo served as the EVP, President of Medicaid Plans at Molina, one of the largest Medicaid plans in the country, covering 5.2 million lives across 19 states. Prior to Molina, Russo was the President of Medicare at Anthem. Earlier in his career, Russo held leadership roles at various payer organizations, including WellCare Health Plans, Blue Shield California, UnitedHealthcare/PacificCare/SecureHorizons, and Oxford Health Plans. "The opioid epidemic is among our nation's costliest problems, and the root of the problem is a lack of access to proven treatment. I've been blown away by Ophelia's ability to expand access through direct-to-patient recruitment strategies, which is extremely rare to see in Medicaid," said Marc Russo, board member at Ophelia. "I'm honored to be part of Ophelia's board and to help get this treatment to everyone who needs it." Trip Hofer is a seasoned health tech leader with over 25 years of experience as both a startup and health plan executive. Hofer was the CEO of AbleTo, a virtual behavioral health company that achieved massive scale and was eventually acquired by Optum where he then became CEO of Optum Behavioral Health. Hofer is currently the CEO of Redox, an organization committed to connecting healthcare organizations to seamlessly exchange healthcare data through reusable technology. In addition to his CEO role, Hofer is currently a Venture Partner at .406 Ventures, an early-stage venture capital firm focused on healthcare and enterprise technology. Hofer serves on the boards of two other innovative healthcare companies, Heartbeat Health, and Brightside Health, and has also held executive roles at United Health Group, CVS Health, Accordant Health Services, Novologix, and Health Dialog. "Ophelia has created a best-in-class care delivery program that's incredibly easy to use for both patients and providers and is built for scale. In addition, it's built by a leadership team with the necessary mix of ethics, thoughtfulness, and expertise to succeed in this space," said Trip Hofer, board member at Ophelia. "I'm excited to help Ophelia continue to develop its strategic partnerships with payors and providers as we work to align all stakeholders in pursuit of the shared goal." For more information, visit ophelia.com, and to read testimonials from Ophelia patients, visit the company's Google Reviews. About Ophelia Ophelia is a virtual provider of medication-assisted treatment (MAT) for opioid use disorder (OUD), committed to making evidence-based treatment universally accessible. Its mission is to remove barriers for the 80% of Americans with OUD who are unable to receive care today, focusing on rural, underserved, and Medicaid populations. At its core is the Ophelia Care Model, a team-based clinical model and technology platform developed by leading experts in addiction medicine and psychiatry. Ophelia is licensed to provide care in 30+ states and accepts Medicaid, Medicare, and Commercial insurance. Media Contact [email protected] SOURCE Ophelia