Hospitals are bracing for a sweeping rewrite of federal health privacy rules that could result in more penalties for cybersecurity breaches and add billions of dollars in costs.

Why it matters: Spurred by the massive Change Healthcare hack in 2024, the changes reflect a growing belief that at least some health care breaches are preventable and that hospitals should be required to meet baseline security standards.

The big picture: Hospitals and other health providers are increasingly fighting cyberattacks on outdated systems that put valuable patient data at risk and threaten serious disruptions of care.

• The update of the HIPAA, launched by the Biden administration, is the biggest overhaul of the landmark privacy law since 2013 and is due to be finalized as early as this month.
• Patient data would have to be secured with safeguards such as multi-factor authentication, the lack of which was a key failure cited in the Change hack.
• It would also mandate encryption, threat scanning and security plans including procedures to restore systems within 72 hours.

By the numbers: Hospitals would have only about eight months to comply at a cost of roughly $9 billion in its first year and $6 billion a year afterward, per HHS.

• A key feature is that the revisions would greatly expand what regulators can enforce as HIPAA violations and put organizations on the hook for $68,000 in civil penalties per violation.

More than 100 organizations led by the College of Healthcare Information Management Executives called on the Trump administration to withdraw the proposal, saying it would "place substantial new financial burdens on health care providers and includes unreasonable implementation timelines."

• Some requirements in the proposed rule, such as restoring systems within 72 hours, are just impractical, said John Riggi, cybersecurity adviser for the American Hospital Association. "No organization can restore safely within 72 hours."

Keep reading

The drug industry struck out at the Supreme Court yesterday in its ongoing efforts to scuttle Medicare drug price negotiations.

Why it matters: It's the latest rebuff to industry arguments that the talks with the government violate free speech protections and due process rights, among other complaints.

• The negotiated prices that took effect this year are expected to generate $1.5 billion in savings to patients and $6 billion to Medicare.

State of play: Justices, without comment, declined to take up petitions from six drugmakers: AstraZeneca, Boehringer Ingelheim, Bristol Myers Squibb, Janssen, Novartis and Novo Nordisk.

• The industry and its allies over nearly three years have repeatedly failed to convince lower courts to halt the negotiations, which were authorized by the Inflation Reduction Act.

The other side: Drug industry trade group PhRMA, which has brought its own lawsuit, continues to believe the program is unconstitutional, spokesperson Sarah Ryan said in a statement.

Yes, but: Separate litigation challenging the program is still pending in several lower courts, meaning the issue could return to the Supreme Court in the future.

• CMS in January announced 15 additional drugs for the third round of price talks, including for the first time drugs covered under Medicare Part B.

Share this

President Trump said Monday that his direct-to-consumer drug website TrumpRx is expanding with the addition of more than 600 generic medicines.

Why it matters: Generic drugs tend to be cheaper — and the expanded offerings help fill a gap in the current version of the platform.

What they're saying: Trump was joined by Mark Cuban, a major advocate for direct-to-consumer drug sales through his Cost Plus Drugs.

• Asked about Cuban's endorsement of Kamala Harris in the 2024 election, Trump praised Cuban. "Mark was very gracious, he said this is something that really works ... he had to believe that if he said it about me," Trump said.
• The White House said discounts on generics offered by Amazon Pharmacy, Cost Plus Drugs and GoodRx will be integrated into the TrumpRx site.

Yes, but: TrumpRx is intended for people making cash purchases, outside of health insurance. Many people cannot afford to fill prescriptions without using insurance.

Read more

Recent FDA moves easing restrictions on vaping and tanning beds could promote unhealthy habits among teens and embolden industries that market high-risk products, public health experts say.

Why it matters: FDA decisions shape perceptions of a product's safety, and critics worry some decisions may not be balancing public health considerations with consumer access and choice.

Driving the news: The FDA handed the vaping industry two wins this month: authorizing its first fruit-flavored vaping products for adults, a decision opposed by the American Academy of Pediatrics, and signaling it won't prioritize enforcement against some unauthorized products.

• In March, the agency also yanked a decade-old proposal to ban minors from tanning beds, which a recent study tied to a nearly threefold increase in melanoma risk.
• "We're absolutely going backwards," said Bonnie Halpern-Felsher, a Stanford University pediatrics professor.
• Richard Danker, Health Secretary Robert F. Kennedy Jr.'s chief spokesperson, resigned in protest over the flavored vaping decision.

More here

⚖️ Colorado's Supreme Court ordered a children's hospital to resume offering gender-affirming care after it halted services in the face of federal threats. (Colorado Sun)

🥼 An American doctor is among the newly confirmed cases in the outbreak in Congo of a rare variant of Ebola, as deaths surpassed 100. (AP)

🔬 The FDA safety study of the abortion drug mifepristone hasn't begun due to months of delays at HHS headquarters. (NYT)