A sweeping update of federal security standards to safeguard patient data against cyberattacks is drawing pushback from health systems, who say it's unworkable and too expensive.

Why it matters: Amid lingering effects from the massive Change Healthcare hack and increasingly sophisticated attacks hitting hospitals, there's industry concern about a one-size-fits-all approach and whether smaller and financially strapped facilities can adapt.

• Experts say the move to update standards, launched with less than a month to go in the Biden administration, didn't adequately consider real-world consequences for an industry grappling with tight margins and a web of aging infrastructure.

The big picture: The new requirements mark the first major overhaul of the Health Insurance Portability and Accountability Act's Security Rule in more than a decade and attempt to address the advent of AI, quantum computing and virtual reality.

• HHS wants to take away provider discretion to decide which safeguards are addressable.
• HIPAA-covered entities would have to encrypt data and follow best practices for multifactor authentication and regular security audits. They'd also have to develop procedures to restore critical information systems and data within 72 hours of an attack.
• HHS estimates first-year costs of complying with the changes would total about $9 billion, and that for years two through five, estimated annual costs would be about $6 billion.

While health system officials say it makes practical sense to push for better practices, they question details like applying multifactor authentication to anything that touches patient health information.

• Hospitals and providers say they simply don't have the resources to hire experts or have the bandwidth to meet testing requirements or annual assessments of their systems.

HHS says the cost of inaction is high and could jeopardize patient safety. The department said hacking and ransomware attacks affected more than 167 million individuals in 2023 alone.

Read more

The Supreme Court will take up another legal fight over the Affordable Care Act after justices on Friday agreed to review a challenge to the law's requirement that insurers cover certain preventive services at no cost.

Why it matters: Eliminating the mandate could limit access to services like cancer screenings, preventive medications for heart disease, behavioral health counseling and HIV drugs known as PrEP.

• The timing of the high court review puts the legal defense of the ACA mandate in the hands of the incoming Trump administration.

Zoom in: The case takes up whether the coverage requirement, based on the recommendations of the U.S. Preventive Services Task Force, is invalid because the panel lacked authority since its members weren't Senate-confirmed.

• Two Christian-owned companies and several individuals sued the federal government on religious freedom grounds in 2020 over the requirement that their employer-sponsored insurance cover no-cost preventive medicines for HIV.
• A federal judge in Texas in 2022 ruled in favor of the plaintiffs and blocked the requirement nationwide. The 5th U.S. Circuit Court of Appeals last year overturned the nationwide injunction while agreeing with some of the arguments.

The Biden administration and the challengers each asked the Supreme Court to review that mixed ruling.

• Allowing employers to exclude PrEP over religious objections could open the door to objections over other covered services, including vaccines, KFF has noted.

The Supreme Court has saved the ACA three times, most recently in 2021, when justices turned back a bid by Republican attorneys general to strike down the law.

Read more

Insurers who administer private Medicare plans could see a more than $21 billion pay increase in 2026 under a plan proposed by the Biden administration on Friday.

The big picture: The adjustment would benefit UnitedHealth Group, the country's largest Medicare Advantage insurer, and other players in the space like Humana and CVS Health.

• The Trump administration will have discretion over how the final policy looks, and analysts expect the ultimate pay increase to be even higher.

Zoom in: The Biden administration proposed raising plans' base payment by about 2% next year. But the insurers in reality would get an average 4.3% increase in overall revenue once rates are adjusted for how sick their enrollees appear, CMS said.

The proposal would finish phasing in controversial changes CMS began implementing in 2023 that are aimed at making payments to plans more accurate.

• Medicare Advantage insurers get more federal money if their enrollees have more documented health issues, a process known as risk adjustment. The Biden policy aims to stop abuses of that system.
• But health insurers have protested, arguing the policy is akin to cutting seniors' health benefits.
• Some MA insurers did leave markets or scale back offerings this year. But CMS maintains that, on the whole, enrollees' premiums, coverage options and extra benefits have remained stable.

Go deeper

The Biden administration unveiled a tuition repayment program to incentivize nurses to work in nursing homes or state agencies that monitor them.

Why it matters: President Biden's marquee policy to improve nursing home care — a national staffing requirement for skilled nursing facilities — is likely to be rolled back by the incoming Republican trifecta.

Zoom in: Registered nurses who work for three years in a qualifying nursing home or in a state agency oversight role can get up to $50,000 in tuition reimbursement and upfront incentive payments from CMS, McKnight's Senior Living first reported.

• CMS will offer up to $20 million in grants to nonprofit nursing and education organizations. Those groups will then distribute money to nurses who qualify.

Context: Nursing homes have protested Biden's minimum staffing policy — and are suing to stop it — in part because they say they can't find enough nurses and aides.

• Indeed, both nursing homes and the state agencies that make sure they're following the rules face staffing shortages.

More here

🚨 The director of FDA's drug evaluation center is leaving this week, becoming the latest top agency official to exit before President-elect Trump takes office. (Stat)

🧑‍💻 Departing HHS Secretary Xavier Becerra described his frustrations combating social media and said federal agencies are outmatched in a world of instantaneous information. (WaPo)

‼️ Johnson & Johnson is in talks to buy Intra-Cellular, a $10 billion maker of treatments for mental health disorders, in a sign biotech dealmaking may be picking up. (Bloomberg News)