Two years after the seismic Change Healthcare cyberattack, Congress is advancing a plan to safeguard against the kind of hacks that can expose millions of people's private data and cripple health systems.

Why it matters: The bipartisan plan puts the burden on the government and providers to prevent the kind of breach that reverberates across the entire industry, jeopardizing patient access to needed treatments and costing hospitals billions.

Driving the news: The Senate's health committee late last month advanced legislation to fortify health care cybersecurity in a strong 22-1 vote.

• The bill would improve coordination among government agencies and requires HHS to develop an incident response plan.
• It also would establish new grants to health entities for cyberattack planning and response and make them use multi-factor authentication and encryption — a key shortcoming exposed by the Change breach.

The average cost of a data breach in the U.S. is around $10 million, with health care having the highest breach cost among all industries, according to an IBM report.

• With hackers often stationed overseas, law enforcement has limited ability to respond.

Between the lines: Democrats put forward legislation in 2024 in the wake of the Change attack that would have taken a more aggressive approach to cybersecurity requirements and penalties, prompting objections from the health industry.

• The legislation that advanced last week is seen as more of a middle ground that could have a better chance of advancing.
• Hospitals aren't publicly commenting on specifics but could raise objections to some of the requirements in the bill. A spokesperson for the American Hospital Association declined to comment.

The big picture: The bigger obstacle is a packed congressional agenda and little time before the midterm elections.

• Backers likely would have to attach the cybersecurity bill to a bigger legislative vehicle, like a year-end government funding deal.

Keep reading

The FDA again is looking for a top vaccine regulator after officials confirmed that Vinay Prasad will step down from his post as director of the agency's Center for Biologics Evaluation and Research at the end of April.

Why it matters: Prasad was a divisive figure who presided over controversial decisions including declining to review Moderna's new mRNA flu vaccine approval application — a decision that was later reversed.

• He was being investigated for workplace complaints, including fostering a toxic work environment, Endpoints News reported.
• FDA commissioner Marty Makary posted on X Friday that the agency will name a successor before Prasad leaves.

The big picture: The news could bring some relief to biotech companies and investors, who've been concerned about the regulatory agency's lack of predictability.

• Prasad's departure "meaningfully de-risks the regulatory path" for several life sciences companies and vaccine makers, though the ultimate impact still is unclear under Health Secretary Robert F. Kennedy Jr., Leerink analyst Mani Foroohar wrote in a note.
• Prasad's division has come under fire most recently for rejecting approvals for multiple rare disease drugs.
• He also called for tighter oversight on vaccines, including more restrictions on new products. In a memo to FDA staff last year, he said an unpublished agency review linked COVID-19 vaccines to the deaths of 10 children, without supplying underlying data.

Prasad unexpectedly left the FDA once before, in July, amid tensions over gene therapy decisions. He returned weeks later to head the agency's biologics division.

Read more

Every hospital in North Dakota, South Dakota and Wyoming is in a highly concentrated market, according to a blog post from Yale's new Health Care Affordability Lab.

• Maine and Montana aren't far behind when it comes to lack of patient choice.

Why it matters: As rising health care costs put more financial strain on Americans, "one major and underappreciated factor driving price increases is rising consolidation among U.S. hospitals," the blog post argues.

• It notes that over the past 20 years, there have been around 1,300 mergers among the nation's approximately 5,000 hospitals.

Between the lines: None of the hospitals in Washington, D.C., are in concentrated markets, and Rhode Island and New Jersey round out the bottom three.

• The tool used in the blog post defines markets based on a 30-minute travel time in order to determine whether patients have a reasonable choice between facilities.

Yes, but: The most concentrated states also have large rural populations, which can make supporting more than one hospital in a community difficult.

The big picture: Hospitals accounted for 40% of the growth in national health spending between 2022 and 2024 — a much larger share than any other health spending category, per a recent KFF analysis.

More here

A senior citizen advocacy group is suing the Trump administration for details on how it's going to implement a new policy that prohibits certain legal immigrants from receiving Medicare benefits.

Why it matters: Last year's GOP tax-and-spending law stripped coverage from an estimated 100,000 immigrants.

• Federal officials haven't released guidance on how the prohibition will be enforced, according to the Center for Medicare Advocacy, which filed the lawsuit in a federal court in Connecticut last week.

Driving the news: Refugees, immigrants who have survived trafficking or domestic violence and individuals allowed to temporarily enter the country for emergency reasons will be dropped from Medicare starting in January.

• The government already is turning away new applicants in those categories.
• The Center for Medicare Advocacy submitted a Freedom of Information Act request in September asking Medicare and Social Security officials to release records related to the changes. But the government denied the request for quick processing and hasn't sent any records, CMA says.
• The lawsuit seeks the records before the current Medicare enrollment period ends on March 31.

The Social Security Administration and CMS didn't respond to a request for comment.

Share this

💊 Pregnant women's Tylenol use changed after President Trump tied it to autism without a proven link, a review of health records showed. (WashPost)

🦠 Measles patients in Utah are developing severe complications, including anemia and liver inflammation, health officials say. (NBC News)

👩‍⚕️ State staffing mandates didn't undermine the financial viability of nursing homes or increase the likelihood of closures, an analysis of almost 7,000 facilities showed. (Health Affairs)