Private insurance plans pay hospitals, on average, 241% of what Medicare pays for the same services — and those rates vary widely from hospital to hospital, according to a new report by the RAND Corporation.

Why it matters: Hospitals make up the largest portion of health care spending, and even people who don't use hospital services pay for them through their premiums.

The big picture: This report reinforces that private insurance generally pays a lot more than Medicare, but it also is the first broad-based study to compare individual hospitals by name — giving it some practical utility for employers and insurers, which is often hard to come by because of the industry's secrecy.

Details: The study includes 1,600 hospitals in 25 states, covering $13 billion in payments from 2015 to 2017.

• If hospitals had been paid Medicare rates over this period, the employers included in this study would have saved $7.7 billion.
• Prices ranged from 150% of Medicare to more than 400%, depending on the hospital system. There was also significant variation among states.
• Outpatient service rates were, on average, 293% of Medicare, while the average inpatient price was 204%.

Yes, but: Hospitals argue that they lose money on Medicare patients because the reimbursement rate is too low, so they have to charge private enrollees more to make up the difference.

The bottom line: Health care costs are only going to rise for those with private insurance. This study suggests that while tackling hospital rates may not be easy, it's an area that's ripe for reform, if employers — or policymakers — decide that they've had enough.

Go deeper: Employers' health care crisis will only get worse

The White House said yesterday that it wants Congress to pass legislation protecting patients from receiving surprise medical bills after they visit the emergency room or unknowingly receive care from providers not covered by their insurance.

Between the lines: While the White House declined to say how it wanted billing disputes between insurers and providers resolved, it said that it's not enthusiastic about an arbitration process, which some industry groups favor.

• Other solutions that have been floated include setting rates or paying hospitals and doctors in one payment, forcing them to figure out who gets what.

The other side: Provider groups didn't love the White House's skepticism toward arbitration, or its principle that "out-of-network providers cannot separately bill patients."

• "While the idea of a single bill sounds appealing, putting that into practice could have significant unintended consequences," the American Medical Association said in a statement.
• "Ideas like 'bundled payments' and rate setting may seem straightforward, but the truth is they are untested, unproven and an unnecessary government intrusion into the private market," the Federation of American Hospitals said.

Go deeper:

• Why ending surprise medical bills is harder than it looks
• We all pay for surprise emergency room bills

Arguably the biggest fear among Medicare Advantage plans right now is a proposal to beef up federal audits that target improper coding. Health insurers have bought some extra time to kill the change, my colleague Bob Herman reports.

Driving the news: The Centers for Medicare & Medicaid Services explained last October that it was ready to claw back huge sums of money if its audits, called risk adjustment data validation (RADV), found insurers were jotting down unnecessary medical codes for their members.

• But 2 weeks ago, CMS extended public comments on its proposal until August (the second such delay) so everyone could have more time to evaluate data and understand its methodology.

What they're saying: America’s Health Insurance Plans wants the feds to "withdraw the RADV provisions in their entirety," according to a December letter.

• MemorialCare, a hospital system in California that owns a Medicare Advantage plan, enlisted a slew of affiliated doctors to write letters (all with the same boilerplate language) opposing the expanded audits. MemorialCare did not respond to an interview request.
• All of the big Medicare Advantage plans hate the idea. One of Cigna's outside attorneys lamented that the proposal "was not the product of … [a] cooperative, collaborative process."
• CMS' lone supporter? The Medicare Payment Advisory Commission.

The bottom line: These Medicare Advantage audits have not done much to date, and the industry is doing everything in its power to keep it that way.

Reach out: Email Bob at [email protected] with any RADV tips.

Gilead has agreed to donate HIV medication for up to 200,000 people each year for up to 11 years.

• Gilead's Truvada is used to reduce the risk of HIV infection, and is crucial to the administration's goal to wipe out the disease by 2030.
• Truvada currently has a list price of more than $20,000 per year. If Gilead's second-generation HIV medication, Descovy, becomes available, the company will switch to donating that drug.

What they're saying: The AIDS Institute's Carl Schmid called the announcement a "very significant development" that "will free up the federal government from having to spend potentially billions of dollars" on the medication for the uninsured.

• Others were less positive. "The real cost of Truvada is about $60 a year. If you really wanted to cover everybody, you’d cut the price to everyone," Massachusetts General Hospital's Rochelle Walensky told the NYT. "If I put on my cynical hat, I think this is the way they make sure they grow the market for Descovy."

The Justice Department announced Thursday that it indicted Fujie Wang, a 32-year-old Chinese citizen, and an unnamed accomplice, with stealing personal information on nearly 80 million Anthem clients, Axios' Joe Uchill reports.

Why it matters: The data breach revealed in 2015 was a historic event in cybersecurity, as evidenced by Anthem being on the hook for record penalties — a $16 million fine from the Department of Health and Human Services and a class-action lawsuit settled for $115 million.

Details: The Chinese hacker group targeted Anthem and several other companies, according to the indictment, including unidentified communications, technology and materials companies.

• The attackers used spearphishing emails to install malware on target computers.