It's been a few months since the worldwide WannaCry ransomware attacks, and a month and a half since the NotPetya attacks that hit U.S. hospitals and the drug company Merck. The cyberattacks were bad enough to get the attention of the health care industry — and the rest of us — but not bad enough to force the industry to solve the underlying problems.

The bottom line: A cyberattack that takes down multiple hospital systems is "the thing that keeps me up at night," said Richard Staynings, principal and cybersecurity healthcare leader at Cisco. "I have no way of knowing the last time a patient received their medication … It essentially renders hospitals near useless."

You can read the full story here, but here's the brief rundown of what's changed and what still hasn't, according to cybersecurity experts:

Changed:

• Health care facilities are less reluctant to install security patches on medical devices.
• Hospital officials are generally more aware of the importance of cybersecurity.

Not changed:

• Health care organizations still don't spend a lot on cybersecurity.
• Electronic health records are becoming a big worry.
• Old or unpatched operating systems will always leave health care facilities vulnerable.
• Facilities have to learn to segment their networks, or divide them into subnetworks to make them more secure.
• Vendors have to be more willing to patch their medical devices.

Bob Herman has a smart interview this morning with Marc Harrison, a doctor, bladder cancer survivor and CEO of Intermountain Healthcare in Salt Lake City.

• Intermountain is a not-for-profit system of hospitals and clinics throughout Utah, and it also owns a health insurance company, SelectHealth. It's like the Kaiser Permanente of Utah.
• Harrison chatted with Bob about a range of issues, from the "principles of insurance" to hospitals' reliance on having patients fill their beds. He said the key to lower costs is "partnerships where risk is shared, and that's upside and downside risk."
• And on Intermountain's future with the Affordable Care Act, Harrison's answer was straight and to the point: "These are our patients. We're not going anywhere."
• Read the full story here.

No, it wasn't just President Trump seeming to threaten nuclear war with North Korea. That was only part of the briefing. The rest was more or less on topic. The highlights:

No national emergency: Health and Human Services secretary Tom Price rejected the suggestion from Trump's opioids commission that he should declare a national emergency to address the crisis, as Shane Savitsky reported yesterday. Price said national emergencies are usually reserved for "a specific area, a time-limited problem — either an infectious disease or a specific threat to public health."

"Nobody is interested in cutting Medicaid": That was Price's response, stepping back to the podium after trying to end the press conference, after he was asked about the failed GOP health care bill. He repeated his frequent criticisms of Medicaid's current structure, adding that "our focus and our desire is to make sure we have a health care system that works for patients."

Reality check: Medicaid is a major source of substance abuse treatment funds — which is why GOP moderates were uneasy about its cuts.

That's the verdict from a survey of large employers released yesterday by the National Business Group on Health. Roughly one in four believe specialty drugs are the biggest cause of rising health care costs, and eight in 10 say it's in the top three cost drivers.

Why it matters: It means employers are going to get more aggressive about managing their costs, like steering their employees away from having specialty drugs administered in the most expensive settings.

One more thing: The survey also found that the number of employers promoting accountable care organizations, the networks of hospitals and doctors that team up to save money, could double by 2020. That could be wishful thinking, given that ACOs' results so far "have not been a home run" in reducing costs, as Ashish Jha of the Harvard T.H. Chan School of Public Health has noted.

CVS is being sued by a woman who claims she was charged $165.68 for a generic medication that only would have cost $92 if she had paid for it without using insurance. According to Business Insider, the lawsuit targets both CVS and pharmacy benefit managers, claiming that because the PBMs determine which pharmacies are in network, CVS offers them a cut of the drug sales.

The response: CVS says the lawsuit is "built on a false premise" and "completely without merit."

Why it matters: It's part of a growing list of lawsuits against "clawback" practices, where patients pay copayments that are more than the cash cost of the drug, per Bloomberg. The public debate over drug prices tends to focus on legislative fixes, but a successful lawsuit could have a powerful impact on industry practices, too.

We got some feedback from America's Health Insurance Plans, the main health insurance trade group, on our item in yesterday's Vitals about Austin Frakt's analysis of Medicare Advantage. Frakt asked why the program costs so much if it's spending less on medical care than traditional Medicare. AHIP took issue with two points:

• The idea that government payments to the private Medicare Advantage plans are higher than they are for the traditional Medicare program. That's based on a study that relied on 2010 data, as they pointed out, which was before the Affordable Care Act cut the payments. Now, AHIP notes that a report from the Medicare Payment Advisory Commission concluded that payments to the plans this year are pretty much in line with traditional Medicare.
• The suggestion that Medicare Advantage is spending less on medical care than traditional Medicare. That's true, according to AHIP's Mark Hamelburg — but it shouldn't be taken as a negative, because lower spending is "the goal of the program." That's how it tries to provide better value, he says, and much of the savings are given back to the customers by providing new benefits.

Frakt's response: He doesn't think there's much actual conflict with what he wrote. Yes, Medicare Advantage payments have come down under the ACA, and yes, the plans are more efficient — but the payments are still above the costs. "You can make a case that Medicare Advantage is doing some great things," he told me. "But from a taxpayer's point of view, you could make the case that, why are we spending so much money on it?"