All Access

Health Tech Deals

Health Tech Deals Alerts

Alert

Standard

Health Tech Deals Thought Bubble

Thought Bubble

mustard

BFD Expert Voices - Health Tech Deals

BFD Expert Voices

topics

politics-policy

epstein-files

donald-trump

2026-midterm-elections

immigration

behind-the-curtain

race-and-equity

technology

privacy-tech-regulation

automation-and-ai

tiktok-news

big-tech

social-media

cybersecurity

economy

social-security

inflation

tariffs

federal-reserve

jobs

transportation

business

stock-market-news

retail-news

crypto

media

elon-musk

dealmaking

health

rfk-jr

drug-prices

axios-explains-abortion

public-health

world

israel

axios-explains-ukraine

iran

russia

china

energy-climate

nuclear-energy

climate-energy-policy

climate-change

extreme-weather

alternative-energy

electric-vehicles

science

emerging-tech

biomedicine

newsletters

pittsburgh

atlanta

san-diego

charlotte

boulder

washington-dc

kansas-city

dallas

denver

detroit

des-moines

austin

boston

chicago

cleveland

columbus

houston

indianapolis

miami

nashville

new-orleans

nw-arkansas

philadelphia

phoenix

portland

richmond

salt-lake-city

san-antonio

san-francisco

seattle

tampa-bay

twin-cities

raleigh

huntsville

colorado-springs

axios-local

axios-pro

axios-live

the-axios-show

ICYMI: How AI is driving the venture capital market

A proposed rule that would require the nation's most critical industries to more quickly report cyberattacks is raising the ire of the health care industry, which claims the new directives could actually hinder its response in a crisis.

Why it matters: Cyberattacks have sent shockwaves across the health care industry, but regulators and providers don't agree on how to get a handle on the problem.

Driving the news: The comment period for new rules surrounding cyberattacks, which closed last Wednesday, illustrates that division.

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 called for companies and organizations to report cyberattacks within 72 hours and ransoms paid within 24 hours.

In rules proposed in April to implement the act, the Cybersecurity and Infrastructure Security Agency (CISA) laid out which entities would be subject to reporting a cyberattack, defined what a "substantial" incident is and specified reporting requirements.

CISA says it isn't learning about many cyberattacks in a timely way, making it difficult to help victims, spot trends and warn other companies about vulnerabilities.

But health systems and physician practices have since said in submitted comments that the proposal places onerous responsibilities on health care organizations, and called for more flexibility.

What they're saying: The proposal would require "a description of the covered entity's security defenses" defining their entire security architecture, the College of Healthcare Information Management Executives and the Association for Executives in Healthcare Information Security stated in a letter to CISA's director.

That's not only a tremendous amount of information to provide, but also a dangerous treasure trove if obtained by bad actors, they wrote.

The American Hospital Association called CISA's definition of "substantial cyber incident" ambiguous, saying it could result in both excessive disclosures of cybersecurity incidents and the underreporting of potentially significant events.

Between the lines: The reporting requirements do not appear to be harmonized across government agencies, the Medical Group Management Association wrote to the agency.

CHIME said it is also unclear which organization would be responsible for CIRCIA reporting when a third-party service provider has a substantial incident, as happened with Change Healthcare.

The bottom line: Health care organizations shouldn't be penalized by "crushing" requirements at a moment when they are trying to juggle patient care and damage control, Chelsea Arnone, director of federal affairs for CHIME, told Axios.

"They're victims of a cyberattack," Arnone said.

Pushback on proposed cyber rules

Illustration of a scalpel pushing a cursor.

Carlyle is in talks to buy medical device giant Baxter's kidney care spinoff Vantive for more than $4 billion, including debt, WSJ reports.

Why it's the BFD: Large-scale LBOs are still few and far between, particularly in health care, where private equity is being scrutinized closely. 

Zoom in: The two entered exclusive negotiations in late June and a deal could be announced in the coming weeks.

Talks could fall apart or another suitor could emerge, WSJ says. Carlyle and Baxter declined to comment to Axios. 

Catch up quick: Baxter announced the spinoff of Vantive last July, noting it was expected to be complete in 2H24. 

Baxter said in a March filing that it had been in talks with select private equity investors for a deal. 

By the numbers: Vantive had about $4.5 billion in revenue last year and more than 22,000 employees.

How it works: Vantive has a broad portfolio of dialysis machines, supplies and services, as well as remote patient management technology and organ support hardware. 

Flashback: Baxter announced a strategic transformation plan in January 2023, after seeing losses swell following its meaty $12.5 billion acquisition of hospital bed maker Hillrom in 2021. 

In May 2023, Advent International and Warburg Pincus teamed up to agree to buy its contract manufacturing unit for $4.25 billion.

The bottom line: Strategic divestitures of life sciences-focused assets remain in vogue for private equity. 

Carlyle's kidney play

illustration of price tag hanging on bag of medicine

Want more health tech deals? Check out the Axios Pro Deals Tracker.

• HarmonyCares, a Nashville home care provider, raised an unlabeled $200m led by General Catalyst, McKesson Ventures and a national payer. K2 HealthVentures and insiders Rubicon Founders, Valtruis, HLM Capital and Oak HC/FT joined. harmonycares.com

• GoJoe, a British provider of a gamified employee health and fitness app, raised £2.4m. Venrex Partners and Redrice Ventures co-led, and were joined by Amrock Ventures and Hellen's Rock Ventures. axios.link/4eLRoYm

• Charme Capital Partners acquired a majority stake in Animalia, an Italian veterinary services provider. axios.link/4cREC8Z

• PSG Equity invested in Corilus, a Belgian provider of connected care software that was acquired in 2010 by Gilde Buy Out Partners. corilus.be

• MedPharm, a North Carolina CDMO and portfolio company of Ampersand Capital Partners, will merge with Tergus Pharma, a North Carolina CDMO and Great Point Partners portfolio company. axios.link/4cSiTO2

• Alcon (Swiss: ALC) agreed to buy Belkin Vision, an Israeli maker of a laser device for treating glaucoma, for $81m up front and up to $385m in earnouts. Belkin had raised around $28m from firms like China Resources Capital, Santen Ventures, Rimonci Capital and Zig Capital. axios.link/3VWh2Rv

• OMERS agreed to sell LifeLabs, a Canadian provider of community lab tests, to Quest Diagnostics (NYSE: DGX) for C$1.35b. axios.link/3LdPn9N

Deals o' the day

• Adam Karol, former managing director at Silver Lake, joined Clayton, Dubilier & Rice as a partner. cdr-inc.com

It's Personnel

🩺 Prior auth has its moment (again) — Axios

🏥 Where the General Catalyst-Summa Health deal stands — Becker's Hospital Review

😬 Troubled for-profit chains stealthily operating psychiatric hospitals under nonprofits' names — STAT

👀 What we're watching for health policy in July — Axios

Your daily dose

Illustration of a weekly pill dispenser box with a newspaper called "daily dose" in each compartment.

☀️ Claire spent the weekend in San Rafael with family, where temperatures reached a scorching 99°. 

🌄 Thanks for reading, and extra thanks to newsletter editor George Moriarty and copy editor Egan Millard. Please ask your colleagues, friends and family to sign up.

July 08, 2024

1 big thing: Pushback on proposed cyber rules