Explosion in breach of health care data

DEEP IMPACT — Health data breaches reported to HHS’ Office for Civil Rights have soared in 2023, on pace to double last year’s total, according to a POLITICO analysis of the latest agency data.

Nearly 89 million people in the U.S. have had their sensitive health information breached so far this year, up from 43.5 million during the same period last year. That includes a breach HCA Healthcare reported in late July that impacted 11 million people, one of the largest data security incidents ever, as well as a ransomware attack on dental plan Managed Care of North America that impacted about 9 million people.

A CMS contractor’s software vulnerability also led to hackers accessing 612,000 Medicare beneficiaries’ data, including Social Security numbers and medical records.

Most incidents reported have been related to hacking or other IT incidents. Such occurrences have affected more than 80 million people. That doesn’t include a breach of 3.2 million people that telehealth provider Cerebral reported to HHS, citing new guidance from HHS about using data for marketing.

The increasing number of breaches is the latest sign that health care’s cybersecurity issues are worsening as more care moves online amid the sector’s digital transformation. It’s making patients’ private medical and financial information vulnerable to hackers. In addition to data security issues, ransomware and other cyberattacks can cripple care delivery, threatening patients’ lives through care disruptions.

The data underscores that no organization is safe. Several states’ health departments or related arms have been breached this year as have major insurers and pharmacy firms. Cyberattacks are becoming increasingly sophisticated.

The policy view: HHS’ Office for Civil Rights has pushed for more funding to help it better handle cyber threats, and it restructured earlier this year to help it be better prepared.

Sen. Mark Warner (D-Va.), who chairs the Intelligence Committee, has discussed a package that could set minimum standards for health care organizations to protect patient data. He told POLITICO last month that he still seeks partners for the legislation and has no timeline for introduction.

Industry groups are concerned about potential penalties if they’re breached, with some arguing that could further punish victims.

The American Hospital Association, the College of Healthcare Information Management Executives and others have pushed for measures like “safe harbors” and incentives over penalties in some situations.

WELCOME TO TUESDAY PULSE. Are you working on health care cybersecurity legislation? We want to hear from you and can keep you anonymous. Reach us at [email protected] or [email protected]. Follow along @_BenLeonard_ and @ChelseaCirruzzo.

TODAY ON OUR PULSE CHECK PODCAST, host Megan R. Wilson talks with Ben, who previews the health care policies at the center of some Senate hearings this week and describes how action on health care issues continues in the House behind the scenes despite the House speaker chaos playing out in public.

FIRST IN PULSE: FLORIDA FUNDING ISSUES — Rep. Bobby Scott (D-Va.), ranking member of the House Education and the Workforce Committee, is raising concerns about Florida’s dispersion of federal funds to safety net programs.

In a letter to HHS Secretary Xavier Becerra first obtained by Pulse, Scott laid out concerns about the state’s budget authority lapsing earlier this year for several weeks, preventing federal funds from going out the door. As a result, four local agencies had to close their doors, and others laid off staff, the letter said.

The letter points to Miami Herald reporting showing the lapse left thousands of people unable to get assistance, including one who struggled to pay her power bill of about $500 monthly due to medically necessary medical equipment. Under one impacted program, more than 1,000 such local agencies offer resources nationwide, including health care services and Covid 19-related programs.

“This most recent episode illustrates a potential pattern that could continue to disrupt vital services,” Scott wrote, calling for Becerra’s department to offer technical assistance and oversight. “I urge the Department to take corrective measures to ensure that there is a timely distribution of federal funds from the state to grantees to maintain the viability and continuity of services.”

Spokespeople for HHS and Florida’s Department of Commerce didn’t respond to requests for comment.

JORDAN TO GET A VOTE — House Speaker candidate Jim Jordan (R-Ohio) is set to get a vote on the House floor today.

He’s gained momentum, but it’s unclear whether he’ll have the needed support to become speaker. A group of Republicans who oppose Jordan say he’ll have a challenger during the vote, but it’s not yet known who that is, POLITICO’s Olivia Beavers has reported.

What it means for health care: Jordan isn’t exactly a health care policy wonk, but his leadership style and penchant for pushing to cut federal spending generally could impact government funding negotiations ahead of the Nov. 17 shutdown deadline.

The House Judiciary Committee chair has largely focused on red-meat issues related to health care in recent years, including slamming the Biden administration for not doing enough to stop fentanyl from coming into the country. Jordan called vaccine skeptic and Democratic presidential candidate Robert F. Kennedy Jr. before his subcommittee on government “weaponization” and focused on Covid’s origins.

In July, he sought information from pharmaceutical company executives as part of an investigation into a “censorship regime.” And when the new House Republican majority took its first votes on abortion this year, Jordan was out front defending Republicans’ position.

STAR RATINGS NOT SHOOTING UP — Medicare Advantage plans’ overall star ratings are falling, according to the latest CDC data.

Less than half of Medicare Advantage Part D plans for 2024 will have ratings of four stars or higher out of five — 42 percent — falling from previous years. That figure was about 51 percent in 2023 and 68 percent in 2022. Six plans have “consistently low quality ratings,” the agency said.

Still, when accounting for enrollee plan distribution, about three-quarters of enrollees in 2024 will be in contracts garnering four stars or more.

The rating system gauges how well the plans deal with chronic conditions, customer service, drug pricing and more. The information is available on Medicare’s website. Open enrollment runs through Dec. 7.

CMS tweaked how it measures star ratings this year in a move that some outside analysts expected could hurt ratings.

WEED USE SPIKES IN CANADA — Canada became the first nation to legalize cannabis sales and possession. Since then, consumption there has spiked, as have purchases of products through legal venues, POLITICO’s Paul Demko reports.

In 2017, about 15 percent of Canadians ages 15 and older said they had used cannabis in the past year, according to a new market snapshot produced by Statistics Canada. By 2021, that climbed to about 22 percent, with the largest growth seen in people 25 and older. That demographic’s use jumped from 21.8 to 31.2 percent.

And 18- to 24-year-olds saw their use rise from 30 to 39 percent during that period.

Among 15- to 17-year-olds — a particularly concerning demographic because of cannabis’ potential effects on brain development — the increase was less significant. Before legalization, 14.2 percent of those teens reported using cannabis in the past 12 months, compared with 15.6 percent in 2021.

STAT reports on the dispute over whether there’s a nursing shortage.

The New York Times reports on Harvard getting its own team of mental health influencers.