Richard Payerchin

 remains a target for ransomware cyberattacks, with three new hacking groups emerging this year.

The U.S. Department of Health and Human Services’ (HHS) Health Sector CyberSecurity Center (HC3) has published an alert and two analyst notes naming three attackers that infiltrate organizations’ computer networks and hold data for pay.

Royal is a human-operated program first observed in September this year and increasing in appearances, according to HC3. Ransom demands have ranged from $250,000 to more than $2 million and “Royal should be considered a threat” to the health care and public health (HPH) sector.

“Royal is an operation that appears to consist of experienced actors from other groups, as there have been observed elements from previous ransomware operations.” It appears to be a private group with financial motivation as the goal, said the 

The group has embedded malicious links in malvertising, phishing emails, fake forums, blog comments, and in Google ads and with malicious installer files on software sites that look legitimate.

Cuba ransomware is not known to be connected with the Republic of Cuba. But it is a threat to the HPH sector, infecting at least 65 organizations in critical infrastructures in the last year, 

. The agency noted the FBI and federal Cybersecurity & Infrastructure Security Agency (CISA) have released a 

 stating Cuba compromised more than 100 entities worldwide, demanding more than $145 million and receiving more than $60 million in ransom payments.

Cuba “has continued to compromise their victims through a variety of software vulnerabilities, phishing, stolen credentials, and legitimate remote desktop protocols,” the HC3 alert said. “The group also threatens to publicly release the exfiltrated data if a payment is not made.

“Due to the historical nature of their targeting and the frequency with which ransomware gangs victimize the greater healthcare community, organizations should maintain awareness of the threat group’s activity,” the alert said.

Lorenz is human-operated ransomware that has been operating about two years in “big game hunting,” or targeting larger organizations in English-speaking organizations. Ransom demands can total in the hundreds of thousands of dollars.

Relatively little is known about Lorenz, which operates a data leak site, but “their leaking process is non-typical,” the 

 said. If victims don’t pay, Lorenz may sell stolen data to other threat actors or competitors, then release password-protected data, then make full archives available for anyone.

HC3 has recommended the following actions to help protect 

. Use a passphrase and/or a complex combination of letters, numbers, and symbols.

In general, avoid opening unsolicited emails from senders you do not know.

Do not open a link or an attachment in an email unless you’re confident it comes from a legitimate source.

Do not download or install programs if you do not have complete trust in the publisher.

Do not visit unsafe websites and do not click on pop-up windows that promise free programs that perform useful tasks.

 about the hackers’ methods and signs of compromise. That agency and 

 about the latest threats and ways to enhance computer network security for HPH and other organizations.

This article originally appeared on Medical Economics®.

Articles

HHS’ cybersecurity wing publishes notices on three ransomware threats.

Health care computers remain targets for emerging hacker groups

Having a staff member call patients a day ahead of scheduled telehealth appointments paid off with better attendance and 

Attendance improved by 9% and the return on investment totaled $11,387 over a 12-week period, according to 

, “Evaluation of Telehealth Visit Attendance After Implementation of a Patient Navigator Program.” The research was published in 

 to explain the program from April to July 2021 at two academic primary care clinics of Harvard Medical Faculty Physicians at Beth Israel Deaconess Medical Center.

Hiring a patient helper was a cost-effective intervention that boosted telehealth attendance, cut patient no-shows and cancelations, and increased successful video visits over 12 weeks, the study said.

“Implementing a Telehealth Patient Navigator may be a high-value proposition for health care systems, as it uniquely benefits patients and clinicians while being cost-effective and yielding a positive net return on investment,” the study said.

Like many doctors, the participating physicians quickly integrated telehealth at the start of the COVID-19 pandemic. But with technical challenges, video visits sometimes needed to become telephone consultations, the study said.

In a pilot program, a patient navigator was hired and trained to call patients a day before video appointments, aiming to improve access to care by reducing technological barriers for those new to the online visits. The navigator, reaching patients with morning and afternoon appointments, covered the steps for patients to connect with their physicians.

Those patients, along with those in a comparator group, all received typical appointment reminders, such as phone calls or text messages, the study said.

There were 4,068 patients involved, and outcomes were not known for two of them. The navigator reached 1,035 patients, with 949 of them, or 91.6%, successfully attending their appointments. There were 60 cancelations for a rate of 5.8%, and 26 patients, or 2.5%, missed their appointments.

Among the remaining 3,031 patients in the comparator group, 2,511, or 82.8%, checked in for their visits; 279, or 9.2%, canceled; and 241, or 8%, never showed.

Based on the visitation rate and a $65 per revenue value unit reimbursement, the program covered the quarterly navigator salary of $17,878 and actualized a return on investment of $11,387 over 12 weeks, the study said.

The researchers noted patients’ willingness to answer the navigator’s calls could indicate a 

, even if the patients did not have video visits before. During the pandemic, the rapid increase in telehealth and novelty of video visits likely contributed to the efficacy of the program.

As pandemic conditions improve, it is unclear if physicians and patients will 

, and patient familiarity with technology could hurt the effectiveness of a navigator, the study said. But if telehealth continues for specific conditions, such as chronic illness management, the work of the navigator can be adapted to support those cases, the study said.

Other limitations include not fully knowing the qualities or qualifications that affect the navigator’s role, and language – the navigator’s outreach is limited to patients who speak the same language, the study said.

Attendance and reimbursement increase when physicians and patients connect in online appointments.

Helping patients navigate telehealth video visits pays off

Online giant Amazon will make primary care services available online with its new 

Amazon announced the venture will operate in 32 states with “virtual care for more than 20 common health conditions, such as allergies, acne, and hair loss.” The company does not yet accept health insurance for services, but process medicines through patients’ prescription drug coverage.

In the company’s announcement, Amazon Clinic Chief Medical Officer and General Manager Nworah Ayogu, MD, MBA, refered to the company’s pending acquisition of One Medical, “a human-centered and technology-powered provider of primary care.”

“But we also know that sometimes you just need a quick interaction with a clinician for a common health concern that can be easily addressed virtually,” Ayogu said. “We’ve thought hard about how to improve this part of the experience as well.”

 that connects customers with affordable virtual care options when and how they need it – at home, after dinner, at the grocery story, or on the go,” the announcement said.

The service will be a “health care store” that lets customers choose among telehealth providers based on their preferences. The telehealth providers have undergone clinical quality and customer service evaluations by Amazon’s clinical leadership team.

Customers will use a website to select their medical conditions and preferred providers. They complete an intake questionnaire and connect to clinicians through a secure message-based portal, according to Amazon.

Costs will vary by provider and do not include prescriptions for medicines. Patients may fill prescriptions through any pharmacy, including Amazon Pharmacy, the company’s online prescription drug ordering and delivery service.

Amazon Clinic will start by treating acne, asthma refills, birth control, cold sores, conjunctivitis, dandruff, eczema, erectile dysfunction, eyelash growth, genital herpes, gastroesophageal reflux disease, hyperlipidemia refills, hypertension refills, hypothyroidism refills, men's hair loss, migraines, motion sickness, rosacea, seasonal allergies, sinusitis, smoking cessation, urinary tract infections, and yeast infections, according to the company.

The announcement was the latest step in this year’s flurry of business activity aiming squarely at primary care.

In March, Amazon announced the company would partner with 

 for telehealth services offered through Amazon’s Echo devices. In July, the company announced its $3.8 billion deal with One Medical, which prompted requests for information by the Federal Trade Commission. The next month, Amazon announced its 

 primary care service would close by the end of 2022.

Along with Amazon, CVS, Rite Aid, Walgreens, Humana, and Walmart all have pledged to supply primary care via clinics, telehealth services, or both, over the last few years. Just this month, 

 announced it would acquire Summit Health-CityMD in an $8.9 billion deal, working with investments from Walgreens Boots Alliance Inc. and a subsidiary of Cigna Corp. health insurance company.

Telehealth store doesn’t accept insurance yet, but Amazon Pharmacy will deliver prescriptions.

Amazon Clinic to offer online primary care services in 32 states

Hackers from Iran could pose the next threat to physician and hospital computer networks.

“Iranian Threat Actors & Healthcare” is the latest 

Health Sector Cybersecurity Coordination Center

 (HC3) within the U.S. Department of Health and Human Services. HC3 periodically publishes the briefs and other information about relevant cybersecurity topics to raise awareness of current threats, threat actors, best practices, and tactics to avoid cyberattacks.

Iran is historically a “risk-averse actor,” but online attacks provide “a means to exploit enemy vulnerabilities while minimizing the risk of escalation/retaliation,” according to HC3. Iranian hackers have engaged in website defacement, spear phishing, distributed denial-of-service attacks, theft of personally identifiable information, installation of malware, and social media-driven operations.

In 2021, Iran also signed cooperation agreements that focus on cybersecurity and information and communication technology with Russian, and establishing a 25-year economic and defense collaboration with China, according to HC3. The countries share some common goals including greater censorship.

To avoid cyberattacks, HC3 recommended the measures such as:

User training on spotting and reporting phishing attacks and social engineering that make phony emails appear credible.

Review computer network vulnerabilities and install security patches.

Segment networks to restrict lateral movements by threat actors.

Maintain offline backups of data and regularly test backup and restoration.

Ensure backup data is encrypted, unchangeable, and covers the organization’s entire data infrastructure.

Use strong passwords and multifactor authentication.

Require administrator credentials to install software.

The threat actor “Charming Kitten” is associated with the Islamic Revolutionary Guard Corps (IRGC), according to HC3. That group formed “as an ideological custodian of Iran’s 1979 revolution.” In April 2019, President Donald J. Trump designated it a 

, the first state security agency to receive that designation, according to the 

Charming Kitten, also known as TA453, Cobalt Illusion, Magic Hound, ITG18, Phosphorus, Newscaster, or APT35, has targeted medical researchers, dissidents, diplomats, human rights activists, media, government, military, energy, and telecommunications operations.

The group has used spear phishing, or targeted phony emails that attempt to fool receivers into revealing confidential information. Other tactics include leveraging fake personas and social media platforms to interact with targets and impersonating popular online sites to harvest user credentials, according to HC3, which listed at least eight other hacking handles, including six that use “kitten” in the name.

The IRGC also was the subject of a multinational 

In the United States, Iranian hackers are associated with a thwarted cyberattack on a children’s hospital and a Facebook campaign targeting Americans and Europeans. In that campaign, hackers pretended to work in hospitality, medicine, journalism, nongovernmental organizations, and at airlines, according to HC3.

Things were worse for the government of Albania. That country has the headquarters of the 

, which opposes the ruling regime in Iran, and was the location for the World Summit of Free Iran conference July 23-24, 2022.

The Albanian government faced a two-phase cyberattack that started about 14 months before July 18, 2022, when the “government published a statement announcing that it had to ‘temporarily close access to online public services and other government websites’ due to disruptive cyber activity,” according to HC3.


This article originally appeared on Medical Economics®.

‘Charming Kitten’ believed to be a front for Islamic Revolutionary Guard Corps, according to HHS’ cybersecurity agency.

Iranian hackers emerge as cyberthreat to health care computer networks

 in the United States, but the 50 states have different per capita spending and rates of increase.

“Varied Health Spending Growth Across US States Was Associated With Incomes, Price Levels, and Medicaid Expansion, 2000-19,” was published in August in 

 per person across the 50 states and Washington, D.C., up to the year before the COVID-19 pandemic.

Researchers aimed to illuminate “changes in health spending during a period with substantial changes in health policy at the state and federal levels,” including the Affordable Care Act (ACA) of 2010 and its provisions for Medicaid expansion after 2014.

“Official state-specific spending estimates that date back to 2014 are not recent enough to enable analyses that consider newer policies or changing state characteristics,” the study said. “In addition, structural, legal, economic, and demographic features vary across US states and types of payers, resulting in substantial variation in health spending across states and payers that is challenging to interpret.”

In 2014, residents of Utah had the lowest annual spending per person at $5,982, while Alaskans spent the most, $11,064 per person per year. Five years later, those states retained their ranks at lowest and highest amounts – $7,250 a year for Utah residents, $14,500 for Alaska residents, according to the analysis.

Primary data came from sources including the U.S. Centers for Medicare & Medicaid Services, the American Hospital Association, the U.S. Commerce Department’s Bureau of Economic Analysis, and the Medical Expenditure Panel Survey.

In 2019, Medicare as a percentage of total health spending ranged from 9% in Alaska, to 30% in Florida.

Medicaid as a percentage of total health spending ranged from 10% of total health spending in South Dakota, to 26% of total health spending in Washington, D.C.

Private insurance as a percentage of total health spending ranged from 25% in West Virginia to 49% in Washington, D.C.

Out-of-pocket payments as a percentage of total health spending ranged from 12% in Washington, D.C., to 42% in Alaska.

Researchers noted the expansion of Medicaid “had a complex relationship with state spending growth.” But emerging trends about the effects of the ACA show increased state and national spending is associated with increased 

, especially for financially disadvantaged patients.

Researchers analyzed spending categories including hospitals, physicians/clinics, nursing facilities, home health, dental, pharmaceutical, and other professional spending categories. In all states, hospitals and physician and clinical services received the most from health care spending per person.

Hospital spending, as a percentage of total health spending, ranged from 35% in New Jersey to 51% in South Dakota.

Physician and clinical services, as a percentage of total health spending, ranged from 16% in Vermont to 30% in Alaska.

There were six non-health-system factors tested to explain variation in health spending per person. They accounted for 77.2% of variation in state per capita health spending from 2000 to 2019:

Behaviors such as physical activity levels and smoking (8%)

For income and regional prices, wealthiest states with the highest prices had the highest estimated per capita spending, while lower income states had lower spending, despite having greater need for health care “because of systematically worse health.”

The researchers noted 22.8% of spending was left unexplained. “This finding calls for a reexamination of possible factors underlying the often piecemeal, state-specific approach to addressing the rising cost and uneven quality of health care,” the study said.

Income, price levels, Medicaid expansion all are factors in state-level analysis.

Health care costs per person vary across 50 states, Washington

Physicians serious about caring for their patients must double down on their efforts to care for the planet.

Reducing pollution and climate change are at the heart of a new 

 by the American College of Physicians (ACP). The paper expands on the organization’s 2016 guidance with new recommendations for physicians, the health care sector, and policy makers.

“Human health is affected by the quality of the air we breathe and the water we drink the substances to which we are exposed, and changes in Earth’s climate,” said the paper published Oct. 25, 2022, in the 

 noted climate and weather conditions have contributed to a surge in natural disasters in the last 50 years. Just this year, wildfires burned on the West Coast, 39 people died in historic flooding in Kentucky, and 157 people died when temperatures topped 110 degrees in Washington – that state’s deadliest weather event.

“Creating sustainable social and physical infrastructure requires systematic accounting and management of potential threats, resources, inputs, outcomes, and concomitant risks, benefits, and harms,” said the editorial by Emily Senay, MD, MPH, and Andrew Hantel, MD. “The U.S. health care system is far behind other economic sectors in engaging in this critical practice that improves performance, reduces costs, and mitigates harms. We eagerly await ACP's translation of these recommendations into action-able partnerships and research funding advocacy that push our health care system toward sustainability, mitigation, and resiliency.”

 outlined three scopes of greenhouse gas emissions, which come directly from health care organizations, indirectly from energy and utility suppliers, and indirectly from supply chains and other sources. Health care accounts for 8.5% of annual U.S. greenhouse gas emissions – 2.5 billion tons a year – and large hospitals account for fewer than 1% of commercial buildings, but consume 5.5% of commercial energy.

Reducing emissions and energy use among them could achieve “early wins” for environmental health, the authors said.

Immediate action to limit global temperature rise to 1.5 degrees Celsius above preindustrial levels.

The policy paper suggested efforts ranging from greater use of zero-emissions energy sources, to sustainable food production and consumption practices, to integrating climate change and health content in medical school curricula and physicians’ continuing education.

Action to achieve environmental justice, particularly for communities with people of color, people with low incomes, and marginalized populations.

“Federal, state, and local officials should aggressively act to prohibit discriminatory practices related to environmental health,” ACP said. Going further, government leaders and planners should conduct meaningful outreach regarding decisions that affect community health, including infrastructure proposals, siting landfills and toxic waste facilities, construction projects and land use.

Reduce indoor and outdoor air pollution, support the federal Clean Air Act, and support robust air quality standards for pollutants.

Along with examining evidence of health effects, ACP called for strict enforcement by the U.S. Environmental Protection Agency (EPA).

Bolster the Safe Drinking Water Act, the Clean Water Act, the Lead and Copper Rule, and other laws and regulations to ensure clean, safe water.

Lead waterlines must be replaced, wells should be improved, and health agencies should have sufficient resources to monitor water safety and respond to illnesses or contamination.

Reduce exposures to toxic substances and chemicals, especially for children, pregnant people, and other at-risk populations.

EPA needs resources for enforcement, and chemical manufacturers should be required to provide health and safety information on their products. Agencies handling lead abatement, exposure screening, and treatment must have enough resources.

Give sustainable and sufficient money to federal agencies with an environmental health mission.

Apart from EPA, the Department of Health and Human Services has agencies and offices dedicated to environmental health and study. They need to research emerging issues such as health effects of exposure to nanomaterials, microplastics, and new chemicals.

The ACP recommendations are the latest among several declarations about the interaction of medicine and the environment this year.

Agency for Healthcare Research and Quality

 published “Reducing Healthcare Carbon Emissions: A Primer on Measures and Actions to Mitigate Climate Change,” with strategies to reduce greenhouse gas emissions through building energy, transportation, and more.

In a separate development, leaders of the First, Do No Harm campaign praised the 

 for calling for the health care sector to reduce its carbon emissions. First, Do No Harm pushed for health care organizations to divest their investments in fossil fuel businesses.

The Amercian Thoracic Society and the American Medical Association (AMA) ripped the 

 that the EPA did not have congressional authority to cap carbon dioxide emissions from coal-fired electric power plants. AMA also declared climate change a 

 threatening the well-being of all people.

Fighting pollution and climate change are at heart of new policy paper for health care sector, government regulators.