Mid-week news roundup: US offers $10M for BlackCat/ALPHV info; most Change systems still down; Risant closes Geisinger buy; SureScripts exploring sale; DarioHealth 2023 revenue -23%; Amazon Pharmacy same-day delivery NYC and LA

April 3, 2024 | by | No Comments

US State Department pays well for Big Breach information. Interestingly, this US agency through the Diplomatic Security Service has a special program, Rewards for Justice (RFJ), for cyberattacks that are deemed “malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act (CFAA)”. The activities of the now-disappeared (ha ha!) BlackCat/ALPHV  ransomware-as-a-service (RaaS) group, identified on 29 February as the culprits in the massive Change Healthcare/Optum system takedown, are now listed as qualifying for a reward, presumably as disruptive to US healthcare and not just UnitedHealth Group. Contact Rewards for Justice via the Tor-based tips-reporting channel at: he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion (Tor browser required). That is, if you dare! Rewards for Justice release, Becker’s

Six weeks later, most Change services are still X-d on the Optum Solution Status page. A quick rundown of the hundred or so programs that Change provides to enterprises has a long line of Xs with some triangles containing ! (partial outage) or yellow boxes (degraded performance). The green checkmarks are clustered in high-priority areas such as pharmacy solutions and clinical decision support. Otherwise, they are scattered across categories. The summary on the top of page (dropdown) lists workarounds for specific programs such as batch processing and transitioning over to Optum systems unaffected by the attack. This Editor bets that most of these Change legacy systems will come back only partially if at all–many will be abandoned and replaced by Optum systems. Hat tip to HIStalk 29 March

Risant Health, the non-profit community hospital system founded by but separate from Kaiser Permanente, has closed its acquisition of Pennsylvania-based Geisinger Health as of 2 April.  Jaewon Ryu, MD, JD, currently Geisinger’s president and CEO, will move to CEO of Risant Health, with Terry Gilliland, MD, replacing him at Geisinger. The Risant plan announced last April is that Kaiser will fund $5 billion to Risant, which will acquire now four or five health systems over the next four to five years. The health systems will retain their names and operational areas. The purpose of Risant is to bring community systems it acquires greater access to capital, technology, and resources for facility improvements, innovation, and investment in patient care. Keeping an eye on 109-year-old Geisinger. Risant release

Mega e-prescription system Surescripts is exploring a sale. Silicon Valley investment bank TripleTree is handling the search for buyers. Currently, Surescripts is owned 50% by CVS Caremark and Cigna-owned Express Scripts, with two trade groups, the National Association of Community Pharmacies and the National Association of Chain Drug Stores, owning the other 50%. It isn’t disclosed in the Business Insider ‘reveal’ what group(s) is interested in selling all or part of its ownership. Since Surescripts holds 95% of the e-prescribing market, any buyer or investor would need be mega flush to buy into it. 

DarioHealth didn’t have a great 2023. Net revenue was down 23% versus 2022: $20.4 million to the prior year’s $27.7 million. The chronic condition management company managed to narrow its 2023 net loss of $59.4 million from $62.2 million in 2022. A lot of the problems seemed to center on their Q4, with net revenue that declined to $3.6 million from $6.8 million in Q4 2022 and a net loss that increased to $14.3 million from $12.6 million in Q4 2022.  Dario’s gross profits for 2023 were down 38% to $6 million, a decrease of 38% versus 2022’s $9.7 million. The changing financial picture was attributed to a new private label platform with Aetna launching in 2024, changing from a B2C to a B2B2C model, and February’s “transformational acquisition” of Twill (Happify) in telemental health. As this Editor noted then, it was a feat of funding legerdemain that rivaled a Frank Lorenzo deregulation-era airline acquisition. Their information around 2023 earnings isn’t much different. Dario provides a combined app and in-person approach to musculoskeletal (MSK) therapy, diabetes (including GLP-1 drugs), hypertension, weight management, and behavioral health. Mobihealthnews, Dario release

And speaking of pharmacy, Amazon Pharmacy expanded same-day medication-delivery offerings to NYC residents and the greater Los Angeles area. This adds to same-day prescription delivery available in Phoenix, Austin, Seattle, Indianapolis, Miami, and Texas, including free drone delivery in College Station. How it works: Amazon has small facilities and pharmacists near the areas, ready to fill and deliver medications in minutes using genAI and machine learning tools. Delivery in NYC/Manhattan will be by bike and in LA, electric vans or other commercial vehicles. (Editor’s note: bike delivery in the outer boroughs is like LA–impractical.) Amazon Prime members have additional benefits. Competition here are online companies like Mark Cuban Cost Plus and GoodRx’s prescription service. But perhaps it’s a good time to sell Surescripts? Mobihealthnews

Short takes: PocketHealth, Brightside fundings; VA OIG reports hit Oracle Cerner; Change cyberattack/legal updates; UHG-Amedisys reviewed in Oregon; Optum to buy Steward Health practices

March 28, 2024 | by | No Comments

It’s a relatively quiet week before the Easter holiday, with a few fundings, more drama at the VA around Oracle Cerner, updating Change Healthcare’s comeback, and the continuing scrutiny around UnitedHealth’s acquisitions:

PocketHealth garners a US$33 million Series B. The Toronto-based company markets an AI-assisted platform to health systems and providers that allows patients to access their medical imaging and reports as well as for providers to easily share imaging information. The funding was an all-equity round by Round13 Capital with participation from Deloitte Ventures, Samsung Next, and existing investors Questa Capital and Radical Ventures to bring total funding since 2020 to $55.5 million. The fresh funding will be used to grow further within the US and Canada and develop new platform functions. Patients have access to three platforms:  Report Reader to explain medical terms in the patient’s report, Follow-Up Navigator for follow-up imaging recommendations, and MyCare Navigator to equip patients with relevant, personalized questions to ask their doctor. The platform is available in 775 hospitals and imaging centers across North America and is used by more than 1.5 million patients.  PocketHealth release, Mobihealthnews

Brightside Health moves to a Series C of $33 million. This round for the telemental health company was led by S32, along with Kennedy Lewis, Time BioVentures, and Anne Wojcicki (Redwood Pacific) with existing investors ACME, Mousse Partners, and Triventures. Total funding since 2018 is $114 million. Brightside provides telemental health through payers in 50 states such as CareOregon, Blue Cross and Blue Shield of Texas, and Centene. The new funding will be used to expand into the usual new markets and offerings. Trip Hofer, who was former CEO of Optum Behavioral Health Solutions and now with .406 Ventures, will join the Brightside board of directors. Their most recent moves are expansion into Medicare and Medicaid programs for psychiatry, therapy, and their Crisis Care program for individuals with elevated suicide risk. Release

The Department of Veterans Affairs Office of Inspector General (OIG) released three reports last Thursday (20-21 March) that were sharply critical of the new Oracle Cerner EHR. While Oracle Cerner Millenium operates in only five VA locations, not including the joint MHS/Genesis Lovell FHCC, each one has been problematic from training to implementation–and are on hold. The OIG reports available here on the Electronic Health Records Modernization (EHRM) are scathing on the EHR’s scheduling and pharmacy features leading to patient safety and staff usability issues.

  • At VA Central Ohio Healthcare System (facility) in Columbus and elsewhere, this led to inaccurate medication and allergy information transmission from new EHR sites to legacy EHR sites that staff and pharmacists had to work around to provide adequate safety checks.
  • Also at VA Central Ohio, the Cerner EHR system error in 2022 led to a patient’s missed appointment since it was not routed to a queue to prompt rescheduling efforts. Subsequently, a nurse practitioner never evaluated the medication refill request, nor did a psychologist evaluate mental status and critical clinical information. The veteran patient died by accidental overdose approximately seven weeks after that missed appointment.
  • Regarding future implementations, the OIG was specific on what had to be fixed on both: “These concerns include the need for additional staffing and overtime to meet or exceed pre-deployment appointment levels, displaced appointment queue functionality, challenges related to providers and schedulers sharing information, inaccurate patient information, difficulties changing appointment type, and the inability to automatically mail appointment reminder letters. At facilities currently relying on the EHR, these issues have resulted in inconsistent workarounds and additional work, increasing the risk for scheduling errors.” 

Healthcare IT News, Healthcare Dive, EHR Intelligence, TTA 22 Feb

Change Healthcare’s systems are gradually returning. Since our last update on 14 March, UnitedHealth Group confirmed that 99% of pharmacy network services were up and running–and that they have fronted $2 billion to providers. Separately, they launched workaround software for medical claims preparation.

  • On 15 March, the electronic payments platform was restored.
  • On 20 March, UHG restored Amazon Web Services. It was backed up from Assurance, a claims and remittance management program, and claims clearinghouse Relay Exchange.
  • Relay Exchange went back online by 24 March to begin processing $14 billion in medical claims.

But on the legal and Federal fronts, UHG will be keeping its legal department busy. Starting the week of 11 March, the first class action lawsuit was filed by a women’s health practice in Albany, MS–Advanced Obstetrics & Gynecology PC. Another class action suit was filed on 18 March by Gibbs Law Group on behalf of providers to be named. Patients who have had compromised PII and PHI will be next from the 4 or 6 terabytes of payer information held by ‘notchy’ and other affiliates from the BlackCat/ALPHV masterminded attack as this is confirmed. Expect these to multiply like weeds in May. HIPAA Journal  And the American Hospital Association, Senators and House Representatives are jumping all over Health and Human Services (HHS) to ensure that payments are made to Medicare, Medicaid, and Medicare Advantage plans–as well as calls for investigating UnitedHealth. Becker’s, FierceHealthcare

As expected, UHG’s acquisition of Amedisys home health is running into more opposition at the state level. In this case, it’s the Oregon Health Authority (OHA) that will be conducting a full review. The Department of Justice (DOJ) has been investigating the acquisition on antitrust grounds almost since it was announced in June 2023. Shareholders approved the $3.3 billion buy the following September, but it has not closed. UHG’s plan is to merge it into Optum’s home health providers Contessa Health and LHG Group, creating a home health juggernaut. As noted earlier this month when DOJ announced a further antitrust probe of UHG around the UnitedHealth plan relationships with Optum services, “DOJ has a long memory, a Paul Bunyan-sized ax to grind, and doesn’t like losing. One wonders if now UHG has buyer’s remorse after fighting for two years to buy Change.” (And winning versus DOJ!) Fierce Healthcare

Yet UHG goes on buying providers, DOJ scrutiny or not. Optum is bidding for Steward Health Care’s Stewardship Health practices over nine states. For-profit Steward, headquartered in Dallas, needs to raise funds as it is in debt overall and facing major problems in Massachusetts, with several hospitals at risk of closure. In any case, the company wants to exit the state. A purchase price was not announced. The transaction is under review by Massachusetts’ Health Policy Commission (HPC) over the next 30 days. The Stewardship transaction would add to OptumCare’s total of 90,000 physicians–10% of US physicians, a number that is raising red flags on the state and Federal levels. FierceHealthcare, WBUR

Is BlackCat/ALPHV faking its own ‘death’? (updated) HHS and CMS come to Change affected providers’ assistance with ‘flexibilities’

March 7, 2024 | by

BlackCat/ALPHV blames the FBI for another ‘shutdown’ and exits, stage left. BlackCat put up a copy of the shutdown screen (left) that appeared on their old leak website back in December [TTA 22 Dec 23] on their new leak website, claiming that law enforcement shut them down. This was not confirmed by the FBI either way, but Europol and the NCA confirmed to Bleeping Computer that they had no recent activity involving BlackCat. The other tell was that the source code on both screens was different–it was served up on another server.

On a Russian hacker forum called Ramp, BlackCat/ALPHV claimed that they “decided to completely close the project” and “we can officially declare that the feds screwed us over. The source code will be sold, the deal is already being negotiated”. The source code is reportedly up for sale for $5 million.

As to the $22 million, BlackCat/ALPHV never admitted it was paid by Optum/Change (nor is Optum confirming), but the affiliate called “notchy” which didn’t get paid [TTA 5 Mar] shared (to Bleeping Computer) that “a cryptocurrency payment address that recorded only one incoming transfer of 350 bitcoins (about $23 million) from a wallet that appears to have been used specifically for this transaction on March 2nd.” That wallet distributed (seven) equal payments of $3.3 million in bitcoin to other wallets.

(Update) Speaking of “notchy”, let’s not forget that this affiliate claims to have 4 TB of PHI/PII data from Change that could be sold or leaked. Since they never got paid by BlackCat/ALPHV, it’s safe to assume that information will be up, so to speak, for grabs.

When it all adds up–the fake FBI ‘raid’, shutting down servers, the signoff on Tox of “GG’ (good game?), the cutting off of affiliates (which also confirmed this to DataBreaches.net–and may or may not have been paid)–it resembles an exit scam.

(Update) Another excellent summary about ALPHV in Krebs On Security also updates LockBit, which was seized in an international takedown in February, and about governmental entities they ransomwared.  To be continued….

The lobbying of HHS by Congress, the American Hospital Association, and UHG to help out providers has produced some results. On 5 March, Health and Human Services (HHS) issued a statement that summarized various ‘flexibilities’ and workarounds to aid providers who cannot access systems or have to resort to alternatives to ensure continuity of services to patients. These will be administered through the Center for Medicare & Medicaid Services (CMS) and range from prior authorization, advance funding, and claims processing for Medicare. From the statement:

  • Medicare providers needing to change clearinghouses that they use for claims processing during these outages should contact their Medicare Administrative Contractor (MAC) to request a new electronic data interchange (EDI) enrollment for the switch.
  • CMS will issue guidance to Medicare Advantage (MA) organizations and Part D sponsors encouraging them to remove or relax prior authorization, other utilization management, and timely filing requirements during these system outages.
  • CMS is also encouraging MA plans to offer advance funding to providers most affected by this cyberattack.
  • CMS strongly encourages Medicaid and CHIP managed care plans to adopt the same strategies
  • If Medicare providers are having trouble filing claims or other necessary notices or other submissions, they should contact their MAC for details on exceptions, waivers, or extensions, or contact CMS regarding quality reporting programs. CMS has contacted all of the MACs to make sure they are prepared to accept paper claims from providers who need to file them.

Many payers are also making funds available while systems are offline. Hospitals may also face “significant cash flow problems from the unusual circumstances impacting hospitals’ operations, and – during outages arising from this event – facilities may submit accelerated payment requests to their respective servicing MACs for individual consideration.”

The statement closes with a reminder of HHS’ December concept paper on cybersecurity strategy for healthcare. DataBreaches.net (full statement), Becker’s

(Update) More on how this is affecting patient care focusing on cancer treatment, from the point of view of a Community Oncology Alliance spokesman. In addition, how consolidation is making healthcare more vulnerable to cybercriminals, and comments on UHG and Federal processes and payment offers to date. HealthcareITNews.

And DDoS attacks and questionable downtimes are now common.

Editor’s Update 11 Mar: The DataBreaches.net website had a major DDoS attack on 7 March and was down for two days thru 8 March. It is now fully up and running with our links working.

Multiple US Government websites went down Thursday evening 7 March based on news reports: Department of Homeland Security (DHS), Customs and Border Protection (CBP), Immigration & Customs Enforcement (ICE), Citizenship and Immigration Services (USCIS), US Secret Service and Federal Emergency Management Agency (FEMA). The timing based on the State of the Union address to Congress is, well, interesting. Daily Express   Later reports announced restoration later in evening. Cyberincidents are not exactly unknown on government websites.

Reality Bites Again: UHG being probed by DOJ on antitrust, One Medical layoffs “not related” to Amazon, the psychological effects of cyberattacks

March 6, 2024 | by

When It Rains, It Really Pours for UnitedHealth Group. On the heels of their Optum/Change Healthcare ransomware disaster are recent reports that the US Department of Justice is investigating UHG over multiple antitrust concerns. According to the Wall Street Journal, DOJ is examining certain relationships between the company’s UnitedHealthcare insurance unit and its Optum services unit, specifically around Optum’s ownership of physician groups. UHG has been aggressively buying and buying interests in practice groups for several years, announcing quite publicly that their goal was to own or control 5% of US physicians. In 2022 and 2023, they bought CareMount, Kelsey-Seybold, Atrius Health, Healthcare Associates of Texas, and Crystal Run Healthcare (Becker’s). Local reporting by the Examiner News in Westchester, NY, brought much of this history to light. In that area, it started with local practice group CareMount and their 25% layoff after being folded into Optum Tri-State with ProHealth in Long Island and NYC and Riverside Health–a layoff pattern that accelerated in the practice groups in 2023.

DOJ lost out on their challenge to the Change Healthcare acquisition in November 2022, deciding not to appeal the Federal District Court decision in 2023 [TTA 23 Mar 2023]. But DOJ never sleeps; they are examining with a microscope UHG’s $3.3 billion bid for home health provider Amedisys that started in August 2023 and has not moved forward. DOJ has a long memory, a Paul Bunyan-sized ax to grind, and doesn’t like losing. One wonders if now UHG has buyer’s remorse after fighting for two years to buy Change.

In the Alternate Reality Department, One Medical CEO Trent Green insisted that their reorganization and layoffs were unrelated to their acquisition by Amazon. Those of us who are a little less credulous know that with 98% of acquisitions, staff are laid off. Overlapping areas wind up being pinkslipped, no matter their individuals’ quality or even difference in business: finance, HR, legal, marketing, IT, operations, compliance, sales, account managers…the list is almost endless. According to the Washington Post article (also Becker’s), One Medical cuts, estimated at up to 400, also included front desk staff, office managers, health coaches, behavioral health specialists and a pediatrician–people who aren’t employed by other Amazon units. One Medical’s corporate offices in New York, Minneapolis, and St. Petersburg, Florida are closing, and its San Francisco office space is reduced to one floor. TTA 14 Feb

One Medical has never been profitable, as this Editor noted when the acquisition was announced as part of the “race to transform healthcare models”. This wasn’t going to last long with Amazon, which has been aggressively been cutting and dumping in other units such as Audible, Prime, and Halo. Marketing Amazon-style with deeply discounted memberships to Prime members also has its limitations. One Medical has a scant 200 mostly urban offices, which means that members outside those areas only have access to virtual visits. It had previously cultivated a patient population of young, mostly healthy and lower-cost urbanites, who as they grow older and have families might stick with the practice–or find it not compatible with or targeted to their needs in middle age. Management has changed: Green replaced Amir Dan Rubin, MD, as CEO last September. CFO Bjorn Thaler will move to a new position focused on growth initiatives. A layer of regional general managers will report to an Amazon head of operations, and legal, finance, and technology teams will report to Amazon’s healthcare business structure. Inbound calls now go to Mission Control, a central call center, and even those humans will be in future supplemented by an AI-enabled chatbot.

Iora Health, One Medical’s specialized (acquired) unit in Medicare Advantage and Medicare Shared Savings Programs including the advanced ACO REACH model, in October was rebranded as One Medical Senior, with an intention for all One Medical offices to serve age 65+–but with current patients, many with multiple chronic conditions, now reporting cutbacks in callbacks, appointment length, physician load, and services provided such as transportation. One clinic had 20 staff cut back to five with patients pushed out to virtual visits–hardly appropriate for a high needs, older, less technologically savvy patient population in value-based care, quality-measured models. Editor’s note: having had some experience in ACO and VBC World, Amazon may as well get out of ACOs because practices in these primary care models require specialized and dedicated management, reporting, and population nurturing. They don’t mainstream well.  I have also read that ironically, Iora was profitable for OneMedical, which is 1) why they bought it and 2) ran it separately.

In this Editor’s view, human costs are a factor shown to be absent from Amazon’s business calculations for success–which doesn’t quite square with the mission of healthcare for healthier patients and better outcomes.

Speaking of the reality of human cost, let’s spare a thought for those dealing with the effects of a cyberattack or data breach. They are the IT staff, pharmacists, software specialists, front line clinicians, billing specialists, doctors, therapists, business managers, coders…the list goes on. They share their feelings of frustration, helplessness, distress, aloneness, and financial fear on Reddit, Twitter/X and other forums. Few think of them taking the brunt of patient frustration and their state of mind day after day as Change/Optum’s disaster goes on and on. Writer Molly Gamble of Becker’s has the final and most sympathetically descriptive say in her brief but important article about When ransomware strikes, who to call?  A full read is recommended.

Helplessness or loss of control, especially at a collective level, can be psychologically and emotionally taxing. Recognizing a threat but not knowing what to do about it can increase one’s stress, anxiety and fear. The lack of a known end point of a cyberattack like Change is experiencing can intensify psychological distress. Some independent therapists, for instance, have noted they have halted their insurance billing for a week due to the downtime and expressed fear about going longer without income. 

These mental effects, while lesser-discussed, are exactly what cyberthreats intend to bring on. Cyberterrorists want to create mental and physical harm, and research has found that the psychological effects of cyber threats can rival those of traditional terrorism.

Week 2: Change Healthcare’s BlackCat hack may last “for the next couple of weeks”, UHG provides temp funding to providers, AHA slams it as a ‘band aid”–but did Optum already pay BlackCat a $22M ransom? (updated)

March 5, 2024 | by

The BlackCat/ALPHV ransomware attack on Change Healthcare’s systems continues. At this point, the Optum systems website doesn’t show anything other than a chronological trail of updates and a long list in very small gray type of Change Healthcare systems affected–no more individual checks on working systems and red Xs on the ones that weren’t. 

  • UnitedHealth Group is setting up a program to loan funds, the “Temporary Funding Assistance Program,” to providers who cannot receive payments while Change systems are down. While without fees or interest, the loans will have to be repaid.
  • In a Tuesday 27 Feb conference call with hospital cybersecurity officers reported by STAT, UHG Chief Operating Officer Dirk McMahon said that the program will continue “for the next couple of weeks as this continues to go on.” This is more of a timeline than UHG has otherwise disclosed.
  • The American Hospital Association (AHA) on Monday slammed the “Temporary Funding Assistance Program” as “not even a band-aid on the payment problems” that hospitals are experiencing. The program is, in their view 1) “available to an exceedingly small number of hospitals and health systems” and with “shockingly onerous” and “one-sided contractual terms” and conditions for payback and verification through access to claims payment data. For their members, “their financial future becomes more unpredictable the longer Change Healthcare is unavailable. UnitedHealth Group, which is a Fortune 5 company that brought in more than $370 billion in revenue and $22 billion in profit in 2023, can — and should — be doing more to address the far-reaching consequences that result from Change Healthcare’s inability to provide these essential hospital revenue cycle functions nearly two weeks after the attack.” 4 March letter to UHG   AHA maintains an update page for members and other providers.
  • US Senator Chuck Schumer wrote 1 March to the Center for Medicare and Medicare Services (CMS) requesting that CMS accelerate payments to hospitals, pharmacies and other providers. Also Becker’s
  • AHA wrote 4 March to all four Congressional leaders detailing the effect on providers, UHG’s assistance program’s inadequacies, and requesting assistance from HHS including requesting “Medicare Administrative Contractors to prioritize and expedite review and approval of hospital requests for Medicare advanced payments.”  

Update: According to First Health Advisory, a cybersecurity firm in healthcare, some large providers are losing $100 million daily because of the interruptions to Change/Optum’s payer systems. CNN, Becker’s

And BlackCat went All Quiet on the Ransomware Front. Bleeping Computer confirmed that BlackCat turned off their servers and took their negotiation website offline over the weekend. “The Tox messaging platform used by the BlackCat ransomware operator contained a message that does does not provide any details about what the gang plans next: “Все выключено, решаем,” which translates to “Everything is off, we decide.”” It has now been changed to “GG”.

This may or may not be related to another development–an affiliate of BlackCat/ALPHV claiming that they were scammed of a $22 million ransomware payment from Optum. These affiliates actually carry out the attacks on cybervictims using encryptors from the main entity. Dmitry Smilyanets of threat intelligence company Recorded Future picked up a message posted by “notchy” that said Change/Optum paid $22 million on 1 March to “prevent leakage and decryption key.” ALPHV suspended their account after receiving the payment and never paid them. This affiliate also claims they still have 4 terabytes of data from Change that goes deep into Tricare, Medicare, MetLife, CVS, and many other payers. As proof on the ransom, “notchy” provided a cryptocurrency payment address with a total of nine transactions. In the ultimate irony, “notchy” warned other affiliates to stop dealing with ALPHV. Cutting off affiliate ties and walking away with the cash, preliminary to another rebrand of BlackCat/ALPHV, formerly DarkSide and Black Matter? Also The Registerand DataBreaches.net–which commented that while Optum may have gotten a decryptor, what about All That Data?

Change Healthcare cyberattack persists–is the BlackCat gang back and using LockBit malware? BlackCat taking credit. (update 28 Feb #2)

February 27, 2024 | by

On Day 7, reports, like recollections, may differ. Today’s Reuters report (26 Feb) attributes the attack on Change Healthcare, which has snarled pharmacies and hospitals since Wednesday [TTA 23 Feb], to a revived BlackCat (a/k/a ALPHV) ransomware operation. Readers will recall that the FBI busted BlackCat right before Christmas last year, seizing their operational darknet websites and putting up a most showy home screen. They worked their way into the BlackCat operation via their affiliate operation. However, BlackCat rebooted a few days later, made an appearance, and went back underground. As Bleeping Computer predicted then, BlackCat is apparently back and, adding insult, not even under a new name. 

Bleeping Computer today reported that BlackCat’s hack went through a critical ConnectWise ScreenConnect auth bypass flaw (CVE-2024-1708 and 1709) which was actively exploited in attacks to deploy ransomware on unpatched servers. This was confirmed by Reuters and Health-ISAC, a healthcare-focused organization engaged in cyber best practices and threat intelligence, via the American Hospital Association’s AHA Cybersecurity Advisory today (26 Feb). AHA is advising healthcare organizations to actively reevaluate their connection or disconnection status of Change Healthcare systems which have been deemed safe by Optum.

As of today, BlackCat did not claim credit for taking down Change’s systems nor is there any report of a ransom demand. It is perhaps too early to determine if there has been any data theft. Nor are there reports of other healthcare or other organizations being attacked through the ScreenConnect flaw.

Optum has a page detailing the status of Change Healthcare’s individual systems here. Optum has a statement that has remained nearly the same on issues with connectivity since last Wednesday.* This Editor’s experience of the page is that it needs refreshing to view the full version. Regarding the systems, they are a long list to scroll through and your Editor lost count after 100. Most have red Xs by them. Some systems are checked green. Change is also holding Zoom calls to update partners. Reuters reported that Alphabet’s cybersecurity unit Mandiant is in charge of investigating the attack.

Change Healthcare processes 15 billion healthcare claims annually. This attack seems to have hit their pharmacy software the hardest. These software tools are used to verify patient eligibility for specific medication and also their insurance coverage. The outage not only covers the big chains like CVS and Walgreens, but also Tricare and the Military Health System (MHS) globally. TTA 22 Feb, updated 23 Feb.

A Friday report in SC Magazine indicated that the malware used by BlackCat was a strain of LockBit malware going through the ConnectWise ScreenConnect bypass flaw. Their source, Toby Goucker, chief security officer at First Health Advisory, stated that their firm found the ScreenConnect flaws and sent out a notification on 19 February. Goucker noted that bad actors prey on the gap between when these vulnerabilities are uncovered and announced, but before when patches are applied. However, Goucker was not able to confirm that Change uses ScreenConnect.

Ironically, the LockBit ransomwareistes were busted only last week by a combined UK NCA and US DOJ/FBI effort. Like weeds, they never go away entirely.

Oddly, Change Healthcare’s website home page does not have a notice about their problem or direct to a page on their or UHG’s site about it for assistance. We know you’re busy, guys, but from this Editor’s marketing perspective not having an information banner and redirect to the Optum page is a basic communication failure.

**This is a developing story and will be updated.**

*Update 27 Feb 9am Eastern Time.

A repeat of Optum’s boilerplate statement on their page today indicates this cyberattack is still unresolved for most of Change Healthcare–and will remain unresolved at least through today:

Update – Change Healthcare is experiencing a cyber security issue, and our experts are working to address the matter. Once we became aware of the outside threat, and in the interest of protecting our partners and patients, we took immediate action to disconnect Change Healthcare’s systems to prevent further impact. This action was taken so our customers and partners do not need to. We have a high-level of confidence that Optum, UnitedHealthcare and UnitedHealth Group systems have not been affected by this issue.

We are working on multiple approaches to restore the impacted environment and will not take any shortcuts or take any additional risk as we bring our systems back online. We will continue to be proactive and aggressive with all our systems and if we suspect any issue with the system, we will immediately take action and disconnect. The disruption is expected to last at least through the day. We will provide updates as more information becomes available.
Feb 27, 2024 – 09:03 EST

Identical message 28 Feb 10:48am ET indicating that the effects of this attack are now one week old.

Updated 28 Feb: DataBreaches.net (“The Office of Inadequate Security”) reports that BlackCat is taking credit for it.

“BlackCat informed DataBreaches that yes, they are responsible for the attack. DataBreaches has asked them if they are willing to share any additional details and will update this post if any are received.”

This Editor is also following coverage in the usually reliable The Register which added a reply they obtained from Optum: “Since identifying the cyber incident, we have worked closely with customers and clients to ensure people have access to the medications and the care they need. We also continue to work closely with law enforcement and a number of third parties, including Mandiant and Palo Alto Networks, on this attack against Change Healthcare’s systems.” They are not confirming the perpetrators. 

#2 update from DataBreaches may point to Change Healthcare as well as healthcare in general. Here is part of a Cybersecurity Advisory (CSA) that is an ongoing #StopRansomware effort by the Cybersecurity and Infrastructure Security Agency (CISA). CISA was joined by the FBI and interestingly, the Department of Health and Human Services (HHS). They “are releasing this joint CSA to disseminate known IOCs and TTPs associated with the ALPHV Blackcat ransomware as a service (RaaS) identified through FBI investigations as recently as February 2024.” The addition of HHS as well as February 2024 should be noted. “FBI, CISA, and HHS encourage critical infrastructure organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of ALPHV Blackcat ransomware and data extortion incidents.” Could this be behind what is going on at Change Healthcare–a BlackCat full-court press versus US healthcare?

And at least one major hospital CEO wants answers now. Tampa General Hospital CEO John Couris went up to Optum’s CEO Amar Desai in the speaker room at the ViVE conference in Los Angeles on Monday, and the answer was far less than satisfactory. “And his answer to me was, ‘We’ll have an update in two days.’ So I don’t think he knows.” Mr. Couris’ speculates that Change Healthcare will 1) not pay ransom and 2) will rebuild its systems in maybe four weeks–and how that puts hospitals like his that use Change as a clearing house for claims in, to put it mildly, a pickle. MedCityNews

News roundup: Cano Health files Ch. 11 bankruptcy, delisted (updated), Walgreens lays off more, Allina Health outsources 2,000 RCM jobs to Optum

February 6, 2024 | by

Cano Health’s telenovela moved to a Delaware court, where it filed for Chapter 11 bankruptcy. This prearranged voluntary Chapter 11 was filed on Sunday 4 February in the US Bankruptcy Court for the District of Delaware. Based on this Editor’s reading of their release, it’s a prepackaged reorganization of this beleaguered primary care provider. It also promises an exit by Q2 2024. It features several parts that have to be approved by the Court in short order:

  • A Restructuring Support Agreement (the “RSA”) with major lenders (the “Ad Hoc Lender Group”). They hold approximately 86% of Cano’s secured revolving and term loan debt and 92% of its senior unsecured notes. The RSA provides for the conversion of nearly $1 billion in secured debt to a combination of new debt and full equity ownership in the reorganized company. (See below as to what that means for Class A shareholders.)
  • Securing liquidity via a commitment for $150 million in new debtor-in-possession financing from certain of its existing secured lenders. 

In addition, Cano itemized several ‘first day’ motions to ensure continuity of operations–these also have to be approved by the Court: 

  • Paying associate wages, including for its doctors and nurses, without interruption
  • Continuing operations and honoring obligations to its affiliate physician groups
  • Ensuring patients at its clinics continue to receive quality value-based healthcare
  • Seeking authority to pay the existing pre-petition claims of certain vendors that are critical to the health and safety of Cano Health’s patients and critical to the operation of the Company’s medical centers.
  • Cano has authority to continue making ordinary course payments for all authorized goods and services provided on or after the filing date.

Earlier actions by their CEO laid groundwork for this reorganization through selling off operations and divesting staff. In September, they sold their Texas and Nevada operations to CenterWell Senior Primary Care, a unit of Humana, for $66.7 million, and exited California, New Mexico and Illinois late last year, with Puerto Rico winding up this quarter. Cano also cut 21% of staff (842 people) by November .

No comfort for their common Class A shareholders, though. Shareholders approved a 1 share for 100 reverse share split to buoy price last December, though the NYSE had notified Cano on 29 December of delisting based on their market capitalization not meeting their standards. Cano’s shares stopped trading as of last Friday at $2.30. What is usual, and signaled by the RSA conversion, is that common shareholders–probably including the infamous Cano 3 who owned about 35% of the shares–will receive bupkis, nada, zip, zero in the reorganization.

Update: The NYSE delisted Cano Health’s (CANO) stock late on Monday, citing the RSA conversion. Press release, Healthcare Dive.  The Class A shares are now listed OTC (the ‘pink sheets’) under CANOQ at $0.70. Shareholders are wholesale unloading with the day’s volume over 580,000 compared to the previous average of 340,000 shares.

Cano remains for sale during this process according to the release.

Here’s the 36-page filing, courtesy of Industry Dive. Healthcare Dive. FierceHealthcare dubbed this a ‘spectacular collapse’ (which it isn’t–that was Babylon Health) but includes some speculation from Ari Gottlieb, a principal at A2 Strategy Group whom this Editor has quoted before, that since Humana has a stake in and partnered with Cano, they should simply pick up what’s left. However, Humana may not be in a cash position to do so, given its recent losses in its Medicare Advantage business that also helped to sink Cano (partly paywalled). The local take in the Sun-Sentinel.

Less drastic but equally, more signs of the times:

Walgreens laid off 145 more staff, primarily in corporate. This follows on November’s 5% corporate layoff. No WARN notices have been filed and all are mum on what areas or states are affected. Nor is there any confirmation that this will be the end. Speculation is that more store closings are in the offing and once leaned down, Walgreens Boots Alliance will be sold off or parted out, with Shields Health Solutions perhaps the first on the block [TTA 25 Jan]. Healthcare Dive, Becker’s

Allina Health, a 10-hospital non-profit health system based in Minneapolis, Minnesota, is outsourcing 2,000 IT and revenue cycle management jobs to Optum. Happily, this is being done as a transition on 5 May from Allina to Optum with no layoffs or shift in workplace, as of this time. Rationale given is to trim needed expenses and ‘deliver on emerging spaces’, whatever that means.   Star-Tribune

*Updated for Cano Health delisting and additional information on Walgreens’ layoffs.

CMA clears £1.2B EMIS acquisition by UnitedHealth Group’s Optum (UK)

October 2, 2023 | by

It took a year, but it’s approved. The Competition and Markets Authority (CMA), the UK agency tasked with approving acquisitions, approved the acquisition of UK healthcare tech systems developer EMIS by UnitedHealth Group (UHG)’s Optum. The actual acquisition will be made by Bordeaux UK Holdings II, a UK Optum unit. 

The £1.2 billion bid for the private company was made in June 2022. In March 2023, CMA moved its review to an independent group for a Phase 2 review due to EMIS’ engagement with the NHS. The Phase 2 review determined that the acquisition by Optum did not raise competitive concerns. Optum is currently a supplier to NHS and GP practices in pharmacy prescription, advisory services, and data analytics. The acquisition of the EMIS system was found to not effectively restrict other entities’ access to data or population health services, and that any restriction could be regulated by the NHS to prevent its use by Optum as a business strategy. Further discussion is presented in the CMA release.

EMIS is the leading EHR system used by NHS GPs throughout the UK. EMIS also has systems for business intelligence, pharmacy, EDs and urgent care, and to identify patients for clinical trials. 

This final approval indicates that the acquisition will close before the end of this year.  Becker’s Payer, CMA release, Medical Buyer (India), Reuters

Mid-week roundup: Babylon Rwanda update, CVS Health laying off 1,700+, Optum laying off too, Veradigm’s third non-compliance Nasdaq notice, AireHealth auctioning assets, Viome’s $86M raise + CVS retail kit deal

August 23, 2023 | by

It’s another jump into the unknown between bankruptcies, layoffs, and funding raises for the Lucky Few. Emblematic of this year as we prepare to wind up this Crazy Summer in the next few weeks.

Rwandan government scrambling to keep Babyl services going. According to a local website, The EastAfrican, on 7 August “Health Minister Sabin Nsanzimana convened a meeting with the head of Babyl’s operations in Rwanda, Shivon Byamukama, to formulate a contingency plan to mitigate the impact of the company’s bankruptcy.” The Rwanda Ministry of Health is trying to secure the Babyl Rwanda operation that serves 2.4 million Rwandans (not Babylon’s 2.8 million, but still close to 20% of population) and employs over 600 people–doctors, nurses, call center agents, and software developers, Babyl is maintaining normal daily operations for now while Babyl Rwanda’s managing director, Dr. Shivon Byamukama, told the publication that the Rwanda operation is in active discussions with potential investors and partners either as a standalone entity or in partnership with another body. One wonders where the $2.2 million in funding from the Bill & Melinda Gates Foundation went.

CVS Health is starting to wield the knife on its promised (to investors) 5,000-person layoff, starting with at least 1,200 in October. The bulk of the layoffs will be in Connecticut and Rhode Island, both home to much of the Aetna operations. State labor departments in Rhode Island and Connecticut have already received WARN notices from CVS that over 1,200 employees in those states will be terminated effective 21 October. In other states, WARN notices have been filed for another 580 also effective 21 October.

  • The Woonsocket, RI headquarters and a neighboring office in Cumberland will lose 770 workers. 198 live in RI, the others are remote workers reporting to RI-based supervisors.
  • 306 employees are based at the insurer’s headquarters in Hartford, Connecticut. An additional 215 work remotely but are supervised out of the Connecticut offices, for a total of 521.
  • Other employees will be terminated in New York (167), Plantation, Florida (288), and Arizona (134), according to notices filed in each state.
  • Updated 24 Aug: another 825 across four additional states. In NJ, 207 employees at multiple locations starting 15 November. In Texas, 167 employees in Richardson and Irving; in Pennsylvania, 157 employees at an Aetna office in Blue Bell; in Illinois, 294 employees in Chicago, Buffalo Grove, and Northbrook starting 21 October.  Becker’s
  • CVS refused to disclose other layoffs to Healthcare Dive in other states where the number fell below WARN notice requirements

These positions include assistants, data engineers, customer care pharmacists, actuary executives, corporate vice presidents, project managers, program managers, and managers/directors of network development. While these constitute only 2% of CVS’ overall workforce of 300,000, it is cold comfort to those affected, many of whom have worked years for Aetna or CVS.   Becker’s  

The timing is revealed in the Becker’s Payer Issues article: When CVS acquired Aetna, “its agreement with state insurance regulators included a promise to keep employment levels at Aetna and its subsidiaries at 5,300 for at least four years after the closure of the deal. The employment levels reflected staffing as of Oct. 1, 2018, and the agreement expired in 2022.” Notice the similarities in the numbers.

In the interim, CVS went on an acquisition binge of $18.6 billion, buying Signify Health and Oak Street Health only months apart in strategic moves to buy up practices and network extenders such as ACOs in value-based care and home health.

  • Oak Street Health and its 169 practices do not project profitability until 2025–maybe–and clocked an over $500 million loss last year [TTA 4 May]. In the views of many on the Street, Oak Street was a $10 billion waste.
  • No one knows if Signify Health is profitable or not with practices and home health, but that company took a bath on Remedy Partners in Episodes of Care models and wound down that business right before the auction. CVS Health got caught up in a four-way bidding war only a year ago (in a universe that feels quite far away) that topped out at over $8 billion in cash. Ill-considered in retrospect?

CVS Health is already dealing with 2023 and 2024 projections that are downtrend: increased Medicare Advantage costs, higher drug utilization, and lower consumer spending expectations affecting retail operations. Mr. Market does not ignore Where The Money Comes From, and the piper that is paid comes from where it usually does–the people working for the company.

Optum not immune from layoffs either. Optum Health’s MedExpress Urgent Care clinics are eliminating registered nursing positions at nearly 150 facilities as part of a larger group of layoffs at Optum. MedExpress’ RNs are circulating an online petition protesting the change as ‘negligent’. Social media has also posted about gradual current layoffs at UnitedHealth Group and Optum building to major layoffs affecting worldwide operations. There are no WARN filings so these are suspected to be below the 50-100 WARN threshold (number and time period e.g. 6 months may vary by state) but cumulatively across UHG substantial. Becker’s    Becker’s updated coverage today 23 August

Veradigm’s ‘problem’ with Nasdaq continues. The former Allscripts still has not filed an annual report for 2022, nor Q1 or Q2 financial reports, with the Securities and Exchange Commission (SEC) which are required for Nasdaq stock listing under Nasdaq Listing Rule 5250(c)(1). TTA previously reported in June that Veradigm is not reporting because they had a software flaw that affected its revenue reporting going back to 2021. This has been going on since March. Veradigm has requested multiple extensions from the exchange and are set to ask for another. Veradigm stock closed today at $12.89, which is well out of the usual trouble, but an accounting software problem this long unresolved from a software company specializing in practice EHRs and practice management software…does not compute. Healthcare Dive, Business Wire

AireHealth auctioning off assets. This respiratory health company based in Winter Park, FL founded in 2018 developed a FDA-cleared nebulizer with Bluetooth functionality plus AI and machine learning software to generate predictive data on patients’ clinical conditions. The online auction of patents, software, hardware, and intellectual property for the company’s remote patient respiratory care platform will be held by Florida-based Fisher Auction Company. Apparently, there was no bankruptcy filed but the early-stage company decided to shutter anyway and sell assets. Mobihealthnews

On the other hand, gut health is hot and Viome scored a Series C of $86.5 million for a total $175 million raise plus gut testing in 200 CVS locations. Lead investors are Khosla Ventures, Bold Capital, and WRG Ventures. With the raise, Viome announced the launch of its Gut Intelligence Test in 200 CVS locations. Online, the Gut Test retails for $149 on current sale. Viome also markets oral and throat tests plus a ‘full body’ test in the $200+ range. The gut test is not currently FDA-cleared, though its saliva-based oral and throat cancer test received FDA breakthrough device designation in 2021. They claim that its RNA sequencing technology that utilizes AI and advanced algorithms to analyze the world’s largest gene expression data from over 600,000 samples, was originally developed out of research from the Los Alamos National Laboratory, “is clinically validated, fully automated, exclusively licensed by Viome [to analyze] biological samples at least 1,000 times greater than other technologies.” Release, Mobihealthnews, TechCrunch

Mid-week roundup: Optum buying Amedisys home care for $3.3B; Clover Health settles 7 shareholder lawsuits around SPAC non-disclosures; Walgreens cuts 2023 outlook, stock plummets 11%

June 28, 2023 | by

UnitedHealth Group expands home health again, aces out Option Care Health in all-cash deal. Amedisys had previously accepted Option Care’s all-stock deal in May valued at $97.38 per share. Optum’s offer is at $101 per share in cash, a dollar higher than its previous offer, creating a valuation for the company at $3.7 billion. Amedisys will add to UHG’s $5.4 billion acquisition of the LHC Group in February, including the hospital-at-home market from its acquisition of Contessa Health for $250 million in 2021. 

Option Care is a public (Nasdaq: OPCH) post-acute and home infusion care company for which Amedisys in-home care delivery would have been an exceptional fit. It was last heard from in August making a run at Signify Health for home health and ACO providers. At that time, the not-well-known company was discovered to have some impressive backing from Goldman Sachs. Walgreens Boots Alliance also backed the company but cut its stake in March and sold the rest for $330 million earlier this month. Option Care will receive a termination fee of $106 million. Healthcare Dive, FierceHealthcare

Insurtech Clover Health settles seven lawsuits around its 2021 SPAC. Clover, with Medicare Advantage plans in eight states, went public in January 2021 at the very peak of ‘blank check’-dom. Almost immediately, after an explosive report by Hindenburg Research that revealed that the Department of Justice (DOJ) had been investigating the company on investor relationships and business practices starting in fall 2020 [TTA 9 Feb 2021], there were multiple lawsuits filed by shareholders (derivative litigation) over not revealing this material fact. Shares took the expected dive from their intro of $15.90 to today’s $0.85. The seven derivative lawsuits were in Delaware, New York, and Tennessee courts and are being settled without payment. According to Clover’s release, “the defendants in the derivative lawsuits will receive customary releases and the Company will implement a suite of corporate governance enhancements. The settlement does not involve any monetary payment, other than payment of an award of fees and expenses to plaintiffs’ counsel, which has not yet been set. The defendants have denied all wrongdoing and have entered into this settlement to avoid the burden, expense, and distraction of ongoing litigation.” In April, Clover settled a securities class action in which the class will receive $22 million, $19.5 million paid by the company’s insurance. Mobihealthnews

Walgreens Boots Alliance missed Wall Street expectations and lowered its outlook for the year. In their Q3, net earnings fell 59% to $118 million, mostly due to lower operating income. Their topline was healthy–$35.4 billion, up 9% year over year–driven by the US health provider segment (VillageMD, Summit Health, and CityMD plus at-home care provider CareCentrix and specialty pharmacy Shields Health Solutions) which was up 22%. However, both retail consumer sales and CityMD underperformed due to the absence of COVID and a mild respiratory illness winter. Together with VillageMD’s clinic expansions, this led to an adjusted operating loss of $172 million for US Healthcare. WBA cut its earnings guidance for the year to $4.00 to $4.05 per share from its previous outlook of $4.45 to $4.65. Walgreens has been selling off businesses or investments that are peripheral to providing healthcare services, such as its investment in Option Care (above). FierceHealthcare, Healthcare Dive

News roundup: UHG closes $5.4B LHC deal, Teladoc’s record $13.7B ’22 loss, Olive AI divesting UM, Cigna exec can’t join CVS, VA anti-suicide program awards, Equiva-Infiniti ACP initiative, Newel Health’s Parkinson’s device

February 23, 2023 | by

UnitedHealth Group added more home care to its Optum unit with the close of the LHC Group deal on 22 February. Final cost was $5.4 billion or $170 per share of the now-delisted Nasdaq company. The acquisition was announced in March and survived two reviews: a request from the Federal Trade Commission (FTC) for additional information which held up the close past the original December date and a shareholder suit on ‘material nondisclosure’ in the SEC filing. FTC requested information on worker pay and ‘vertical harm’ on market competition, but did not proceed with further action prior to the closing. LHC Group serves 960 locations in 37 states, with 30,000 employees and revenue of $2.2 billion last year. The original announcement indicated that the Louisiana-based management team will be coming over to Optum Health and co-founders Keith and Ginger Myers will personally invest $10 million in UHG following the acquisition close. Interestingly, as of today (Thursday noon ET), neither company has announced the closing on their websites. Home Health News, FierceHealthcare  For those into value-based care, as previously noted, Optum is acquiring via LHC Imperium Health, a good-sized ACO, population health, and management services company. It’s another fit as Optum is a major physician group owner, many of whom are also in ACOs, and made LHC even more attractive. According to their website, Imperium now manages 16 ACOs and is in partnership with a large ACO group. 

Unsurprisingly, Teladoc notched a record loss for 2022– $13.7 billion on revenue of $2.4 billion. This included the Q1 2022 $6.6 billion write-off of the Livongo acquisition. On the investor call, company executives scaled down 2023 revenue forecasts to $2.55-$2.68 billion, which is about 9% growth. Teladoc remains at about 80 million members. The company’s ‘balanced growth’ plan to move toward profitability has already resulted in January’s announcement of 6% of staff being laid off and a reduced geographic footprint, presumably including real estate and leases. Healthcare Dive, HISTalk 2/24/23 which also cross-references the MedCityNews Livongo ‘lemon’ interview

Olive AI continues to shrink and juggle, with today’s announcement of their putting their utilization management service line up for sale. Earlier, they announced divesting their population health and 340B service lines to a sister company. The UM line buyer would take on the accounts and the 100-person staff. Olive AI is an automator of routine health system administration tasks such as these. Their pivot will be in automating revenue cycle management for health systems. Last week, Olive announced the release of 215 employees, about 35% of its remaining staff, in addition to its July layoff of 450 employees, then about 33% of staff. If this Editor’s calculations are correct, Olive is down to about 900 or less. Becker’s  Original report in Axios is paywalled, but indicates problems with the software’s efficacy, multiple executive departures, and a previous asset sale.

Yes, Virginia–non-competes ARE enforceable. So Amy Bricker, Cigna’s former head of pharmacy benefits unit Express Scripts, found out when she tried to join CVS as a senior executive as chief product officer for its consumer area, not Caremark which is a direct competitor. She had signed a two-year non-compete/non-disclosure barring her from any employment with any direct competitor. Cigna apparently imposes non-competes on only their most senior executives, a total of 16. This is a temporary restraining order from the US District Court for the Eastern District of Missouri to bar her from joining the company, duration unknown. Cigna had to post a $250,000 bond for possible future damages. FTC (again) is attempting to ban non-compete use both in future and retroactively. Restraining order, Healthcare Finance News, Healthcare Dive

Some blue side up news: 

  • Mission Daybreak Grand Challenge awarded by the VA. 10 companies were awarded $20 million to pursue digital health approaches to prevent veteran suicide as part of a 10-year VA initiative. The first-place winners were Stop Soldier Suicide and Televeda, awarded $3 million each. Healthcare IT News has additional details on all the finalists.
  • Digital health is leveraging an existing $14.2 billion FCC initiative called the Affordable Connectivity Program (ACP). Two companies, Equiva Health, a digital patient engagement and health relationship management solution provider, is partnering with internet provider Infiniti Mobile to create Equiva ACP Connect. The product configures tablets and mobile devices for care management and patient education distributed by hospitals, nursing homes, insurers, and other healthcare organizations. Release
  • Newel Health has received a grant from the Michael J. Fox Foundation to further development for Soturi, a digital therapeutic solution for Parkinson’s disease management. Soturi utilizes data collected from a wearable sensor, using an algorithm-based decision-making method, for personalized treatment. The project will be presented at the SINdem conference in Bressanone, Italy on 24th February. Release (PharmaPhorum)

Optum Labs creates and funds digital health research hub at Cornell Tech NYC

December 6, 2022 | by

Optum Labs, the research and development arm of Optum/UnitedHealth Care, is allying with Cornell University to create a collaborative health research hub at the university’s NYC-Roosevelt Island campus, Cornell Tech. The initiative, funded by Optum Labs, is targeted to develop precision behavioral health and advance equity. According to the release, it will drive innovative research in precision behavioral health, extended reality for aging in place, and equitable human and algorithmic decision-making. A large part of this is incorporating new types of health data from wearables and IoT devices, Also this joint venture will seek to create new types of remote intervention and care delivery using augmented reality and virtual reality actuation technologies with computational techniques. (Whew!)

The digital health hub will be led by Deborah Estrin, an Associate Dean and a Robert V. Tishman ’37 Professor at Cornell University, and Tanzeem Choudhury, Ph.D., Senior Vice President at Optum Labs, and a Roger and Joelle Burnell Professor in Integrated Health and Technology at Cornell University. The funding amount is not disclosed. To this Editor, this seems like an effort to restore the New York area as a digital health hub and regain momentum lost since 2020. Cornell release, 

Optum has been reaching out on multiple fronts. The RVO Health joint venture brought over media and Healthgrades doctor ratings [TTA 14 July], UHG inking a 10-year deal with Walmart Health starting with Florida locations, and of course the Change Healthcare wrap into OptumInsight [TTA 20 Sept, 4 Oct] though still being contested by DOJ post-closing. All a part of Keeping Up With the CVS Health/Aetnas, Walgreens/VillageMDs, Amazons, and fellow payers like Cigna and Elevance. HealthcareFinanceNews

VillageMD opens the Walgreens purse, set to buy Summit Health for $8.9B

November 9, 2022 | by

Moving from rumor to deal in a New York Minute. Primary care provider VillageMD has moved to a definitive agreement to acquire specialty/urgent care provider Summit Medical in an $8.9 billion deal including debt. This was heavily rumored last week [TTA 1 Nov]

This will create a provider behemoth of 680 provider locations, 750 primary care providers, and 1,200 specialty care providers in 26 markets. The fun facts:

  • VillageMD has 342 total primary care clinics in 22 southern and northeastern markets covering 15 states, with 152 co-located with Walgreens; these will eventually increase to 200.
  • Summit Health has 370 locations in New York, New Jersey, Connecticut, Pennsylvania, and central Oregon. VillageMD and Summit do not overlap (except in NJ) on markets.  
  • VillageMD consists of primarily owned and affiliated primary care practices; Summit Health specialty practices (neurology, chiropractic, cardiology, orthopedics, dermatology) plus 150 CityMD urgent care locations.
  • VillageMD has successfully mastered value-based care models in Medicare and entered advanced Medicare ACO models early and vigorously (Editor’s information). Summit Health presently is primarily is fee-for-service with some participation in value-based programs.

The participation in this one is interesting: 

  • Walgreens Boots Alliance (WBA) will invest $3.5 billion through an even mix of debt and equity 
  • Cigna’s health services organization Evernorth will become a minority owner; the exact percentage is not disclosed at this point
  • It’s not disclosed at this time whether Summit Health’s current majority owner, Walburg Pincus, will retain an interest in the combined companies. 

WBA remains the largest and consolidating shareholder of VillageMD, but with this acquisition, reduces its ownership share from approximately 62-63% to 53%. WBA’s other US non-retail healthcare interests include specialty pharmacy company Shields Health Solutions and at-home care provider CareCentrix.

Based on their release, the acquisition is expected to close in January 2023, subject to the usual Hart-Scott-Rodino Act (HSR) premerger notification and report with the DOJ and the Federal Trade Commission (FTC) that initiates a 30-day waiting period.

Bet on VillageMD and Summit closing deeper into Q1–but closing. This Editor’s over/under is that this is overly optimistic given the current DOJ and FTC’s scrutiny and apparent dislike of healthcare acquisitions, even though the provider groups don’t overlap except in a minor way in NJ. But perhaps Amazon, with a healthcare footprint primarily in pharmacy and shuttering Amazon Care, thought OneMedical would move smartly. CVS thought the same with Signify Health, yet both are on information Second Requests that extend the waiting period. DOJ is after all smarting hard with a Federal District Court nixing their challenge of UHG’s Optum with Change Healthcare, but it’s hard to throw typical antitrust at this one.

Go big or go home, indeed.     Healthcare Dive, Becker’s

Midweek heat wave roundup: GE Healthcare’s new name, hospital-to-home health trending big, over 2 million patient records hacked

July 20, 2022 | by

GE’s breakup into three public companies, announced last November [TTA 12 Nov 21], has been formalized with brand names. No surprise, the healthcare business has but a teeny tiny change to GE HealthCare (logo left) and after the spinoff will be trading sometime in early 2023 under GEHC on Nasdaq because “GE HealthCare will benefit from the exchange’s profile and track record as a market for innovative, technology-led public companies, particularly in the healthcare sector. The heritage ‘meatball’ (as we called it in marketing internally, but formally the Monogram) will be retained but the color will change from poison green to “compassion purple” to reflect more humanity and warmth and achieve greater distinction”. The hardest hit part of GE, the energy businesses, will be spun off as GE Vernova and key color an ‘evergreen’. What is left will be GE Aerospace, retaining its name and change its color to an ‘upper atmosphere’ blue that is almost black. Outer space, anyone? GE release, interview on YouTube

Au courant is hospital-to-home (H2H) and home health, digitally enabled mais bien sûr.

  • Mass General Brigham (MGB) is reportedly expanding its current 25-bed program to 200 in the next 2.5 years. Since 2016, MGB has treated nearly 1,800 H2H patients. By end of 2023, they plan 90 hospital-at-home beds managed across Massachusetts General Hospital, Brigham and Women’s Hospital, Newton-Wellesley Hospital, and Salem Hospital. Their new head for home-based care will be Heather O’Sullivan, who comes from EVP and chief clinical innovation officer spots at Kindred at Home, acquired by Humana in 2021. FierceHealthcare
  • Out in rural Wisconsin, Marshfield Clinic is rolling out a H2H program with DispatchHealth, to coordinate medical care for injuries and illnesses including viral infections, COPD exacerbations, congestive heart failure, and more. The goal is to reduce non-emergency ED visits. DispatchHealth can also perform services such as onsite diagnostics, mobile imaging, and CLIA-certified labs for kidney function, electrolytes, and urinalysis. In March 2021, they closed a $200 million Series D bringing their funding to unicorn level. HealthcareITNews
  • UHG’s Optum has moved closer on its $5.5 billion acquisition of LHC Group home health and hospice [TTA 31 Mar] with shareholder approval on 21 June. Once closed later this year, LHC will be integrated into Optum Health. LHC operates in 37 states and the District of Columbia, employing about 30,000 individuals. Home Health Care News, Becker’s

And what would a week with a heat wave that melts runways at RAF Brize Norton and Luton be without a couple of big data breaches to heat up things? Stolen: an iPad chock full of 75,000 Kaiser Permanente patients’ PHI from Kaiser’s Los Angeles Medical Center’s COVID-19 testing center. While the information on the iPad included first and last names, dates of birth, medical record numbers, and dates and location of service (but not SSN or financial information), Kaiser was able to remotely erase the data. At this point, there is no evidence of theft or misuse. NBC Los Angeles, Becker’s   An even larger breach of 2 million records came via a February hack attack on health provider debt collector Professional Finance Company (PFC). Hackers got into PFC’s computers and accessed patient names, addresses, SSN, health insurance, and medical treatment data. Among the 650 client companies affected were Banner Health and Nevada physician network Renown Health. Healthcare Dive

Wednesday news roundup: March telehealth claims down to 4.6%, state telehealth waivers expiring, UnitedHealth’s Optum bids for EMIS, Talkspace reportedly rejected Amwell, Mindpath bids

June 22, 2022 | by

Telehealth usage continuing its downward trend. At 4.6%, telehealth medical claims in March were off over 6% (0.3 points) versus February’s 4.9%. Again, 65% of claims were for mental health conditions, and social workers were the leading providers of telehealth at 32% for primarily one hour of psychotherapy at 26%. FAIR Health monthly US tracker.

One possible contributing factor is states pulling back on the broad telehealth provider location and other waivers (such as platforms) that were enacted during the Covid emergency. These waivers primarily permitted out-of-state providers. The expiration of waivers thus return telehealth delivery to in-state licensed providers unless covered by other regulations, for instance Medicaid. Last year, 26 states waived in-state licensure requirements; this year, only 12 states have these waivers. California and New Jersey are due to expire soon.  NBC News with a hat tip to HISTalk.

Optum bids to buy UK health software provider EMIS. The bid of £1.24 billion ($1.5 billion) was announced last Friday. A UK affiliate of Optum, Bordeaux UK Holdings II Limited, is the actual entity for the acquisition, recommended by the EMIS board. The offer is in cash and represents a 49% premium to the current share price. EMIS is a leading provider of software and systems to the NHS, serving primary care, community care and pharmacy, acute care, and the Patient.info website. When completed, EMIS would be UnitedHealth’s largest acquisition in the UK and Europe. FierceHealthcare 

Troubled telementalhealth provider Talkspace reportedly rejected a bid from Amwell pretty much out of hand, leading to speculation that it’s up for sale but being picky-picky-picky.  According to the report in Behavioral Health Business, from Seeking Alpha, their talks did not even reach number discussions. This is after Talkspace rejected another bid in May from another telementalhealth provider Mindpath, backed by Centerbridge Partners and Leonard Green & Partners. Sources were split on whether $500 million was offered or not (Axios).

Talkspace is one of the poster children for Cracking SPACs. It hit the market in January 2021 at a valuation of $1.4 billion, opening above $8, hitting a peak of about $11 per share. Share price declined to as low as $1.06 before rising on this acquisition talk to $1.58. Current valuation is $58 million, but it is sitting on a reported $184 million in cash. Reportedly their CEO search is going nowhere. Much like Teladoc, one year after their SPAC, investor lawsuits were filed against the company for misleading investors. Look for Talkspace to be sold over the summer.

Thursday roundup: UHG/Optum, Change extend merger deadline to 31 Dec, buys Kelsey-Seybold; $2B Tivity Health sale; General Dynamics enters derm AI diagnostics; MobileHelp PERS sold to Advocate Aurora

April 7, 2022 | by

UnitedHealth Group’s Optum unit and Change Healthcare, to no one’s surprise, have cast the die and extended their merger deadline to 31 December. Originally, the acquisition was to be completed at end of 2021 and later pushed to 5 April.

In a joint release, they touted their shared vision for a “simpler, more intelligent and adaptive health system for patients, payers and providers”. Backing this up is a break fee of $650 million from Optum to Change Healthcare in the event the court scuppers the deal.

On 25 February, the US Department of Justice filed a lawsuit in US District Court in Washington, DC to stop the acquisition on anti-competitive grounds [TTA 25 Feb]. UHG/Optum and Change, despite divestitures, could not evade DOJ’s reasoning that Optum was buying its only major competitor in areas such as hospital claims data, claims processing, claims editing, and EDI clearinghouse, which facilitates the transfer of electronic transactions between payers and physicians, health care professionals, or facilities. Less than a month later, Optum and Change responded, contesting the charges in that same District Court, and contending that it would be ‘economic suicide’ for Optum to be anti-competitive, since Optum’s business model is dependent on payers other than UnitedHealth. Fighting rather than switching off the deal, it’ll be heard on 1 August [TTA 23 March]. FierceHealthPayer, 

As noted last week, Optum is writing big checks for LHC Group home care/management services and Refresh Mental Health. This week’s jumbo buy is the Kelsey-Seybold Clinic of Houston. This is a multi-faceted operation with multiple multi-specialty care centers, a cancer center, a women’s health center, two ambulatory surgery center locations, and a 30-location specialized sleep center. It also has a highly regarded ACO and KelseyCare Advantage, a 5 Star Medicare Advantage plan, in addition to partnering with insurers on commercial value-based health plans. If it closes, Optum will be more than likely well over its goal of owning or controlling over 5% of US providers. Terms were not disclosed, but TPG’s private equity arm made a minority investment in Kelsey-Seybold two years ago. At the time, the valuation was rumored to be $1.3 billion.

Tivity Health is being acquired by funds managed by Stone Point Capital for $2 billion. The $32.50 per share is a 20% premium to the 90-day price average, which reflects its 40% financial share growth in the past year. Having sold its original name of Healthways and a sizable chunk of its original business to the digital health conglomerate Sharecare, it rebranded in 2017 as Tivity and concentrated on fitness businesses: senior-targeted SilverSneakers, gym chain Prime Fitness, and alternative/complementary medicine WholeHealth Living. Closing is anticipated to be Q3. CEO Richard Ashworth will remain with the company, and headquarters stay in Franklin, TN. Release, Becker’s

A palate cleanser: a division of defense/aerospace giant General Dynamics, General Dynamics Information Technology (GDIT) has developed an AI diagnostic for remote dermatologic use for the active service/veteran market. It classifies images of skin lesions, determines if they are indicative of skin disease, and will recommend follow-up care. According to the GDIT release, “the GDIT skin lesion classifier tool won third place in the VA National AI Tech Sprint 2020-2021, a competition organized by the Department of Veterans Affairs (VA) National Artificial Intelligence Institute (NAII) to match private sector talent with veterans, VA clinicians and other experts to brainstorm AI-based solutions that can improve veteran health and well-being.” Also Healthcare IT News

MobileHelp, one of the earliest mobile PERS, and sister company Clear Arch Health, a remote patient monitoring provider, have been purchased by Advocate Aurora Enterprises. Terms were not disclosed, but management will remain in place in Boca Raton. MobileHelp was private, so estimates of valuation are difficult, but their private equity backing included ABRY Partners and Topmark Partners (Crunchbase). Their PERS market claimed 300,000 households. Clear Arch had a separate clinical base with provider care management of chronic condition patients connected to EHRs. For AAE, a division of Advocate Aurora Health systems in Illinois and Wisconsin, MobileHelp’s acquisition will complement their recently acquired home health provider Senior Helpers and Xhealth clinical digital solution ordering. The traditional PERS and call center business continues to be of interest, but blending into other businesses. Release, Healthcare IT News