TTA’s April Showers 3: UHG damp financials, Change hack, House grilling; Cerebral hands over $7M; VA may restart Cerner EHR implementation; NeueHealth gets $30M from NEA; TandemStride debuts trauma survivor app, more!

April 19, 2024 | by | No Comments

 

 

Another packed week, with a few baffling events. Leading in bafflement is NeueHealth’s additional $30M from NEA, which now owns 60%. UHG battling on multiple fronts between the Change hacking and the House, Walgreens lays off more to cut costs, VillageMD sued on ad trackers, and Cerebral’s comeuppance costs $7.1M. VA may restart Oracle Cerner implementation, Epic and Particle Health feud. But restoring faith in health tech benefiting a neglected group is TandemStride. 

TandemStride launches platform to assist survivors of traumatic injury; a personal look (A real care gap)
News roundup: Congress hammers absent UHG on Change cyberattack–and more; 10% unhinged at Hinge Health; Steward Health nears insolvency; Two Chairs $72M Series C (UHG’s troubles cover the waterfront)
ISfTeH student contest and award 2024–deadline 26 April! (Move fast!)
Mid-week short takes: UnitedHealth’s $1.2B Q1 loss from Change attack, another Walgreens layoff, Dexcom-MD Revolution partner, Kontakt.io $47.5 raise, GeBBS Healthcare may sell for $1B (Walgreens still downsizing–what’s next)
News roundup: VillageMD sued on Meta Pixel trackers; Cerebral pays $7.1M FTC fine on data sharing, cancellation policy; VA may resume Oracle Cerner implementation during FY2025; Epic-Particle Health dispute on PHI sharing (Cerebral still in trouble)
The New Reality, Bizarro World version: NeueHealth gets $30M loan increase from NEA, now majority owner (Baffling)

This packed week was about righting listing ships. Teladoc’s CEO suddenly departs, Amwell at risk of a NYSE delisting–we look at What Happened and what needs to be done. VillageMD gets new COO to manage the shrinkage. And Change Healthcare data on sale from disgruntled ALPHV affiliate. Digital health funding continues to limp along. Clover looks at another delisting, Walmart Health applies the brakes. And we highlight innovations from Novosound, Biolinq, Eko, Universal Brain. 

Digital health’s Q1 according to Rock Health: the New Reality is a flat spin back to 2019 (Limping, but alive)
VillageMD names new president and COO as it shrinks to 620 locations (Ex Centene, Humana exec comes out of short retirement to clean up)
News roundup: Now Clover Health faces delisting; BlackCat/ALPHV affiliate with 4TB of data puts it up for sale; $58M for Biolinq’s ‘smallest blood glucose biosensor’ (Will UHG pay more ransom?)
Opinion: Further thoughts on Teladoc, Amwell, and the future of telehealth–what happens next? (A hard look at the follies, mistakes, and saving ships)
News roundup: Amwell faces NYSE delisting; Walmart Health slows Health Centers, except Texas; Novosound’s ultrasound patent; Eko’s Low EF AI; Universal Brain; Elizabeth Holmes in ‘Dropout’ + update
Teladoc CEO Jason Gorevic steps down immediately in shock announcement (Now what?)

A damp start to April leads with puzzling news. NeueHealth loses plans and big money in ’23–but gives a big bonus to its CEO. Cano Health reorganizing or selling by June. ATA kicks DOJ about expediting controlled substance telehealth regs. Apple keeps kicking around the ‘Davids’, but Davids won’t stop slinging either. And if you work with a PR or marketing agency, our Perspectives has some advice for you.

More New Reality: NeueHealth (Bright Health) CEO’s $1.9M bonus, 2023 financials–and does Cano Health have a future? (Two stories gone way sideways)
ATA requests expediting of revised proposed rule on controlled substance telehealth prescribing; announces Nexus 2024 meeting 5-7 May (DEA needs to get moving now, not later)
Davids (AliveCor, Masimo) v. Goliath (Apple): the patent infringement game *not* over; Masimo’s messy proxy fight with Politan (updated) (Seeing value in Masimo?)
Perspectives: Working with a PR Agency–How to Make the Most of the Partnership (Expert advice if you manage communications)

It was a pre-Easter week that started as quiet and got VERY LOUD at the end. Walgreens took the hard road, writing down VillageMD even before the closures were final and lowering forecasts. An important metastudy+ casts doubt on the efficacy of present digital health diabetes solutions but provides solid direction forward. And it’s definitely an early sunny spring for funding, but there’s continued bad weather forecast for UnitedHealth Group and Oracle Cerner’s VA implementation.

Facing Future 2: Walgreens writes down $5.8B for VillageMD in Q2, lowers 2024 earnings on ‘challenging’ retail outlook (Biting bullet early and hard)
Short takes: PocketHealth, Brightside fundings; VA OIG reports hit Oracle Cerner; Change cyberattack/legal updates; UHG-Amedisys reviewed in Oregon; Optum to buy Steward Health practices (UHG carries on as does company funding)
Can digital health RPM achieve meaningful change with type 2 diabetics? New metastudy expresses doubt. (Major digital health findings from PHTI)

This week’s Big Quake was DOJ’s antitrust suit against Apple for smartphone monopoly and control over apps. Another quake: 2023 data breaches were up 187%–when a medical record is worth $60, it’s logical. Early-stage funding and partnerships are back with a roar when AI’s in your portfolio. And Walgreens shrinks both VillageMD and distribution.

2023 US data breaches topped 171M records, up 187% versus 2022: Protenus Breach Barometer (And that was LAST year!)
Why is the US DOJ filing an antitrust lawsuit against Apple–on monopolizing the smartphone market? (One wonders)
Mid-week roundup: UK startup Anima gains $12M, Hippocratic AI $53M, Assort Health $3.5M; Abridge partners with NVIDIA; VillageMD sells 11 Rhode Island clinics; $60 for that medical record on the dark web (Funding’s back and AI’s got it)
Walgreens’ latest cuts affect 646 at Florida, Connecticut distribution centers (More in next week’s financial call)

A lighter week with the Change hacking starting to recede (pharmacy back up on Wed 13 March) and most industry types at HIMSS, we caught up with the first VA go-live in a year, Dexcom’s cleared OTC CGM, WebMD doubles down on health ed with Healthwise buy, Centene may sell abandoned HQ building. And Friday’s news is on a big cyberattack of an NHS Scotland region.

Weekend roundup: NHS Dumfries (Scotland) cyberattacked; delisted Veradigm’s strong financials; One Medical NY patients’ coverage clash; Suki voice AI integrates with Amwell; Legrand and Possum extended; Zephyr AI’s $111M Series A

News roundup: Cerner goes live at VA, DOD Lovell Center; WebMD expands education with Healthwise buy; Dexcom has FDA OK for OTC glucose sensor; Centene may have buyer for abandoned Charlotte HQ (Back to normal news!)
Updates on Change cyberattack: UHG’s timeline for system restorations, key updates around claims and payments in next weeks (updated) (Saving the analysis for later)

The Change Healthcare/Optum cyberattack entered a second week with no restoration of services in sight; how providers and pharmacies are coping without their primary means of processing patient claims and furnishing care–and the psychological toll; and the uncertain future of Walgreens, WBA, and the rapid downsizing of their provider arm, VillageMD. To add further insult to UHG, now DOJ is putting them under antitrust scrutiny.

Is BlackCat/ALPHV faking its own ‘death’? (updated) HHS and CMS come to Change affected providers’ assistance with ‘flexibilities’
Update: VillageMD lays off 49 in first two of six Village Medical closures in Illinois
Reality Bites Again: UHG being probed by DOJ on antitrust, One Medical layoffs “not related” to Amazon, the psychological effects of cyberattacks
Facing Future: Walgreens CEO moves company into strategic review–will he get WBA board alignment? (‘Go big’ now in reverse)
Week 2: Change Healthcare’s BlackCat hack may last “for the next couple of weeks”, UHG provides temp funding to providers, AHA slams it as a ‘band aid”–but did Optum already pay BlackCat a $22M ransom? (updated) (When will it end? Providers. staff, and patients are hurting)

Three major stories lead this packed week. Change Healthcare’s and Optum’s week-long struggle to get 100 or so BlackCat hacked systems up and running again for pharmacies and hospitals–no end in sight. Walgreens keeps closing Village MD locations–up to 85. But the funding freeze seems to be thawing, with M&A and lettered funding rounds suddenly poking through like daffodils–though the structure of one (Dario-Twill) is puzzling and another may be contested (R1 RCM). And Veradigm finally delists–while buying ScienceIO.

BlackCat is back, claims theft of 6TB of Change Healthcare data (Latest breaking news)

Breaking: VillageMD exiting Illinois clinics–in its home state–as closures top 80 locations (Something not good in the Village)
Short takes on a springlike ‘defrosting’: Redi Health’s $14M Series B, Dario Health buys Twill for ~$30M (About time for a Spring thaw)
Roundup: Walgreens’ new chief legal officer; Digital Health Collaborative launched; fundings/M&A defrosting for b.well, R1 RCM, Abridge, Reveleer; Veradigm likely delists, buys ScienceIO–mystery? (updated)
Change Healthcare cyberattack persists–is the BlackCat gang back and using LockBit malware? BlackCat taking credit. (update 28 Feb #2) (100 systems down, BlackCat’s back)

Have a job to fill? Seeking a position? See jobs listed with our new job search partner Jooble in the right sidebar!

Read Telehealth and Telecare Aware: https://telecareaware.com/  @telecareaware

Follow our pages on LinkedIn and on Facebook

We thank our advertisers and supporters: Legrand, UK Telehealthcare, ATA, The King’s Fund, DHACA, HIMSS, MedStartr, and Parks Associates.

Reach international leaders in health tech by advertising your company or event/conference in TTA–contact Donna for more information on how we help and who we reach. 

Telehealth & Telecare Aware: covering the news on latest developments in telecare, telehealth, telemedicine, and health tech, worldwide–thoughtfully and from the view of fellow professionals

Thanks for asking for update emails. Please tell your colleagues about this news service and, if you have relevant information to share with the rest of the world, please let me know.

Donna Cusano, Editor In Chief
donna.cusano@telecareaware.com

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

News roundup: VillageMD sued on Meta Pixel trackers; Cerebral pays $7.1M FTC fine on data sharing, cancellation policy; VA may resume Oracle Cerner implementation during FY2025; Epic-Particle Health dispute on PHI sharing

April 16, 2024 | by | No Comments

It’s all about personal health data–sharing, bad sharing, and bad transfers in this roundup.

VillageMD takes another hit, this time on Meta Pixel ad tracker issues. A class-action lawsuit filed on 10 April charges VillageMD (formally Village Practice Management Company), via its Village Medical website, of using the Meta Pixel ad tracker for disclosing user-protected health information (PHI) and other identifiable information generally classified as PII. This included visitors to their website villagemedical.com seeking information and patient users of Village Medical’s web-based tools for scheduling and the patient portal. The lawsuit by a “John Doe”, a patient since January 2023 resident in Quincy, Massachusetts but brought by three Midwest law firms in the US District Court for the Northern District of Illinois, states that VillageMD used trackers that transferred this personal information to Meta Networks’ Facebook and Instagram, as well as other third parties like Google, for use in targeted advertising, in violation of HIPAA and other regulations. The lawsuit seeks 1) an injunction stopping Village Medical from using ad trackers and 2) monetary redress via damages–actual, compensatory, statutory, and punitive for the entire affected class. The suit also alleges that VillageMD violated its own internal procedures. Crain’s Health Pulse, Healthcare Dive

Readers will recall that in June 2022, STAT and The Markup published a study and follow-ups on Meta Pixel and ad tracker use by healthcare organizations. Ostensibly, the ad trackers were there to better track website performance and to tailor information for the patient [TTA 17 June, 21 June 2022], but they sent information to third parties that violated HIPAA and privacy guidelines. Ad trackers were also monetized. Meta blamed the health systems [TTA 16 May 2023] for misuse though they used the data for ad serving.  Congressional hearings, FTC, and DOJ followed later in 2022 and 2023. Multiple class action lawsuits against providers large and small have ensued. Providers have pushed back on FTC and HHS rules on ad trackers, stating the restrictions hamper their ability to build better websites based on customer usage and to serve individuals with useful information. 

Another ‘oversharing’ company, troubled telemental Cerebral, whacked with $7.1 million FTC fine on disclosing consumer information via ad trackers plus ‘negative option’ cancellation policy. The proposed order for a permanent injunction filed by the Department of Justice (DOJ) and docketed on 15 April has to be approved by the Federal District Court for the Southern District of Florida. The fine for the company only penalized the following:

  • Cerebral released 3.2 million consumers’ information to third parties such as practices, LinkedIn, and TikTok. This included PHI and PII such as names, medical histories, addresses, IP addresses, payment methods including insurance, sexual orientation, and more. Even more outrageously, they also used the mail for postcards that had sensitive information such as diagnosis printed on them. The insult on injury was that Cerebral failed to disclose or buried information on data sharing to consumers signing up for their ‘safe, secure, and discreet’ services. Cerebral now has to restrict nearly all information to third parties.
  • Cerebral also set up their service cancellation as a ‘negative option’ cancellation policy, which in reality meant that it was renewed indefinitely unless the customer took action to cancel. It was not adequately disclosed in violation of the federal Restore Online Shoppers’ Confidence Act (ROSCA). Then Cerebral made it extremely difficult to cancel by instituting a complex procedure that required multiple steps and often took several days to execute. They even eliminated a one-step cancel button at their then-CEO Kyle Robertson’s direction. The order requires this to be corrected including deleting the negative option.
  • Former employees were not blocked from accessing patient medical records from May to December 2021. It also failed to ensure that providers were only able to access their patients’ records.

Cerebral’s settlement with the FTC and DOJ breaks down to $5.1 million to provide partial refunds to consumers impacted by their deceptive cancellation practices. They also levied a civil penalty of $10 million, reduced to $2 million as Cerebral was unable to pay the full amount. The decision and fine do not cover charges to be decided by the court against the former Cerebral CEO Robertson due to his extensive personal involvement in these practices. Those have not been settled and apparently were severed from the company as a separate action (FTC case information). Since 2022, Mr. Robertson has consistently blamed company management and investors for pushing for bad practices such as prescribing restricted stimulant drugs. Cerebral countersued him for defaulting on a $49.8 million loan taken in January 2022 to buy 1.06 million shares of Cerebral common stock. More to come, as the order also does not address other Federal violations under investigation, such as those under the Controlled Substances Act.  FTC release, FierceHealthcare  

VA to possibly resume Oracle Cerner EHR implementation at VA sites before the end of FY 2025, even if not in budget. During House Veterans’ Affairs Committee hearings on FY 2025 and 2026 budgets, VA Secretary Denis McDonough last Thursday (11 April) said that the VA intends to resume deploying the Oracle Cerner EHR as part of VA’s Electronic Health Records Modernization (EHRM) before the end of FY 2025. As Federal years go from October to September, FY 2025 starts October 2024 and ends September 2025. When asked if VA plans to maintain the “program reset” as they termed it in April 2023 for all of FY25, Secy. McDonough said that “we do not.”However, there is no budget allocated for additional implementations in either FY. The plan is to use carryover funding.

Oracle Cerner’s Millenium EHR was implemented at five VA locations before suspending in April 2023 for a massive re-evaluation which involved reworking systems such as the Health Data Repository which created critical scheduling and pharmacy problems detailed by the Office of Inspector General (OIG)  [TTA 28 Mar]. The joint VA and MHS/Genesis Lovell FHCC implementation, which went live in March, is not included.  NextGov/FCW, Healthcare Dive

And in another dispute about data sharing, leading EHR Epic cut off requests made by some Particle Health customers, expressing concern about privacy risks. Particle Health is a health data exchange API platform for developers. Both Epic and Particle are part of Carequality, a large scale data exchange group that connects 600,000 care providers, 50,000 clinics, and 4,200 hospitals to facilitate the exchange of patient medical records On 21 March, Epic filed a dispute with Carequality that some of Particle’s users “might be inaccurately representing the purpose associated with their record retrievals.” and stopped responding to some Particle Health customer queries. This has now degenerated into a ‘who said what‘ dispute, with Particle and their CEO alleging that Epic implied that it completely disconnected Particle Health and its customers from Epic’s data, while Epic has said that after a review by its 15-member Care Everywhere Governing Council, they flagged three companies who were using Particle’s Carequality connection to access data not related to patient care or treatment. There’s also a larger concern being brought up by providers on the use of these mass data exchanges for fraudulent extraction of data or use that would violate HIPAA guidelines. FierceHealthcare, CNBC, Becker’s, Morningstar

FTC, HHS OCR scrutiny tightens on third-party ad trackers, sends letter to 130 hospitals and telehealth providers

July 27, 2023 | by

If you’ve checked on your legal department, they may resemble Pepper (left). Hospitals and telehealth companies have been put on notice by letter agencies HHS Office for Civil Rights (OCR) and the Federal Trade Commission (FTC) that personal health information–not just protected health information (PHI) covered by HIPAA–that can be transmitted to third-parties by ad trackers like Meta Pixel is now forbidden, verboten, not permitted. In the joint statement by OCR and FTC, hospitals, providers, and telehealth providers were explicitly told that use of these online trackers is being equated with violations of consumer privacy. Their release specified “sensitive information” such as health conditions, diagnoses, medications, medical treatments, frequency of visits to health care professionals, and where an individual seeks medical treatment. Hospitals and telehealth companies also cannot plead ignorance of what their developers did, as the responsibility is being put squarely on them to monitor the data going to third parties out of websites and apps. 

“The FTC is again serving notice that companies need to exercise extreme caution when using online tracking technologies and that we will continue doing everything in our powers to protect consumers’ health information from potential misuse and exploitation.” Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, said. At OCR, which historically had its hands full with HIPAA violations and data breaches, their scope has broadened. “Although online tracking technologies can be used for beneficial purposes, patients and others should not have to sacrifice the privacy of their health information when using a hospital’s website,” said Melanie Fontes Rainer, OCR Director. “OCR continues to be concerned about impermissible disclosures of health information to third parties and will use all of its resources to address this issue.” Both HHS and FTC can take action without the time-consuming legal actions that DOJ must undertake.

True to FTC’s renewed use of the 2009 Health Breach Notification Rule, the letter sent to 130 hospital systems and telehealth providers came down hard on anything that could be interpreted as personal health information. Even for health organizations not covered by HIPAA, the letter is explicit on their obligation to protect against disclosure to third parties and to monitor the flow to third parties even if not used for marketing. Without explicit consumer authorization, it can “violate the FTC Act as well as constitute a breach of security under the FTC’s Health Breach Notification Rule.” Previous TTA coverage on third-party trackers and FTC actions here. Health IT Security

Between the DOJ and FTC alone, with actions on ad trackers and changes to antitrust guidelines, they have made the spring and summer of 2023 a most interesting and busy one for hospital and healthcare company legal departments. It’s even more amazing that given this background and on notice, Amazon just keeps flouting basic regulations about health information usage, such as for Amazon Clinic–which to date has not rolled out. TTA 27 June

FTC, DOJ float enhanced information requirements for HSR premerger notification filing process–what will be M&A effects?

June 29, 2023 | by

FTC, DOJ are now coming after M&A–and you thought they were tough before? New information disclosure requirements proposed by the US Federal Trade Commission (FTC) and the Department of Justice (DOJ) Antitrust Division for mergers and acquisitions that fall under the Hart-Scott-Rodino Act (HSR) may put a damper on an already stagnant business area. On Tuesday 27 June, FTC, notably taking the lead with the concurrence of DOJ, released multiple proposed changes to the premerger notification filing process, the most extensive since they were first published in 1978 after HSR was passed in 1976. HSR premerger notification is required for transactions that exceed the threshold currently set at $111.4 million.

These changes will be formally submitted for the standard 60-day public review and comment later this week in the Federal Register. Changes are typically made after that time before final rules are published, a process that may take months.

From FTC’s release, the proposed changes fall under these areas.

  • Provision of details about transaction rationale and details surrounding investment vehicles or corporate relationships.
  • Provision of information related to products or services in both horizontal products and services, and non-horizontal business relationships such as supply agreements.
  • Provision of projected revenue streams, transactional analyses and internal documents describing market conditions, and structure of entities involved such as private equity investments.
  • Provision of details regarding previous acquisitions.
  • Disclosure of information that screens for labor market issues by classifying employees based on current Standard Occupational Classification system categories.
  • These proposed changes also address Congressional concerns that subsidies from foreign entities of concern [North Korea, China, Russia, and Iran–Ed.] can distort the competitive process or otherwise change the business strategies of a subsidized firm in ways that undermine competition following an acquisition.

The National Law Review goes into far more detail on exactly what additional information will be required. This includes disclosure of what foreign jurisdictions are reviewing the deal. The rationale for the changes is that transactions have become far more complex since the original requirements were set and that the additional information will “more effectively and efficiently screen transactions for potential competition issues within the initial waiting period, which is typically 30 days.” According to FierceHealthcare, the FTC said it expects the proposed changes will take merging entities 144 hours per filing, up from the current 37-hour average. It’s clear that the mountain of information already needed to file a pre-merger notification and the time needed to gather such information will be much higher, perhaps to months and reveal far more than perhaps some companies want to disclose.

For those surprised that FTC is taking the lead on this, this once-sleepy agency woke up late last year in a heckuva bad humor and is now (more…)

Monday roundup: Envision files Ch. 11, who’s to blame for Meta Pixel abuse?, CVS Health to shut clinical trials unit, Amino Health scoops $80M, DocGo flat but optimistic, Owlet way down in revenue

May 16, 2023 | by

What was envisioned last week came to pass for Envision Healthcare on Sunday. The hospital and physician staffing company filed for Chapter 11 reorganization five years after it was taken private by investment company KKR. At the time of that massive buyout, the value of the company was pegged at $10 billion. Things started to go south for Envision after 2020 with the pandemic drying up patient volumes for two years, with the added factors of regulations kicking in on ‘no surprise’ billing, inflation, staffing shortages, and major fights with health plans around out-of-network inflated charges plus a huge claims dispute with UnitedHealthcare [TTA 12 May]. Ironically, Envision won the main dispute with UHG; that $91 million won in arbitration in an insider’s view would have staved off the bankruptcy this year.

KKR will apparently lose its $3.5 billion equity in the company as $8 billion in debt restructuring takes place. What’s before the court is that the Envision staffing operation will be separated from the AmSurg surgical clinics. Senior lenders will have their debt rearranged into equity into one or the other company. Junior lenders, bondholders, and KKR will receive zero, or as we say locally, bupkis. It’s envisioned (sic) that the restructuring will take about three to four months.  Financial Times, Envision release

The hospitals, that’s who! If you believe Meta, it’s the hospitals that abused those poor Pixels, making them do things against their wishes to tattle all sorts of PHI and PII to Big Bad Meta which sends patients all those Nasty Intrusive Ads. Meta is being sued by parties from the ACLU to patients in class action lawsuits on how the Pixel was used on hospital patient portals and scheduling websites. Meta’s argument is that the health systems’ developers could but did not control how the ad trackers were used and that “Meta did not implement or configure” the Pixels used on the health systems’ websites. In fact, Meta claims that they have filtering tools that screen out sensitive data and that would alert the developer. “It’s ultimately the developer, not Meta, that controls the code on its own website and chooses what information to send,” according to the May 5 filing in that busy US District Court of Northern California.

This could influence outcomes in the multitude of lawsuits being filed against health systems like Kaiser Permanente, UCSF Health, and LCMC Health in New Orleans plus Willis-Knighton Health in northwest Louisiana (Healthcare Dive). If the District Court finds that Meta, and possibly other ad trackers such as those from Google, Twitter, or Bing were not inherently liable for personal health data violations that monetized PHI, then the health systems are 100% on the hook for the data breaches (or ‘wiretapping’ in a creative use of terminology). It also makes the potential paydays possibly less lucrative–in the eyes of this Editor, as Meta and Google have far deeper pockets than any ol’ health system. SC Media, Paubox   The Meta Pixel backstory here

CVS Health to shut its clinical trials unit by December 2024. CVS, like Walgreens and Walmart, jumped into the clinical trials business during the Covid-19 pandemic, seeing a need in the market with pharmaceutical companies and a ready-made, 100 million deep diverse base of patients among their pharmacy users. CVS cited to Healthcare Dive that the shutdown was to better concentrate on core business. Current active trials on the website include narcolepsy, rheumatoid arthritis, and kidney health. No disclosure as to profitability but CVS has a lot to digest with new buys Signify Health and Oak Street Health.

Amino Health’s $80 million funding is a bright spot in this sideways spring. With a digital guidance model that works with employers and health plans to help 1.6 million members navigate their care, their new funding will be used for technology scaling. Equity and debt financing were led by Transformation Capital, which will be joining the Amino board, and Oxford Finance LLC. Amino is being boosted by the Federal Transparency in Coverage (TIC) Rule which makes pricing disclosure a key part of plan navigation. Amino originally started with a direct-to-consumer model but shifted to enterprise, including brokers and third-party administrators. Amino’s total raise is now $125 million (Crunchbase). Mobihealthnews, Amino release

DocGo’s two services, mobile health and medical transport, essentially swapped revenue this quarter in a better-than-average picture. Their mobile health services area in Q1 fell 19% to $72.9 million from $90.1 million in Q1 2022, while transportation services grew 44% to $40.1 million from $27.8 million in Q1 2022. This added to total revenue of $113 million with a net loss of $3.9 million. Their 2023 revenue guidance remains at $500-$510 million with adjusted EBITDA guidance of $45-$50 million. 

What’s promising here is that it’s a SPAC that didn’t crack like practically every other. DocGo pointed out in their release that they have a backlog of $205 million in total contract value over approximately three years and they have doubled their RFPs. Their patient target for 2023 is 50,000. Share price today on Nasdaq ticked up to $8.77. Considering their high last year of $11.08, they are not doing badly in this time at all. Mobihealthnews .We last saw DocGo providing mobile clinics in a Tennessee pilot with Dollar General [TTA 24 Jan] which now is tied in with the state of Tennessee, plus a pilot in NY and NJ with Redirect Health. They provide services in 26 states and the UK.  

This Editor is trying to be as cheerful as the baby at left about baby sock/monitor Owlet, which has had a rough ride in the past two years. Their revenue dropped to $10.7 million in Q1 2023 versus $12 million in Q4 2022 and $21.5 million in Q1 2022. Owlet ended 2021 with a nastygram from the FDA that pulled their original Smart Sock off the market [TTA 4 Dec 2021] but rebounded early in 2022 with the Dream Sock and Dream Duo [TTA 16 Feb 2022] that avoided the claims that sent them into 510(k) Marketing Neverland.  Still, they were delisted by the NYSE in December 2022. On the positive side, Owlet wound up 2022 with $69.2 million in revenue and a good-sized private placement of $30 million in February [TTA 18 Mar]. It has submitted to FDA for two products, including the steep de novo climb on an enhancement to the Dream Sock. Now a much smaller company than it was last year, they have reduced operational expenses to $15.1 million from $24.1 million in Q4 2022 to get to breakeven by end of this year and to be relisted on the NYSE in the future. Having followed them since the early ‘telehealth for the bassinet set’ days of 2012-2013, this Editor wishes them bonne chance. Owlet release, Mobihealthnews

Week-end roundup: Cano Health’s $60M loss and divesting, Oscar Health exits CA, UCSF Meta Pixel lawsuit narrows, Syneos goes private for $7.1B, Envision nears Ch. 11, Australia’s A$429M EHR modernization funded

May 12, 2023 | by

Cano Health’s Q1 was not a cheerful one, what with a board fight, the Cano 3 resigning and nailing a long list of grievances to the door, and a new chairman of the board, Sol Trujillo, who specializes in turnarounds. The results bore out the Cano 3’s concerns, with a $60.6 million net loss versus 2022’s barely-there $100,000. Revenue increased 23% to $866.9 million but per member per month (PMPM) revenue fell 13%, driven by a higher proportion of non-Medicare members but partially offset by membership growth: 388,667 including 207,420 Medicare capitated members, an increase of 44% and 29% year-over-year. Adjusted EBITDA was only $5 million, compared to $29.2 million in Q1 2022. What’s being divested to improve cash flow are the proverbial ‘non-core assets’ which are outside of Medicare Advantage–a complaint of the Cano 3 who noted things like family self-dealing and a murky relationship with a Miami claims recovery outfit. Cano also raised 2023 forecasts for membership and total revenue, but no mention of growth in medical centers. Cano earnings release, Healthcare Dive, Digital Health Business

In other slimming-down news, Oscar Health will exit its exchange plans within Covered California at the end of the year. While they have 35,000 members, their medical loss ratios (MLR) are over 100% versus the desired 80%. (MLR, a key metric in exchange plans, is defined as the proportion of total paid medical service claims and all quality improvement activities together, then dividing that number by the total premium revenue minus all allowable deductions. New CEO Mark Bertolini says they will return when Oscar reshapes their product offerings and strategy. This Editor hears a heavy boot drop. Healthcare Dive

Lawsuits of health systems on Meta Pixel being used to send private patient information to Facebook and other third-party advertisers are now rolling through the courts. The class action against University of California San Francisco (UCSF) Health just got a little narrower. Judge William Horrick of the US District Court for the Northern District of California granted defendant UCSF Health’s motion to dismiss several plaintiff claims. As a public entity, UCSF argued that the “unjust enrichment” claims were invalid. ‘Jane Doe’s’ lawyers representing the class of patients have a deadline of 30 May to amend the breach-of-contract claim. Health systems caught up in the ad pixel mess should follow this closely, though Becker’s seems to be the only news coverage. Our coverage of Meta Pixel

And in other healthcare news from two ends of the spectrum:

  • Biopharma contract research organization (CRO) Syneos Health will be going private in a $7.1 billion deal.  Elliott Investment Management, Patient Square Capital, and Veritas Capital are leading the cash buyout for $43.00 per share, a tidy 24% premium to the 13 February closing price, which is a somewhat unusual delay but apparently due to heavy media speculation around it. Syneos was formed in the merger of two large CROs, InVentiv Health and INC Research, and as a public company has been on the share price roller coaster, though the category is considered to be highly attractive for investment to improve the odds of biopharma success.  The deal is expected to close in the second half of the year. Syneos release, Healthcare Dive
  • Healthcare staffing company Envision Healthcare envisions filing a Chapter 11 bankruptcy soon, according to a Wall Street Journal report. They are carrying about $7 billion in outstanding debt, ongoing and costly legal spats with UnitedHealthcare, and has had difficulty finding physicians and nurses that are contracted to augment hospital staff. Conflicts with payers center around out-of-network billing charges which are far above the customary and the ‘no surprises’ patient protection billing law that took effect this year. Investor KKR owns the company and reportedly has already written it down. Their EBITDA cracked from $1 billion in 2020 to about $250 million in 2022. FierceHealthcare, Healthcare Dive

And Down Under, the modernization of Australia’s health system EHR, estimated to cost A$429 million over two years, is now funded in the 2023-4 budget. The My Health Record (MHR) modernization will improve data sharing across service settings, sharing of pathology and diagnostic imaging information, and increase usage of MHR by allied health professionals. The budget also includes substantial fresh funding to the Australian Digital Health Agency (ADHA)–over A$325 million over four years and an ongoing A$80 million–and A$5.7 billion to Australia’s national Medicare program including strengthening primary care and urgent care. IT News (Australia)

FTC takes off the gloves, v2: a walk on the technical side of ad pixel tracking

March 22, 2023 | by

FTC explains its actions versus GoodRx and Teladoc’s BetterHelp. If ad trackers leave you a little “pixelated”, this FTC blog (who would have thunk?) is a decent explanation of what ad trackers, a/k/a third-party tracking pixels, do. They’re not evil, as some of the FTC statements would have you think, and have legitimate uses in tracking how your website pages are being used (and by whom). But GoodRx and BetterHelp in particular went too far in information gathering, sloppy handling, and monetizing customer information with third parties. 

  • Pixels, once tiny images, are now extensive bits of JavaScript or HTML code that send information back to the owner of the page they’re on. Consumers are of course totally unaware of their use.
  •  These codes can send back basic, non-identifiable, and useful information to marketers, such as pageviews, clicks, and interactions with ads or with their pages.
  • Unfortunately, code can be written to send back far more detailed information back to marketers, such as names, answers to questionnaires, email addresses, financial information, and more. Some of this can be hashed (a form of masking) but can be decoded. This is potentially sensitive information that needs to be handled carefully and with the assumption of confidentiality. 
  • As mentioned in our TTA articles, this information can be monetized by companies and provide an additional revenue stream. This type of information has value to ad networks (Apple, Microsoft, Google, Meta etc.), data brokers, social networks (Facebook, TikTok), advertisers, and others. 
  • Neither site asked permission from users to retain information nor to use it for third-party ad targeting.

The FTC blog then goes on to discuss their concerns and where FTC will go even more extensively into areas such as consumer harm and how companies manage the data. You don’t have to be a HIPAA-covered entity to fall under FTC’s purview–just capture consumer health data then share it with third parties or make deceptive representations.

Digital health companies are on notice to be concerned about yet another Federal three-letter agency. Expect more actions by FTC beyond GoodRx (getting off lightly at $1.5 million) and BetterHelp (dinged for $7.8 million which will somehow be returned to consumers). 

Ad tracker action heats up: Congress questions DTC telehealth companies on sensitive patient health data sent to advertisers

February 9, 2023 | by

It looks like telemental and addiction counseling telehealth sites are routinely sending patient information to media ad platforms–Google, Facebook (Meta), TikTok, Microsoft, Snapchat, Bing, Pinterest, and Twitter–to serve ads back to patients. Four Senators sent letters this week to three telehealth companies treating patients: Monument (alcohol addiction), Workit Health (opioid and alcohol), and Cerebral (ADHD and other mental health). The letters questioned the use of ad trackers (pixels) such as Meta Pixel that collect information from telehealth sites and then use the information to send users targeted ads based on that information. Except that this is not about curtains or shoes, but medical treatment. 

Kicking this off was The Markup/STAT study in December, examining 50 telehealth websites.

  • 49 of 50 websites shared user/patient tracking data to advertising platforms. This captured data as routine as URLs and IPs, and as extensive as name, email, phone, questionnaire answers, when users created accounts, and cart behavior, such as a prescription medication or treatment plan.
  • 35 were found by the study to have trackers sending individually identifying information to at least one media platform that included names, email addresses, and phone numbers
  • 25 had at least one tracker that indicated when users added prescription drugs and other items to their cart or when they checked out with a subscription for a treatment plan
  • 13 had at least one tracker that collected patients’ answers to medical questions

Ad trackers then send that information to platforms, which then serve targeted ads back to the telehealth companies’ users and patients. For the telehealth companies, the data is monetized. Because ads are served, there is a revenue stream back to the telehealth companies. 

From the senators’ letter: “This data is extremely personal, and it can be used to target advertisements for services that may be unnecessary or potentially harmful physically, psychologically, or emotionally.” Markup/STAT

Users may well assume that because the telehealth companies eventually connect them to a provider covered by HIPAA, or sends them a prescription from a provider, such as migraine treatment, that their data is protected along the entire journey. That assumption has now been demonstrated to be incorrect. This included major, heavily advertised DTC providers such as Lemonaid, Keeps, Hims & Hers, Talkspace, and Roman (Ro). Many of them are now examining their pixel policies.

The December article linked above has all 50 companies and what information they found was sent to ad platforms. The only website that did not was Amazon Clinic–brand new and of course not wanting to share their information outside of Amazon.

This follows on the FTC’s still to be approved by a Federal court, but apparently successful $1.5 million action against med discounter GoodRx using the never-used-before Health Breach Notification Rule, enacted in 2009 [TTA 3 Feb]. 

Why this is significant: first, the FTC action using an old rule, followed by the senators targeting three prominent (and in Cerebral’s case, beleaguered) telehealth companies, and the red meat documentation provided by The Markup/STAT study provide grounds for endless follow-up by not only Congress, but also private and public (DOJ) litigation. Stay tuned.

News roundup: GoodRx pays $1.5M to FTC on Meta Pixel use, ATA concerns on Covid PHE end, defending Livongo sale to Teladoc, Philips lays off 18K, Amazon health layoffs–and big ’22 loss, Ireland HSE digital head quits, Matt Hancock assaulted on Tube

February 3, 2023 | by

Rounding up the week–and it’s not over. 

Prescription discounter GoodRx settled with the FTC for $1.5 million for the unauthorized sharing of user health data with Facebook, Google, Criteo, and other advertising sites. GoodRx used the Meta Pixel and other Javascript trackers in software development kits (SDK) for sharing user data with third-party advertisers. They would then be capable of serving personalized health and medication-specific ads to GoodRx users. This differs from the earlier Meta Pixel incidents which involved hospitals using the tracker on their website appointment schedulers and patient portals which exposed personal health information (PHI) under HIPAA regulations. GoodRx is not a covered entity, thus does not fall under HIPAA violations of PHI.

For the first time, the Federal Trade Commission (FTC) used the Health Breach Notification Rule, created in 2009, in charging GoodRx in a Federal court with misuse of consumer health information. The action was taken in US District Court for the Northern District of California, which has yet to approve the FTC order and the settlement.

GoodRx responded to the charges in their release that they stopped using pixel trackers in 2019 to protect user privacy. The trackers transmitted no PHI but primarily IP addresses and web page URL information. GoodRx maintains that this is a “novel application” of the Health Breach rule. But they settled with the FTC to avoid ‘the time and expense of protracted litigation’ on privacy issues they’ve already updated. HISTalk, The Markup, FierceHealthcare  TTA’s Meta Pixel articles

The good news for most of us is that the Public Health Emergency for Covid-19 will be ending 11 May. Not such good news, according to ATA and ATA Action, for mental health patients. While the omnibus budget passed at the end of the 117th Congress last year extended many telehealth provisions for two years [TTA 4 Jan], it did not extend the remote prescribing of controlled substances as part of the Ryan Haight Act. They are urging the Drug Enforcement Administration to release its rules for special registration for telemedicine as a first step. Release

With Teladoc’s $6.6 billion writeoff of the costs of acquiring Livongo in Q1 2022 [TTA 4 May 22], did Teladoc pick up an $18 Billion Bunch of Lemons in Livongo? Or did Teladoc mess up the expensive buy? You have to hand it to MedCityNews’ Arundhati Parmar for asking that burning question of Zane Burke, who was Livongo’s CEO at the time and the engineer of the sale, now CEO of Quantum Health. Not surprisingly, he said that “When we left the business, it was a freaking good business”, had just turned a big funding, was EBITDA positive, and wasn’t seeking a buyer. The massive difference was in the cultures, a ‘chasm’ that wasn’t bridged. One indicator: none of the top 16 Livongo executives stayed with Teladoc–and they were not required to as a condition of the sale. Teladoc considered it a ‘roll up’. 

This Editor was skeptical about it from the start–see TTA analyses 6 August and 11 August, as it happened in 2020. And while many smart observers were enthusiastic, others were not–the synergies (forgive me) they saw and the bottom line boosts were not there as predicted. In retrospect, which is always 20/20, it’s now proven to be a terrible buy. Teladoc has rebooted Livongo as of last month. More than the writeoff cost for Teladoc, it cost the industry, and affected lives.  It’s an important read in today’s situation.

Philips will be laying off 6,000 globally over the next two years, in addition to 4,000 booted this past October. Reasons why are the 2021 recall of Respironics ventilators, BiPAP machines, and CPAP machines because of the potential health risks of deteriorating polyester-based polyurethane (PE-PUR) foam, supply-chain challenges, lower sales in China, and the fallout from the Russia-Ukraine war. Their new focus will be on R&D and fewer ‘more impactful’ projects. Dataquest India, Mobihealthnews

Amazon’s layoffs of 18,000–and huge 2022 loss–also affected their developing healthcare areas. The shutdown of Amazon Care affected 159 jobs. But surprisingly, growth areas that had just rolled out new programs also lost staff. Amazon Pharmacy, which just rolled out RxPass, a $5 per month medication prescription service, laid off some of its program managers, risk compliance managers, and billing managers. Employees working on Halo health and fitness trackers were also laid off.  Becker’s Hospital Review  Yet many health executives see Amazon as the #1 threat to health systems’ core business. In a survey by Health Tech Nerds (sic), these execs predicted that Amazon might buy Color, Walgreens, and Smile Digital Health–in addition to a health plan! At this point, their One Medical buy is under scrutiny by both the DOJ and FTC [TTA 15 Sept 22] and on 2 February they reported a $2.7 billion net loss for 2022, the first since 2014 (The Verge) so those predictions on aggressive healthcare moves might be very blue side up.  Becker’s Hospital Review

In Ireland, Prof. Martin Curley, who headed digital innovation for the Health Services Executive (HSE), resigned in an unusual fashion. On LinkedIn announcing his resignation effective immediately, he said he has “called off this particular ascent on Everest”. In the post, he expressed frustration with supply chain and funding blockages, but later interviewed by the Irish Times cited poor IT infrastructure creating patient adverse outcomes, even death–and that senior administrators blocked new technology solutions. He is now a visiting professor at the University of Bath and a professor of innovation at Maynooth University. Irish Times 16 Jan, 25 Jan

And former Health Secretary Matt Hancock cannot catch a break. First, he was suspended from the Conservative Party in November, having decided that traveling to Australia for several weeks to appear in a reality show was more important–while he was Conservative Whip and Commons was still sitting. Now as an independent representing West Suffolk, in December he announced he will not stand for re-election next year. The insult upon injury was being assaulted last month by a 61-year-old man on the London Underground, following Mr. Hancock through Westminster station and onto a train, and earlier by the same man on Parliament Street. The Lancashire man was arrested. Lately quite in the BBC News.

News roundup: WakeMed sued on Meta Pixel; Hint Health buys AeroDPC; Neurotrack’s $10M raise, 3 min. cognitive tool intro; layoffs dim Kry, Brightline

November 3, 2022 | by

WakeMed has been caught up in the litigation surrounding Meta Pixel. The Raleigh, North Carolina area health system installed it on their MyChart patient portal and website, where it was in place for over four years sending information back to Facebook, violating patient privacy and open to unauthorized misuse. The class action lawsuit filed in NC states that it was installed in March 2018 and not removed until June 2022. PHI cited includes names and contact details; computer IP addresses; emergency contact information; check-in information, such as allergies and medications; appointment details; and, in some cases, Social Security numbers or financial information. Matthiae v. WakeMed Health and Hospitals (ClassAction.org), Becker’s.  TTA’s Meta Pixel articles

Two more acquisitions and fundings announced this week:

  • Hint Health is acquiring AeroDPC, an EHR and practice management software for direct primary care clinics. Purchase price was not disclosed. AeroDPC will operate as a subsidiary of Hint, with cofounder Dr. Brad Brown joining the combined company as medical director. Hint is a platform with a subscription-based payment model for primary care providers that bypasses health plans. It sets them up with enrollment, member management, billing, and administration.  Mobihealthnews   In June, Hint raised $45 million in a funding round led by Banneker Partners and Frist Cressey Ventures. Crunchbase, Mobihealthnews
  • Neurotrack, a startup focusing on developing digital cognitive tools, raised $10 million in new funding, adding to its 2019 $21 million Series C. Putting the raise to work right away, yesterday (1 Nov) it launched a three-minute digital assessment tool to screen for cognitive decline and impairment during the typical 40-minute wellness appointment. CMS guidelines require a cognitive assessment as part of a Medicare beneficiary’s annual wellness visit (AWV) enrolled in Part B or Medicare Advantage, yet only about 25% actually receive one.   Release, Mobihealthnews

Unfortunately, the layoffs do continue. From Layoffs.fyi which track them by industry:

  • Kry, known in the UK, US, and France as Livi, is having its second layoff of the year with 10% (about 300) of its workforce pinkslipped. Back in June, they released 100 employees [TTA 30 July]. While Dagens Nyheter reports that Kry is already profitable in Sweden, overall profitability is elusive. The goal is to achieve it in 18-24 months.
  • On Friday, pediatric virtual behavioral health startup Brightline laid off 20% of their workforce, citing realignment of strategic priorities. A number was not estimated. Brightline raised $115 million between March and July this year from 7Wire and Northwell Health, for a total of $212 million (Crunchbase) and, at that time, a valuation of $705 million. [TTA 1 April]. Brightline provides digital tools, coaches, live therapy sessions, psychiatric services, and medication support for children, teens, and families. Behavioral Health Business

Meta Pixel ad tracker collects another 3 million data breaches at Advocate Aurora Health; Zuckerberg getting Senate scrutiny

October 21, 2022 | by

The Pixel ad tracker continues to be a Big Problem for Meta and Facebook. Advocate Aurora Health, a large health system in Illinois and Wisconsin, this week informed 3 million patients of a potential data breach connected to the use of Meta Pixel. The Meta Pixel snippets of JavaScript code were used within their Epic MyChart and LiveWell websites and applications, as well as on some of their schedulers.

As we have previously noted (below), ad trackers like the Meta Pixel are used to target website visitors and also to track ads placed on Facebook and Instagram. Developers routinely permit these snippets of code as trackers for better performance and website tracking, but the problem here is that sensitive patient information (PHI) is being sent back to Facebook where it violates patient privacy and can be misused.

Advocate Aurora cited that Meta Pixel may have collected “IP address; dates, times, and/or locations of scheduled appointments; your proximity to an Advocate Aurora Health location; information about your provider; type of appointment or procedure; communications between you and others through MyChart, which may have included your first and last name and your medical record number; information about whether you had insurance; and, if you had a proxy MyChart account, your first name and the first name of your proxy.” It did not collect social security number, financial accounts, credit cards, or debit card information. At this point, there is no reported misuse of information. Bleeping Computer, HealthcareITNews

That this is at all problematic is being vigorously denied by Facebook. But in an unusual move, Senator John Warner (D-VA) sent a letter yesterday to Meta CEO Mark Zuckerberg, containing seven fairly rigorous questions based on The Markup’s articles to be answered by 3 November. This follows on Sen. Jon Ossoff’s request via the Senate Homeland Security Committee (below)  (Editor’s opinion: to be written by Meta’s lawyers, and don’t hold your breath for any rending of garments or mea culpas.) HealthcareITNews, The Markup

Our previous articles on The Markup‘s research and Meta Pixel:

Breaking: Hospitals sending sensitive patient information to Facebook through website ‘Meta Pixel’ ad tracker–study

Facebook Meta Pixel update: Nemours Children’s Health using 25 ad trackers on appointment scheduling site

Let the lawsuits begin: Meta sued by health system patient for Meta Pixel info gathering

Novant Health notification 

Meta facing some Senate scrutiny on Meta Pixel’s health data collection–and how it’s used

Meta facing some Senate scrutiny on Meta Pixel’s health data collection–and how it’s used

September 20, 2022 | by

A member of the Senate Homeland Security and Governmental Affairs Committee, Sen. Jon Ossoff (D-GA) has requested that Facebook’s parent, Meta, account for healthcare information that it has collected as a result of the Meta Pixel being used on leading hospitals’ websites as an ad tracker. During a hearing, Meta chief product officer Chris Cox was questioned about Meta’s having and using the data and responded, “Not to my knowledge.” According to this latest report in The Markup, Cox will follow up with a written response to the committee.

The June investigation by The Markup and STAT [TTA 17 June] investigated how these snippets of code, routinely used by developers to track website performance, could be sending to Facebook through online appointment schedulers and patient portals highly sensitive patient information. As we noted then from the article, “None of the hospitals using the Pixel have patient consent forms permitting the transmission of individual patient information, nor business associate agreements (BAAs) that permit this data’s collection.” Facebook’s defense is that it does not use this information in any identifiable way.  

Developments have moved quickly since then. According to The Markup, 28 of the 33 hospitals in the initial report have removed the Meta Pixel from their appointment schedulers or blocked it from sending patient information to Facebook. At least six of the seven health systems had also removed the pixels from their patient portals. In August, Novant Health notified patients of a code misconfiguration of their Meta Pixel tracker that may lead to unauthorized disclosure of their personal health information (PHI) [TTA 19 Aug]. North Carolina’s attorney general may investigate. Five class action lawsuits have been filed by patients, including against Novant and Medstar [TTA 23 June].

It may be that Meta may have a very hard time ‘splainin’ to Sen. Ossoff how the data flow and is used for any given account, based upon their own internal engineers’ assessments in a leaked 2021 privacy memo. But given Meta’s and the founder’s pull in the Federal government, one wonders how far all of this will go. Your Editor is not optimistic. TTA’s articles on Meta Pixel

Week-end news roundup: +Oscar data tech platform pauses, BD buys MedKeeper pharmatech for $93M, Novant’s Meta misconfiguration reveals PHI, Mt Sinai’s Sema4 genomics spinoff releases 250 + founder

August 19, 2022 | by

+Oscar, Oscar Health’s foray into selling value-based health plan management services within a full-stack platform, has taken a minus. They are no longer pursuing relationships until they straighten out the ones they have, which are proving problematic. Their last implementation at Florida-based insurer Health First Health Plans (not to be confused with NY’s HealthFirst) proved to have some problems that prevented them from going live early this year, which were not itemized but were serious enough for Oscar Health to stop acquiring accounts until said difficulties are sorted out.  +Oscar’s platform is designed to deliver medical cost management to payers and value-based care by closing care gaps, improving quality scores, enhancing value, and communicating effectively with patients through its Campaign Builder and Next Best Actions engines (release). How many contracts +Oscar has implemented was not disclosed, although since startup in April 2021, they were claiming a pace of 1-2 annually. Oscar Health has experienced a few bumps since its March 2021 IPO that raised $1.4 billion, what with share prices cruising in the mid-single digits and shareholder class action lawsuits [TTA 19 May]. Healthcare Dive, Q2 results

Medical device giant BD gets into pharmatech with MedKeeper buy for an eye-popping $93 million. The purchase was made from pharmaceutical manufacturer Grifols, SA, a Spanish multinational pharmaceutical and chemical manufacturer, as part of their plan to exit non-core businesses. MedKeeper is a photo-based automation system for in-hospital workflows and systems for pharmacy communications, compliance, and productivity.  BD also owns two pharmacy-related companies in their Medication Management Solutions portfolio, Parata for automating vial filling, packaging, and central fill, and Pyxis automated medication dispensers. Count BD as another company that acquires technology from, as this Editor put it earlier, “healthy health tech companies at the right (discounted) price that fill in their tech gaps.” MedTechDive, BD release

North Carolina provider Novant Health has notified patients of a code misconfiguration of their Meta Pixel tracker that may lead to unauthorized disclosure of their personal health information (PHI). The number of patients is not disclosed. In June, The Markup and STAT jointly published a several-part exposé of the Meta Pixel tracker being loaded into patient portals and the online appointment scheduler, capturing sensitive patient information and sending it to Facebook [TTA 17 June]. The letter explains the event as a campaign to connect more patients to their MyChart portal. The pixel was removed in June (after the article published). Novant determined that PHI could have been disclosed, although they have not uncovered any improper use to date. HealthITSecurity, Novant release

Layoffs and restructurings continue this summer with the latest being Sema4, a population health/analytics/ML/AI-assisted disease model spinoff of Mount Sinai. In what the company (Nasdaq: SMFR) has termed “a series of corporate realignments”, the company is discharging 250 staff, about 13%, plus shedding its founder from both the president and director slots effective immediately. Leading the company will be a transformation management office that includes the CEO and the new chief technology & product officer. On their Q2 earnings call, coupled with the first half, Sema4 disclosed layoffs from first half to total 30% of “legacy” staff to reduce to 1,600 employees. With shuttering some of their lab business and moving of operations, they expect to achieve cost savings of $50 million in 2022 and $250 million by end of 2023, to refocus on what they term their ‘health insights business’. Net loss in the second quarter of 2022 was $85.7 million, up over $40 million in Q2 2021. Yahoo Finance, Becker’s.

Let the lawsuits begin: Meta sued by health system patient for Meta Pixel info gathering

June 23, 2022 | by

That was fast. Class action game on! Today’s reports of a class action lawsuit being filed against Meta Friday in the US District Court for the Northern District of California in San Francisco is going to be only the first. The ‘John Doe’ plaintiff, a patient of Baltimore-based Medstar Health System and a Facebook user, claims that he is filing on behalf of “millions of other Americans whose medical privacy has been violated by Facebook’s Pixel tracking tool.” Four law firms are involved in the lawsuit. It follows on last week’s investigative report by The Markup and STAT on the Meta Pixel tracker being used by 33 of the top 100 hospital systems [TTA 17 June].

The study indicates that the information gathered in the appointment booking form included IP address, doctor’s name, patient name, email address, phone number, zip code, and city of residence. When it’s put together with outside information, it can be considered a HIPAA violation.

The lawsuit alleges that the information was collected without consent. Neither Meta nor Facebook have a Business Associate Agreement (BAA) agreement in place covering them for gathering this information in any one of the 664 health systems using the Meta Pixel cited in the suit.

The suit requests compensatory and punitive damages for breach of contract, constitutional invasion of privacy, violation of the Electronic Communications Privacy Act, violation of the California Invasion of Privacy Act, and other allegations. The filing was captured by ReclaimTheNet.org. If you look at page 18, there are multiple statements from Meta/Facebook stating that advertising based on health is ‘inappropriate’, but then illustrates how Facebook goes ahead and does it anyway (!)

A small wrinkle: In a statement to HIPAA Journal, Medstar Health Systems claimed it does not use the Meta Pixel or any Facebook code on its website. It creates an issue of the plaintiff’s standing and harm.

FierceHealthcare, Becker’s, HealthITSecurity

Facebook Meta Pixel update: Nemours Children’s Health using 25 ad trackers on appointment scheduling site

June 21, 2022 | by

The Meta Pixel tracker study gets a little worse–this time, it’s information on appointments for children. The Markup’s investigation on healthcare use of ad trackers continues with an examination of Nemours Children’s Health, a Delaware-based multi-state health network with 97 locations in Delaware, Pennsylvania, New Jersey, and Florida that serve about 500,000 families. Once again, Meta Pixel and other ad trackers were found to capture personal information and patient/family details entered by an adult on the appointment scheduling site to Facebook that may constitute protected health information.

Meta Pixel was recorded as tracking:

  • IP addresses
  • Scheduled doctor and his or her specialty
  • In some cases, the first and last name of the child being scheduled

It is not this information alone, but in combination with other information that Facebook possesses, that can profile any user’s health conditions, link specific conditions to individuals and parents, and thus constitute a privacy violation. IP addresses are one of the factors that HIPAA cites as when linked to other information, create a violation.

The Markup used a tool called Blacklight to scan Nemours’ websites.

What was Nemours thinking in building their website? In addition to Meta Pixel, the scheduling site is riddled with 25 ad trackers and 38 third-party cookies. These are coded in by Facebook, Amazon, Google, and The Latest Healthcare Transformer, Oracle. Oracle claims it has healthcare data on 80% of US internet users, and one can assume this is how they get it. Ad platforms MediaMath and LiveRamp also captured data. The Markup’s team could detect the trackers, but not determine what information these ad trackers were capturing. 

In addition to the trackers on the scheduling site, Blacklight picked up a session recorder from Mouseflow. This is code that can potentially track what people click on a page. Mouseflow states on its Legal Hub that in order to transmit HIPAA-protected information to a third party, a business associate agreement (BAA) must be in place. Mouseflow did not confirm a BAA agreement to The Markup, but in a statement to them insisted that Mouseflow does not permit the transmission of PII or PHI and masks that information.

Not all health data transmitted constitute HIPAA violations, but capture of appointment scheduling information is right on the line of HIPAA violations, though not 100% conclusive.

Elsewhere on the Nemours website, there were nine ad trackers and ten third-party cookies. 

Even after they were notified by The Markup, Nemours persisted in using Meta Pixel. While many of the trackers on the scheduling site were removed, trackers from Facebook, Google, and Salesforce remained. Facebook’s Meta Pixel was removed after last week’s story.

This is certainly another gap between the suits in the suites and the IT/developers rowing in the galley.

Breaking: Hospitals sending sensitive patient information to Facebook through website ‘Meta Pixel’ ad tracker–study

June 17, 2022 | by | 2 Comments

Meta Pixel tracker sending appointment scheduling, patient portal information to Facebook–likely to become the Hot Story of next week. A study published jointly by The Markup and STAT examined the patient-facing areas of Newsweek’s 100 leading hospitals’ websites. It found that 33 of them permit the Meta Pixel ad tracker to send sensitive patient information back to Facebook. Ostensibly the reason is to better serve the patient with more tailored information, but what is not disclosed is what else Facebook is doing with the information. At a minimum, the information is the IP address–which HIPAA considers one of 18 identifiers that when linked to other personal information, can constitute data as protected health information.

Ad trackers like the Meta Pixel are used to target website visitors and also to track ads placed on Facebook and Instagram. Developers routinely permit these snippets of code as trackers for better performance and website tracking.

  • For 33 hospitals, the Pixel tracker is picking up and sending back to Facebook information from users of the hospital’s online appointment scheduler: the user’s IP, the text of the button, the doctor’s name, and the search term. In testing the sites using a team approach facilitated by a plug-in called Mozilla Rally, the testers found that in several cases, even more identifiable patient information was being sent: first name, last name, email address, phone number, zip code, and city of residence entered into the booking form.
  • Seven hospitals have the Pixel deep into another highly sensitive area–the password-protected patient portal. These go by various names, but a popular one is Epic’s MyChart. One surveyor found that for Piedmont Healthcare, the Pixel picked up the patient’s name, the name of their doctor, and the time of their upcoming appointment. For Novant Health, the information was even more detailed: name and dosage of medication in our health record, notes entered about the prescription about allergic reactions, and the button clicked in response to a question about sexual orientation. (Novant has since removed the Pixel.)

None of the hospitals using the Pixel have patient consent forms permitting the transmission of individual patient information, nor business associate agreements (BAAs) that permit this data’s collection.

The reaction of most of these hospitals was interesting. Some immediately removed it without comment. Others maintained that no protected information was sent using Pixel or otherwise defended its use. Houston Methodist was almost alone in providing a detailed response on how they used it, but subsequently removed it.

Facebook maintains that it does not use this information in any identifiable way and that from 2020 it has in place a sensitive health data filtering system and other safeguards. The New York Department of Financial Services, in a separate action monitoring Facebook in this area, questioned the accuracy of the filtering system. Even when the information is ‘encrypted’, it’s easy to break. Internal leaked Facebook documents indicate that engineers on the ad and business product team admitted as late as 2021 that they don’t have “an adequate level of control and explainability over how our systems use data, and thus we can’t confidently make controlled policy changes or external commitments such as ‘we will not use X data for Y purpose.” (quoted from Vice)

The study could not determine whether Facebook used the data to target advertisements, train its recommendation algorithms, or profit in other ways, but the collection alone can be in violation of US regulations. 

On the face of it, it violates patient privacy. But is it a HIPAA violation of protected health information? No expert quoted was willing to say that was 100% true, but a University of Michigan law professor who studies big data and health care said that “I think this is creepy, problematic, and potentially illegal” from the hospitals’ point of view. Some of the hospitals in their comments say that they vetted it. One wonders at this tradeoff.

To this Editor, Meta Pixel’s use in this way walks right up to the line and puts a few toes over.

If this is true of 33 major hospitals, what about the rest of them–smaller and less important than Columbia Presbyterian, Duke, Novant, and UCLA? What all of us have suspected is quite true–social media is collecting data on us and invading our privacy at every turn, and except for exposés like this, 99% of people neither know nor care that their private information is being used.

The Markup is continuing their “Pixel Hunt” series with childrens’ hospitals. A previous article is about Pixels tracking information from crisis pregnancy centers, about as sensitive as you can get. Also HISTalk.