Today on Health in 2 Point 00, I air some of my grudges as we get into our deals for the day. In the third extension of their Series C, Medable gets another $78 million bringing their total to $217 million. Olive acquires Empiric Health, expanding into surgical data analytics – where does this fit in with Sean Lane’s five-point strategic plan? Finally, Papa gets a $60 million raise and Anthem, Blackstone and K Health launch a joint venture. —Matthew Holt
#Healthin2Point00, Episode 166 | $100 million, scandal, & more
Today on Health in 2 Point 00, we have scandal, drama, intrigue, $100 million and murder! Wait, no; not murder. On Episode 166, we catch up on more deals before Jess gets carried away again. The $100 million goes to Carbon Health in a Series C, which is another Bay Area-based primary care startup; they’re doing a lot of work in COVID testing and growing fast. Next we have many health plans uniting with Cigna Ventures, Humana, and Anthem all investing in Buoy Health which just raised $37.5 million in a Series C. That leads us to a scandal with the former CEO of Navigating Cancer suing Merck’s Global Health Innovation Fund. Finally, in the world of DTx, NightWare has received FDA clearance for its Apple Watch app designed to wake people with PTSD up from nightmares. —Matthew Holt
Health in 2 Point 00, Episode 133 | PBMs galore, Genome Medical, & the FCC’s Rural Health Program
Episode 133 of Health in 2 Point 00 is brought to you by the letter P — that’s P for PBMs, of course. In this episode, Jess and I talk about Genome Medical extending their series B and getting another $14 million on top of the $23 million they already raised for their remote genetic counseling services, the FCC adding another $198 million to their rural health program, bringing the funding to a whopping total of $802 million, Anthem’s PBM IngenioRx acquiring pharmacy startup Zipdrug, and Capital Rx, a startup PBM, announced a deal with Walmart. —Matthew Holt
Will Your Health Plan Tell You That It Can Save Your Life?
By MICHAEL MILLENSON
At kitchen tables everywhere, ordinary Americans have been grappling with the arcane language of deductibles and co-pays as they’ve struggled to select a health insurance plan during “open enrollment” season.
Unfortunately, critical information that could literally spell the difference between life and death is conspicuously absent from the glossy brochures and eye-catching websites.
Which plan will arrange a consultation with top-tier oncologists if I’m diagnosed with a complex cancer? Which might alert my doctor that I urgently need heart bypass surgery? And which plan will tell me important information such as doctor-specific breast cancer screening rates?
According to Matt Eyles, president and chief executive officer of America’s Health Insurance Plans (AHIP), insurers over the last decade have made a “dramatic shift” to focus more on consumers. That shift, however, has yet to include giving members the kind of detailed information available to corporate human resources managers and benefits consultants (one of my past jobs).
What’s at stake could be seen at a recent AHIP-sponsored meeting in Chicago on consumerism. Rajeev Ronaki, chief digital officer for Anthem, Inc., explained how the giant insurer is using artificial intelligence to predict a long list of medical conditions, including the need for heart bypass surgery. Information on individual patients is passed on to clinicians.
Continue reading…The Year of the Hacker
2015 was the year health care got serious about cyber security.
Hackers gave the industry no other choice.
The year started with a massive data breach at Indianapolis-based Anthem Inc., which the health insurer revealed on Feb. 4. Hackers roamed around in Anthem’s computers for six weeks and stole personal and financial information of 78.8 million customers, as well as the information of 8.8 million customers at Blue Cross and Blue Shield plans not owned by Anthem.
There have been 269 data breaches at health care organizations this year, according to statistics collected through Dec. 22 by the Identity Theft Resource Center. That’s actually down from 2014, when health care organizations suffered 333 breaches.
But the number of records stolen has soared to 121.6 million records stolen, up from less than 8.4 million records in 2014. Even without the Anthem breach, there were still 34 million records stolen this year from health organizations.
The health care industry accounted for one out of every three breaches recorded by the Identity Theft Resource Center.
“They can and are trying to break into everything,” Doug Leonard, president of the Indiana Hospital Association, said of hackers. He added, “It’s really on everybody’s radar screen in the health care industry.”
In a survey released in August by consulting firm KPMG, 81 percent of health care executives said their organization had suffered a cyber attack in the previous two years and 13 percent said they were being attacked daily.
Anthem Arrogantly Refuses Audit Processes. Twice.
Recently, I took a bunch of heat for writing that Anthem was right not to encrypt. My point was that the application encryption is just one of several security measures that add up to a security posture, and that we needed to wait until we got more information before condemning Anthem for a poor security posture.
A security posture is the combination of an organization’s overall security philosophy as well as the specific security steps that the organization takes as a result of that philosophy. Basically the type of posture taken shows whether an organization takes security and privacy seriously, or prefers a “window dressing” approach. I argued that simply knowing that the database in question did not have encryption was not enough detail to assess the Anthem security posture.
Well we have more evidence now, and its not looking good for Anthem.
Why Anthem Was Wrong Not to Encrypt
Being provocative isn’t always helpful. Such is the case with Fred Trotter’s recent headline ‒ Why Anthem Was Right Not To Encrypt.
His argument that encryption wasn’t to blame for the largest healthcare data breach in U.S. history is technically correct, but lost in that technical argument is the fact that healthcare organizations are notably lax in their overall security profile. I found this out firsthand last year when I logged onto the network of a 300+ bed hospital about 2,000 miles away from my home office in Phoenix. I used a chrome browser and a single malicious IP address that was provided by Norse. I wrote about the details of that here ‒ Just How Secure Are IT Network In Healthcare? Spoiler‒alert, the answer to that question is not very.
I encourage everyone to read Fred’s article, of course, but the gist of his argument is that technically ‒ data encryption isn’t a simple choice and it has the potential to cause data processing delays. That can be a critical decision when the accessibility of patient records are urgently needed. It’s also a valid point to argue that the Anthem breach should not be blamed on data that was unencrypted, but the healine itself is misleading ‒ at best.
Anthem Was Right Not to Encrypt
The Internet is abuzz criticizing Anthem for not encrypting its patient records. Anthem has been hacked, for those not paying attention.
Anthem was right, and the Internet is wrong. Or at least, Anthem should be “presumed innocent” on the issue. More importantly, by creating buzz around this issue, reporters are missing the real story: that multinational hacking forces are targeting large healthcare institutions.
Most lay people, clinicians and apparently, reporters, simply do not understand when encryption is helpful. They presume that encrypted records are always more secure than unencrypted records, which is simplistic and untrue.
Encryption is a mechanism that ensures that data is useless without a key, much in the same way that your car is made useless without a car key. Given this analogy, what has apparently happened to Anthem is the security equivalent to a car-jacking.
When someone uses a gun to threaten a person into handing over both the car and the car keys needed to make that care useless, no one says “well that car manufacturer needs to invest in more secure keys”.
In general, systems that rely on keys to protect assets are useless once the bad guy gets ahold of the keys. Apparently, whoever hacked Anthem was able to crack the system open enough to gain “programmer access”. Without knowing precisely what that means, it is fair to assume that even in a given system implementing “encryption-at-rest”, the programmers have the keys. Typically it is the programmer that hands out the keys.
Most of the time, hackers seek to “go around” encryption. Suggesting that we use more encryption or suggesting that we should use it differently is only useful when “going around it” is not simple. In this case, that is what happened.
