While the insurer faces between $100 to $200 million in costs to fix what hackers have wrought, it won't necessarily face civil penalties for HIPAA violations, says a healthcare data security expert.
Anthem Inc. faces hefty costs to repair the massive security breach that may have compromised the personal records of 80 million people. The extent of that liability could depend upon what safeguards the health plan had in place, and how it responds to the concerns of customers and federal regulators, industry observers say.
Chris Apgar,
CEO of Apgar & Associates
Given that this is the largest breach of healthcare sector data in U.S. history, Anthem potentially could face record-busting fines for violating the Health Insurance Portability and Accountability Act.
Or not, says Chris Apgar, CEO of Apgar & Associates, Portland, OR-based, healthcare data security consultants.
"It is understood that there is no such thing as risk-free security," Apgar says. "It doesn't matter how good you are. Breaches are inevitable. Even the federal government has been hacked. It is just a matter of what you should do before the incident to make sure you are doing the best you could to reasonably make sure that something like this would not happen. That is what it is going to hinge on."
With respect to potential HIPAA violations, Apgar says the Department of Health and Human Services' Office of Civil Rights will ask Anthem to explain the breach in detail.
"They'll be asking for a copy of their risk analysis, all of your security policies and procedures, describe the incident, what you did to mitigate, what are your efforts to prevent this from happening again," Apgar says. "If you can answer those questions, it's a matter of being able to demonstrate that they did the right thing."
"If Anthem can document that they have done due diligence and have the appropriate safeguards in place and this was just a sophisticated hacker that got through their defenses, they will be OK from a compliance side of things. They won't necessarily face civil penalties."
Chris Keegan
That doesn't mean that Anthem won't face substantial costs to fix the problem, and a barrage of civil lawsuits from angry customers and eager class-action lawyers, says Chris Keegan, Cyber and Technology Practice Leader, at Beecher Carlson, an Atlanta-based law firm.
"Anthem is going to find itself liable," Keegan says. "There is going to be some sort of duty of care that would be imposed on Anthem and they will say 'we gave you our information. It is your obligation to protect it and you did not.' The implication is that there is some negligence on their part, at least enough for class-action lawyers to start to make claims against it."
Even if the fines for HIPAA violations are relatively mild, Keegan says Anthem is already looking at spending $100 million or more just to notify consumers and pay for credit monitoring.
"That's before you even get into the litigation and defense of these class actions and any potential damages. Based on my experience, this is probably going to be in the $100 million to $500 million range," Keegan says.
"I am sure those lawyers are working as hard as they can. I haven't seen a lawsuit filed yet, but in other situations like this—[such as]Community Health Systems— a lawsuit was filed two days after the breach was uncovered. I am expecting to see lawsuits against Anthem pop up at any hour now."
Even when demonstrating due diligence, Keeger says, no business can credibly claim ignorance about the threat of hackers.
"Just look back in 2014," he says. "We had the biggest retail breach with Home Depot. We had the biggest financial institutions breach with Chase. Look at Sony. This is another breach with healthcare records. Every year we are setting new records in the numbers of data that are being breached in any industry."
So far, Keegan says, Anthem appears to be making all the right moves by getting out in front of the story.
"They went public with it much more quickly than a lot of other companies [have]," he says. "They have already offered credit monitoring, which will allow people to find out as soon as somebody tries to open an account in [their] name. They will get that information as soon as they can, and put a stop to it. There is another product called identity theft insurance that can be offered by Anthem, though I haven't seen them offer it yet."
Apgar says that if Anthem did not encrypt all of its consumer data, it likely was due to expediency more than negligence.
"If I have patient information on my laptop or my tablet I darn well should encrypt it because that is a huge vulnerability if it gets lost or stolen," he says. "On the other hand, if I have servers in a secure data center, the downside of encrypting everything all the time is that it slows things down and gets in the way of doing business."
"You balance your risk," he says. "What you are looking at from an encryption standpoint is what security geeks call 'uncompensated controls.' If they have compensating controls in a hardened data center that has all the bells and whistles, then there is not a lot of sense in encrypting."
Apgar says he doesn't expect Anthem to publicly divulge any "trade secrets" in the coming weeks about the status of their investigation, "but they should take proactive steps through the media saying we are doing this."
"They're also watching to see if something else happens," Apgar says. "A good example is the state of Utah where they had a breach of Medicaid information. The breach was so big, and a couple weeks later it was bigger and bigger, and it just grew. It's just watching it to make sure that doesn't happen. If it does, that is an indicator that they didn't have their hands around it in the first place. Just watch to make sure they are above board and that something new doesn't crop up."
A data security expert explains how a huge cyber attack on one of the nation's largest health plans could be the catalyst that makes the healthcare industry take significant steps toward improving data security.
Anthem Health's massive data breach announced Thursday sent shockwaves through the healthcare information technology sector. As many as 80 million people may have had personal data compromised, placing them at risk of identity fraud, Anthem reported.
Investigators, including the FBI, are sifting through what happened, attempting to determine how security was breached, who may have done it, and what will happen to the stolen information.
Dwayne Melancon, chief technology officer with Portland, OR-based Tripwire, a security software provider, spoke with HealthLeaders Media Thursday about the potential ramifications for healthcare data collection, storage, and security. The following is an edited transcript.
HLM: How can the stolen data be used?
Dwayne Melancon: This is a different level than just losing a credit card number. It would be easy to create a lot of chaos with this. Unlike credit card data or email addresses that don't tend to affect you personally from a financial perspective, when people start losing Social Security numbers, health data, previous employer data, and previous address data, problems arise.
HLM: Anthem calls this a "very sophisticated" attack. What does that mean?
DM: That generally means that the attackers were able to get into the systems where they could probably impersonate employees or administrator accounts. With a brute force attack somebody might be able to guess a password, log into a site, and steal data.
A more sophisticated attack would implant malware in your network and make configuration changes to allow them to get back in later, poke around the network, and look for more data. In some cases we have seen attackers create temporary storage locations on a company's network, pile a bunch of employee or customer data into the location, and run a script to exfiltrate that data out of the corporate network to some other site so they can do what they want with it later.
HLM: Who would be capable of doing this?
DM: One person could do it but probably not alone. They need to get information. In a lot of cases people will tap into other attackers who have profiled the network and have found a specific vulnerability that can be taken advantage of to access the network.
In other breaches people have been able to find ex-employees and get information to create custom malware. The Target breach was indirect—through an air conditioner contractor. That is part of the reconnaissance that these criminals do. They will use that knowledge to create a piece of malware that is custom-tailored to the target organization and is difficult to detect because they know your patterns, they know what you watch for, and they are able to fly in under the radar.
HLM: How will we be able to determine if this stolen data is being put to ill use?
DM: There are a number of organizations, including law enforcement and independent security research firms, which regularly watch the places where this kind of information is sold. They will look for data dumps that are associated with the Anthem breach. That will be a first indication that this information has been processed and is now being sold.
HLM: Would encrypting data prevent breaches?
DM: In a lot of cases encryption helps. In some cases, if people are able to impersonate a trusted user on your network, then they have the means to request the data in a legitimate query. Your systems will decrypt the data and give it to them.
Simply encrypting data is good, but often it is not enough. You also have to have good segregation of data, where you make sure that only a select groups of people can access sensitive data, that there are lots of controls around it, and make it more difficult for people to casually browse data and take it.
HLM: Is the healthcare sector good at protecting data?
DM: I would say they are ahead of retail but not as sophisticated as the financial industry. There has been a lot of emphasis on HIPAA to protect the personal data. That has helped a lot in terms of getting healthcare companies to put more controls around data to make it more difficult to access.
The challenge is that a sophisticated hacker with a lot of resources can sometimes get into a position where you can't tell the difference between them and a trusted employee. That is where the problems start.
HLM: What can the healthcare sector do to improve data security?
DM: Financial institutions are really good at data classification and segregation. Classification means they determine which data is the most sensitive and valuable. The more critical the data is the more security they wrap around it. Segregation means that even if you gain access to part of the data there are additional hoops you have to jump through to get to the rest of the data.
HLM: Do you have any idea what sort of HIPAA penalties Anthem will incur?
DM: There will be consequences, but rather than jump directly to punishing the victim I hope they try to determine how much of this was negligence and how much was somebody who was determined to hack into the system.
There is a tendency to say a company didn't know what they were doing. That is not always the case. In some cases people are able to compromise an insider or gain access to an obscure security vulnerability. In a lot of those cases it isn't negligence, it's just something people could not foresee.
I'd rather we see what the cause is and what the investigation turns up before we start calling for their heads on a stick. If they do find them to be negligent or short-sighted there should be consequences. But if they were taking reasonable measures and still got compromised, it may be that they had well-resourced, determined attackers and any organization could be vulnerable to that.
HLM: How do you expect the healthcare industry to respond to this breach?
DM: This will definitely increase the sense of urgency. We saw this with retailers and financial institutions when they were compromised. There was huge increase in security scrutiny. The boards and company management started talking about it. Investment in security increased.
A word of caution: Just because it's a dollar spent on security doesn't mean it's worth spending. All of this should be aligned within a good risk framework to make sure that people really are spending in a way that increases security, and doesn't just add window dressing.
We have seen a lot of cases where people have deployed technologies and either not implemented them properly or it was the wrong technology and they still got breached.
Rather than panic, I would rather that people take a more deliberate approach, see what we have learned from this, and then invest so that they shape of their spending for security matches the risk.
HLM: Does this breach change the way we assess health data security?
DM: It very well could be. People feel violated, and the more personal it feels, the more likely we are to take notice. This may be a bellwether moment where we look back in a few years and say the Anthem breach triggered all of this and healthcare information is much more secure because of this.
I hope that is what happens, because this is critical data that we need to protect. But time will tell to see how we react.
While everyone is affected by the proposed cuts, they are particularly painful for smaller hospitals, which have tighter margins and fewer options for dropping services or making up the losses.
The Obama Administration's 2016 budget axe takes a double whack at critical access hospitals.
First, the proposal eliminates critical access designation for hospitals closer than 10 miles from the nearest hospital, which would create projected savings of $770 million.
Second, critical access hospitals that are fortunate enough to maintain that designation will see their reimbursements cut from 101% to 100% of costs, which is expected to save the federal government about $1.7 billion over the next decade.
The National Rural Health Association, in Washington, DC, this week for its 26th annual Rural Health Policy Institute, calls the president's proposal "short-sighted."
"Rural hospitals already operate at the narrowest of financial margins—41% already operate at a loss," NRHA lead lobbyist Maggie Elehwany told me by email.
While everyone is affected, these cuts are particularly painful for smaller hospitals because they have much smaller margins and fewer places where they can cut services or make up the losses.
"Sequestration, DSH, bad debt, and other types of cuts have already hit rural hospitals hard," Elehwany says. "Forty-seven rural hospitals have closed since 2010, and 283 more are on the verge of closure. If this occurs, 700,000 rural patients will be without access to their closest point of emergency care. We hope that the President will recognize the importance of critical access hospitals and stop calling for cuts to these important facilities."
Making matters worse, Elehwany says, the 2016 budget again "zeroed out" funding for Area Health Education Centers, which provide recruiting and training for rural medical staff.
"Over 90% of the rural counties in this nation are Health Professional Shortage Areas," Elehwany says. "AHECs do much to improve workforce shortages where the need is the greatest—rural America."
The wisdom of these budget cuts can be questioned, but nobody paying attention should be surprised. We all saw this coming. The Obama Administration and the federal government have for several years made it clear that they will closely examine the critical access hospital sector to see what savings can be wringed from it.
In August 2013, a report from the Office of the Inspector General for the Department of Health and Human Services recommended that Congress allow the Centers for Medicare & Medicaid Services to strip critical access designation from the nearly 1,000 hospitals with "permanent exemption" status under a state "necessary provider" designation.
Before we rush to the fire escape, let's put some perspective on this. First, Republicans now control the House and Senate, and GOP lawmakers in both chambers have declared the Obama budget DOA.
Second, rural health is a true bipartisan issue. A good number of Republicans and Democrats represent rural states. Leaders in both parties understand the importance of properly funding rural healthcare. They understand that rural hospitals are economic engines for their regions, and they understand that access to healthcare is a critical issue for their constituents, the voters.
Nothing is guaranteed when it comes to Congress. (Remember how they knee-capped ICD-10 last year!) With the new fiscal year, however, I cannot imagine that Republican majorities would agree to the president's call to end non-defense sequestrations and turn around and cut funding for rural hospitals.
Near term, it would be surprising to see critical access hospitals lose their designation or their funding.
That doesn't mean that rural healthcare providers and patient advocates can relax. The president's budget, and recommendations from OIG make it clear that the federal government has critical access hospitals in its crosshairs. This likely will continue after Obama leaves office. The pressure to find savings in a healthcare sector that consumes nearly 20 cents of every dollar spent will continue with Obama's successor, regardless of her or his political affiliation.
Small rural hospitals are free to hope for the best, but they should also prepare for the inevitable.
The budget proposal calls for a permanent repeal of Medicare's widely reviled sustainable growth rate funding formula for physicians, but also calls for about $400 billion in cuts, mostly to Medicare and Medicaid, over the next decade.
The reaction from healthcare providers to the Obama Administration's $4 trillion 2016 budget proposal has been mixed, but predictable, with those earmarked for more money praising the president's spending plan, and those facing cuts bemoaning "bad medicine."
The total proposed budget for the Department of Health and Human Services in fiscal year 2016 is approximately $1.1 trillion, up from $1.04 trillion in 2015, and includes about $84 billion in discretionary funding. The proposal calls for a permanent repeal of Medicare's widely reviled Sustainable Growth Rate funding formula for physicians, which would cost about $150 billion over the next decade, and the end of the sequestered 2% reimbursement cuts to providers that are budgeted through 2021.
However, the president's proposal also calls for about $400 billion in cuts, mostly to Medicare and Medicaid, over the next decade. About $350 billion would come from reimbursements to providers, and $84 billion would come from structural reforms that include fraud reduction initiatives.
The cuts include $16.2 billion in reductions to fund graduate medical education, and reduced inflation updates for Medicare post-acute care amounting to about $102 billion over the next 10 years. Critical access hospitals would see reimbursements cut from 101% of costs to 100%, amounting to more than $1.7 billion over the next decade.
"Taken together, the President's budget request for HHS makes investments that impact millions of Americans for the better; investments that are good for the health of our families, the American middle class, and our nation's economy," HHS Secretary Sylvia Burwell told the media on Monday.
"They support the broader goals of bringing middle class economics into the 21st Century; helping working families feel more secure with paychecks that go further … helping create the conditions for our businesses to keep generating good new jobs for our workers to fill… and fulfilling our most basic responsibility to keep Americans safe."
Hospitals Pan Budget Proposal
American Hospital Association President and CEO Rick Umbdenstock disagreed with Burwell's claim.
"The cuts to hospital care are bad medicine for our nation's seniors and other vulnerable patients," Umbdenstock said in statement released by his office. "Hospitals are implementing enormous changes while they continue to improve the quality of care, but the Administration proposes further cuts to hospital care. These reductions are short-sighted at a time when our nation's healthcare infrastructure needs to be strengthened."
An AHA budget analysis found that the proposal would also reduce payments to providers by $29.5 billion by implementing site-neutral policies; cut bad debt payments to providers, including hospitals, by $31.1 billion, and eliminate critical access designation for hospitals closer than 10 miles from the nearest hospital for savings of $770 million.
Umbdenstock noted that one in three hospitals is losing money, and many hospitals are struggling to maintain access and services.
"With cuts to hospital services approaching $122 billion since 2010, this continued pattern of reductions is no longer sustainable," he says. "Many items in today's proposal would seriously challenge hospitals' ability to keep the promise of maintaining access to quality health care services."
Bruce Siegel, MD, president and CEO of America's Essential Hospitals, said proposed cuts to Medicaid disproportionate share hospitals, enforced site-neutral policies, and reduced bad debt payments would be "particularly hard" on safety net hospitals.
"Essential hospitals, which already operate at a loss on average, cannot withstand more reductions in federal spending," Siegel said in prepared remarks. "These proposed cuts would jeopardize access to care for low-income patients, as well as trauma care and other vital services to entire communities."
Medical, Nursing Colleges Mixed
As expected, medical schools and teaching hospitals for physicians and nurses rejected the president's call for $16 billion in reduced funding over the next decade, saying it poses a threat to public health.
"For example, the administration's proposed $16 billion cut in support for the complex patient care provided at teaching hospitals will have a severe, negative impacton the very institutions that have historically led the way in health crises, most recently the fight against Ebola,"Association of American Medical Colleges) President and CEO Darrell G. Kirch, MD, said in a media statement.
"In fact, those facilities designated as Ebola Treatment Centers would see dramatic cuts under the budget proposal. Medical schools and teaching hospitals depend on federal funding, not only to respond to public health emergencies, but also to provide critical services often not available elsewhere and to train the next generation of physicians and health professionals."
Kirch said AAMC was pleased to see the continued funding for physician training under the National Health Service Corps, but said that would not overcome the cuts to teaching hospitals that may have to cut the number of residency positions.
"We appreciate the president's vision to improve health care in this country, but remain concerned that the proposals in the administration's budget will jeopardize patient care and exacerbate the doctor shortage," he said.
American Association of Colleges of Nursing President Eileen T. Breslin said her organization was pleased to see that the proposed budget calls for expanding Medicare Accountable Care Organizations to include "a broader set of primary care providers," that would include physician assistants, and clinical nurse specialists.
"This expansion clearly illustrates the value and expertise of these advanced practice registered nurses in the delivery of high-quality, patient-centered, and interdisciplinary care," Breslin said.
Health Centers Embrace New Funding
The budget calls for an additional $2.7 billion in funding over three years for community health centers, along with $1.5 billion in additional discretionary and reserve funding, according to the National Association of Community Health Centers, which praised the spending plan.
NACHC President/CEO Tom Van Coverden said without additional funding community health centers across the national could close.
"We are pleased to see that the budget proposal released by the President acknowledges the need for a multi-year solution to the funding cliff," Van Coverden says. "By proposing three years of additional mandatory funding, the President has clearly signaled that maintaining our nation's investment in health centers must be a priority."
The first draft of the document identifies critical actions toward improving the way providers are paid and how information is shared more broadly and securely.
The federal government has issued a non-binding "draft Roadmap" that policymakers will use to identify technological standards for interoperability functions.
Draft 1.0 of the roadmap, released Friday, is the result of months of input from HIT experts and policymakers across the nation, and National Coordinator for HIT Karen DeSalvo, MD, pledged continued cooperation with all players across the healthcare spectrum as the process moved forward.
"To realize better care and the vision of a learning health system, we will work together across the public and private sectors to clearly define standards, motivate their use through clear incentives, and establish trust in the health IT ecosystem through defining the rules of engagement," DeSalvo said in prepared remarks.
"We look forward to working collaboratively and systematically with federal, state, and private sector partners to see that electronic health information is available when and where it matters."
Specifically, the Department of Health and Human Services has placed its focus on three areas:
Improving the way providers are paid;
Improving and innovating in care delivery
Sharing information more broadly to providers, consumers, and others to support better decisions while maintaining privacy.
The draft Roadmap identifies critical actions to achieve success in sharing information and interoperability and outlines a timeframe for implementation.
Industry Reaction
Reaction to the guidelines Friday was positive from key players in the HIT sector.
Keith J. Figlioli, senior vice president of healthcare informatics at Premier Inc., said the roadmap "represents a leap forward in the evolution of HIT.
"With this roadmap, members of Premier remain hopeful that we will finally create strong policies that incent open source infrastructure and application programming interfaces to enable new applications that healthcare providers desperately need," Figlioli said in a media release.
"With interoperability standards, providers will be in a much better position to manage population health across the care continuum and support HHS's new initiative to transition away from fee-for-service in favor of shared savings and bundled payment."
Russell P. Branzell, president of the College of Healthcare Information Management Executives, called the guidelines "a much-needed playbook for each and every health IT professional."
"Now, healthcare providers and health IT developers have a single source of truth, with an extensible process to align clinical standards towards improved interoperability, efficiency and patient safety," Branzell said. "While we have made great strides as a nation to improve EHR adoption, we must pivot towards true interoperability based on clear, defined, and enforceable standards."
Data from a 10-year study does not show any increase in the rate of Medicaid patients' visits to doctors' offices. A shortage of primary care physicians willing to accept Medicaid may be a factor.
Slapping copayments on emergency department visits by Medicaid patients seeking non-urgent care does little or nothing to reduce the costly practice, research shows.
A study this week by Johns Hopkins researchers published in JAMA Internal Medicine tracked the use of the emergency department for Medicaid non-urgent care from 2001–2010 in eight states where hospitals were authorized to charge copayments. Researchers compared ED utilization in those eight copay states with those of 10 states where hospitals were not authorized to charge ED copayments.
"With respect to this particular study, we can say that cost-sharing in the ED did not have an impact and that has implications for how cost-sharing is approached in Medicaid moving forward," says study lead author Mona Siddiqui, MD, MPH, assistant professor of internal medicine at the Johns Hopkins University School of Medicine.
ED copays were authorized by Congress in 2005 as part of the Deficit Reduction Act with the hope of steering Medicaid patients to less-costly care venues. Researchers sampled about 3,000 Medicaid patients in Florida, Kentucky, Minnesota, Montana, Ohio, Pennsylvania, South Carolina and Washington, that charged copayments of $3 to $15 for non-urgent ED visits.
They also sampled about 7,500 Medicaid recipients in 10 states—California, Colorado, Connecticut, Georgia, Louisiana, Maryland, Michigan, North Carolina, Virginia and Texas—that did not charge copayments.
The study found that the states with the highest initial rates of ED use also sought copayments from Medicaid recipients for non-urgent care. When the copayments went into effect, however, rates of ED use in those states went down less than one-tenth of 1%. The data did not show any increase in the rate of Medicaid patients' visits to doctors' offices.
Possible Contributing Factors
"It's remarkable that over the 10-year period that we used the data for, cost-sharing did not have an impact," Siddiqui says. "We could postulate as to a couple of things that are underlying the findings. Number one, a lot of patients may not be aware of those copayments and so that's playing a bit of a factor."
"Another issue here is how do we actually define non-urgent care? We know there is no agreed-upon definition from a provider perspective and I don't think a lot of patients would feel comfortable saying when something is not urgent as opposed to urgent."
Siddiqui says the burden of determining if patients' ailments were non-urgent was placed on emergency department clinicians during the initial triage. "Oftentimes it can be difficult at that point to determine whether something is urgent or not urgent," she says.
"The minimal effort it may take to complete that service encounter doesn't completely equate with the minimal amount of cost-sharing charge, and the hospital's administrative paperwork."
Siddiqui says many Medicaid patients seek care in the ED because they can't find a primary care physician.
"We know there is a shortage of Medicaid-accepting providers," she says. "When a patient comes to the ED and a provider deems an episode non-urgent, they have to provide the patient with a list of acceptable Medicaid-accepting providers, which isn't always easy."
The Johns Hopkins study predates Medicaid expansion under the Patient Protection and Affordable Care Act. But Siddiqui says the findings remain relevant.
"There is an increased burden on Medicaid and states taking an increasing share of costs," she says. "States are concerned about the sense of personal responsibility to shape the way patients utilize the healthcare system. That is a question that hasn't changed for states or for the federal government."
"This study shows that co-payments for emergency department non-urgent care visits were ineffective in getting people to see a primary care provider more. These questions are still persistent in terms of how do we get patients to have better preventive care instead of going to the ED for their usual source of care."
Siddiqui says Medicaid expansion reaffirms the importance of access to primary care. "The shortage that we know exists of primary care providers in a lot of rural areas and in Medicaid-heavy populations plays a huge role in patients then not being able to seek care with a longitudinal provider," she says.
Two days after HHS unveiled significant Medicare payment reforms, a group of commercial payers, providers, and industry partners says it is committed to putting 75% of its business into value-based models by 2020.
Some of the nation's largest healthcare systems and payers on Wednesday launched the Health Care Transformation Task Force, with an ambitious commitment to put 75% of their business into value-based models by 2020.
Richard J. Gilfillan, MD
CEO of Trinity Health
The task force describes itself as a "private sector alliance dedicated to accelerating the transformation of the U.S. health care system to value-based business and clinical models aligned with improving outcomes and lowering costs." Members include commercial payers, providers, and partners.
The announcement comes just two days after Health and Human Services Secretary Sylvia Burwell announced plans to ramp up Medicare payment reforms featuring alternative payment models and value-based payments.
Richard J. Gilfillan, MD, CEO of Livonia, MI-based Trinity Health, is chairman of the task force, which he said is "committed to rapid, measurable change both for ourselves and our country that will improve quality and make healthcare more accessible for all American families."
Gilfillan spoke with HealthLeaders Media on Wednesday about the task force and the goals and challenges it will face in the coming months and years. The following is an edited transcript.
HealthLeaders Media: What is your biggest concern about the value-based care rollout and how can your task force prevent it from happening?
Richard Gilfillan: My biggest concern is that as an organization we don't get there in a timely way because we find ourselves having to respond to the pushes and pulls from all directions as opposed to a clear and smooth path forward.
My concern from the broader perspective of the industry is that this is an incredible time and a great opportunity to get to where we all want to get to. I'd hate for us to miss the opportunity because we can't find a way to make it happen, and this kind of cooperation in setting goals and working together really gives us an optimal chance to transform our care system.
HLM: Are you concerned that the value-based rollout could become as disorganized as the HIT rollout?
RG: I wouldn't want to come off as being critical of that specific issue and segment of the industry. From a provider standpoint I am concerned, and I used to be in the payer business as well. I know that we all—whether providers, payers, or employers, or advocates for patients—have our ideas and we think they are the best and only way.
This is hard work for providers and payers making this big transition. If we are pushing and pulling on 10 different paths to how we see it and what we think the timing should be, it's even harder.
People will find themselves in this hedging scenario, one foot in the canoe and one on the dock. If we could get some commonality around time frame and consistency of approach then it is very doable.
HLM: Are you on the same page as HHS at this point on the value-based rollout?
RG: Secretary Burwell talked about two sets of metrics. One was for gauging the extent to which their payments are operating under these alternative contracts, which they defined as medical homes with triple-aim outcomes, bundled payment programs, ACO programs. That aligns directly with our thinking about our 75% commitment.
They also talked about how many of the dollars would be operating under the value-based payment systems, which is more the incentive-type arrangements that don't necessarily have total cost of care included.
I understand that they needed to pay attention to that space. We are well-aligned in terms of the goals and the definitions. Hopefully, we'll find that as the industry comes together to develop the best ways to get at that and define those models in more detail, that is where we will influence each other and come to an approach that works.
We would like to work with HHS and CMS to do the most we can to create a synergistic approach. There is a lot of potential for building momentum in the private sector as well.
HLM: Why do you believe this transition should be "rapid?"
RG: We have found as we have talked to other providers that it's really hard to operate in two or three different ways. At first everyone said, 'let me try a little alternative contracting, a little responsibility for total cost of care and better outcomes, but I want to keep my old way of doing things too.'
People realized that the halfway world is very difficult and disorienting for an organization and its people. That period of uncertainty, mixed messages, and confusion, is painful. Many of us have said, 'let's find our way to that sooner and be on a specific path so we can communicate in a straightforward way with our organization and people.'
We want to give them a clear message and a path forward and a sense of where we are going so that we can plan that out and execute on it in a logical thoughtful way. Most of us feel that it's better to do it sooner rather than drag it out into an extended period of uncertainty.
HLM: So the mindset now is that this is going to happen so we might as well get it done?
RG: I think so. The other thing we are realizing is that it's not just about cost, or quality, or health. It's about all three. Nobody went into healthcare to deliver fragmented, uncoordinated, inaccessible, and unaffordable care. This is actually taking us back to why we went into healthcare. It's exciting. Let's get there sooner rather than later. The country needs this sooner rather than later from a lot of perspectives.
HLM: Did the timing of the HHS announcement on Monday affect your announcement?
RG: Our first meeting was in June and we were reaching out to people two or three months before that. This is almost a year's work getting to this point. People in Washington have talked about there being a timeline from the federal government since 2009.
We heard from the secretary's office a week and a half ago that there was going to be some announcement. They were putting a stake in the sand. We were invited to be part of an initial information session and then we were invited to join the secretary at the announcement.
We realized this is very much on a parallel track and one that works. It's a great coming together of people's thinking about what it would take to be successful.
HLM: Do you anticipate more disagreements within the task force as you address more specific details on how value-based care will work?
RG: The answer is yes. We do anticipate differences of perspective. The reason we need to do this is because there are multiple perspectives and those perspectives are different among providers and payers and across those groups.
We have already done some hard work in talking through those differences and creating what we think is a preferred set of principles and policies.
Our most immediate effort is going to be to provide comments in the episode-based payment space and in ACOs and we are working on that now. So yes, there will be differences, but that is the purpose of this.
We have to listen to each other and understand each other's perspectives and this task force creates a context in which we can actually do that. We hope we can provide input for CMS along the way.
HLM: How did you come to decide upon 75% in value-based by 2020?
RG: We knew that one of the key goals here was to put a stake in the ground that we all had to agree to and 75% and five years seemed reasonable.
HLM: How will the task force spend its time over the next few months?
RG: Organizationally, we just launched publically and we are still putting the logistics in place to operate the task force. It's been up and operating, but we are trying to understand the best way to engage as many people and organizations as possible, so we are working through the best way to do that, and respond to what we see as a lot of interest.
There are a lot of people who are interested and I hope between this and the HHS announcement people will see it's a good time to make that commitment organizationally.
HLM: Do you expect the task force to take on new members in the coming years?
RG: This is about folks coming together who hope and expect that others will be interested in signing on and working on this goal. I am already getting a fair number of inquiries from folks saying they'd like to be involved.
Ratings of dialysis centers are based on population health statistics that are often beyond the facilities' control and don't reflect quality measures important to patients, says an executive at the National Kidney Foundation.
The Centers for Medicare and Medicaid Services' new five-star rating system for kidney dialysis centers is getting one-star reviews from patient advocacy groups.
"Star ratings are simple to understand and are an excellent resource for patients, their families, and caregivers to use when talking to doctors about healthcare choices," outgoing CMS Administrator Marilyn Tavenner said in prepared remarks. "CMS has taken another step in its continuous commitment to improve quality measures and transparency."
The rankings are akin to CMS's Nursing Home Compare and Physician Compare websites, although the methodologies are dissimilar. DFC ranks centers on a bell curve based upon nine quality measures that include mortality, hospitalization, and transfusion ratios.
Those measures are creating frictions with advocates for kidney patients, who say CMS ignored their suggestions for creating a more accurate rating of the quality of care delivered by dialysis centers. Instead, the advocates say the DFC ratings from CMS will become a confusing and inaccurate resource for dialysis patients.
"It's great that CMS specifically is looking to make quality a little bit easier for patients to understand, but the way the program is laid out has oversimplified the situation," says Tonya Saffer, senior federal health policy director, government relations, at the National Kidney Foundation.
"This is going to be misleading to patients who are looking for a quick way to see how their facility is doing or how the facility they're considering going to might be doing. There is a lot of misleading information in these rankings."
Population Health Benchmarks
For starters, Saffer says, the dialysis centers are judged on population health statistics that are often beyond their control, such as population mortality and hospitalization rates.
"A lot of these star ratings can reflect things such as population health, and that is a big concern of ours," she says. "It is not necessarily that the dialysis facility itself is doing a poor job, but that there aren't enough community healthcare resources, or general population health in those areas is likely poor."
Saffer also says the CMS ranks don't reflect quality measures that are important to dialysis patients, such as the cleanliness or physical condition of the facility, the attentiveness of the staff, and overall patient satisfaction.
And kidney patient advocates are concerned that the ratings rely on a bell curve, which they believe will unfairly penalize some dialysis centers and unfairly reward others.
"You have a set number of facilities and there is no set standard of care that they are being measured against," Saffer says.
The DFC star rating for more than 5,500 centers break down like this:
1-star — 545
2-star — 1,105
3-star — 3,399
4-star — 1,126
5-star — 565
"We know that by looking at the country, population health in different areas of the country is lower or higher. So, I don't think these rating provide a snapshot that can provide patients with an ability to make a decision off of a star rating. My fear is they will look at these and they will make decision."
The National Kidney Foundation's concerns were echoed by other kidney health advocacy groups, including Kidney Care Partners, and Dialysis Patient Citizens. Both groups complained after the DFC rollout last week, criticizing CMS for ignoring issued they'd raised about the ranking methodologies.
"We wanted the system to be reliable and meaningful to patients and to reflect the quality of care being delivered," KCP Board Chairman Edward M. Jones, MD, a nephrologist, said in prepared remarks. "The program as developed and now launched by CMS simply does not accomplish that goal."
Scores Favor Healthy States
DPC noted on its website that "a nationwide competition among all facilities that gives considerable weight to health outcomes (such as hospitalizations and mortality) [and] disfavors facilities in places where, in general, patients are less healthy. Dialysis Facility Compare star ratings are most favorable to clinics in healthy states, such as Hawaii and Colorado, but unfavorable to clinics in places like West Virginia. This discourages investment in clinics in places that need them the most."
Not everyone dislikes the rankings.
DiVita Kidney Care, the national for-profit chain of dialysis centers, issued a press release bragging about its high scores from CMS. "For 15 years clinical quality has always been the first order of business at DaVita," DaVita HealthCare Partners Co-Chairman/CEO Kent Thiry said. "It's gratifying to see those efforts positively reflected in the two government reports showing our national leadership in dialysis patient outcomes."
Community Health Systems, Inc. has announced that it will purchase 80% equity in Metro Health. In Colorado, Humana and Boulder Community Health have announced the launch of an accountable care arrangement and population health partnership.
Community Health Systems, Inc. will enter the Michigan market with its announced purchase of 80% equity in Metro Health, a not-for-profit community hospital in the Grand Rapids suburb of Wyoming, MI.
Financial terms were not disclosed.
"Metro Health provides an opportunity for our company to expand into Michigan and add the state's fastest growing market to our organization," Wayne T. Smith, CEO and President of Franklin, TN-based CHS said in prepared remarks. "This health system has served Western Michigan for many years, and we look forward to supporting Metro Health's medical staff and employees in their ongoing work to provide quality care."
The acquisition, announced Friday includes the 208-bed Metro Health Hospital, outpatient centers, and other assets and businesses. For-profit CHS also agreed to invest between $100 million and $125 million in capital over the next five years for facilities, services, medical technology, and physician recruitment.
Metro Health posted a net loss of $3.4 million in 2013, according to its Medicare cost report. The health system had posted a net gain of $7.2 million in 2012.
The deal is subject to regulatory approval by the Michigan Office of the Attorney General and certificate of need review by the Michigan Department of Community Health, a process that is expected to take several months.
If the sale is approved, Metro Health will change its tax status to for-profit as it girds to compete against Spectrum Health, the 11-hospital not-for-profit system and a dominant player in the Grand Rapids and western Michigan market.
"We had the luxury of time to work together with CHS to achieve the best long-term strategic outcome," Mike Faas, president/CEO of Metro Health, said in prepared remarks. "We could be patient looking to the future, not in a panic mode for a short-term solution."
Along with the access to capital, CHS has agreed to retain the Metro Health workforce, including more than 500 physicians on the medical staff, adopt the not-for-profit system's charity care policies, continue residency and fellowship programs, retain the local board of directors, and maintain relationships with the University of Michigan, Orthopaedic Associates of Michigan, Pennant Health, and other affiliations.
CHS owns, leases or operates 206 hospitals in 29 states with an aggregate of approximately 31,100 licensed beds. The deal marks CHS's entry into Michigan, and also the first affiliation in West Michigan of a community hospital with an investor-owned, national health system.
Josh Fangmeier, a senior health policy analyst at the University of Michigan Center for Healthcare Research & Transformation, says the same forces that are pushing hospital consolidation elsewhere in the nation are at play in Michigan.
"We are seeing increasingly fewer and fewer independent hospitals. There is a lot of pressure to join larger systems for a variety of reasons," Fangmeier says. "Just in the southeast Michigan area recently we have seen Crittenton Hospital in Detroit acquired by Ascension Health, a not-for-profit chain. Also Garden City Hospital just outside of Detroit was acquired by an out of state for profit chain. We're also seeing Duke-LifePoint making a presence in the Upper Peninsula and now we are starting to see acquisitions in western Michigan in the Grand Rapids area with more out-of-state, for-profit activity."
Fangmeier says Michigan is getting a lot of attention from out-of-state for-profit chains ever since Nashville-based Vanguard Health Systems, Inc. acquired Detroit Medical Center in 2011.
"A few years ago the state was almost entirely not-for-profit-based hospital systems. Many of these systems faced significant financial challenges, particularly those that are independent, relatively small and without a lot of negotiating power," Fangmeier says.
"We are going to continue to watch not only these remaining independent hospitals, of which there are almost none in the Detroit Metro area. There are a few remaining in the state, but what are the next steps for them? Are they going to be able to continue the status quo?"
"There is a lot of financial pressure not only from Medicare reimbursement reductions under the Affordable Care Act, but also from private insurers to slow cost growth. So, for a lot of these systems that don't have a lot of bargaining power there is going to be more pressure on them to join other systems, whether those are other existing chains already here in MI or out of state partners."
Stony Brook U. Hospital, Southampton Hospital Deal Advances
Stony Brook University Hospital and Southampton Hospital are moving toward an affiliation following the unanimous approval this month by the State University of New York Board of Trustees.
"There is still work to be done, but this is an extraordinarily important first step as we look at the future of Stony Brook University Hospital and our ability to compete in a crowded marketplace, but one in which we are excelling," Samuel L. Stanley Jr., MD, president of Stony Brook University, said in prepared remarks.
"For both Southampton Hospital and for Stony Brook University Hospital, this is a win-win in every sense of the word. We are taking two very strong institutions and strengthening both of them through this action."
Stony Brook University Hospital, a tertiary academic medical center and Southampton Hospital, a 125-bed community hospital, have been formally affiliated since 2008 and provide healthcare services to the South Fork of Long Island. In August 2012, leadership from both hospitals signed a non-binding letter of intent in which Southampton Hospital would join the Stony Brook Medicine healthcare system.
Humana, Boulder Community Health Launch ACO
Humana Inc. and Boulder Community Health have announced the launch of an accountable care arrangement and population-health partnership through Connect for Health Colorado and Humana's commercial HMOs for employers.
Humana members will have in-network access to the inpatient, outpatient, and emergency care services at Foothills Hospital and Boulder Community Hospital as well as the urgent care center, physician offices and special medical services at Mapleton Center and at Community Medical Center. More than 128 primary care physicians and specialists affiliated with Boulder Community Health, an integrated health system, are also now in-network to Humana members.
The value-based arrangement uses measures defined by the National Committee for Quality Assurance Healthcare Effectiveness Data and Information Set for diabetes care and treatment, breast cancer screenings, colorectal cancer screenings and high-risk medication.
"These types of partnerships are a critical step for Humana in Colorado as we look to create a system that works in a more coordinated way," Jeremy Gaskill, Regional Vice President, of Market Development for Humana's West Central Region, said in prepared remarks.
"With a tremendous scope of services and highly integrated model, Boulder Community Health is an ideal partner as we continue developing improved quality care and health care experiences for our members
CT's Johnson Memorial Medical Center Sold to Saint Francis Care
The board of directors at financially strappedJohnson Memorial Medical Center has approved the sale of the health system to Saint Francis Care.
The agreement came after discussions among JMMC's board of directors, lenders, governmental agencies and consultants. Under the arrangement, JMMC will enter a voluntary reorganization under a Chapter 11 bankruptcy filing, which hospital leaders said was the most expedient way to proceed with the deal under the terms negotiated, which includes a debt restructuring."
"This will clear the path for JMMC's continued financial strength and stability," the health system said in a media release. "The terms of the transaction will allow JMMC to emerge from this process with less debt and the deepened relationship with Saint Francis Care will help to achieve the goal of becoming a stronger, more financially sound hospital, well-positioned for the future."
JMMC and Saint Francis Care signed an affiliation agreement in July 2012.
"Our current affiliation agreement provides the framework necessary to ensure the continued delivery of quality care to the local community and sustain a major economic resource for the region," Christopher Dadlez, president and CEO of Saint Francis Care, said in prepared remarks. "Recently we have watched JMMC stabilize and strengthen its operations. Both parties are enthusiastic about the next steps ahead."
Under the deal, which requires regulatory approval, JMMC would become a wholly owned subsidiary of Saint Francis Care as part of a clinically integrated healthcare delivery system.
Saint Francis Care is an integrated healthcare system anchored by Saint Francis Hospital and Medical Center, which is licensed for 617 beds and 65 bassinets.
In our July Intelligence Report, healthcare leaders identified "all-cause hospitalwide readmissions" as the outcome-of-care measure that presents the biggest challenge. HealthLeaders Media Council members discuss how they are addressing this critical metric.
This article first appeared in the January/February 2015 issue of HealthLeaders magazine.
Michael Murphy, MD
Chief Medical Officer
Sharp Grossmont Hospital
La Mesa, California
We concentrate on congestive heart failure, heart attacks, and strokes, and what we have found and what the literature supports is that among the biggest issues are medication management and knowledge of medications. We have dedicated nurses who contact the patients and go to their homes and make sure their medications are correct, that they're taking them and they understand what they're doing.
We also deal with a lot of social factors. One is a lack of food. We connect with the food bank and social support systems.
The skilled nursing facility project is kind of the same thing. If we can go out to these SNFs and teach them when it's appropriate to have heart failure patients return to the hospital, then we can improve the care and decrease the costs for the whole system. Because when we teach them with our patients, it is going to work for other patients, too.
Our readmissions have been decreasing over three or four years, and we see a bit of a percentage decrease each year. We are putting more resources into this effort than we lose from the readmission from Medicare reductions. For readmissions, we lose $150,000, but we are putting far more dollars into it to save $150,000. If you talk to our CFO, there is no ROI and it is the right thing to do.
Stephen Moore, MD
Senior Vice President and Chief Medical Officer
Catholic Health Initiatives
Englewood, Colorado
The majority of the patients who come back to the hospitals within 30 days for all-cause readmissions are a key subset of folks with multiple comorbid diseases. They have issues with access to physicians' offices, follow-up, transportation issues, and a number of things, and this can be predicted.
At CHI we use the LACE tool—Length of stay, Acuity of admission, Comorbid conditions, and the number of ER visits in the last six months. Any patients admitted who trigger a score with this tool are focused on in a different way than we would with a low-risk patient population. We ensure that care management, pharmacy, and the physician team caring for the patients are aware of their high risk for readmissions. We also ensure a more rigorous medication reconciliation process with the patient wherever they may go afterward, whether it is a nursing home, home, long-term acute care facility, or other postdischarge disposition area.
Of all patients, those who trigger LACE are between 10% and 12% of our patient population. These are the folks who are responsible for about 60%–70% of the readmissions. We've seen our readmission rates for all-cause over the past three years drop by about 15%–20%. We expect we will see this drop even more as we get the tool fully implemented over the organization.
Jeffrey DiLisi, MD, MBA
Senior Vice President and Chief Medical Officer
Virginia Hospital Center
Arlington, Virginia
In the latest data dump from Hospital Compare, we are going to be listed as better-than-expected for all-cause hospitalwide readmissions. I attribute that to two things: rounding and case management.
We have care coordination rounds on all of our units. Every morning at about 9 a.m. on each of our nursing units there is a meeting involving physicians, nurses taking care of the patients, and case managers where we talk about every patient on every unit. One of the questions we ask is "What day will the patient go home?"
It's important because if we know that someone is going to go home the next day and we predict that correctly over half the time, then we are able to properly get all of the right things set up for the patient for that transition of care: to make sure that the transportation is set up, get the discharge instructions together, make sure the family is aware.
The second big element is we have a fantastic case management department. This comes down to making sure you have the right director of case management who hires the right case managers. Our case managers do utilization review, and they really understand the patients they are taking care of. We have great relationships with the free clinics, the subacute nursing facilities, the nursing homes in our area.
William Cors, MD
Vice President and Chief Medical Officer
Pocono Medical Center
East Stroudsburg, Pennsylvania
On getting your feet wet. We became involved in a CMS demonstration project for bundled payments. We wanted to get our feet wet to see what is actually involved in the total financial picture of taking care of an episode of care for three days prior to admission and 90 days postadmission. As a result we realized we needed a mechanism to identify high-risk chronic disease patients. We formed what we call a community care network.
On developing a community care network. We hired an internal medicine physician with a specialty in geriatrics and a nurse who assists in running a course at East Stroudsburg University, where we take premed, pre–physician assistant, and pharmacy students and we teach them to be health coaches who go into the homes of patients we have identified as high-risk.
We are running that almost as outpatient care management. As time goes on, we are probably going to have to add a social worker to the network. But we're finding that so far, at least with the COPD patients, we probably are now slightly lowering readmissions, maybe in the 5%–10% range.
On patient-centered medical homes. We're also investing in establishing patient-centered medical homes at key strategic areas of the county. Coincident with that is the establishment and expansion of a primary care health network. Without a primary care network supporting the home, you basically have a house of cards. I would love to tell you we get reimbursed for this. We don't.
