Kaiser Permanente Strike Ends, HC3 Warns of NoEscape Ransomware

October 18, 2023 - Kaiser Permanente and a group of unions have reached a tentative deal to end the largest US healthcare labor dispute. The new contract addresses understaffing concerns by offering wage increases, establishing a minimum wage for healthcare workers, restricting subcontracting and temporary staffing, and job training and workforce development investments.
Meanwhile, the Food and Drug Administration (FDA) announced the creation of a Digital Health Advisory Committee, set to begin operations in 2024. The committee will evaluate various digital health technologies, including but not limited to artificial intelligence (AI) and machine learning, to advance health equity and transform care delivery. 
Additionally, the Health Sector Cybersecurity Coordination Center (HC3) warned the healthcare community about NoEscape Ransomware which threatens healthcare organizations with multi-extortion tactics. Medicare Advantage plan ratings dropped for the second year in a row.

Kyle Murphy:

Hello and welcome to the latest edition of Healthcare Strategies | Headlines. In today's episode, we've got

• Kaiser strike closure
• FDA oversight of AI and digital health
• NoEscape from bad actors
• Ratings drop among MA plans

This is Kyle Murphy, Vice President of Editorial at Xtelligent Healthcare Media, and I'm joined, as always, by senior editor and multimedia manager, Kelsey Waddill. Kelsey, you were in Vegas for the first time last week for the HLTH Conference. Which made a bigger impression, the event or the sphere?

Kelsey Waddill:

Well, it depends what we're evaluating on, but I think they both had the same amount of lights. But the sphere was amazing. That's really why I was there, if we're being honest. Other than it's-

Kyle Murphy:

It's really hard to take your eye off of it.

Kelsey Waddill:

It really is.

Kyle Murphy:

As soon as you see it on the horizon, you're just like, 'oh, hey sphere.'.

Kelsey Waddill:

Yeah.

Kyle Murphy:

Like how many conversations are had on a daily basis where literally someone's just like, "Hey, it's the sphere again."

Kelsey Waddill:

Yeah. Or like, what's on the sphere today? I feel like that would be--

Kyle Murphy:

That's really wacky.

Kelsey Waddill:

--the new, "what's the weather like in your area" in Las Vegas?

Kyle Murphy:

"What's on the sphere?"

Kelsey Waddill:

Yeah.

Kyle Murphy:

All right, well, you ready for some headlines?

Kelsey Waddill:

Let's do it.

Kyle Murphy:

All right, Kaiser strike closure. All right, following up. Per NPR, Kaiser Permanente and a coalition of unions reached a tentative deal last Friday, ending the largest healthcare labor dispute in US history. The new contract addresses staffing shortages with raises totaling 21% in wage increases over the next four years, aimed at retaining current workers, which I hear is important. This resolution followed a three-day strike from October 4th through the sixth by tens of thousands of nurses, ER technicians, and pharmacists who argued that understaffing was negatively impacting patients.

Kaiser employees who participated in the strike will vote on the contract starting October 18th. The contract establishes a minimum wage for healthcare workers at Kaiser, starting at $25 per hour in California and $23 per hour in other states. I'm going to move to California. It covers 85,000 Kaiser Permanente staff and includes restrictions on hiring subcontractors and outside firms for temporary staffing, which we know was an emergency measure to kind of offset some of those shortages.

Additionally, it mandates investments in job training programs, referral bonuses, job fairs, and other workforce development efforts to ensure an adequate supply of new employees. Kaiser aims to fill vacant positions as 11% currently remain unfilled.

Kelsey, we heard plenty about the healthcare workforce at Health in Vegas, but little about strikes.

Kelsey Waddill:

Yeah.

Kyle Murphy:

So seems like this isn't the end by any means. No?

Kelsey Waddill:

Yeah, no, I don't think it is because it's been an ongoing theme this year. Becker's Hospital Review reported there were 18 major strikes in 2023 as of September 2023. That doesn't even count, obviously, the historic Kaiser Permanente strike. So it's ongoing. And it's looking like, this year, hospital execs might be in for a sort of reckoning, and providers are seeing the power that they have in their presence. Maybe more so even than in other jobs, when providers walk off the job and strike, there [are] huge repercussions, obviously. So I'm interested to see if this is something that continues into 2024 or if this is something that we can start seeing more productive conversations on in 2023.

Kyle Murphy:

Yeah, there's literally no way to replace these people. So if they walk off the job--

Kelsey Waddill:

Right.

Kyle Murphy:

Healthcare is a hands-on job, so if no one's there to do it, healthcare does not exist, so.

Kelsey Waddill:

Yep. AI can do a lot, but it's not going to completely restore the entire healthcare--

Kyle Murphy:

It can't do that. It can't do that.

Kelsey Waddill:

Speaking of AI, per Life Sciences Intelligence, the Food and Drug Administration announced the creation of a new digital health advisory committee on October 11th, 2023. This committee is expected to start operations in 2024 and is going to begin evaluating scientific and technical aspects of various digital health technologies. So these technologies obviously include artificial intelligence and machine learning, but they also scope virtual and augmented reality, digital therapeutics, wearables, and remote patient monitoring.

The committee aims to weigh the benefits, risks, and clinical relevance of these technologies to advance health equity and hopefully transform care delivery. The FDA is going to incorporate knowledge from both inside and outside the agency to establish regulatory guidance. The committee will consist of a total of nine voting members, including the chair with additional temporary members depending on the specific issue that's under discussion.

Kyle, there's a ton of buzz around AI coming to healthcare. Obviously, we talked about this a lot, even in our recent episodes. So how important of a step is this one with many of the existing manufacturers and startups that want a piece of the healthcare pie?

Kyle Murphy:

I think one of the things that, when you play the word association game, "AI" you think "black box." And no one in healthcare cares for a black box.

Kelsey Waddill:

Nope.

Kyle Murphy:

So I think this is something that's definitely necessary. You've got OpenAI talking about the need for federal oversight. You had other developers asking for this. So this is logical, and to me, especially important in healthcare where human beings have to make the final decision. These tools are very, very important, but at the end of the day, it's the interaction between human beings which determines an outcome. So really need some people, smart people in the room to start looking and evaluating these things and really protecting patients. And I would say, by extension, protecting providers too, who are liable when they rely on technology to make certain key decisions. So I know you and I have heard tremendous amount about AI, but really pales in comparison when people just say they need a little bit more balance in their work-life...arrangement.

Kelsey Waddill:

Yeah.

Kyle Murphy:

So it's good to get upstream with these things, but at the end of the day, you still really have to be skeptical of what AI can do in healthcare, considering what it is.

Kelsey Waddill:

Right. Yeah, yeah. I'm encouraged that this is coming to existence, especially since one of the payer leaders that we talked to at the HLTH conference was saying regulation is going to be pretty key to how fast AI progresses in healthcare and its future in healthcare. So we'll see what happens.

Kyle Murphy:

Let's hope it moves quickly because, honestly, we can't deal with slowing things down. Innovation moves at its speed. So it'd be a shame that we miss out on opportunities just by taking too long to analyze things.

Kelsey Waddill:

Yeah. Yeah.

Kyle Murphy:

I'll tell you what there's no escape from. There's no escape from ransomware in healthcare. So per HealthITSecurity, the Health Sector Cybersecurity Coordination Center, also known as HC3, issued a warning about NoEscape ransomware, a new threat targeting healthcare among other industries--as if healthcare needed any more threats.

Emerging in May 2023, NoEscape uses aggressive multi extortion tactics and is suspected to be a successor to Avaddon ransomware. I could use multi extortion tactics on my children, honestly, that'd be really helpful around dinner time. The ransomware is unique in that its developers' claims to have built it from scratch. Well, good on them. Farm-to-table ransomware. Rather than using existing source codes or leaks, NoEscape operates as a ransomware as a service--and because it's tech, there's an acronym for that, called "RaaS"--encrypting files on victims' computers and demanding ransoms that can range up to more than $10 million. There's a pipe dream. Nearly 25% of its attacks have targeted US-based organizations.

Technical details provided by HC3 indicate that NoEscape operates specifically on Windows NT 10.0 operating systems, but can encrypt data on both Windows and Linux systems, as well as VMware ESXi. HC3 recommends standard ransomware mitigations, including regular software updates--wow, surprise--backups--oh my goodness--and strong passwords. Oh, along with ongoing employee education to reduce risk.

The likelihood of cyber threats remains particularly high for the healthcare sector. Kelsey, I can tell you're flabbergasted right now.

Kelsey Waddill:

Yeah.

Kyle Murphy:

So we have long heard that healthcare is a target for bad actors when it comes to cyber threats, yet we know the issue isn't as sexy as other tech. So I guess, what's your thought on the number of ransomware and malware attacks and how healthcare is talking about them?

Kelsey Waddill:

Yeah. Yeah, this does not obviously come as any surprise that there's a new one on the horizon. There's always a new one on the horizon, unfortunately.

Everybody obviously knows that making healthcare secure is essential. But I do wonder if it's becoming a little bit like alert fatigue, where you just hear about so many happening all the time that it's overwhelming to, I know myself, but also I imagine to the healthcare leaders who have to talk about it on a regular basis. So to me, I think maybe one of the key questions here is how can we talk about the more sexy new technologies that we love talking about, and also integrate those conversations with conversations about security threats like NoEscape. And how can we do that in ways that are helpful to healthcare leaders, that [aren't] overwhelming? I think it's interesting that... It seems to be a lot of the same three things. It's like: regular software updates, backups, and strong passwords. I don't know about you, I don't have any strong passwords left in me, but...

Kyle Murphy:

Well, I can auto-generate, but then I can't remember it. To me, it's like the onus on the end user that... Strong passwords are important. I think the education component is what's really important. And educating folks about the messages that they're receiving and how most of them should... You should not trust anything.

Kelsey Waddill:

Yeah.

Kyle Murphy:

Do not trust anything, particularly in the age of misinformation.

Kelsey Waddill:

That's the point of this podcast.

Kyle Murphy:

Yeah, don't trust anything that comes to your inbox just because you know that... Especially as you're higher up the ladder, I just imagine you're probably being inundated with things. So if there's no way to filter this, the best way to do it is to just not believe anything.

Kelsey Waddill:

Yeah, pretty much. Okay.

Kyle Murphy:

Which is a really sad thing to say, I think. All right, let's go on to the last item.

Kelsey Waddill:

Yes.

Kyle Murphy:

Give me a little, give me a little more.

Kelsey Waddill:

Give a little more...Well, it's not going to be a boost, but it's going to be more information about ratings dropping among Medicare Advantage plans.

So, per HealthPayerIntelligence, CMS data has revealed that average star ratings for Medicare Advantage and Medicare Part D prescription drug plans have declined for the second consecutive year in a row, standing at 4.04 and 3.11 stars, respectively. The star rating system, just for those who are maybe not familiar, it evaluates quality based on consumer satisfaction and care measures. The methodology has been slightly altered for 2024, that includes the addition and removal of different measures. But that's the overarching theme of it.

And so in Medicare Advantage plans with prescription drug coverage, 42 percent of contracts received four stars or higher, which was a decrease from 51 percent last year. However, three-quarters (or 74 percent) of beneficiaries are in plans rated four stars or higher. For Part D plans, only 27 percent earned four or more stars, which represented only 2 percent of beneficiaries. A total of 36 contracts received a high-performing icon with 11 new additions in 2024. Six contracts, however, were tagged as low performing, which was up from one contract in 2023.

Kyle Murphy:

Misery loves company.

Kelsey Waddill:

Yeah. They just couldn't help themselves.

Almost a third of Medicare Advantage and a little over half (52 percent) of Part D plans earned three stars or less. Nonprofit organizations--the trend is that they're generally outperforming for-profit entities.

Kyle Murphy:

Shocker.

Kelsey Waddill:

And... Shocker, yes. Plans with longer participation in Medicare Advantage also showed better ratings. Also, a shocker.

The open enrollment period for Medicare, which is going to last until December 7th, 2023, is going to let consumers use these star ratings to inform their 2024 plan choices.

So Kyle, I think this is particularly interesting as Medicare Advantage is growing in popularity among consumers, it's gained a lot of traction, especially driving a lot of revenue for these big payers. Should this be troubling?

Kyle Murphy:

I don't think so. I think it's a good thing. The plans that really meet consumer need should be the ones who are standout and exemplary. That is the point of a rating system.

Kelsey Waddill:

True.

Kyle Murphy:

So you can weed out the high performers from the "also-rans."

We also know that Medicare Advantage is one of those programs where some of these health plans, who don't necessarily have a long or a great track record, try to break into because it'd be very, very lucrative, but they under-delivered to their beneficiaries. So I think seeing this is great. I think it should inform consumers. The question is, do consumers actually use this information?

Kelsey Waddill:

Yeah.

Kyle Murphy:

That's always been an issue. You can lead a horse to water, but you can't make it drink. So the thing is, are people evaluating this information? Are they using it in their evaluation process, I should say? I don't know that that's occurring. I just know that there are no shortages of options. There's federal regulations against how these things can be marketed and advertised. So we know that there's something fishy going on with some of these programs and middlemen who are trying to connect Medicare beneficiaries to particular plans.

Kelsey Waddill:

For sure.

Kyle Murphy:

So I think we need more transparency. We need people to shine the light more on these ratings, and we need to follow up and listen to Medicaid beneficiaries to say, is this working for you? And if it's not, then these programs need to be shown the door. I think there's no shortage of Medicare Advantage plans,

Kelsey Waddill:

Yeah.

Kyle Murphy:

And I think you can be spoiled for choice sometimes and paralyzed by just the number of options you have.

So I'm encouraged. I want to see the scores go down because I want there to be an incentive for these plans to improve year over year. And if everyone's getting to five, it's like grade inflation.

Kelsey Waddill:

Yeah.

Kyle Murphy:

It doesn't show you anything about value.

Kelsey Waddill:

Yeah, that's a...

Kyle Murphy:

I almost tripped.

Kelsey Waddill:

That's a good point.

Kyle Murphy:

I almost tripped on my soapbox right there.

Kelsey Waddill:

Yeah, I was going to say, keep going. Unfortunately, this is only a 10-minute podcast and we're at 15 minutes, so....

Kyle Murphy:

I'm going to put in for overtime today. All right. You want to sign them off?

Kelsey Waddill:

All right. Well, this has been Healthcare Strategies | Headlines. Thank you for joining us today and see you next week!

Kyle Murphy:

Thanks, everybody!