HHS designed its new voluntary cyber performance goals (CPGs) to address problems in the health care industry that cause or contribute to the bulk of security events and breaches. The CPGs are carefully aligned with existing cyber frameworks and standards, said an expert involved in developing the CPGs.

Erik Decker, vice president and chief information security officer at Intermountain Healthcare and chair of the HHS Health Sector Coordinating Council Cybersecurity Working Group, said at a recent conference that HHS will back the CPGs with incentives for industry adoption and, ultimately, with enforcement mechanisms.^[1]

The HHS Office for Civil Rights (OCR) is seeking to prevent medical records from being used against patients who receive reproductive care in states where that care is legal, even those who reside where it is not. To that end, OCR has finalized its rule intended to prohibit the disclosure of protected health information (PHI) related to lawful reproductive health care.^[1]

United Healthcare Group (UHG) CEO Andrew Witty was in a board meeting on Feb. 21 when officials interrupted with the news that Change Healthcare—a clearinghouse UHG subsidiary Optum had purchased for $1.3 billion in October 2022—was in the throes of a ransomware attack.

Hackers had actually entered the system nine days earlier via a single, external “portal” that—contrary to UHG policy—was not protected with multi-factor authentication.

Organizations typically deal with ransomware attacks out of the public eye, but the massive scale of United Healthcare Group’s (UHG) February breach made that an impossibility. UHG CEO Andrew Witty was recently on the hot seat before the Senate Finance Committee for two-and-a-half hours, explaining how the breach occurred. The hearing also featured pronouncements by committee chair Sen. Ron Wyden, D-Ore., and others about efforts needed in the wake of the nation’s largest breach.^[1]

Witty offered details about the steps UHG undertook in response to the breach. These may prove instructive to others in a similar situation.

◆ CMS updated place-of-service (POS) coding information in an MLN fact sheet on the three-day qualifying inpatient hospital stay before a skilled nursing facility admission.^[1] “If a patient is seen in a physician’s office, but is an inpatient of the hospital, use POS code 21 for inpatient hospital. The POS code reflects a different setting than the address and ZIP Code of the practice location (the physician’s office),” CMS said.