“Los republicanos no quieren reivindicarlo”, dijo Trump en una entrevista a finales de septiembre.

En cambio, al menos en 17 ocasiones este año, Trump ha prometido cortar los fondos a las escuelas que exigen vacunas.

Los voceros de la campaña han dicho previamente que esta promesa solo se aplicaría a las escuelas con mandatos relacionados con covid. Pero los discursos revisados por KFF Health News no incluían tal distinción, lo que genera la posibilidad de que Trump también apunte a las normas de vacunación para enfermedades infantiles comunes, y potencialmente letales, como la polio y el sarampión.

La campaña de Trump no respondió a las solicitudes de comentarios para este artículo.

Trump ha liderado un cambio radical en la visión de su partido sobre las vacunas, reflejado esta temporada de campaña en afirmaciones falsas de candidatos republicanos durante las primarias y en teorías conspirativas desconcertantes de voces conservadoras prominentes.

Cada vez más, los republicanos expresan preocupación por los riesgos de las vacunas. Una encuesta de septiembre de 2023 de Politico y Morning Consult mostró que una pequeña mayoría de esos votantes se preocupaba más por los riesgos que por los beneficios de vacunarse.

Un aumento en las políticas antivacunas en las legislaturas estatales ha seguido la retórica. Matt Motta, politólogo de la Universidad de Boston que rastrea la política de salud pública, dijo que los datos preliminares muestran que los estados promulgaron al menos 42 proyectos de ley antivacunas en 2023, un incremento casi nueve veces mayor desde 2019.

En algunos estados, parece una cruzada: la plataforma del Partido Republicano de Texas para 2024, por ejemplo, propone una prohibición de la tecnología de ARNm, la innovación detrás de algunas vacunas contra covid-19 que los científicos creen podría tener aplicaciones significativas en el tratamiento del cáncer.

En septiembre, Trump apeló a los votantes antivacunas al obtener el respaldo de Robert F. Kennedy Jr., uno de los personajes públicos anti vacunas más prominentes del país, y nombrarlo en su equipo de transición. En una gira reciente con el ex locutor de Fox News Tucker Carlson, Kennedy dijo que estaría “profundamente involucrado en ayudar a elegir a las personas que dirigen la FDA, los NIH y los CDC”.

El alcance de Trump puede ser más discreto: recientemente se reunió con una delegación de activistas escépticos de las vacunas, incluido un grupo que aboga por el fin de los mandatos y ciertos tipos de vacunas, en su club de golf en Nueva Jersey; la reunión fue publicitada por el blog conservador “Gateway Pundit”.

Trump tiene opciones para avanzar en los objetivos antivacunas como presidente, como sembrar más dudas y socavar la capacidad del gobierno federal para hacer recomendaciones sobre vacunas. Ha prometido nombrar a Kennedy, junto con “los mejores expertos”, para un panel que explore enfermedades crónicas, algunas de las cuales la organización sin fines de lucro de Kennedy ha vinculado con las vacunas.

“Nadie ha hecho más” para abogar por “la salud de nuestras familias y nuestros hijos”, declaró Trump en un mitín aceptando el respaldo de Kennedy.

Aun así, es difícil saber cómo se traduciría en la práctica la propuesta más frecuente de Trump: quitar fondos a las escuelas que exigen vacunas, dijo Judith Winston, ex consejera general del Departamento de Educación durante la administración de Obama.

Actualmente, el Departamento de Educación no tiene la facultad de cortar la financiación de las escuelas públicas de una vez, dijo, lo que significa que una segunda administración de Trump tendría que retirar el dinero programa por programa.

Y la base legal para tal medida no está clara. “No tengo conocimiento de ninguna ley federal que exija a los distritos escolares proporcionar o no proporcionar una vacuna”, dijo Winston, y agregó que probablemente requeriría la acción del Congreso.

Los 50 estados tienen un requisito de vacunación vinculado a la asistencia escolar.

El acercamiento de Trump a los sectores antivacunas ocurre en un momento de aumento de la vacilación hacia las vacunas y un resurgimiento de enfermedades prevenibles. Este verano, Oregon experimentó su peor brote de sarampión desde 1991.

La situación podría empeorar, dijo Tom Frieden, ex director de los Centros para el Control y Prevención de Enfermedades (CDC): en los 90, cuando también proliferó el escepticismo hacia las vacunas, Estados Unidos vio miles de casos de sarampión. Según los CDC, aún no se ha vuelto a esos malos tiempos, pero el número de casos de sarampión registrados este año ya es cuatro veces mayor que el del año pasado.

“Fue muy perturbador”, dijo. “Muchos niños que tuvieron sarampión terminaron con problemas de audición o problemas cognitivos de por vida. Un pequeño número murió en este país”. A nivel mundial, la enfermedad mató a más de 100,000 personas en 2022, en su mayoría niños menores de 5 años, según la Organización Mundial de la Salud.

Las encuestas muestran que una minoría sustancial de estadounidenses, concentrada en el Partido Republicano, sostiene posiciones escépticas respecto a las vacunas, dijo Robert Blendon, profesor de Harvard y experto en política sanitaria. “Es una continuación de esta rebelión contra los mandatos de vacunación contra el covid”.

La oposición a las vacunas ha dividido al Partido Republicano. El gobernador de Florida, Ron DeSantis, hizo de la oposición a las vacunas una parte central de su fallida campaña para la nominación presidencial republicana. En estados como Wyoming y Missouri, este año se libraron intensas campañas primarias centradas en temas antivacunas.

Bob Onder, médico y candidato republicano al Congreso en Missouri, fue acusado en anuncios de Facebook colocados por su principal oponente de recibir millones de las compañías farmacéuticas para probar vacunas. “Él se benefició de nuestro dolor”, decía uno de los anuncios. “Tú sufriste las consecuencias”.

Onder “nunca ha realizado investigaciones sobre la vacuna contra covid” y se opone a los mandatos de vacunas, dijo su gerente de campaña, Charley Lovett, a KFF Health News. (Lovett dijo que Onder “realizó” un estudio patrocinado por AstraZeneca sobre la prevención del covid en pacientes de alto riesgo mediante el uso de anticuerpos monoclonales, no vacunas).

Onder ganó la primaria republicana, pero su oponente antivacunas aún obtuvo poco más del 37% de los votos.

Los candidatos antivacunas suelen convertirse en legisladores antivacunas. El impacto se puede ver en Texas, donde la política de vacunas solía ser un tema bipartidista. Según los investigadores, de 2009 a 2019, los legisladores aprobaron 19 proyectos de ley a favor de las vacunas, como una medida que permitía a los farmacéuticos administrar inmunizaciones.

Pero ese consenso comenzó a cambiar hacia el final de la década. Pequeños grupos, a menudo surgidos en Facebook, hicieron sentir su influencia. Uno de esos grupos, Texans for Vaccine Choice, impulsó testimonios ante la Legislatura estatal en 2021 y atacó a los legisladores pro inmunización, algunos de los cuales cayeron en sus primarias republicanas.

La desinformación ha alimentado el giro anti vacunas en Texas, junto con las actitudes conservadoras tradicionales sobre la autonomía individual, dijo Summer Wise, ex miembro del comité ejecutivo del Partido Republicano del estado, particularmente ideas erróneas sobre el uso de células fetales en el desarrollo de vacunas; investigaciones falsificadas sobre un vínculo entre las vacunas y el autismo; y teorías conspirativas sobre Bill Gates, el filántropo multimillonario que ha defendido la vacunación.

“Los políticos ven las vacunas como un objetivo fácil para propagar el miedo entre el electorado, que luego puede ser aprovechado y dirigido para controlar un bloque de votantes”, dijo Wise.

Además de pedir una prohibición de la tecnología de ARNm, la plataforma del Partido Republicano de Texas para 2024 incluye una lista de políticas que podrían socavar la vacunación, como permitir que los residentes médicos y los médicos opten por no administrar vacunas por motivos religiosos. También pide consagrar la capacidad de un paciente para optar por no vacunarse en la Declaración de Derechos del estado.

A nivel nacional, las políticas anti inmunización podrían tomar un giro agresivo bajo una segunda administración de Trump.

Roger Severino, ex jefe de la Oficina de Derechos Civiles del Departamento de Salud y Servicios Humanos y ahora con la Fundación Heritage, redactó la sección de la agencia de salud del Proyecto 2025, la iniciativa liderada por Heritage Foundation para planificar una administración republicana.

Entre otras ideas, el documento propone recortar la autoridad de los CDC para emitir orientación sobre vacunas o cuarentenas de naturaleza “prescriptiva”, dirigida a las escuelas o en otros lugares.

Un vocero de la Heritage Foundation señaló que Severino dijo que la credibilidad de la agencia se ha visto afectada y que tiene la carga de explicar que “todas las vacunas del calendario se toman en combinación”.

La propuesta malinterpreta la historia y los poderes de los CDC, dijo Lawrence Gostin, profesor de derecho de salud pública en la Universidad de Georgetown. La agencia “rara vez” hace recomendaciones vinculantes, dijo.

“Cuando llegue la próxima pandemia, recurriremos a los CDC para que nos ofrezcan orientación basada en la evidencia más conocida”, dijo. “No queremos una agencia sin poderes en una emergencia de salud pública”.

Algunos intelectuales republicanos han elaborado visiones distópicas en torno a las vacunas. Como ejemplo, “Dawn’s Early Light”, un libro aún no publicado del presidente de Heritage, Kevin Roberts. El texto, que recibió un prólogo entusiasta del candidato republicano a la vicepresidencia, JD Vance, reserva palabras especialmente duras para las vacunas.

En una sección del libro, Roberts imagina que el gobierno federal usaría de alguna manera supuestas nuevas capacidades para “desplazar a los conductores” de automóviles por “no seguir el último mandato de vacunación”.

“Otra poderosa herramienta de control social entra en juego”, escribió.

Healthbeat es una redacción sin fines de lucro que cubre temas de salud pública, que publica Civic News Company y KFF Health News. Regístrese para recibir sus boletines aquí.

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.

USE OUR CONTENT

This story can be republished for free (details).

“The Republicans don’t want to claim it,” Trump told an interviewer in late September.

Instead, on at least 17 occasions this year, Trump has promised to cut funding to schools that mandate vaccines. Campaign spokespeople have previously said that pledge would apply only to schools with covid mandates. But speeches reviewed by KFF Health News included no such distinction — raising the possibility Trump would also target vaccination rules for common, potentially lethal childhood diseases like polio and measles.

The Trump campaign did not respond to requests for comment on this article.

Trump has presided over a landslide shift in his party’s views on vaccines, reflected this campaign season in false claims by Republican candidates during the primaries and puzzling conspiracies from prominent conservative voices. Republicans increasingly express worry about the risks of vaccines. A September 2023 poll from Politico and Morning Consult showed a narrow majority of those voters cared more about the risks than the benefits of getting inoculated.

A surge in anti-vaccine policy in statehouses has followed the rhetoric. Boston University political scientist Matt Motta, who tracks public health policy, said preliminary data shows that states enacted at least 42 anti-vaccine bills in 2023 — nearly a ninefold surge since 2019.

In some states, it has the look of a crusade: The 2024 Texas GOP platform, for example, proposes a ban on mRNA technology, the innovation behind some covid-19 vaccines that scientists believe could have significant applications for cancer care.

Last month, Trump made an appeal to anti-vaccine voters by landing the endorsement of Robert F. Kennedy Jr., one of the nation’s most prominent vaccine skeptics — and appointing him to his transition team. In a recent tour with former Fox News broadcaster Tucker Carlson, Kennedy said he was “going to be deeply involved in helping to choose the people who run FDA, NIH, and CDC.”

Trump’s outreach can be more discreet: He recently met with a delegation of vaccine-skeptical activists — including one group pushing an end to mandates and certain types of vaccines — at his New Jersey golf club; the discussion was publicized by the conservative blog “Gateway Pundit.”

Trump has options in advancing anti-vaccine goals as president, such as by sowing further doubt and undermining the federal government’s ability to make vaccine recommendations. He has promised to appoint Kennedy, along with “top experts,” to a panel exploring chronic diseases, some of which Kennedy’s nonprofit has linked to inoculations. “Nobody’s done more” to advocate for “the health of our families and our children,” Trump declared at a rally accepting Kennedy’s endorsement.

Still, it’s hard to tell how Trump’s most frequently made proposal — defunding schools that mandate vaccinations — would translate into action, said Judith Winston, former general counsel of the Department of Education during the Obama administration.

Currently, the Department of Education lacks the power to turn off public school funding all at once, she said — meaning a second Trump administration would have to take away money program by program.

And the legal basis for such a move isn’t clear. “I am unaware of any federal law that mandates school districts either provide or not provide a vaccine,” Winston said, adding it would probably require congressional action.

All 50 states have a vaccine requirement tied to school attendance.

Trump’s outreach to anti-vaccine constituencies comes as vaccine hesitancy increases and preventable disease surges. This summer, Oregon experienced its worst outbreak of measles since 1991.

The situation could get worse, said Tom Frieden, a former director of the Centers for Disease Control and Prevention: In the Nineties, during a time when vaccine skepticism also proliferated, the U.S. saw thousands of measles cases. According to the CDC, we haven’t yet returned to those bad old days — but the number of measles cases recorded this year is already quadruple that of last year.

“It was highly disruptive,” he said. “Many children who had measles ended up with hearing problems or cognitive problems that were lifelong. A small number died in this country.”

Worldwide, the disease killed over 100,000 in 2022, mostly among children under age 5, according to the World Health Organization.

Polling shows a substantial minority of Americans, concentrated in the Republican Party, hold vaccine-skeptical positions, said Harvard professor and health politics expert Robert Blendon. And skepticism about covid vaccines is blossoming into suspicion of vaccines generally among that group, he said. “It follows from this rebellion against the covid vaccine mandates.”

Vaccine opposition has divided the GOP. Florida Gov. Ron DeSantis made opposition to vaccines a core part of his ill-fated campaign for the GOP presidential nomination. In states such as Wyoming and Missouri, pitched primary campaigns centered on anti-vaccine themes this year.

Bob Onder, a physician and Republican candidate for Congress in Missouri, was accused in Facebook ads placed by his top opponent of taking millions from pharmaceutical companies to test vaccines. “He profited from our pain,” one ad said. “You suffered the consequences.”

Onder “has never done covid vaccine research” and opposes covid vaccine mandates, his campaign manager, Charley Lovett, told KFF Health News. (Lovett said Onder “conducted” one study sponsored by AstraZeneca on preventing covid in high-risk patients using monoclonal antibodies, not vaccines.)

Onder won the Republican primary, but his vaccine-disparaging opponent still scored just over 37% of the vote.

Anti-vaccine candidates typically become anti-vaccine policymakers. The impact can be seen in Texas, where vaccine politics were once a bipartisan matter. According to researchers, from 2009 to 2019, legislators there passed 19 pro-vaccine bills, such as a measure allowing pharmacists to administer immunizations.

But that consensus began to shift toward the end of the decade. Small groups, often nurtured on Facebook, made their influence felt. One such group, Texans for Vaccine Choice, spurred testimony before the state legislature in 2021 and targeted pro-immunization legislators, some of whom fell in their GOP primaries.

Misinformation has fueled the anti-vaccine turn in Texas, alongside traditional conservative attitudes about individual autonomy, said Summer Wise, a former executive committee member of the state’s Republican Party — particularly misconceptions about the use of fetal cells in vaccine development; falsified research about a link between vaccines and autism; and conspiracy theories about Bill Gates, the billionaire philanthropist who has championed vaccination.

“Politicians see vaccines as an easy foil to propagate fear among the electorate, which can then be leveraged and directed to control a voting bloc,” Wise said.

In addition to calling for a ban on mRNA technology, the Texas GOP’s 2024 platform features a laundry list of policies that could undermine vaccination, including allowing medical residents and physicians the ability to opt out of administering shots for religious reasons. It also calls for enshrining a patient’s ability to opt out of vaccine mandates in the state’s Bill of Rights.

Nationally, anti-immunization policies could take an aggressive turn under a second Trump administration.

Roger Severino, formerly head of the Department of Health and Human Services’ Office of Civil Rights and now with the Heritage Foundation, penned the health agency section of Project 2025, the Heritage Foundation-led initiative to plan for a Republican administration.

Among other ideas, the document proposes clipping CDC authority to issue vaccine or quarantine guidance of a “prescriptive” nature, targeted at schools or elsewhere.

A spokesperson for the Heritage Foundation noted Severino has said the agency’s credibility has been hurt, and it has a burden to explain “all the vaccines on the schedule being taken in combination.”

The proposal misunderstands CDC’s history and powers, said Lawrence Gostin, a public health law professor at Georgetown University. The agency “rarely if ever” makes binding recommendations, he said.

“When the next pandemic hits, we will look to CDC to offer guidance based on the best-known evidence,” he said. “We don’t want a disempowered agency in a public health emergency.”

Some Republican intellectuals have spun dystopian visions surrounding vaccines. Take “Dawn’s Early Light,” a yet-to-be-published book by Heritage president Kevin Roberts. The tome — which earned a glowing foreword by Republican vice presidential nominee JD Vance — reserves especially sharp words for vaccines.

In one section of the book, Roberts imagines that the federal government would somehow use alleged new capabilities to “deplatform drivers” of cars for “failing to follow the latest vaccine mandate.”

“Yet another powerful tool of social control falls into place,” he wrote.

Healthbeat is a nonprofit newsroom covering public health published by Civic News Company and KFF Health News. Sign up for its newsletters here.

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.

USE OUR CONTENT

This story can be republished for free (details).

Beginning last winter, it operated for months without being paid, surviving on cash on hand, practice manager Julie Tracewell said. The practice is caught up in the aftermath of one of the most significant digital attacks in American history: the February hack of payments manager Change Healthcare.

COPC recently learned Change has started processing some of the outstanding claims, which numbered roughly 20,000 as of July, but Tracewell doesn’t know which ones, she said. The patient payment portal remains down, meaning customers are unable to settle their accounts.

“It will take months to be able to calculate the total loss of this downtime,” she said.

Health care is the most frequent target for ransomware attacks: In 2023, the FBI says, 249 of them targeted health institutions — the most of any sector.

And health executives, lawyers, and those in the halls of Congress are worried that the federal government’s response is underpowered, underfunded, and overly focused on protecting hospitals — even as Change proved that weaknesses are widespread.

The Health and Human Services Department’s “current approach to healthcare cybersecurity — self-regulation and voluntary best practices — is woefully inadequate and has left the health care system vulnerable to criminals and foreign government hackers,” Sen. Ron Wyden (D-Ore.), chair of the Senate Finance Committee, wrote in a recent letter to the agency.

The money isn’t there, said Mark Montgomery, senior director at the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation. “We’ve seen extremely incremental to almost nonexistent efforts” to invest more in security, he said.

The task is urgent — 2024 has been a year of health care hacks. Hundreds of hospitals across the Southeast faced disruptions to their ability to obtain blood for transfusions after nonprofit OneBlood, a donation service, fell victim to a ransomware attack.

Cyberattacks complicate mundane and complex tasks alike, said Nate Couture, chief information security officer at the University of Vermont Health Network, which was struck by a ransomware attack in 2020. “We can’t mix a chemo cocktail by eye,” he said, referring to cancer treatments, at a June event in Washington, D.C.

In December, HHS put out a cybersecurity strategy meant to support the sector. Several proposals focused on hospitals, including a carrot-and-stick program to reward providers that adopted certain “essential” security practices and penalize those that didn’t.

Even that narrow focus could take years to materialize: Under the department’s budget proposal, money would start flowing to “high-needs” hospitals in fiscal year 2027.

The focus on hospitals is “not appropriate,” Iliana Peters, a former enforcement lawyer at HHS’ Office for Civil Rights, said in an interview. “The federal government needs to go further” by also investing in the organizations that supply and contract with providers, she said.

The department’s interest in protecting patient health and safety “does put hospitals near the top of our priority partners list,” Brian Mazanec, a deputy director at the Administration for Strategic Preparedness and Response at HHS, said in an interview.

Responsibility for the nation’s health cybersecurity is shared by three offices within two different agencies. The health department’s civil rights office is a sort of cop on the beat, monitoring whether hospitals and other health groups have adequate defenses for patient privacy and, if not, potentially fining them.

The health department’s preparedness office and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency help build defenses — such as mandating that medical software developers use auditing technology to check their security.

Both of the latter are required to create a list of “systemically important entities” whose operations are critical to the smooth functioning of the health system. These entities could get special attention, such as inclusion in government threat briefings, Josh Corman, a co-founder of the cyber advocacy group I Am The Cavalry, said in an interview.

Federal officials had been working on the list when news of the Change hack broke — but Change Healthcare was not on it, Jen Easterly, leader of Homeland Security’s cybersecurity agency, said at an event in March.

Nitin Natarajan, the cybersecurity agency’s deputy director, told KFF Health News that the list was just a draft. The agency previously estimated it would finish the entities list — across sectors — last September.

The health department’s preparedness office is supposed to coordinate with Homeland Security’s cybersecurity agency and across the health department, but congressional staffers said the office’s efforts fall short. There are “silos of excellence” in HHS, “where teams were not talking to each other, [where it] wasn’t clear who people should be going to,” said Matt McMurray, chief of staff for Rep. Robin Kelly (D-Ill.), at a June conference.

Is the health department’s preparedness office “the right home for cybersecurity? I’m not sure,” he said.

Historically, the office focused on physical-world disasters — earthquakes, hurricanes, anthrax attacks, pandemics. It inherited cybersecurity when Trump-era department leadership made a grab for more money and authority, said Chris Meekins, who worked for the preparedness office under Trump and is now an analyst with the investment bank Raymond James.

But since then, Meekins said, the agency has shown it’s “not qualified to do it. There isn’t the funding there, there isn’t the engagement, there isn’t the expertise there.”

The preparedness office has only a “small handful” of employees focused on cybersecurity, said Annie Fixler, director at the FDD’s Center on Cyber and Technology Innovation. Mazanec acknowledges the number isn’t high but hopes additional funding will allow for more hires.

The office has been slow to react to outside feedback. When an industry clearinghouse for cyberthreats tried to coordinate with it to create an incident response process, “it took probably three years to identify anyone willing to support” the effort, said Jim Routh, the then-board chair of the group, Health Information Sharing and Analysis Center.

During the NotPetya attack in 2017 — a hack that caused major damage to hospitals and the drugmaker Merck — Health-ISAC ended up disseminating information to its members itself, including the best method to contain the attack, Routh said.

Advocates look at the Change hack — reportedly caused by a lack of multifactor authentication, a technology very familiar in America’s workplaces — and say HHS needs to use mandates and incentives to get the health care sector to adopt better defenses. The department’s strategy released in December proposed a relatively restricted list of goals for the health care sector, which are mostly voluntary at this point. The agency is “exploring” creating “new enforceable” standards, Mazanec said.

Much of the HHS strategy is due to be rolled out over the coming months. The department has already requested more funding. The preparedness office, for example, wants an additional $12 million for cybersecurity. The civil rights office, with a flat budget and declining enforcement staff, is due to release an update to its privacy and security rules.

“There’s still significant challenges that the industry as a whole faces,” Routh said. “I don’t see anything on the horizon that’s necessarily going to change that.”

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.

USE OUR CONTENT

This story can be republished for free (details).

To give an example, my daughter, typically a cooing little marsupial, quickly discovered babyhood’s superpower: Infants emerge from the womb with talon-strength fingernails. She wasn’t afraid to use them, against either her parents or herself. So we purchased a pistachio-green, hand-held mani-pedi device.

That was the easy part. The difficulty came when we consulted the manual, a palm-sized, two-page document.

The wandlike tool is topped with a whirring disc. One can apparently adjust the speed of its rotation using a sliding toggle on the wand. But the product manual offered confusing advice: “Please do not use round center position grinding,” it said. Instead, “Please use the outer circle position to grinding.” It also proclaimed, “Stay away from children.” In finer print, the manual revealed the potential combination of kids and the device’s smaller parts was the reason for concern.

One would hope for more clarity about a doodad that could inadvertently cause pain.

Later, I noticed another warning: “If you do not use this product for a long time, please remove the battery.” Was it dangerous? Or simply an unclear and unhelpful yet innocuous heads-up? We didn’t know what to do with this information.

We now notice shoddy instructions everywhere.

One baby carrier insert told us to use the product for infants with “adequate” head, neck, and torso control — a vague phrase. (The manufacturer declined to comment.)

Another manual, this one online and for a car seat — a device that’s supposed to protect your kid — informed readers with words and images that a model baby was “properly positioned” relative to the top of the headrest “structure” when more than one inch from the top. Just pixels away, the same model, slumped further down, was deemed improperly positioned: “The headrest should not be more than 1” from the top of her head,” it said, in tension with its earlier instructions. Which was it, more than one inch or not? So we fiddle and hope for the best.

I acknowledge this sounds like new-parent paranoia. But we’re not entirely crazy: Manuals are important, and ones for baby products “are notoriously difficult to write,” Paul Ballard, the managing director of 3di Information Solutions, a technical writing firm, told me.

Deborah Girasek, a professor of social and behavior sciences at the Uniformed Services University of the Health Sciences, told me that for decades, for the young and middle-aged alike, unintentional injury has been the leading cause of death. That’s drownings, fires, suffocation, car crashes. The USU is a federal service academy training medical students destined for the armed services or other parts of the government.

Some of these deaths are caused by lack of effective communication — that is, the failure of instruction about how to avoid injury.

And these problems stretch from cheap devices to the most sophisticated products of research and development.

It’s a shortcoming that’s prompted several regulatory agencies charged with keeping Americans healthy, including the Consumer Product Safety Commission, the Food and Drug Administration, and the National Highway Traffic Safety Administration, to prod companies into providing more helpful instructions.

By some lights, they’ve had success. NHTSA, for example, has employees who actually read manuals. The agency says about three-quarters of car seats’ manuals rate four or five stars out of five, up from 38% in 2008. Then again, our car seat’s has a five-star rating. But it turns out the agency doesn’t evaluate online material.

Medical product manuals sometimes don’t fare too well either. Raj Ratwani, director of MedStar Health’s Human Factors program, told me that, for a class he teaches to nurses and doctors, he prompted students to evaluate the instructions for covid-19 tests. The results were poor. One time, instructions detailed two swabs. The kit had only one.

Technical writers I spoke with identified this kind of mistake as a symptom of cost cutting. Maybe a company creates one manual meant to cover a range of products. Maybe it puts together the manual at the last moment. Maybe it farms out the task to marketers, who don’t necessarily think about how manuals need to evolve as the products do.

For some of these cost-cutting tactics, “the motivation for doing it can be cynical,” Ballard said.

Who knows.

Some corners of the technical writing world are gloomy. People worry their jobs aren’t secure, that they’re going to be replaced by someone overseas or artificial intelligence. Indeed, multiple people I spoke with said they’d heard about generative AI experiments in this area.

Even before AI has had its effect, the job market has weighed in. According to the federal government, the number of technical writers fell by a third from 2001, its recent peak, to 2023.

One solution for people like us — frustrated by inscrutable instructions — is to turn to another uncharted world: social media. YouTube, for instance, has helped us figure out a lot of the baby gadgets we have acquired. But those videos also are part of a wild West, where creators offer helpful tips on baby products then refer us to their other productions (read: ads) touting things like weight loss services. Everyone’s got to make a living, of course; but I’d rather they not make a buck off viewers’ postpartum anxiety.

It reminds me of an old insight that became a digital-age cliché: Information wants to be free. Everyone forgets the second half: Information also wants to be expensive. It’s cheap to share information once produced, but producing that information is costly — and a process that can’t easily or cheaply be replaced. Someone must pay. Instruction manuals are just another example.

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.

USE OUR CONTENT

This story can be republished for free (details).

Federal officials have been in constant conversation with senior leaders at UnitedHealth and across the industry, including at a Monday meeting where Department of Health and Human Services and White House officials again pressed UnitedHealth to be more transparent about its timeline for restoring services.

Many insurers have committed to “making accelerated or advance payments,” an HHS official told reporters on a media call after yesterday’s meeting, declining to specify which plans had done so. The plans have also committed to making interim payments to Medicaid providers, a second official added, as well as providing other support, including payment for pending claims, loans and assistance switching to other electronic clearinghouses when needed.

“We have seen significant improvement between last week and this week,” a third official told reporters, but “we have a last mile to go — we are still hearing from small, rural safety-net providers who need cash assistance.”

UnitedHealth’s Change Healthcare is still struggling to recover from a ransomware attack by hackers believed to be part of a Russia-based group called ALPHV, or Blackcat. Change, little known outside the health-care industry, processes billions of transactions a year on behalf of hospitals, physician practices, pharmacies and the insurers that pay them.

Both UnitedHealth and the federal government have come under fire from health-care providers and lawmakers for being unprepared for the attack and too slow to respond. 

“Neither UnitedHealth Group nor federal agencies were prepared for the attack on Change Healthcare and its fallout,” Senate Finance Committee Chairman Ron Wyden, an Oregon Democrat, said last Thursday.

The byzantine structure of the U.S. health-care system has created obstacles for regulators to navigate as they help the industry recover. For example, said Chip Kahn, president of the Federation of American Hospitals, which represents for-profit hospitals: Because hospitals and doctors receive many payments from commercial insurers operating Medicare Advantage plans, over which HHS has limited authority, the agency can’t necessarily force those payers to make the providers whole.

Instead, the administration is applying public pressure — including a tense White House meeting with UnitedHealth CEO Andrew Witty and other insurers last week. (HHS’ Office for Civil Rights, which enforces some of the agency’s privacy and security regulations, has also announced an investigation of the hack.)

HHS has “taken the actions they can, within the constraints of the law,” Kahn said in an interview.

Accelerated payments from Medicare may also make a difference. Brad van Pelt, president of the Palm Beach Institute of Sports Medicine, a physical therapy group in South Florida, told me those patients are about half his caseload.

The payments “will make us a little bit whole,” he said, though he took out a loan on Monday to cover payroll. The federal money hadn’t yet arrived.

Longer-term, HHS has signaled it wants mandatory cybersecurity standards imposed through Medicare and Medicaid. That’s not popular with hospitals.

“The trouble with penalties is that at the end of the day, you could penalize institutions that are mission-critical to a community,” Kahn said.

Wyden floated his own more populist approaches on Thursday. Health-care companies, he argued, have become too large.

A federal judge appointed by then-President Donald Trump ruled in September 2022 that UnitedHealth’s $13 billion acquisition of Change could proceed over the Biden administration’s opposition.

“Negligent CEOs” should be held accountable for the mess, Wyden said.

The Washington Post’s Dan Diamond contributed to this report.

This article is not available for syndication due to republishing restrictions. If you have questions about the availability of this or other content for republication, please contact NewsWeb@kff.org.

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.

USE OUR CONTENT

This story can be republished for free (details).

Since a Feb. 21 cyberattack on a previously obscure medical payment processing company, Change Healthcare, Parsons said, she and her colleagues haven’t been able to electronically bill for their services.

She heard Noridian Healthcare Solutions, California’s Medicare payment processor, was not accepting paper claims as of earlier this week, she said. And paper claims can take 3-6 months to result in payment anyway, she estimated.

“We will be in trouble in very short order, and are very stressed,” she said in an interview with KFF Health News.

A California Medical Association spokesperson said March 7 that the Centers for Medicare & Medicaid Services had agreed in a meeting to encourage payment processors like Noridian to accept paper claims. A Noridian spokesperson referred questions to CMS.

The American Hospital Association calls the suspected ransomware attack on Change Healthcare, a unit of insurance giant UnitedHealth Group’s Optum division, “the most significant and consequential incident of its kind against the U.S. health care system in history.” While doctors’ practices, hospital systems, and pharmacies struggle to find workarounds, the attack is exposing the health system’s broad vulnerability to hackers, as well as shortcomings in the Biden administration’s response.

To date, government has relied on more voluntary standards to protect the health care system’s networks, Beau Woods, a co-founder of the cyber advocacy group I Am The Cavalry, said. But “the purely optional, do-this-out-of-the-goodness-of-your-heart model clearly is not working,” he said. The federal government needs to devote greater funding, and more focus, to the problem, he said.

The crisis will take time to resolve. Comparing the Change attack to others against parts of the health care system, “we have seen it generally takes a minimum of 30 days to restore core systems,” said John Riggi, the hospital association’s national adviser on cybersecurity.

In a March 7 statement, UnitedHealth Group said two services — related to electronic payments and medical claims — would be restored later in the month. “While we work to restore these systems, we strongly recommend our provider and payer clients use the applicable workarounds we have established,” the company said.

“We’re determined to make this right as fast as possible,” said company CEO Andrew Witty.

Providers and patients are meanwhile paying the price. Reports of people paying out-of-pocket to fill vital prescriptions have been common. Independent physician practices are particularly vulnerable.

“How can you pay staff, supplies, malpractice insurance — all this — without revenue?” said Stephen Sisselman, an independent primary care physician on Long Island in New York. “It’s impossible.”

Jackson Health System, in Miami-Dade County, Florida, may miss out on as much as $30 million in payments if the outage lasts a month, said Myriam Torres, its chief revenue officer. Some insurers have offered to mail paper checks.

Relief programs announced by both UnitedHealth and the federal government have been criticized by health providers, especially hospitals. Sisselman said Optum offered his practice, which he said has revenue of hundreds of thousands of dollars a month, a loan of $540 a week. Other providers and hospitals interviewed by KFF Health News said their offers from the insurer were similarly paltry.

In its March 7 statement, the company said it would offer new financing options to providers.

Providers Pressure Government to Act

On March 5, almost two weeks after Change first reported what it initially called a cybersecurity “issue,” the Health and Human Services Department announced several assistance programs for health providers.

One recommendation is for insurers to advance payments for Medicare claims — similar to a program that aided health systems early in the pandemic. But physicians and others are worried that would help only hospitals, not independent practices or providers.

Anders Gilberg, a lobbyist with the Medical Group Management Association, which represents physician practices, posted on X, formerly known as Twitter, that the government “must require its contractors to extend the availability of accelerated payments to physician practices in a similar manner to which they are being offered to hospitals.”

HHS spokesperson Jeff Nesbit said the administration “recognizes the impact” of the attack and is “actively looking at their authority to help support these critical providers at this time and working with states to do the same.” He said Medicare is pressing UnitedHealth Group to “offer better options for interim payments to providers.”

Another idea from the federal government is to encourage providers to switch vendors away from Change. Sisselman said he hoped to start submitting claims through a new vendor within 24 to 48 hours. But it’s not a practicable solution for everyone.

Torres said suggestions from UnitedHealth and regulators that providers change clearinghouses, file paper claims, or expedite payments are not helping.

“It’s highly unrealistic,” she said of the advice. “If you’ve got their claims processing tool, there’s nothing you can do.”

Mary Mayhew, president of the Florida Hospital Association, said her members have built up sophisticated systems reliant on Change Healthcare. Switching processes could take 90 days — during which they’ll be without cash flow, she said. “It’s not like flipping a switch.”

Nesbit acknowledged switching clearinghouses is difficult, “but the first priority should be resuming full claims flow,” he said. Medicare has directed its contractors and advised insurers to ease such changes, he added.

Health care leaders including state Medicaid directors have called on the Biden administration to treat the Change attack similarly to the pandemic — a threat to the health system so severe that it demands extraordinary flexibility on the part of government insurance programs and regulators.

Beyond the money matters — critical as they are — providers and others say they lack basic information about the attack. UnitedHealth Group and the American Hospital Association have held calls and published releases about the incident; nevertheless, many still feel they’re in the dark.

Riggi of the AHA wants more information from UnitedHealth Group. He said it’s reasonable for the conglomerate to keep some information closely held, for example if it’s not verified or to assist law enforcement. But hospitals would like to know how the breach was perpetrated so they can reinforce their own defenses.

“The sector is clamoring for more information, ultimately to protect their own organizations,” he said.

Rumors have proliferated.

“It gets a little rough: Any given day you’re going to have to pick and choose who to believe,” Saad Chaudhry, an executive at Maryland hospital system Luminis Health, told KFF Health News. “Do you believe these thieves? Do you believe the organization itself, that has everything riding on their public image, who have incentives to minimize this kind of thing?”

What Happens Next?

Wired Magazine reported that someone paid the ransomware gang believed to be behind the attack $22 million in bitcoin. If that was indeed a ransom intended to resolve some aspect of the breach, it’s a bonanza for hackers.

Cybersecurity experts say some hospitals that have suffered attacks have faced ransom demands for as little as $10,000 and as much as $10 million. A large payment to the Change hackers could incentivize more attacks.

“When there’s gold in the hills, there’s a gold rush,” said Josh Corman, another co-founder of I Am The Cavalry and a former federal cybersecurity official.

Longer-term, the attack intensifies questions about how the private companies that comprise the U.S. health system and the government that regulates them are defending against cyberthreats. Attacks have been common: Thieves and hackers, often believed to be sponsored or harbored by countries like Russia and North Korea, have knocked down systems in the United Kingdom’s National Health Service, pharma giants like Merck, and numerous hospitals.

The FBI reported 249 ransomware attacks against health care and public health organizations in 2023, but Corman believes the number is higher.

But federal efforts to protect the health system are a patchwork, according to cybersecurity experts. While it’s not yet clear how Change was hacked, experts have warned a breach can occur through a phishing link in an email or more exotic pathways. That means regulators need to consider hardening all kinds of products.

One example of the slow-at-best efforts to mend these defenses concerns medical devices. Devices with outdated software could provide a pathway for hackers to get into a hospital network or simply degrade its functioning.

The FDA recently gained more authority to assess medical devices’ digital defenses and issue safety communications about them. But that doesn’t mean vulnerable machines will be removed from hospitals. Products often linger because they’re expensive to take out of service or replace.

Senator Mark Warner (D-Va.) has previously proposed a “Cash for Clunkers”-type program to pay hospitals to update the cybersecurity of their old medical devices, but it was “never seriously pursued,” Warner spokesperson Rachel Cohen said. Riggi said such a program might make sense, depending on how it’s implemented.

Weaknesses in the system are widespread and often don’t occur to policymakers immediately. Even something as prosaic as a heating and air conditioning system can, if connected to a hospital’s internet network, be hacked and allow the institution to be breached.

But erecting more defenses requires more people and resources — which often aren’t available. In 2017, Woods and Corman assisted on an HHS report surveying the digital readiness of the health care sector. As part of their research, they found a slice of wealthier hospitals had the information technology staff and resources to defend their systems — but the vast majority had no dedicated security staff. Corman calls them “target-rich but cyber-poor.”

“The desire is there. They understand the importance,” Riggi said. “The issue is the resources.”

HHS has proposed requiring minimum cyberdefenses for hospitals to participate in Medicare, a vital source of revenue for the entire industry. But Riggi says the AHA won’t support it.

“We oppose unfunded mandates and oppose the use of such a harsh penalty,” he said.

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.

USE OUR CONTENT

This story can be republished for free (details).

Whether on Facebook or Instagram, patients and clinics alike are giddy about the possibilities. But it is a drug that can be abused and can be deadly. Thus, ketamine is the latest challenge for Meta, the social media platforms’ parent company, which for years has struggled to moderate posts and ads touting health-related products like weight loss supplements and dodgy covid-19 cures.

Still, despite warnings about the drug’s dangers, Meta allows ads and posts about ketamine. Sometimes that chatter comes from sources that don’t meet the conglomerate’s voluminous standards, which, in theory, ensure posts are based on credible information.

Other internet ad networks are also trying to strike balances. Google says that because ketamine is a prescription drug, it can be advertised only if a provider is offering a prescription and is certified with a third-party oversight group; advertisers can’t promote “highs.” TikTok, which didn’t reply to a request for comment, broadly prohibits advertising from unauthorized pharmacies or dispensaries, or advertising that features prescription drug abuse.

Meta’s rules have created a conundrum for the company. Posts about ketamine, both a party drug and a possible mental health therapeutic, are governed by very different rules depending on the context, according to an investigation and report by the company’s outside Oversight Board, an organization dubbed Facebook’s “Supreme Court” for its role in refereeing the platform’s speech regulations. That balancing act was on public display after a post about the substance was inspected repeatedly by the company’s content review bureaucracy. When asked to comment for this article, Meta simply referred KFF Health News to the board’s report and the company’s reply to the report.

This back-and-forth dates to December 2022, when a paid influencer posted on Instagram how the drug eased the influencer’s “treatment-resistant depression and anxiety.” The post described a “magical entry into another dimension.”

After reviewing the paid post and Meta’s rules on drug promotion, the Oversight Board found that the post inappropriately hyped the high of the drug, while not placing it in a medical context — a problem, given the tension in the company’s rules allowing discussion of pharmaceutical products and disallowing references to illicit drug use.

Ketamine, which is available in both liquid and powder form, emerged first as an anesthetic and became popular as a party drug because of its dissociative and hallucinogenic effects. It’s FDA-approved as an anesthetic and, in some formulations, as a prescription antidepressant, to be administered in medically supervised settings. Regulated as a Schedule 3, nonnarcotic substance under the Controlled Substances Act, the drug has been shown to cause dependence, especially for people with a history of addiction to other substances. But researchers are intrigued by another aspect of ketamine: its mind-altering properties, which have potential therapeutic benefits.

These possibilities, aided by a boom in ketamine-focused medical startups and spas promoting the prescription drug as part of “holistic healing” or other wellness purposes, are fueling consumer interest, news coverage, and social media attention.

But there are indications of a dark side. According to an autopsy report from Los Angeles County’s medical examiner department, actor Matthew Perry died with ketamine in his system as he reportedly was undergoing infusion therapy meant to treat depression and anxiety. Poison center reports of exposures involving ketamine surged just over 80% from 2019 through 2021, a study showed.

The tug of war is leading to conflicts between social media giants and advertisers. While Meta and its peers sometimes allow posts on the drug, they also include warnings. For example, if you search Instagram for “ketamine,” you learn the term “may be associated with the sale of drugs” and are offered a button to “get help” for substance abuse treatment. (You can also opt to get the results anyway.)

In 2023, hoping to resolve the situation, Meta referred the controversy concerning the post to its Oversight Board. The group has received $280 million in irrevocable funding since 2019. Membership includes former heads of state, prominent journalists, and human rights advocates.

For the “magical entry” post, according to a Meta missive cited in the board’s report, the company expected the board would agree and open its platforms to more posting about mind-altering drugs with therapeutic potential. But the board instead offered pointed critiques and questions, threatening the status of other ketamine posts. The board argued that, based on the company’s policies, the post inappropriately made ketamine seem like a “high,” rather than a medical experience.

“This case indicates that Meta’s strong restrictions on branded content promoting drugs and attempts to buy, sell, or trade drugs may be inconsistently enforced,” the board concluded in its report.

Indeed, in a comment to the board, the National Association of Boards of Pharmacy suggested it’s easy to find sellers offering the drug for recreational use, citing two clear examples found “with only a cursory search.”

The company’s executives disagreed. When presenting the controversy to the board, they said they expected medical use of ketamine to increase, so it should allow the post. That led, in its response, to the company brushing off some of the board’s suggestions, which could directly impact ketamine clinics’ profits. After all, Facebook and Instagram audiences overlap with their clientele, and these ads are one of the main ways they promote their brands. Consider the money at stake. One recent academic review of ketamine clinics’ advertising online, which was published in JAMA Network Open, found prices ranging from $360 to $2,500 per infusion.

When a particularly influential influencer posts about his clinic, there’s “a sharp uptick” in interest “every single time,” Jacob Silverstone, the medical director of a ketamine infusion clinic outside Miami, told KFF Health News. That interest often drives patients to his clinic, he said.

Still, despite the social media buzz, evidence for ketamine as a mental health treatment is unsettled.

“Data from clinics strongly suggest that there’s a benefit” from the drug, said Boris Heifets, a Stanford University School of Medicine professor of anesthesiology studying ketamine and other psychiatric therapies like MDMA. Ketamine, some of these studies indicate, can work for depression — even for patients who don’t respond to conventional treatments like SSRIs, or selective serotonin reuptake inhibitors.

But, Heifets said, pop culture oversells the potential. On social media, some clinics promote practices without scientific backing, he said. “It’s not clear that they have any mental health expertise,” he said.

Some clinic ads he has seen, Heifets said, dwell on the idea that the drugs act quickly and comprehensively — avoiding the lack of good data about long-term therapeutic use.

The review of ketamine clinics’ claims in ads on Google found the businesses rarely disclosed potential side effects, while aggressively marketing its benefits. Some ads falsely claimed the drug is nonaddictive, the review said.

Facebook and Instagram advertising can be similarly bullish about ketamine’s potential. A fall 2023 search of Meta’s ad library shows an armada of ketamine clinics with sunny claims, some promising “rapid relief” or telling viewers they can “say goodbye to a once-daily SSRI” or that “IV ketamine can be your light in the darkness.”

These types of claims, while downplaying risks like substance use disorders, create outsize expectations in patients, Heifets said. “You can create expectations for some of these kind of big interventions that if they’re not met — that can actually be disastrous for patients.”

The ads making such claims and minimizing or not mentioning the risks often appear to be slipping through a system with inconsistent regulations, and puzzling gaps, a review by KFF Health News suggests.

Meta’s policies require many advertisers who offer prescription drugs, and all advertisers offering drug and addiction treatment services, to undergo additional vetting by a group called LegitScript before they’re allowed to hawk their wares or services on Facebook and Instagram. (Google similarly requires certification from an outside body like LegitScript for online pharmacies, telemedicine, and addiction services.) LegitScript reviews the advertisers’ operations, like their clinical leadership and partnerships with pharmacies.

But in practice, ketamine advertisers often don’t go through this process even if they fall into a category that should. KFF Health News reviewed 27 advertisers on Meta in October and November 2023. Of those, 10 advertisers, spread over both months, either offered ketamine for drug addiction or ketamine via telehealth, and were not registered with LegitScript.

The online ads promote services, generally via telehealth, that prescribe ketamine — often in a lozenge prepared by a compounding pharmacy. There’s much less evidence for the safety and effectiveness of oral ketamine, Heifets said, compared with that of intravenously administered ketamine, which is more often studied.

Enforcement is on Meta’s agenda. In its response to the Oversight Board on the ketamine case, Meta said it has improved its automated review tools for some advertisements promoting drugs, and pledged to consider auditing its policies in the first half of this year.

Federal regulators are showing signs of concern about ketamine, particularly when obtained online. Last year, the Drug Enforcement Administration shut down the telehealth practice of at least one physician who prescribed ketamine nationwide. In October 2023, the FDA issued a warning about compounded ketamine — which these telehealth startups tend to rely on, Silverstone said.

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.

USE OUR CONTENT

This story can be republished for free (details).

By the afternoon, the company described the situation as a “cyber security” problem.

Since then, it has rapidly blossomed into a crisis.

The company, recently purchased by insurance giant UnitedHealth Group, reportedly suffered a cyberattack. The impact is wide and expected to grow. Change Healthcare’s business is maintaining health care’s pipelines — payments, requests for insurers to authorize care, and much more. Those pipes handle a big load: Change says on its website, “Our cloud-based network supports 14 billion clinical, financial, and operational transactions annually.”

Initial media reports have focused on the impact on pharmacies, but techies say that’s understating the issue. The American Hospital Association says many of its members aren’t getting paid and that doctors can’t check whether patients have coverage for care.

But even that’s just a slice of the emergency: CommonWell, an institution that helps health providers share medical records, information critical to care, also relies on Change technology. The system contained records on 208 million individuals as of July 2023. Courtney Baker, CommonWell marketing manager, said the network “has been disabled out of an abundance of caution.”

“It’s small ripple pools that will get bigger and bigger over time, if it doesn’t get solved,” Saad Chaudhry, chief digital and information officer at Luminis Health, a hospital system in Maryland, told KFF Health News.

Here’s what to know about the hack:

Who Did It?

Media reports are fingering ALPHV, a notorious ransomware group also known as Blackcat, which has become the target of numerous law enforcement agencies worldwide. While UnitedHealth Group has said it is a “suspected nation-state associated” attack, some outside analysts dispute the linkage. The gang has previously been blamed for hacking casino companies MGM and Caesars, among many other targets.

The Department of Justice alleged in December, before the Change hack, that the group’s victims had already paid it hundreds of millions of dollars in ransoms.

Is This a New Problem?

Absolutely not. A study published in JAMA Health Forum in December 2022 found that the annual number of ransomware attacks against hospitals and other providers doubled from 2016 to 2021.

“It’s more of the same, man,” said Aaron Miri, the chief digital and information officer at Baptist Health in Jacksonville, Florida.

Because the assaults disable the target’s computer systems, providers have to shift to paper, slowing them down and making them vulnerable to missing information.

Further, a study published in May 2023 in JAMA Network Open examining the effects of an attack on a health system found that waiting times, median length of stay, and incidents of patients leaving against medical advice all increased — at neighboring emergency departments. The results, the authors wrote, mean cyberattacks “should be considered a regional disaster.”

Attacks have devastated rural hospitals, Miri said. And wherever health care providers are hit, patient safety issues follow.

What Does It Mean for Patients?

Year after year, more Americans’ health data is breached. That exposes people to identity theft and medical error.

Care can also suffer. For example, a 2017 attack, dubbed “NotPetya,” forced a rural West Virginia hospital to reboot its operations and hit pharma company Merck so hard it wasn’t able to fulfill production targets for an HPV vaccine.

Because of the Change Healthcare attack, some patients may be routed to new pharmacies less affected by billing problems. Patients’ bills may also be delayed, industry executives said. At some point, many patients are likely to receive notices their data was breached. Depending on the exact data that has been pilfered, those patients may be at risk for identity theft, Chaudhry said. Companies often offer free credit monitoring services in those situations.

“Patients are dying because of this,” Miri said. Indeed, an October preprint from researchers at the University of Minnesota found a nearly 21% increase in mortality for patients in a ransomware-stricken hospital.

How Did It Happen?

The Health Information Sharing and Analysis Center, an industry coordinating group that disseminates intel on attacks, has told its members that flaws in an application called ConnectWise ScreenConnect are to blame. Exact details couldn’t be confirmed.

It’s a tool tech support teams use to remotely troubleshoot computer problems, and the attack is “apparently fairly trivial to execute,” H-ISAC warned members. The group said it expects additional victims and advised its members to update their technology.

However, there’s uncertainty about how the attack happened. ConnectWise said in a statement that it is unaware of any connection to the breach and that its internal reviews have “yet to identify Change Healthcare as a ScreenConnect customer, and none of our extensive network of managed service providers have come forward with any information regarding their association with Change Healthcare.”

When the attack first hit, the AHA recommended its members disconnect from systems both at Change and its corporate parent, UnitedHealth’s Optum unit. That would affect services ranging from claims approvals to reference tools.

Millions of Americans see physicians and other practitioners employed by UnitedHealth and are covered by the company’s insurance plans.

UnitedHealth has said only Change’s systems are affected and that it’s safe for hospitals to use other digital services provided by UnitedHealth and Optum, which include claims filing and processing systems.

But not many chief information officers “are jumping to reconnect,” Chaudhry said. “It’s an uneasy feeling.”

Miri says Baptist is using the conglomerate’s technology and that he trusts UnitedHealth’s word that it’s safe.

Where’s the Federal Government?

Neither executive was sanguine about the future of cybersecurity in health care. “It’s going to get worse,” Chaudhry said.

“It’s a shame the feds aren’t helping more,” Miri said. “You’d think if our nuclear infrastructure were under attack the feds would respond with more gusto.”

While the departments of Justice and State have targeted the ALPHV group, the government has stayed behind the scenes more in the aftermath of this attack. Chaudhry said the FBI and the Department of Health and Human Services have been attending calls organized by the AHA to brief members about the situation.

Miri said rural hospitals in particular could use more funding for security and that agencies like the Food and Drug Administration should have mandatory standards for cybersecurity.

There’s some recognition among officials that improvements need to be made.

“This latest attack is just more evidence that the status quo isn’t working and we have to take steps to shore up cybersecurity in the health industry,” said Sen. Mark Warner (D-Va.), the chair of the Senate Select Committee on Intelligence and a longtime advocate for stronger cybersecurity, in a statement to KFF Health News.

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.

USE OUR CONTENT

This story can be republished for free (details).

“Es un problema de enormes proporciones”, afirmó Bob Wachter que preside el Departamento de Medicina de la Universidad de California-San Francisco (UCSF). “Existe el riesgo de que se use artillería pesada y regulemos en exceso”.

El impacto de la IA en el sector de salud ya es generalizado. La Administración de Alimentos y Medicamentos (FDA) ha aprobado unos 692 productos de inteligencia artificial.

Los algoritmos ayudan a programar las citas de los pacientes, determinar la dotación de personal en las salas de emergencias e incluso transcribir y resumir las visitas clínicas para ahorrarle tiempo a los médicos. También han empezado a ayudar a los radiólogos a leer resonancias magnéticas y radiografías. Wachter dijo que a veces consulta una versión de GPT-4, un gran modelo lingüístico de la empresa OpenAI, para casos complejos.

El impacto de la IA —y el potencial de futuros cambios— significa que los gobiernos ya deben estar poniéndose al día.

“Los legisladores están terriblemente atrasados”, aseguró en un correo electrónico Michael Yang, gerente de OMERS Ventures, una empresa de capital riesgo. Los colegas de Yang han realizado grandes inversiones en el sector. Rock Health, una compañía similar, declaró que financistas han invertido casi $28,000 millones en empresas de salud digital especializadas en inteligencia artificial.

Según Wachter, uno de los problemas a los que se enfrentan los reguladores es que, a diferencia de los medicamentos, que dentro de cinco años tendrán los mismos componentes químicos que hoy, la IA cambia constantemente.

Por eso, la Casa Blanca ha creado una gestión junto con agencias centradas en la salud para elaborar normas que garanticen la transparencia y la privacidad en el uso de la IA en el campo médico. El Congreso también ha mostrado interés. El Comité de Finanzas del Senado tuvo una audiencia el 8 de febrero sobre la IA en la atención de salud.

Junto con la regulación y la legislación, aumenta la actividad de los grupos de presión. Una investigación de CNBC mostró que hubo un aumento del 185% en el número de organizaciones que divulgaron actividades de lobby sobre IA en 2023.

La compañía TechNet ha lanzado una iniciativa de $25 millones, que incluye la compra de anuncios de televisión, para educar a la audiencia sobre los beneficios de la inteligencia artificial.

“Es muy difícil saber cómo regular la IA de manera inteligente, ya que estamos en una fase muy temprana de invención de la tecnología”, dijo en un correo electrónico Bob Kocher, socio de la empresa de capital de riesgo Venrock, que anteriormente trabajó en la administración Obama.

Kocher ha hablado con senadores sobre la regulación de la IA. Destaca algunas de las dificultades a las que se enfrenta el sistema de salud a la hora de adoptar estos productos. Los médicos, que enfrentan riesgos de mala praxis, podrían mostrarse recelosos a la hora de utilizar tecnología que no entienden para tomar decisiones clínicas.

Un análisis de los datos de la Oficina del Censo de enero, realizado por la consultora Capital Economics, reveló que el 6,1% de las empresas de salud tenía previsto utilizar IA en los próximos seis meses, aproximadamente en la mitad de los 14 sectores encuestados.

Como cualquier producto médico, los sistemas de IA pueden plantear riesgos para los pacientes, a veces de forma curiosa. Un ejemplo: pueden inventar cosas.

Wachter recuerda que un colega, a modo de prueba, encargó a GPT-3 de OpenAI que redactara una carta de autorización a una aseguradora para una receta deliberadamente “descabellada”: un anticoagulante para tratar el insomnio de un paciente.

Pero la IA “escribió una carta preciosa”, dijo. El sistema citó “bibliografía reciente” de forma tan convincente que la colega de Wachter, por un momento, se preguntó si se le había escapado una nueva línea de investigación. Resultó que el chatbot se lo había inventado.

También existe el riesgo de que la IA agrave los prejuicios ya presentes en el sistema de salud. Históricamente, las personas de color han recibido menos atención que los pacientes blancos no hispanos. Estudios muestran, por ejemplo, que los pacientes negros con fracturas tienen menos probabilidades de recibir analgésicos que los blancos no hispanos. Este sesgo puede quedar grabado cuando la inteligencia artificial se entrena con esos datos y posteriormente actúa.

La investigación sobre la IA desplegada por grandes aseguradoras ha confirmado que eso ya ha ocurrido. Pero el problema está más extendido. Wachter explicó que la UCSF probó un producto para predecir las ausencias en las citas médicas. Los pacientes con pocas probabilidades de acudir a una visita tienen más probabilidades de que se les agende una cita dos veces.

La prueba demostró que las personas de color tenían más probabilidades de faltar a la cita. Independientemente de que el resultado fuera exacto o no, “la respuesta ética es preguntarse a qué se debe y si hay algo que se pueda hacer”, dijo Wachter.

Dejando a un lado las exageraciones, es probable que estos riesgos sigan acaparando la atención con el paso del tiempo. Expertos en IA y responsables de la FDA han insistido en la necesidad de algoritmos transparentes, supervisados a largo plazo por seres humanos: reguladores e investigadores externos. Los productos de IA se adaptan y cambian a medida que se incorporan nuevos datos. Y los científicos desarrollarán nuevos productos.

Los formuladores de leyes tendrán que invertir en nuevos sistemas para hacer un seguimiento de la IA a lo largo del tiempo, aseguró la rectora de la Universidad de Chicago, Katherine Baicker, que testificó en la audiencia del Comité de Finanzas. “El mayor avance es aquel en el que aún no hemos pensado”, dijo en una entrevista.

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.

USE OUR CONTENT

This story can be republished for free (details).

“It’s an incredibly daunting problem,” said Bob Wachter, the chair of the Department of Medicine at the University of California-San Francisco. “There’s a risk we come in with guns blazing and overregulate.”

Already, AI’s impact on health care is widespread. The Food and Drug Administration has approved some 692 AI products. Algorithms are helping to schedule patients, determine staffing levels in emergency rooms, and even transcribe and summarize clinical visits to save physicians’ time. They’re starting to help radiologists read MRIs and X-rays. Wachter said he sometimes informally consults a version of GPT-4, a large language model from the company OpenAI, for complex cases.

The scope of AI’s impact — and the potential for future changes — means government is already playing catch-up.

“Policymakers are terribly behind the times,” Michael Yang, senior managing partner at OMERS Ventures, a venture capital firm, said in an email. Yang’s peers have made vast investments in the sector. Rock Health, a venture capital firm, says financiers have put nearly $28 billion into digital health firms specializing in artificial intelligence.

One issue regulators are grappling with, Wachter said, is that, unlike drugs, which will have the same chemistry five years from now as they do today, AI changes over time. But governance is forming, with the White House and multiple health-focused agencies developing rules to ensure transparency and privacy. Congress is also flashing interest. The Senate Finance Committee held a hearing Feb. 8 on AI in health care.

Along with regulation and legislation comes increased lobbying. CNBC counted a 185% surge in the number of organizations disclosing AI lobbying activities in 2023. The trade group TechNet has launched a $25 million initiative, including TV ad buys, to educate viewers on the benefits of artificial intelligence.

“It is very hard to know how to smartly regulate AI since we are so early in the invention phase of the technology,” Bob Kocher, a partner with venture capital firm Venrock who previously served in the Obama administration, said in an email.

Kocher has spoken to senators about AI regulation. He emphasizes some of the difficulties the health care system will face in adopting the products. Doctors — facing malpractice risks — might be leery of using technology they don’t understand to make clinical decisions.

An analysis of Census Bureau data from January by the consultancy Capital Economics found 6.1% of health care businesses were planning to use AI in the next six months, roughly in the middle of the 14 sectors surveyed.

Like any medical product, AI systems can pose risks to patients, sometimes in a novel way. One example: They may make things up.

Wachter recalled a colleague, as a test, assigning OpenAI’s GPT-3 to write a prior authorization letter to an insurer for a purposefully “wacky” prescription: a blood thinner to treat a patient’s insomnia.

But the AI “wrote a beautiful note,” he said. The system so convincingly cited “recent literature” that Wachter’s colleague briefly wondered whether she’d missed a new line of research. It turned out the chatbot had made it up.

There’s a risk of AI magnifying bias already present in the health care system. Historically, people of color have received less care than white patients. Studies show, for example, that Black patients with fractures are less likely to get pain medication than white ones. This bias might get set in stone when artificial intelligence is trained on that data and subsequently acts.

Research into AI deployed by large insurers has confirmed that has happened. But the problem is more widespread. Wachter said UCSF tested a product to predict no-shows for clinical appointments. Patients who are deemed unlikely to show up for a visit are more likely to be double-booked.

The test showed that people of color were more likely not to show. Whether or not the finding was accurate, “the ethical response is to ask, why is that, and is there something you can do,” Wachter said.

Hype aside, those risks will likely continue to grab attention over time. AI experts and FDA officials have emphasized the need for transparent algorithms, monitored over the long term by human beings — regulators and outside researchers. AI products adapt and change as new data is incorporated. And scientists will develop new products.

Policymakers will need to invest in new systems to track AI over time, said University of Chicago Provost Katherine Baicker, who testified at the Finance Committee hearing. “The biggest advance is something we haven’t thought of yet,” she said in an interview.

KFF Health News is a national newsroom that produces in-depth journalism about health issues and is one of the core operating programs at KFF—an independent source of health policy research, polling, and journalism. Learn more about KFF.

USE OUR CONTENT

This story can be republished for free (details).