Silas Inman

home

authors

silas-inman

After 2 years of regulatory hurdles, the US Food and Drug Administration has approved a new tool for patients with mental illnesses taking aripiprazole tablets (Abilify)—a digital sensor that reports when patients have taken their medication (Abilify MyCite).

For the new digital pill, a sensor that is approximately the size of a grain of sand is embedded into the aripiprazole tablet, according to Proteus Digital, the company that develops the sensor. Upon reaching the fluids in the stomach, the sensor begins to report that it has been ingested to a patch worn on the skin, which is synced to an application on a smart phone. In addition to reporting that it has been ingested, the sensor also records drug activity data.

The application for aripiprazole with the embedded sensor was originally accepted by the FDA for review in September 2015, and was subsequently rejected, with a request from the FDA for more information on the digital drug. A resubmission of the new drug application was accepted by the agency in May 2017.

Aripiprazole was initially approved by the FDA in 2002 as a treatment for patients with schizophrenia, with other indications granted for other mental illnesses. The sensor that is used along with the medication was first cleared for use by the FDA in 2012; however, the approval of the pill and the sensor together represents a milestone for the FDA. The agent and sensor are now approved for schizophrenia, acute treatment of manic and mixed episodes associated with bipolar I disorder and as an add-on treatment for depression in adults.

“Being able to track ingestion of medications prescribed for mental illness may be useful for some patients,” Mitchell Mathis, MD, director of the Division of Psychiatry Products in the FDA’s Center for Drug Evaluation and Research, said in a statement. “The FDA supports the development and use of new technology in prescription drugs and is committed to working with companies to understand how technology might benefit patients and prescribers.”

The FDA advised that healthcare professionals should show patients how to use the drug, patch, and app before prescribing the medication. Data from the tracker can be kept private for the patient alone to see, with the option to share data with healthcare professionals or other individuals, if desired. On the app, patients can also share information on levels of rest and mood.

The ability to track ingestion of the medication is meant to cut back on medical waste while improving adherence, although data to support this are lacking for Abilify MyCite, according to the FDA. Estimates suggest that 50% of patients with chronic conditions do not take their medications, costing the US healthcare system upwards of $100 billion in avoidable costs. Additionally, according to findings published in the Journal of Clinical Psychiatry, patients with schizophrenia are particularly vulnerable to non-adherence.

In addition to lacking data supporting improvements in adherence, the FDA also noted that the patch and sensor should not be used in an emergency to ensure treatment has been taken. In general, communication between the pill, patch, and app are delayed, and data are not available in "real-time," according to the FDA.

Keeping with the longstanding label for aripiprazole, Abilify MyCite was also approved with a Boxed Warning concerning an increased risk of death when used as a treatment for elderly patients with dementia-related psychosis. Additionally, the medication has been associated with increased suicidal thoughts and behavior in children, adolescents, and young adults taking antidepressants.

In clinical trials establishing the efficacy of aripiprazole, the most common adverse events were nausea, vomiting, constipation, headache, dizziness, akathisia, anxiety, insomnia, and restlessness. The common adverse events associated with the sensor were related to the patch, and were predominantly skin irritation.

Articles

The FDA has approved a new tool for patients with mental illnesses taking aripiprazole tablets&mdash;a digital sensor that reports when patients have taken their medication.
 

First "Digital Pill" Gains FDA Approval

In a monumental step toward personalized medicine, the U.S. Food & Drug Administration (FDA) has granted an approval to the chimeric antigen receptor (CAR)-modified T-cell therapy known as axi-cel (axicabtagene ciloleucel; Yescarta) for patients with certain types of lymphoma.

The novel T-cell therapy was approved after showing high levels of complete remission (CR) in a phase 2 study known as ZUMA-1. According to the FDA, the objective response rate (ORR) with axi-cel was 72% and the CR rate was 51% (95% CI, 41%-62%). The median durability of CRs was not yet reached (95% CI, 8.1-not estimable). At a 6-month analysis, 80% of patients treated with axi-cel remained alive.

Although ZUMA-1 was a single-arm study, work has been done to compare axi-cel to the current standard of care for patients in a study known as SCHOLAR-1. In a standardized comparison of the two trials, the ORR was 74% with axi-cel versus 20% with the standard of care (odds ratio, 7.97; 

 <.0001). Moreover, the CR rate with axi-cel was 51% compared with just 6% in SCHOLAR-1.

“Engineered cell therapies like Yescarta represent the potential for a changing treatment paradigm for cancer patients,” David Chang, MD, PhD, Worldwide Head of Research and Development and Chief Medical Officer at Kite, said in a statement. “Together, Gilead and Kite will accelerate studies of CAR T therapy in multiple blood cancers and advance other cell therapy approaches for solid tumors, with the goal of helping patients with diverse cancers benefit from this new era of personalized cancer therapy.”

The novel immunotherapy manufacturing process requires several steps, for which hospitals systems will need special training and certification. Each treatment of the T-cell therapy is customized using a patient's own immune cells, starting with T cells collection via apheresis, shipment to a manufacturing facility, and genetic modification of the cells to express a CAR specific to CD19, which is commonly over-expressed in B cell malignancies allowing the modified immune cell to target and kill the lymphoma cell.

Kite Pharma, which was recently acquired by Gilead, plans to market axi-cel at a list price of $373,000. The company plans to manufacture the treatment in El Segundo, California, which was the facility used for the ZUMA-1 trial, wherein cells were successfully manufactured 99% of the time and the median turnaround time was 17 days.

Axi-cel was approved with a boxed warning regarding cytokine release syndrome (CRS), which occurred in 13% of patients in the ZUMA-1 trial. To address the risk of CRS and neurologic toxicities, which 28% of patients experienced, the FDA approved axi-cel with a risk evaluation and mitigation strategy (REMS), which includes elements to assure safe use (ETASU). Additionally, certification and training will be required before hospitals will be cleared to administer the T cell therapy. The required training will focus on identifying and managing CRS and neurologic toxicity.

“The FDA approval of Yescarta is a landmark for patients with relapsed or refractory large B-cell lymphoma.” Arie Belldegrun, MD, FACS, Founder of Kite, said in a statement. “We must also recognize the FDA for their ability to embrace and support transformational new technologies that treat life-threatening illnesses. We believe this is only the beginning for CAR T therapies.”

Axi-cel is the second CAR T-cell therapy approved by the FDA, with the first, labeled tisagenlecleucel (Kymriah), approved in late August for patients with acute lymphoblastic leukemia, a rare blood cancer commonly affecting children. The FDA anticipates that more agents in this class will gain approval in the future and is taking steps to establish a system for evaluation of these adaptive T-cell therapies. Axi-cel was approved following a priority review and under the FDA's breakthrough therapy program.

"We will soon release a comprehensive policy to address how we plan to support the development of cell-based regenerative medicine. That policy will also clarify how we will apply our expedited programs to breakthrough products that use CAR-T cells and other gene therapies," Scott Gottlieb, MD, FDA Commissioner, said in a statement. "We remain committed to supporting the efficient development of safe and effective treatments that leverage these new scientific platforms.”

Peter Bach, MD, On Logistical Considerations of Treating with Kymriah

Kymriah: an (Expensive) Precision Medicine Breakthrough

Talking Value, Culture, and CAR-T with the CMO of Mayo Medical Labs

The "new era of personalized cancer therapy” is here: effective, novel, and expensive.

FDA Approves Second CAR T-cell Therapy

In perhaps the most anticipated legislative act since November's contentious election, House Republicans today proposed a replacement for the Affordable Care Act (ACA).

Dubbed the American Health Care Act, the new proposal would eliminate the individual mandate that imposes a tax penalty on Americans without heath insurance. Some of the restrictions regarding pre-existing conditions would remain, as would the provision to grant coverage for dependents until the age of 26. Certain refundable tax credits that exist under the ACA would stay in place for families with incomes lower than $14,000.

Republicans hope the new bill will pass Congress within the next 30 days.

Additionally, age-based credits would be built into the bill, starting at $2,000 for those under age 30 and reaching $4,000 for those over 60. The maximum per household credit will be $14,000.

“The American Health Care Act is a plan to drive down costs, encourage competition, and give every American access to quality, affordable health insurance,” House Speaker Paul Ryan (R-WI), said in a statement. “It protects young adults, patients with pre-existing conditions, and provides a stable transition so that no one has the rug pulled out from under them.”

In addition to repealing a number of ACA-related taxes, other changes in the bill focus on health savings account expansions, a per capita allotment for states, a patient and state stability fund of $100 billion, and continued tax credits to help pay for insurance, including the age-based incentives. These new tax credits would be phased out for individuals making more than $75,000 and for families making more than $150,000.

The new bill also repeals the employer mandate, which imposes a fee on companies with more than 50 employees if they do not provide insurance for at least 95% of full time employees. The removal of the individual and employer mandates would take effect retroactively for the 2016 calendar year.

“Obamacare is rapidly collapsing. Skyrocketing premiums, soaring deductibles, and dwindling choices are not what the people were promised seven years ago,” Ryan said. “It’s time to turn a page and rescue our health care system from this disastrous law.”

The announcement of the American Health Care Act drew criticism from Democrats. In a statement, Nancy Pelosi (CA-D) mocked the proposal, calling it the “Make America Sick Again” bill.

“Tonight, Republicans revealed a Make America Sick Again bill that hands billionaires a massive new tax break while shifting huge costs and burdens onto working families across America,” said Pelosi. “Under the Republican bill, older Americans will be exposed to soaring new costs, and millions of families will lose their health coverage.  The GOP bill shortens the life of the Medicare Trust Fund and pushes millions of seniors and disabled Americans who depend on Medicaid coverage into the cold.”

Elements of the bill had been in discussion since late February, when what appeared to be an early draft made its way to the press. That also included the age-based credits, which drew criticism for being insufficient. Republicans may argue increased competition and lower costs could stretch those credits further. 

The call to repeal the ACA and replace it with a different set of legislature has echoed through the halls of Congress since the act was signed. In his first Executive Order while in office, President Donald J. Trump called for a “prompt repeal” of the ACA. Prior to the Executive Order, Congress passed a budget resolution to defund part of the ACA. The Senate passed to budget change in a vote of 51-48 and the House voted 227-198. This resolution was passed as a “budget reconciliation,” to avoid filibuster, which is a similar tactic used to introduce the American Health Care Act.

Before becoming law, the American Health Care Act will still need to pass a vote from the House of Representatives and Senate before ultimately being signed by President Trump.  

ACA REPLACEMENT PROPOSED: Republicans Announce Plan to Eliminate Individual Mandate

IBM Health and Medtronic have teamed up to create a patient-facing mobile technology with a one-on-one coaching component, to help patients better manage their diabetes while at home. The program, known as Medtronic Turning Point, was presented at the IBM booth during the HIMSS17 meeting.

The device used for the program consists of a Bluetooth-enabled blood glucose meter (BGM) and Medtronic's iPro 2 Professional Continuous Glucose Monitoring (CGM) system. Additionally, using a telehealth solution on an App, a health coach educates the patient on how best to carry out their doctor's recommended care plan and provides exercise and nutrition counseling, along with real-time intervention based on the data points collected.

The need for a remote device to help control diabetes stems from the fact that over 90% of diabetes care is carried out by the patient at home. It is estimated by the American Diabetes Association (ADA) that managing diabetes costs nearly $175 billion a year in the United States, placing importance on ensuring this care is delivered appropriately. This is particularly true, as the number of new diabetes cases continues to skyrocket.

Prior to the HIMSS17 meeting, the system was piloted at Methodist Healthcare Ministries. Within the first 3 months of using the program, patients had an average 2% reduction in their A1C levels. There were improvements in A1C noted across 83% of participants. Furthermore, patients experienced weight loss and a decline in blood pressure and cholesterol. These drops were associated with nutrition and exercise counseling.

The goal of the system is to get A1C levels to below 7%, as recommended by the ADA. In a series of examples highlighted by IBM and Medtronic, the main benefits come from the education provided on diet and exercise. Additionally, as Watson digs into the data, other recommendations may begin to emerge.

The Medtronic Turning Point program is now being expanded to a greater number of health systems, thanks to the computing power and capabilities provided by IBM. Additionally, the collaboration with IBM Health has invoked the power of IBM Watson's cognitive computing capabilities. Medtronic has already built a database of over 125 million patient days, from its insulin pumps and glucose monitors alone, which Watson is analyzing.

“We believe that we can play a leadership role, but we can’t do it alone, and that’s where partnerships like the one we have with IBM come in,” Hooman Hakami, Executive Vice President and President, Medtronic Diabetes, said in an case study published to the Medtronic website. “So we can take their capability, apply it to the knowledge and the products and the capability that we have to try to do something truly transformational.”

IBM Health and Medtronic have teamed up to create a patient-facing mobile technology with a one-on-one coaching component, to help patients better manage their diabetes while at home.

IBM, Medtronic Focus on Remote Diabetes Counseling

IBM has announced the next step for Watson Health: a value-based care management solution. The new system, built on the Watson supercomputing artificial intelligence backbone, will combine, analyze, and make predictions based on data in electronic health records (EHR), hospital administrative and clinical databases, claims data, and other sources.

The new Watson Health product was announced during a keynote address by IBM chairman, president, and CEO Ginni Rometty. The new value-based system, which is completely cloud based, gives providers and insurers the ability to identify potential risk factors and flags to prevent events at a population, group, or individual basis.

"This idea of cognitive healthcare, systems that learn, this is real and it is mainstream and it is here and it can change almost everything about healthcare," said Rometty during her talk.

Watson Health is already integrated into healthcare systems across the globe and has been gathering data and learning for the past few years. Watson for Oncology, with a focus on personalized medicine, is rolling out across China, India, Thailand, and Finland, Rometty announced. In India, specifically, there is a shortage of oncologists, with just 1 doctor for every 1600 patients.

"We're on a path for there to be 22 million new cancer cases a year, and 70% of the news cases are in developing countries," said Rometty. What once took doctors in India 20 minutes to gather now takes just 20 seconds with Watson, she added.

Watson for Oncology has also made an impact in the United States, where oncologists at top cancer centers across the country helped to train the artificial intelligence platform. At the UNC Lineberger Cancer Center, Watson and physician recommendations matched for nearly 100% of 1000 cases, with Watson detecting greater clinically actionable items in 30% of cases.

Based on its ability to detect these obscure findings, Watson for Genetics is now being incorporated into tests from Quest Diagnostics and Illumina. Now, Rometty announced, Atrius Health is incorporating Watson cognition directly into its EHR. "Precision medicine is really starting to come alive," she said.

Outside of oncology, Watson already has a broad reach, especially within the United States federal government. The Watson platform now serves 50 different Health and Human Services departments and analyzes 44% of all Medicaid cases. It also works with the health agencies of 18 countries, Rometty noted.

The expanded use of systems like Watson will require a reconsideration of existing data architectures, particularly given the breadth of data sources that can be used and transferred to the cloud-based services, Rometty said. To utilize a cognitive system, a full spectrum of data will need to be pulled together, including both unstructured and structured data. In medicine, this includes a wealth of scans and images, which makes up 90% of data and were previously not utilized.

With all this now being possible, Rometty noted that a golden era was on the horizon for healthcare, one she called the cognitive era. "This is a time to play offense, because you could build this world," she said. "This cognitive world will be a healthier world, it will be more secure. It will in the end be less wasteful. It will be productive, it will be personalized. And in the end, it's a fairer, more diverse, and I believe more just world."

​IBM has announced the next step for Watson Health: a value-based care management solution. The new system, built on the Watson supercomputing artificial intelligence backbone, will combine, analyze, and make predictions based on data in electronic health records, hospital administrative and clinical databases, claims data, and other sources.

IBM Watson Health Launches Value-Based Care Solution

Social media represents a huge opportunity to improve patient communication and care but comes with a variety of added risks and compliance hurdles that must be addressed, according to a presentation at the HIMSS17 meeting.

Social media can effectively be used for education, communication, and marketing but can also result in HIPAA violations, if not used appropriately. To counter the risks, IT and compliance must be put into place to evaluate and prevent the risks, while also capturing communications for compliance. Additionally, employee policies and training are essential.

"Social media can be used to engage and inform patients in strategic ways to facilitate utilization of specific proven therapies. If can be used to send patients to trusted sources," social media expert Kevin Campbell, MD, from North Carolina Heart and Vascular, said during the presentation. "Social media can be effective in promoting new therapies and allowing patients to participate in treatment plans."

There have been various stages in the evolution of communication between the provider and the patient. Throughout this process of change, there was a need for compliant capture and archiving of the conversations and privacy to ensure HIPAA compliance. These systems were put in place to improve information delivery and response.

Early in the process, communication was primarily conducted over email; however, this has broadened substantially to include social media and a variety of chat clients, such as Slack. These new channels still need to be stored, just like the emails before them, which presents huge data archiving challenges.

These hurdles scared many physicians away from using social media, which is problematic, since most patients turn to social media and the internet for medical information. "Increasingly patients go to the internet for information and come to see their providers armed with information," said Campbell.

In general, more than 75% of patients seek information online after talking to their doctor. Consumers have ranked their trust in various online sources, placing doctors as the most trusted source (61%) followed by hospitals (55%), health insurers (42%), and drug companies (37%).

The most effective social media tools for reaching patients are Twitter, Facebook Live, and blogging, believes Campbell. "It's not how much you talk, it’s what you say and when you say it," he said. "You can have 14 tweets in 2 days and have 14 million impressions. In terms of engagement, there is 6000% more engagement with video."

To stay compliant, the latest research and treatments can be discussed but engagement with patients should not mimic a doctor-patient relationship, Campbell noted. It can also be used to teach more than patients, "We discussed a certain procedure with fellows in Germany very successfully," he noted.

Meaningful use of social media also opens the ability to consult and market skills, knowledge, and abilities for the physician. This can help doctors become nationally known as experts or improve referrals. The key to success is engagement, noted Campbell, which can take place over a conference hashtag, Facebook support pages, blogs, and Twitter chats.

With these new social platforms and strategies there is a wave of new risks, noted Michael Rutty, an expert on Information Archiving for the company Actiance. He stressed keeping HIPAA, regulatory policy, and cybersecurity threats front of mind. This raises the risk and concerns of data breaches, especially since there are now potentially dozens of applications, Rutty noted.

Adding to this, social media updates are now admissible in court, as evidence of a breach. To address this, these social media updates need to be archived and searchable in their original forms, not screen captures, representing a huge data compliance issue. "Unless you have intelligence around all the different data points, it is almost meaningless," warned Rutty.

Despite these added risks and challenges, social media is here to stay. These applications help improve education and awareness, the speakers agreed. Instead, software and new applications are being produced and developed to better mitigate the risks.

As an example, artificial intelligence is being developed to crawl through social media updates to find new side effects and benefits of treatment, noted Campbell. This same type of system could help archive these updates. Overall, the potential is endless, and key stakeholders need to take advantage of the opportunity, he concluded.

For a more in depth discussion on the potiential benefits of social media data mining within the heathcare industry, listen in to HRA's webinar "

Advances in Digital Data Mining Create New Opportunities for Research

Social media represents a huge opportunity to improve patient communication and care but comes with a variety of added risks and compliance hurdles that must be addressed.

Social Media Risky but Required for Health Care Delivery

The University of Texas (UT) Southwestern launched a comprehensive and successful Accountable Care Organization (ACO) with significant savings using the help of data analytics and a series of customized dashboards and reports to elicit physician engagement and buy-in, according to a presentation at the HIMSS17 meeting.

Overall, since being put into place, the UT Southwestern system has resulted in a 20% improvement in ACO/Healthcare Effectiveness Data and Information Set (HEDIS) measures. Moreover, it generated $6 million in savings during the first year of the program and $30 million in the second year.

"UT is really driving impressive results and health IT is really at the center of this transition," said Sam Stearns, MS, MBA, Vice President, Analytic Consulting, Verscend Technologies, during the presentation. Verscend is working with UT Southwestern on the solution, along with other vendors.

"This is all based on a foundation of data sharing with monthly reports and communications across a very broad physician network. Its all around driving results, whether that's better quality or savings," he noted.

UT Southwestern launched their Accountable Care Network (UTSCAN) in 2014. At this point, they had 17,000 lives under value-based contracts. In 2015, they were the largest participant in the ACO program, and by 2016 they had 177,000 lives covered.

To help implement the program, UTSCAN developed regional population management units, or pods, to help break up over 3000 physicians into more than 45 manageable groups. These pods meet monthly to share data, review reports, improve their referral process, and discuss best practices. Getting physician buy-in and commitment to accountable care was key to making the system work, said Christy Cawthon, during the presentation.

"With value-based initiatives going on, there are a lot of programs out there and it's important to keep trying new strategies," said Cawthon, Manager, Decision Support, University of Texas Southwestern Medical Center. "Define your strategy, and execute on it. Build a partnership with your physicians and stay focused, as accountable care is a marathon, not a sprint."

At a high level, data for the UTSCAN system are pulled from databases for paid claims, electronic medical records (EMR), and admission, discharge, and transfers (ADT). From these data sources, UTSCAN has developed predictive analytics applications and reports, to fully integrate data across the enterprise. These data are shared with all providers across pods, to engage providers in the metrics and costs.

Each provider has access to the dashboards and reports to track their performance against key quality measurements and, importantly, each other, fostering competition to get the best results. For this, UTSCAN extracted and standardized all EMR data across the ACO, and then drilled down on specific care gaps. This gave providers clinically-related measures and targets, and, from a system level, this allowed for resource allocation.

The dashboard also provides cost analyses, including trending costs and utilization efficiency calculations. Each team can view different sets of data and tools. This further allows the provider to focus in on high-risk patients, to ensure these individuals are addressed before an incidence, the presenters noted.

Home health utilization also became a focus of the program, which is using paid claims data and a risk adjustment to determine how best to use this approach. Using this calculation, a list of home health agencies (HHA) was narrowed down to 44 with ≥90% efficiency. This was cross checked with CMS STAR ratings to narrow down the list to 20 recommended HHAs, which UTSCAN uses preferentially.

"The CMS STAR rating is a practical useful approach to help bring quality information that compliments the cost information. This helps provide value," said Stearns.

To optimize the use of home health, UTSCAN first got physician buy-in for the program and created a team focused on home health utilization. This system was fed into the dashboard, to provide a report on individuals and the HHA costs. This helped each physician engage in the conversation. Using this system, there was a 15% reduction in home healthcare costs.

"We don't want to eliminate HHA, we just want to get people to the right care setting, so they can better use the tools that are out there," said Cawthon.

However, no system is perfect, as noted by a user of the UTSCAN pod system. Oftentimes, the system will assign a patient to a provider who may have met the individual once 3 years ago, he said anecdotally. When it comes to contacting and meeting gaps, this disconnection causes issues. Despite this, the commenter was optimistic that a solution was out there for this issue.

The next steps for the system is to continue to optimize the home healthcare component while also monitoring the quality and efficiency of each HHA, according to the presenters. Additionally, the reports and dashboards will continue to evolve, as new data sources become available and are leveraged.

The University of Texas Southwestern launched a comprehensive and successful Accountable Care Organization with significant savings using the help of data analytics and a series of customized dashboards and reports to elicit physician engagement and buy-in

Data Analytics Essential for Optimizing Accountable Care

Ransomware, which is expanding at a rapid rate, has crippled several hospital systems and hurt patient care, warranting close attention and proper steps to address these concerns, according to a presentation during the HIMSS17 meeting.

Prevention and mitigation of these risk are possible, using an appropriate cybersecurity framework. It is important that the system put in place to protect against ransomware should also be customized, based on the hospital system, as it is not a one-size-fits-all solution. Additionally, training of all staff is key to preventing an event.

"Evaluate which prevention measures are appropriate for your environment in light of the risks presented," said Brian Balow, JD, Member, Dawda Mann PLC, during the presentation. "It must be a customized approach. It can't be tossed together based on what worked for someone else."

Ransomware gains access to health data and blocks the organization from getting into its own system unless a "ransom" is paid. In most cases, these attacks gain access to protected health information (PHI) on patients, and threaten to leak this information, which could cause broader implications or fines from the Office of Civil Rights (OCR).

Ransomware is becoming more prevalent, with a milestone publicity event at the Hollywood Presbyterian Medical Center in February 2016. In this situation, the ransom was $16,664 (which was paid as 40 bitcoins). After this event, there were several more incidences in 2016, with a growing frequency. In fact, hospitals are the primary target for ransomware attacks, with Experian anticipating a ramp up in the attacks in 2017. According to reports, ransomware has now become a billion-dollar business.

"Ransomware is really exploding—ransomware as a service. It has become an industry in and of itself. They develop it and then they sell it," said Balow. "This is really an unintended byproduct of the Affordable Care Act, with its information technology and data requirements."

In a poll of the audience, more than 50% of the attendees reported experiencing a ransomware attack at their institution. Moreover, they noted that in over 60% of attacks the target is people and patient records not the technology. The audience consisted of an array of C-suite executives and Chief Medical Officers/Physicians.

"The prevalence of this is much higher than what we read in the press," noted Balow. Many breaches go unreported or unnoticed, he added.

These attacks can enter the system through several means, including suspicious emails, often with subjects about HIPAA audits. Other techniques include brute force hacking, various types of phishing emails, infected downloads, vulnerable web servers, and web-based instant messaging applications.

"If you're using third party technologies, we don't know what they're doing. We need to be aware of what the staff are doing," Tatiana Melnik, JD, Attorney, Melnik Legal PLLC, said during the presentation. "We often find that staff are using services like Dropbox, without anyone knowing it is being used—and now that PHI can be anywhere."

Melnik, a lawyer practicing in Florida, noted that not all ransomware incidences need to be reported to the OCR. If an event occurs, the next steps should be customized based on the type of ransomware used and the data that was accessed. However, in the views of the OCR, every event should be reported.

The OCR will not always pursue action when there is a breach; however, to date, there have been more than $30 million in settlements related to PHI leaks. Some of these settlements were related to a lack of timely notification of the breach, so action is required quickly if there is a reportable incidence.

"Bottom line is that it comes down to a business decision. What are the risks, and are you comfortable with the decision," said Melnik. "Many people will just report, to avoid the risks of the OCR investigating." The enforcement environment is extremely complex, she added. In addition to the OCR, if there is a report, it could potentially be a tidal wave of lawsuits, depending on the data that was breached.

In the case of a breach, Melnik and Balow recommended first contacting the security officer, who would then contact internal or external technical security. They recommended bringing in a legal counsel as the third step in the process, followed by initiating redundant systems, if available.

After these steps were in place, an investigation on the scope of encrypted data released should begin, to determine if the incidence needs to be reported. If needed, forensic resources should be engaged and law enforcement should be contacted, preferentially the FBI for larger leaks, the speakers recommended. "Local law enforcement is not equipped for this type of issue," Balow noted.

In addition to knowing the information that was leaked, it is also extremely important to know what is covered under your insurance policy. Before contacting insurance, Melnik advised being acutely aware of all the details within the insurance policy. "It can be very complicated," Balow said. "You need someone qualified to discuss the ins-and-outs of these conditions."

Importantly, they noted that following a breach, all communication should be done over the phone or in person. Email blasts should be avoided and other files should not be opened, to avoid spreading the virus. Although payment might be unavoidable, it should not be pursued immediately. Payment should only be issued after a thorough assessment.

"If you're going to pay, you better be sure it isn't going to happen again," Balow cautioned. "At this point, you're an easy target."

Ransomware, which is expanding at a rapid rate, has crippled several hospital systems and hurt patient care, warranting close attention and proper steps to address these concerns.