Clinical laboratories are particularly tasty targets for cybercriminals seeking the abundance of protect health information contained in patient electronic health records
Recent data from cybersecurity company Netwrix of Frisco, Texas, shows that 84% of healthcare organizations—including clinical laboratories and pathology groups—caught at least one cyberattack in the past year and “69% of them faced financial damage as a result.” That’s according to the company’s latest Hybrid Security Trends Report which notes that 24% of healthcare organizations are “fully cloud-based,” as opposed to just 11% of non-healthcare industries.
“Phishing was the most common type of incident experienced on premises, similar to other industries. Account compromise topped the list for cloud attacks: 74% of healthcare organizations that spotted a cyberattack reported user or admin account compromise,” the Netwrix report notes.
Phishing, where cybercriminals send fake emails and texts to unsuspecting employees that trick them into providing private information, continues to be one of the most prevalent cyberthreats experienced by healthcare organizations and often serves as the catalyst for much larger and more dangerous cyberattacks.
This is particularly dangerous in clinical laboratories where as much as 80% of protected health information (PHI) in patients’ electronic health records (EHRs) is laboratory test results and other personal medical data.
“Protected health information (PHI) is one of the most expensive types of data sold on darknet forums, which makes healthcare organizations a top target for cybercriminals, said Ilia Sotnikov (above), security strategist and VP of user experience at Netwrix, in the report. Clinical laboratory patient electronic health records are particularly weighted toward PHI. (Photo copyright: Netwrix.)
Don’t Open That Email!
Typical phishing scams begin with innocent-looking emails from companies that appear to be legitimate and often contain language that implies urgent action is needed on the part of the user. These emails can be very convincing, appear to originate from reputable companies, and usually instruct users to open an attachment contained in the email or click on a link that goes to a known company website. However, the site is a fake.
Once the harmful file attachment is opened, users will be directed to download fake software or ransomware that attempts to capture the user’s personal information. When visiting a malicious website, consumers will often receive pop-ups with instructions for updating information, but the true purpose is to harvest personal data.
Never provide any personal information to an unsolicited request.
If you believe the contact is legitimate, initiate a contact with the organization using verified data, usually via telephone.
Never provide any passwords over the phone or in response to an unsolicited Internet request.
Review any accounts, such as bank statements, often to search for any suspicious activity.
“Healthcare workers regularly communicate with many people they do not know—patients, laboratory assistants, external auditors and more—so properly vetting every message is a huge burden,” said IT security expert Dirk Schrader, VP of security research at Netwrix, in the report. “Plus, they do not realize how critical it is to be cautious, since security awareness training often takes a back seat to the urgent work of taking care of patients. Combined, these factors can lead to a higher rate of security incidents.”
Top 10 Brands Faked in Phishing Scams
Phishing emails often appear to be from legitimate companies to lull the recipient into a false sense of security. In a January 22 report, Check Point Research (CPR) announced its latest Brand Phishing Ranking for the fourth quarter of 2024. The report reveals the brands that were most frequently impersonated in phishing attacks by cybercriminals for the purpose of stealing personal information from consumers.
According to the CPR report, 80% of disclosed brand phishing incidents occurred within just 10 brands (listed below with each brand’s percentage of phishing attacks). They are:
According to the report, fraudulent domains “replicated official websites to mislead shoppers with fake discounts, ultimately stealing login credentials and personal information. These fraudulent sites replicate the brand’s logo and offer unrealistically low prices to lure victims. Their goal is to trick users into sharing sensitive information, such as login credentials and personal details, enabling hackers to steal their data effectively.”
Steps Clinical Labs Can Take to Protect Patients’ PHI
Clinical laboratories and pathology groups can take precautions that minimize the risk of allowing cybercriminals access to their patients’ PHI.
“A core defense strategy is to minimize standing privileges by using a privileged access management (PAM) solution. Another is to implement identity threat detection and response (IDTR) tools to quickly block malicious actors using compromised credentials,” said Ilia Sotnikov, security strategist and VP of user experience at Netwrix, in the report.
The threat of phishing scams is a lingering issue that everyone in healthcare should be aware of and take necessary precautions to recognize and prevent having one’s PHI stolen. Clinical laboratory management should constantly remind lab personnel and contractors to be vigilant regarding fake emails and texts from well-known brands that ask for private information.
Encouraging the next generation of clinical laboratorians could contribute to solving current staffing shortages in the nation’s medical laboratories
This holiday season brings an exciting new gift that will catch the attention of Dark Daily’s readers. It’s a children’s book that introduces young readers to working in clinical laboratories!
“This is a steppingstone into the career of laboratory science, so we should share what we do with the world. Any lab scientist who has a child, niece, nephew, or grandchild in their life should give this gift. It could open an entirely new world of possibilities for them. It could make them excited for science,” said the book’s author Kelli Garcia, microbiology supervisor at Saint Francis Hospital and Medical Center, part of Trinity Health of New England, in an exclusive interview with Dark Daily.
“Most children have a small idea or image of what options are available in medicine or science—usually a doctor or nurse. They never see the people that work behind the scenes or different areas,” Garcia noted.
She penned her book with hopes of calling attention to medical fields beyond those most commonly seen by children, as she also had only learned about the field when she was graduating from college.
“I Want to be a Laboratory Scientist,” is now available at many major retailers, including Amazon and Barnes and Noble. (Graphic copyright: Kelli Garcia.)
Opening Children’s Eyes
Garcia’s journey took about four years from the moment she began writing to finally finding a publisher for her 36-page book that’s geared toward 6-8 year-olds. “I spent many hours writing and rewriting so it wouldn’t be too specific but also not too minimal that the point and purpose would be missed,” she said, adding that her daughter was her muse.
Garcia’s own children have excitedly brought the book to their schools and shared them with their local library. Such steps could help a field that is working hard to keep up with demand.
“There are so many ways to engage children in different areas of science as long as we make those areas known to them. They don’t all wants to be a doctor or nurse, but some still want to help in another way. This book will show them you can be in medicine helping people but behind the scenes—the unsung hero,” microbiologist and children’s book author Kelli Garcia (above) told Dark Daily. She added, “It will also make them aware that laboratory science is a rewarding career and show that it’s not just doctors and nurses who are involved in treating patients.” (Photo copyright: Kelli Garcia.)
Those low numbers are not going unnoticed. The Medical Laboratory Personnel Shortage Relief Act of 2024, introduced in September by State Representative Deborah Ross (NC-02), was created to help bring a much-needed boost to the field. The Act brought in grants for clinical laboratory staff training in accredited institutions and added “medical laboratory professionals to the National Health Service Corps,” the ASCLS noted.
The ASCLS continues to encourage those working in clinical laboratories to make their voices heard on Capitol Hill to further support the field.
Hope is growing that more students will choose clinical laboratory work for their futures. Medical and clinical laboratory technologist was listed in Careers Fittest rankings of the top 14 careers to consider in 2024/2025. Careers Fittest cited an 11% job growth expected in the area by 2031.
It is a worthy objective to educate younger children about the career path of a clinical laboratory scientist and opportunities to work in microbiology laboratories. Perhaps Garcia’s new children’s book will help with that trend, and just in time for the holidays!
Patients concerns about the quality of care provided since Amazon acquired One Medical in 2022 can affect clinical laboratory testing for those providers
Recently, The Washington Post reported on leaked documents that appear to indicate Amazon’s One Medical primary care call center was not using trained, certified medical professionals to field patient phone calls and provide telehealth guidance. Instead, The Post reported, “[One Medical’s] call center is staffed by contractors who receive about two weeks of medical training before responding to patient concerns,” and that, “They have missed urgent issues like blood pressure spikes and sudden stomach pain with blood in one patient’s stool,” MSN’s Business Insider reported.
The Washington Post, which is owned by Amazon founder Jeff Bezos, went on to report, “Amazon’s primary care clinic One Medical circulated talking points telling workers to claim that in cases when its call center failed to escalate potentially urgent calls to medical staff, patients ‘received the care they needed,’ according to screenshots of internal messages seen by The Washington Post.”
The Post’s report highlights the challenges some telemedicine providers using “non-physician” personnel are having in delivering quality primary care.
During the COVID-19 pandemic, social distancing and hospital lockdowns kept many people indoors and unable to access their doctors and clinical laboratories when they needed. As the pandemic progressed, enterprising mega corporations like Amazon saw an opportunity and invested heavily in bringing healthcare to patients where they live and shop.
Amazon, for example, announced in 2022 that it would be purchasing One Medical and all of its primary care clinics nationwide for $3.9 Billion.
“There is an immense opportunity to make the healthcare experience more accessible, affordable, and even enjoyable for patients, providers, and payers,” said Amir Dan Rubin, One Medical’s CEO, in an Amazon press release announcing the acquisition at that time. “We look forward to innovating and expanding access to quality healthcare services, together,” he added.
But it turns out, developing alternative pathways to primary care is not such an easy thing. According to Business Insider, some patients with One Medical are struggling to get adequate care, major patient concerns have been missed, and there are concerns over the efficacy of the services.
“The opportunity to transform healthcare and improve outcomes by combining One Medical’s human-centered and technology-powered model and exceptional team with Amazon’s customer obsession, history of invention, and willingness to invest in the long-term is so exciting,” said Amir Dan Rubin (above), One Medical’s CEO, in an Amazon press release. Clinical laboratories that service One Medical’s providers may want to follow this developing story. (Photo copyright: LinkedIn.)
Call Center Contractors Spark Concerns
One Medical was started by Harvard-trained internist Thomas Lee, MD, in an effort to streamline medical services to the benefit of stakeholders and patients, according to Forbes. This subscription based service offered patients 24/7 virtual care with access to in-person appointments.
“One Medical was founded in 2007 as a concierge medical network before going public in 2020 and purchasing Iora Health, a value-based provider for seniors, in 2021. By the end of 2022, a majority of One Medical’s revenue came from capitated contracts. The company currently operates more than 200 clinics and a telehealth service in a membership model,” Healthcare Dive reported.
But according to reports reviewed by journalists at The Washington Post, on more than one occasion elderly patients have been failed by the One Medical call center in Tempe, Arizona. Patients began to be rerouted to this call center about a year after the Amazon acquisition.
The Post reported that several patients reported symptoms such as pain and swelling, blood in stool, a spike in blood pressure and sudden rib pain, and that the call center failed to escalate these calls to clinical staff—instead simply scheduling an appointment sometimes for days later.
The workers at the Tempe call center included newly hired contractors with what The Post described as “limited training and little to no medical experience.” Internal sources at One Medical are raising the alarm bell about the dangers of Amazon’s frugal approach. “There were a lot of things slipping through the cracks,” one anonymous source told The Post.
Quantity over Quality
In an interview with PBS, Caroline O’Donovan, the reporter at The Washington Post who broke this story said, “In the documents that were leaked to us, there’s a doctor who wrote a note saying, ‘I don’t think these call center people even realize that they’re triaging patients, which is not something that they’re qualified to do.’”
Amazon contends that no one was harmed in the cases where protocol was not followed.
In an email statement concerning the Washington Post report, Amazon spokesperson Dawn Brun wrote, “While the patients ended up receiving the care they needed (during in-person visits with their providers), the initial call could have been managed more effectively,” The Post reported.
“We take patients’ feedback seriously and the [Washington Post] story mischaracterizes the dedication we have to our patients and care teams,” she added.
However, O’Donovan says that the patients—and some employees—she spoke with challenged that idea. “The patients I spoke to again and again—and some of the One Medical employees I spoke to—said there’s a difference between getting your phone call answered faster, literally someone picking up the phone, and actually getting your problem solved,” she told PBS.
When data-driven companies like Amazon get involved in healthcare certain care standards may be sacrificed in the name of optimization.
This story shows that there is not an easy solution/answer to developing alternative primary care pathways. Clinical laboratories have a stake in the evolution and developments in the field of primary care and telemedicine because often these patients need lab tests.
Trifecta of forces at work that will affect the clinical laboratory and pathology industries have been described as a ‘perfect storm’ requiring lab and practice managers to be well informed
Digital pathology, artificial intelligence (AI) in healthcare, and the perfect storm of changing federal regulations, took centerstage at the 29th Executive War College on Diagnostics, Clinical Laboratory, and Pathology Management in New Orleans this week, where more than 1,000 clinical laboratory and pathology leaders convened over three days.
This was the largest number of people ever onsite for what has become the world’s largest event focused exclusively on lab management topics and solutions. Perhaps the highlight of the week was the federal Food and Drug Administration’s (FDA’s) announcement of its final rule on Laboratory Developed Tests (LDTs). Overall, the conference featured more than 120 speakers, many of them national thought leaders on the topic of clinical lab and pathology management. More than 65% of the audience onsite were executive level lab managers.
“The level of interest in the annual Executive War College is testimony to the ongoing need for dynamic, engaging, and highly relevant conference events,” said Robert Michel (above), Editor-in-Chief of Dark Daily and its sister publication The Dark Report, and founder of the Executive War College. “These in-person gatherings present great opportunities for clinical laboratory and pathology managers and leaders to network and speak with people they otherwise might not meet.” (Photo copyright: Dark Intelligence Group.)
Demonstrating Clinical Value
For those who missed the action onsite, the following is a synopsis of the highlights this week.
Lâle White, Executive Chair and CEO of XiFin, spoke about the future of clinical laboratory testing and the factors reshaping the industry. There are multiple dynamics impacting healthcare economics and outcomes—namely rising costs, decreasing reimbursements, and the move to a more consumer-focused healthcare. But it is up to labs, she said, to ensure their services are not simply viewed as a commodity.
“Laboratory diagnostics have the potential to change the economics of healthcare by really gaining efficiencies,” she noted. “And it’s up to labs to demonstrate clinical value by helping physicians manage two key diagnostic decision points—what tests to order, and what to do with the results.”
But even as labs find ways to increase the value offered to clinicians, there are other disruptive factors in play. Consumer-oriented tech companies such as Google, Apple, and Amazon are democratizing access to patient data in unforeseen ways, and Medicare Advantage plans are changing the way claims are processed and paid.
Clinical labs are fundamental components of the public health infrastructure. So, the CDC plans on focusing on delivering high-quality laboratory science, supported by reliable diagnostics and informatics for disease outbreaks and exposures, and engaging with public and private sector partners.
The history of MolDX and Z-Codes were the topics discussed by Gabriel Bien-Willner, MD, PhD, Chief Medical Officer for healthcare claims and transaction processing company Palmetto GBA. Molecular testing is highly complex, and the lack of well-defined billing codes and standardization makes it difficult to know if a given test is reasonable and necessary.
Z-Codes were established to clarify what molecular testing was performed—and why—prompting payers to require both Z-Codes and Current Procedural Terminology (CPT) codes when processing molecular test claims. Medicare’s MolDX program further streamlines the claims process by utilizing expertise in the molecular diagnostics space to help payers develop coverage policies and reimbursement for these tests.
FDA Final Rule on LDT Regulation
Timothy Stenzel, MD, PhD, CEO of Grey Haven Consulting and former director of the FDA’s Office of In Vitro Diagnostics reviewed the latest updates from the FDA’s Final Rule on LDT (laboratory developed test) regulation. Prior to the FDA releasing its final rule, some experts suggested that the new regulations could result in up to 90% of labs discontinuing their LDT programs, impacting innovation, and patient care.
However, the final rule on LDTs is very different from the original proposed rule which created controversy. The final rule actually lowers the regulatory burden to the point that some labs may not have to submit their LDTs at all. The FDA is reviewing dozens of multi-cancer detection assays, some of which have launched clinically as LDTs. The agency is likely to approve those that accurately detect cancers for which there is no formal screening program.
Stenzel explained the FDA’s plan to down-classify most in vitro diagnostic tests, changing them from Class III to Class II, and exempting more than 1,000 assays from FDA review. He also discussed the highlights of the Quality Management System Regulation (QMSR). Launched in January, the QMSR bought FDA requirements in line with ISO 13485, making compliance easier for medical device manufacturers and test developers working internationally.
Looming Perfect Storm of Regulatory Changes
To close out Day 1, Michel took to the stage again with a warning to clinical laboratories about the looming “Perfect Storm” trifecta—the final FDA ruling on LDTs, Z-Code requirements for genetic testing, and updates to CLIA ’92 that could result in patient data being considered a specimen.
Laboratory leaders must think strategically if their labs are to survive the fallout, because the financial stress felt by labs in recent years will only be exacerbated by macroeconomic trends such as:
Staff shortages,
Rising costs,
Decreasing and delayed reimbursements, and
Tightening supply chains.
Lab administrators looking for ways to remain profitable and prosperous should look beyond the transactional Clinical Lab 1.0 fee-for-service model and adopt Clinical Lab 2.0, which embraces HEDIS (Healthcare Effectiveness Data and Information Set) scores and STAR ratings to offer more value to Medicare Advantage and other payers.
Wednesday’s General Session agenda was packed with information about the rise of artificial intelligence, big data, and precision medicine in healthcare. Taking centerstage on the program’s final day was Michael Simpson, President and CEO of Clinisys. Simpson gave a global perspective on healthcare data as the new driver of innovation in diagnostics and patient care.
Plans by several national retail pharmacy chains to expand primary care services and even some clinical laboratory test offerings may be delayed because of financial woes
Times are tough for the nation’s retail pharmacy chains. Rite Aid Corporation, headquartered in Philadelphia, closed 25 stores this year and has now filed for bankruptcy. In a press release, the retail pharmacy company announced it has “initiated a voluntary-court supervised process under Chapter 11 of the US Bankruptcy Code,” and that it plans to “significantly reduce the company’s debt” and “resolve litigation claims in an equitable manner.”
Rite Aid may eventually close 400 to 500 of its 2,100 stores, Forbes reported.
Meanwhile, other retail pharmacy chains are struggling as well. CVS Health, headquartered in Woonsocket, Rhode Island, and Walgreens Boots Alliance of Deerfield, Illinois, are each closing hundreds of stores, according to the Daily Mail.
They are each experiencing problems with labor costs, theft, being disintermediated for prescriptions by pharmacy benefit managers (PBMs), and probably building too many stores in most markets.
This is a significant development, in the sense that Walgreens, CVS, and Walmart are each working to open and operate primary care clinics in their stores. This is a way to offset the loss of filling prescriptions, which has migrated to PBMs. Primary care clinics are important to the revenue of local clinical laboratories, but retail pharmacy chains do not yet operate enough primary care clinics in their retail pharmacies to be a major influence on the lab testing marketplace.
“With the support of our lenders, we look forward to strengthening our financial foundation, advancing our transformation initiatives, and accelerating the execution of our turnaround strategy,” said Jeffrey Stein (above), Rite Aid’s CEO/Chief Restructuring Officer, in a press release. Clinical laboratory leaders may want to closely monitor the activities of the retail pharmacies in their areas. (Photo copyright: Rite Aid.)
Multiple Pharmacy Companies at Financial Risk
Rite Aid Corporation (NYSE: RAD) confirmed it continues to operate its retail and online platforms and has received from lenders $3.45 billion in financing to support the company through the bankruptcy process.
However, according to the Associated Press (AP), Rite Aid has experienced “annual losses for several years” and “faces financial risk from lawsuits over opioid prescriptions,” adding that the company reported total debts of $8.6 billion.
Additionally, the US Department of Justice (DOJ) filed a complaint “alleging that Rite Aid knowingly filled unlawful prescriptions for controlled substances,” explained a DOJ press release.
Rite Aid is not the only retail pharmacy brand dealing with unwelcome developments. Fortune reported last year that Walgreens and CVS paid a combined $10 billion to 12 states for “involvement in the opioid epidemic.”
Walgreens intends to close 150 US and 300 United Kingdom locations, its former Chief Financial Officer James Kehoe shared in a third quarter 2023 earnings call transcribed by Motley Fool.
And in a news release, CVS announced plans to close 900 stores between 2022 and 2024.
Pharmacy Companies’ Investment in Primary Care
Though they are experiencing difficulties on the retail side, Walgreens and CVS have significantly invested in primary care.
In that same ebrief, we reported on CVS’ acquisition of Oak Street Health, a Chicago-based primary care company, for $10.6 billion. CVS plans to have more than 300 healthcare centers by 2026.
“We looked at our business, and we said, ‘We’re seeing an aging population.’ We know people don’t have access to primary care. We know that value-based care is where it’s going. We know that there’s been a renaissance in home (care). So that’s kind of how we approached our acquisitions,” Karen Lynch, CVS Chief Executive Officer told Fortune.
Other Challenges to Retail Pharmacies
It could be that these major pharmacy chains are hoping entry into primary care will offset the loss of sales from prescriptions that have migrated to PBM organizations.
In addition to reimbursement challenges, retail pharmacies are reportedly experiencing:
High labor costs,
Competition from online, bricks-and-mortar, and grocery businesses, and
Effects from the work-at-home trend, among other struggles.
“I think there’s a number of challenges which are coming to a head. One, you have ongoing reimbursement pressure. The reimbursement level for drugs continues to decrease, so profit margin on the core part of the business is under pressure,” Rodey Wing, a partner in the health and retail practices of global strategy and management consulting firm Kearney, told Drug Store News.
Additionally, the pharmacy’s drug sales need to be high enough to retain pharmacists, who are difficult to recruit in a post-pandemic market, Drug Store News explained.
And in the retail space where products are displayed, some pharmacies struggle to compete with Amazon on convenience and with “dollar” stores on price. And with more people working from home, retail pharmacies are seeing less foot traffic, Drug Store News noted.
Retail pharmacy companies also have competition from pharmacies conveniently situated in grocery and big-box stores, Forbes reported. These include:
Walmart, for its part, reduced operating hours of pharmacies at more than 4,500 sites, Daily Mail reported.
Thus, medical laboratory leaders would be wise to keep an eye on market changes in their local retail pharmacies. Some locations are equipped with clinical laboratory services and a closure could give local labs an opportunity to reach out to patients and physicians who need access to a new testing provider.
