Colonial hack a wake-up call to CFOs with legacy systems

What is a cyber attack? Recent examples show disturbing trends | CSO Online

CFOs whose finance and accounting functions are built on legacy computer systems got a stark reminder last week from the Colonial pipeline hacking of what’s at stake if their system is breached.

The hack to Colonial’s system led to widespread gas shortages throughout the East and reportedly forced the company to pay $5 million in ransomware to get the instructions for reclaiming its data. 

“For finance departments, the cybersecurity risk is huge,” Samir Jaipati, a finance solutions leader with EY Americas, told CFO Dive in an email. “Something built on outdated technology won’t be able to keep hackers out.” 

Security specialists generally agree legacy, on-premises systems starting from about 10 years ago typically have solid cybersecurity features built in, but those that are older might require significant upgrades if they’re going to stand a chance against today’s sophisticated hackers.

The risk for CFOs who must manage their processes on an outdated system is they’ll try to get by with short-term fixes that won’t solve the systemic problems they face. 

“These temporary fixes aren’t as dependable and in the long-term may cost more,” said Kaipati.

Best effort

For CFOs who don’t have the time or budget to implement the system overhaul they need or to transfer their processes to a more secure on-premises system or to a cloud-based system, the best step is to do a comprehensive review of their end-to-end finance processes to audit for consistency and reliability, said Steve Adams, Gartner finance director. 

He suggested reviewing the organization’s record-to-report process from start to finish to understand where non-secure platforms are used, whether there are audit trails that don’t exist, and if exogenous data is incorporated. By eliminating these and other red flags, CFOs can go a significant way to clean up their processes and reduce risk without making system changes, Adams said. 

CFOs taking this approach should first engage their IT business partner and ask for a full audit of the cybersecurity capabilities of the suite of financial applications and to use that review as a starting point to making improvements, he said. 

Wider integration

Legacy systems pose a broader problem than just security risk; they can impede company growth because CFOs aren’t generating the data or producing the analytics that can help them identify ways to make more money or reduce costs in the same way they can get from sophisticated cloud-based solutions. 

Nor can legacy systems be expected to be as good at integrating data throughout the organization in the same way as cloud systems.

For CFOs who can do it, switching from an old on-premises system to the cloud can be a game-changer, said Manish Sharma, an Accenture operations group executive.

“CFOs that are agile and able to overcome these restrictions by scaling digital and cloud-powered technologies have been able to break down data silos and siloed ways of working to support the ever-evolving business strategy with speed and flexibility,” he said. 

The importance of using up-to-date IT was emphasized in a recent Accenture report that found “future-ready” leaders are emerging ahead of the pack with higher efficiency and profitability by scaling digital capabilities in ways to improve operational maturity.

“These leaders use better, more diverse data to inform decision-making as part of a cloud-powered continuous feedback loop,” said Sharma.

Flexible categorization

Another benefit of moving to the cloud or a hybrid cloud-on-premises arrangement is cost flexibility. 

On average, the cost of managing an outdated IT system can cost a business around $3.61 per line of code or over $1 million for an application with 300,000 lines of code, said Kevin Shuler, owner and CEO of the Quandary Consulting Group, a Denver-based IT firm. 

“It accounts for customizations, maintenance, reporting, server and hardware, etc.,” he said. 

While replacing the old with the new might appear to be prohibitively expensive at first glance, Shuler noted what can put a CFO more at ease is the costs are more transparent than maintaining a legacy system.

“Better, they can be categorized as either an operating expense or a capital expense since a lot of software is classified as a service rather than software,” he said. 

This gives flexibility to the CFO’s finances and forecasting. It also means more resources can be available for modernized systems. 

“That means you can get superior resources at a lower cost than trying to pull from a pool of highly specialized and competitive contractors who work mainly with legacy systems,” he said.

Some Face Dire Consequences for Delaying Care During Pandemic

Mammogram

Throughout the COVID-19 pandemic, experts have been warning of the dangers of postponed health care services. In January, the American Cancer Society, the National Comprehensive Cancer Network, and 73 other organizations, including many major health care systems, issued a statement stressing the urgency of preventive care. “We urge people across the country to talk with their health care provider to resume regular primary care checkups, recommended cancer screening, and evidence-based cancer treatment (PDF) to lessen the negative impact the pandemic is having on identifying and treating people with cancer,” the groups said.

Essential Coverage

That was sound advice not everyone could follow, as ProPublica’s Duaa Eldeib reported last week in a tragic story about Teresa Ruvalcaba. The 48-year-old single mother of three worked for 22 years at a candy factory on Chicago’s West Side. During the pandemic, disaster struck. “For more than six months, the 48-year-old factory worker had tried to ignore the pain and inflammation in her chest. She was afraid of visiting a doctor during the pandemic, afraid of missing work, afraid of losing her job, her home, her ability to take care of her three children,” Eldeib reported.

“Even though her chest felt as if it was on fire, she kept working. She didn’t want to get COVID-19 at a doctor’s office or the emergency room, and she was so busy she didn’t have much time to think about her symptoms,” Eldeib wrote.

Ruvalcaba’s pandemic fears were typical of patients across the nation, surveys revealed. A 2020 CHCF poll of 2,249 California adults revealed that even when people wanted to see a doctor for an urgent health problem, one-third did not receive care. Nearly half of those surveyed didn’t receive care for their nonurgent health problems.

Nationally, more than one in three people delayed or skipped care because they were worried about exposure to Covid-19, or because their doctor limited services, according to an Urban Institute analysis of a September 2020 survey.

The toll of this disruption in care — the forgone cancer screening, the chest pain that isn’t reported — will devastate some patients and families. Ruvalcaba had to face a diagnosis with a terrible prognosis, inflammatory breast cancer. “If she would have come six months earlier, it could have been just surgery, chemo and done,” Ruvalcaba’s doctor told Eldeib. “Now she’s incurable.”

Doctors expect the delayed care “could cause worsening health conditions, delayed diagnoses and earlier deaths,” Ana Ibarra reported in CalMatters.

“Unfortunately, we know we’re going to see some tragedies related to the delays,” Wiley Fowler, an oncologist at Dignity Health in Sacramento, told Ibarra.

Consequences of Delayed Care

Public health messages early in the pandemic urged people to avoid public places, including doctor’s offices. In April, as Hayley Smith noted in a Los Angeles Times story, the US Centers for Disease Control and Prevention (CDC) and the Centers for Medicare & Medicaid Services “both published guidelines recommending the postponement of elective and nonurgent procedures, including ‘low-risk cancer’ screenings, amid the first wave of the pandemic.”

Patients and doctors listened. Appointments were canceled. “Nonurgent” procedures encompassing a wide array of treatments and operations, including cancer surgeries, were delayed.

Preventive cancer screenings dropped 94% over the first four months of 2020, Eldeib reported. The National Cancer Institute expects to see 10,000 preventable deaths over the next decade because of pandemic-related delays in diagnosis and treatment of breast and colorectal cancer. Screenings for these cancers, which account for about one in six cancer deaths, are routine features of preventive care.

I know I should get another check soon, but the anxiety of COVID feels like more of a priority than the anxiety of cervical cancer.

—Molly Codner, a Southern Californian who received an abnormal Pap smear last summer

In California, cancer deaths have remained roughly the same as prepandemic rates, but that stability is not expected to last. Based on the National Cancer Institute data, Ibarra calculates that an additional 1,200 Californians will die from breast and colon cancer. The National Cancer Institute estimate is conservative “because it only accounts for a six-month delay in care, and people are postponing care longer than that,” Ibarra reported.

Nationally, death rates from cancer are expected to increase in a year or two. Slow-growing cancers will remain treatable despite a delayed diagnosis, Norman Sharpless, MD, director of the National Cancer Institute, told Eldeib. Yet for conditions like Ruvalcaba’s inflammatory breast cancer, delayed care can be disastrous.

Women, People of Color Disproportionately Affected

For women across Southern California, appointments have been delayed, exams canceled, and screenings postponed during the pandemic, Smith reported in the Los Angeles Times. “Some are voluntarily opting out for fear of encountering the virus,” Smith wrote, “while others have had their appointments canceled by health care providers rerouting resources to COVID-19 patients.”

Before Pap smears became part of routine American health care, cervical cancer was one of the deadliest cancers for women. Today, as many as 93% of cervical cancer cases are preventable, according to the CDC, and screenings are a crucial component of preventive care. Yet during the first phase of California’s stay-at-home orders, cervical cancer screenings dropped 80% among the 1.5 million women in Kaiser Permanente’s regional network, Smith wrote.

The effects of the pandemic shutdown extended beyond delayed Pap smears. Women who spoke to Smith said that “mammograms, fertility treatments and even pain prevention procedures have been waylaid by the pandemic.”

Sometimes, obstacles other than the pandemic are continuing to interfere with access to care. One woman had an appointment delayed and then lost her job and her health insurance, Smith reported.

“Molly Codner, 30, has needed a checkup ever since she received an abnormal Pap smear last summer,” Smith wrote, “but like many Southern Californians, the trauma of the last year still weighs heavily on her mind: Nearly a dozen people she knows have had COVID-19.” Codner told Smith that “I know I should get another check soon, but the anxiety of COVID feels like more of a priority than the anxiety of cervical cancer.”

People who face disparities in treatment and care are most likely to be hard hit by pandemic delays. That includes Black people, who were already more likely to die from cancer than any other racial group. Cancer also is the leading cause of death among Latinx people. Breast cancer is the most common cancer diagnosis for Latinx women. Overall, more Americans die of heart disease.

Black adults are more likely than White or Latinx adults to delay or forgo care, according to researchers from the Urban Institute.

Telehealth Solved Access Issues for Some, Not All

Telehealth was a boon for patients during the pandemic year. Yet, as Ibarra notes, “there’s only so much that doctors and nurses can do through a screen.” Dental visits, mammograms, and annual wellness checks were also put on hold by the pandemic.

Unequal access is another challenge for telehealth. The benefits of the telehealth boom were not shared equally, according to a statewide survey conducted last month by the University of Southern California and the California Emerging Technology Fund.

Latinx, Asian, and Black respondents did not use telehealth as often as White respondents. USC researchers attribute these differences to “disparities in income, education and access to any kind of health care.”

Researchers at the Urban Institute report similar findings: “Black and Latinx adults were more likely than White adults to report having wanted a telehealth visit but not receiving one since the pandemic began, and that difficulties getting a telehealth visit were also more common among adults who were in poorer health or had chronic health conditions.”

After controlling for socioeconomic factors and health status, patients with limited English were half as likely to use telehealth compared to fluent English-speaking patients, the Urban Institute said. “Much work remains to ensure all patients have equitable access to remote care during and after the pandemic,” the researchers wrote.

Whether telehealth is conducted by video or phone may be crucial to ensuring access to care. A study of telehealth use at Federally Qualified Health Centers in California in 2020 found that “more primary care visits among health centers in the study occurred via audio-only visits (49%) than in-person (48%) or via video (3%). Audio-only visits comprised more than 90% of all telemedicine visits.”

“For many Californians with low incomes, the ability to connect with a doctor or their care team by phone or video is much more than a convenience,” Chris Perrone, director of CHCF’s Improving Access team, explained on The CHCF Blog. “It’s really the difference between canceling a visit because the barriers are too great or getting the timely care that they or their child needs.”

Pandemic Health Effects Will Outlast COVID-19

Public health efforts might need to focus on two goals at the same time as the US recovers from the pandemic: increasing vaccine uptake to keep COVID-19 in check and proactively managing the fallout from delayed care.

“As we focus on recovery, we have to ensure that we get vaccinated,” Efrain Talamantes, a primary care physician in East Los Angeles, told Ibarra. “But also that we have a concerted effort to manage the chronic diseases that haven’t received the attention required to avoid complications.”

In analyst call, Clover reveals it doesn’t have the customers it said it did during IPO

Why Clover Health Chose a SPAC, Not an IPO, to Go Public | Barron's

When it planned to go public through a SPAC merger, insurance startup Clover Health told investors that it already had 200,000 direct contracting lives under contract for 2021. But in new guidance shared on Monday, the company now plans to end the year just 70,000 to 100,000 covered lives from direct contracting. 

After telling investors that it would more than quadruple its membership base in a year, insurance startup Clover Health is cutting its projections in half.

The insurance startup now plans to end the year with between 70,000 and 100,000 covered lives from direct contracting, a new payment program launched last by the Centers for Medicare and Medicaid (CMS) services last year, according to its most recent earnings report. 

Last year, when Clover announced plans to go public through a merger with a special-purpose acquisition company backed by “SPAC King” Chamath Palihapitiya, the company told investors it already had 200,000 direct contracting lives under contract for 2021, according to a slide deck.

But its projections call into question the veracity of those shared when the company was looking to go public. In fact, Kevin Fischbeck, an analyst with Bank of America, called out the discrepancy when he asked the company about estimates that it would have nearly half-a-million members covered through direct contracting by 2023.

Clover could only manage a feeble response, with CFO Joe Wagner saying it was “too early to say in future years exactly where we’re going to end up.”

It’s not the only big question that Clover faces about its future. After a scathing report from a short-seller earlier this year, the startup confirmed it had received a request for information from the Department of Justice, which it hadn’t disclosed previously. A day later, the company received notice of an investigation from the Securities and Exchange Commission.

When asked about the current status of the investigation, co-founder and CEO Vivek Garipalli said it was the company’s policy not to comment on pending inquiries.

In an unusual move, the company fielded questions from Reddit during the investor call, alongside those from analysts.

Clover is one of 53 companies selected to participate in CMS’ direct contracting programs in 2021. The value-based payment models were created under the previous administration, which would allow the startup to strike contracts with doctors who are caring for patients under the traditional Medicare program and manage their care.

Under the new administration, CMS has stopped taking applications for the new direct contracting models, which are slated to launch next year. It also paused the rollout of an alternative model that would tie payments to the population health and cost outcomes for all residents of a specific location.

In the meantime, most of Clover’s business still comes from its Medicare Advantage plans, where it has 66,300 members, an 18% increase year-over-year. It brought in $200.3 million in revenue in the first quarter, up 21%, but its net loss jumped more than 70% to $48.4 million.

The company also decreased its revenue projections from what it originally told investors last year. The startup said it expects to bring in revenue of $810 million to $830 million by the end of 2021, a decrease from its previous projections of $880 million. A small portion of that, just $20 million to $30 million, would come from direct contracting.

UnitedHealth’s Surgical Care Affiliates fires back at DOJ in collusion case

Senate narrowly confirms new head of Justice Department's criminal  division, who worked for Russian bank | PBS NewsHour

Surgical Care Affiliates, which is part of UnitedHealth Group’s Optum division, hit back at the Department of Justice’s defense of a federal case accusing SCA of agreeing with competitors to not poach senior-level employees.

In a May 14 proposed reply brief supporting its bid to dismiss the case, SCA argued the Justice Department’s defense is unlawful and violates due process rights.

“The government seeks to criminally prosecute as a per se Sherman Act violation an alleged agreement not to solicit another company’s employees, even though no court in history has ever definitively found such an agreement unlawful under any mode of analysis,” according to the proposed reply brief. “Not only is this kind of agreement not illegal per se, but subjecting a practice to per se condemnation for the first time in a criminal prosecution would violate bedrock guarantees of due process.” [emphasis in original]

In January, a federal grand jury charged SCA and its related entities, which own and operate outpatient medical care centers, with entering and engaging in conspiracies with other healthcare companies to suppress competition between them for the services of senior-level employees. 

In an email statement to Becker’s Hospital Review, SCA said at the time of the charges: “This matter involves alleged conduct seven years before UnitedHealth Group acquired SCA and does not involve any SCA ambulatory surgery centers, their joint owners, physician partners, current leadership or any other UnitedHealth Group companies. SCA disagrees with the government’s position, and will vigorously defend itself against these unjustified allegations.”

The charges are the first from the department’s antitrust division in its ongoing investigation into employee allocation agreements. Violators of the Sherman Act can face a maximum $100 million fine, or twice the gain derived from the crime or twice the loss suffered by victims if the amount is greater than the maximum. 

Providence’s operating loss narrows to $221.9M

Providence Medical Center reports COVID-19 outbreak within hospital | KOMO

Providence, a 52-hospital system based in Renton, Wash., saw its operating loss hit $221.9 million in the first quarter, compared to an operating loss of $276.2 million recorded in the first quarter of 2020, according to financial documents released May 17.

“We’re turning a corner and seeing signs of renewal,” said Rod Hochman, MD, president and CEO of Providence. “Throughout this crisis, the caregivers of Providence have stepped up to respond to the needs of our communities, and we are incredibly grateful to everyone who has been serving on or supporting the front lines of care.” 

The health system recorded revenue of $6.4 billion in the quarter ended March 31, up 1.6 percent from the same period in 2020. Providence said the growth was driven by 9 percent growth in capitation revenue and 57 percent growth in diversified revenue.

Operating expenses reached $6.7 billion in the first quarter, an increase of 1 percent from the same period last year. Providence said the expense increase was driven by costs to support caregivers and to serve patients, including labor and more personal protective gear and drugs. 

After factoring in $306.5 million in nonoperating income, Providence ended the quarter with a net income of $84.6 million. In the same period last year, Providence recorded a net loss of $1.1 billion. Last year’s net loss was largely attributed to negative financial market forces. 

Cartoon – Rebuilding Customer Trust

Cartoon – How can we Rebuild Trust | HENRY KOTULA