Healthcare Brew covers pharmaceutical developments, health startups, the latest tech, and how it impacts hospitals and providers to keep administrators and providers informed.

Healthcare Brew

A pink piggy bank with a black umbrella standing out of the top of it sitting on a small desk with a grey background

Health Insurance

Maia Anderson

Healthcare Brew delivers the latest news and trends in healthcare.

healthcare-brew.com

Ever wonder what entices an executive to jump ship and join a new health system? For Amy Perry, Banner Health’s insurance arm caught her eye.

Perry joined the Arizona-based nonprofit health system as president and COO in November 2021 and took the reins as president and CEO in July 2024. Before joining Banner, she was SVP of integrated care delivery and CEO of New Jersey-based Atlantic Health’s hospital division for four years.

Banner is Arizona’s largest health system and consists of 33 hospitals that handle roughly 6.4 million clinic visits per year and have more than 55,000 employees. The system brought in $15.6 billion in revenue in 2024.

Perry told Healthcare Brew the fact that Banner has its own health plan with about 1.2 million members was a big part of the reason she took the job, as she sees provider-sponsored health plans, or PSHPs, as a “really important approach to healthcare.”

PSHPs are health insurance companies that are owned, either partially or fully, by a health system, hospital, or other provider group. The largest example is the Kaiser Foundation Health Plan, which has more than 12.6 million members and is run by Kaiser Permanente, a California-based health system.

As of 2022, 197 health systems in the US (or 31%) have PSHPs, according to healthcare analytics firm Trilliant Health.

PSHPs help health systems move away from a 

Healthcare’s reliance on sick people to generate revenue is a primary reason costs keep rising, according to Perry.

“When we are able, as health systems, to get premium revenue, we can actually save money when people stay well. It’s almost a completely shifted paradigm,” she said.

About 74% of Banner’s revenue came from the fee-for-service side of the health system and about one-quarter (or about $4 billion) came from premiums in 2024, Perry said.

“I’m just a fervent believer that we’ve got to find a way to migrate, as health systems, toward more of this at-risk, premium-based care,” she said.

However, it’s not easy to be both insurer and provider, according to Katherine Hempstead, a senior policy officer at healthcare research organization Robert Wood Johnson Foundation.

That’s because providers are typically incentivized to do more higher-cost procedures while payers try to keep costs down.

“When you’re trying to do both jobs, it can create a conflict,” Hempstead said.

Some large hospitals, including Northwell Health, the largest health system in New York, have 

 to create PSHPs. Northwell blamed high risk adjustment payments for why it shuttered its PSHP, CareConnect Insurance Company, in 2017, Fierce Healthcare reported. 

Perry acknowledged how hard it is to run both a health system and an insurer, saying “it’s very difficult to live in both worlds.”

However, despite the challenges, there are also upsides, she added, such as premium revenue that allows the health system to invest in chronic disease management and other things “you wouldn’t even consider on the fee-for-service side because there’s simply not enough funding.”

But premium revenue hasn’t shielded Banner from broader industry headwinds like Medicaid funding cuts and 

President Trump’s One Big Beautiful Bill Act, which was signed into law on July 4, is set to 

 by about $1 trillion over the next 10 years. Perry said Banner is bracing for a reality in which some services may have to be cut.

“We have a significant commitment to Medicaid patients and the service lines, but at the same time, there’s only so much we can do if we are scaled back,” Perry said. “Access will be affected, not only in clinics but in emergency rooms.”

To prepare for the cuts, which will take effect 

 over the coming years, Banner is “battening down the hatches like most health systems and trying to reduce our expenses as much as possible,” she said.

Tariffs on products like aluminum and steel already cost Banner roughly $23 million as of September, according to Banner’s SVP of Finance Adrienne Moore, and the health system expects that figure to be less than $35 million by the end of 2025.

In addition to navigating Medicaid cuts and tariffs, one of Perry’s top goals as CEO involves a $1 billion investment in technology the health system plans to pay over the course of five years, she said.

As part of that initiative, Banner created its own ChatGPT-like program called BannerWise via a 

 with AI company Anthropic to analyze data from things like physician notes and pathology results, Modern Healthcare reported earlier this month. Perry told Healthcare Brew this will help providers use the health system’s data “in a more strategic and analytical way.”

Beyond investing in technology, Perry said she’s very focused on connecting with the communities the health system serves in the near term.

“If we’re able to do that and we do it successfully over the next five years, I’m going to be one happy CEO,” Perry said. 

A woman, Amy Perry, Banner Health CEO, cutout and contained in an abstract shape while breaking the frame.

Banner Health CEO Amy Perry on running a health system with an insurance business

From health insurance to Medicaid cuts, Perry dishes on her first year leading Banner Health.  

Banner Health CEO on running a health system with an insurance business

illustrated headshot of caroline catherman, healthcare brew reporter

Caroline Catherman

In the world of prior authorization reforms, an insurance “gold card” may sound like a golden ticket. But some providers say the shine wears off fast.

, offered by UnitedHealthcare and states like Arkansas and Texas, allows providers with a track record of approved prior authorizations to bypass some of the process’s hurdles. And there are a 

 of hurdles. Prior authorizations take up an average of 13 hours of a physician’s week, according to a 2024 American Medical Association (AMA) 

A Sept. 4 press release from United claims a 40% increase in the number of provider groups qualifying this year compared to the year before, though United didn’t provide Healthcare Brew with the actual number.

But despite the program’s growth, gold cards don’t seem to be making a huge impact. Only 3% of providers in Texas qualified for the state’s gold card in December 2024, according to the Texas Department of Insurance. And an AMA survey published in August 2024 found just 8% of 1,000 physicians contracted with health plans that offered programs like gold cards.

“It’s a simple, elegant concept,” Kavita Nair, professor of neurology and pharmacy at the University of Colorado Anschutz Medical Campus, told Healthcare Brew. “Lots of the appeal gets lost in the actual operationalization.”

UnitedHealthcare’s program requires provider groups to have been in network for the last two consecutive years and have done at least 10 eligible prior authorizations annually with an approval rate of 92% for both years to get gold card status for a medical code.

Those who qualify submit an advance notification for a procedure through the same online portal, phone system, or fax process they would otherwise use to submit a prior authorization request. Unlike prior authorization, it doesn’t require clinical information. They then receive notification that no additional information is needed, according to a United FAQ page.

United said in its press release that 94% of the “most active gold card users” it surveyed said they’re satisfied overall and the program has reduced administrative tasks. United did not provide the number surveyed.

But to Nair, it feels like a “bait and switch” that gold card providers still have to submit a request through a portal before doing a procedure. 

“You’re still making folks go through hoops. You’re just saying ‘We’re not asking for additional clinical documentation,’” Nair said. “I guess we’ll take any steps that we don’t have to do, but it’s not creating the kind of meaningful impact that it could create.”

It’s also hard for independent groups to measure the exact impact these prior authorization reforms have, Kaye Pestaina, director of patient and consumer protection for the nonpartisan health policy research organization KFF, told us.

“We always have a barrier in terms of getting access to prior authorization data for commercial insurance,” Pestaina said.

Caduceus, Healthcare medical symbol on gold card.

As health insurance gold card programs grow, criticism persists

It’s a golden ticket…with fine print.

As gold card programs grow, criticism persists

About 1.3 million people could lose health insurance in 2026 due to marketplace and Medicaid changes in the 

, the independent Congressional Budget Office estimated Aug. 11.

 ways of paying for healthcare will have 1.3+ million more potential customers amid a “perfect storm” of insurance coverage losses, Sabrina Corlette, founder and director of the Georgetown University Center on Health Insurance Reforms, told us.

 protections, allowing them to charge some customers less in exchange for covering less.

Though some analysts argue these plans offer a good alternative to people who might otherwise go uninsured, the American Hospital Association says their growth could increase the billions of dollars per year hospitals and health systems spend on uncompensated care if these plans stick patients with medical bills they can’t pay.

“We’re going to see a lot more people experiencing medical debt, and the [healthcare] system is not going to be able to absorb all of that,” Molly Smith, group VP of public policy at the American Hospital Association (AHA), told us.

If a patient’s non-ACA plan can’t cover their expenses and they can’t pay, it “erodes the relationship” between patients and hospitals, Ariel Levin, AHA’s director for coverage policy, told us.

(Patients’ trust in hospitals is already low, down to 40% in January 2024, according to a July 2024 JAMA Network Open 

Not to mention, hospitals sometimes waste time and resources going through the traditional billing process for these plans, which often fails, Levin said.

 in the journal Health Affairs Scholar, administrative expenses for 5,639 hospitals were $166 billion, or 17% of total expenses.

“This is obviously a huge problem for hospitals,” Levin added.

In theory, if a patient knows what they’re getting into with these plans and is able to foot the medical bill themselves in the case of an emergency expense, hospitals still get paid. But 8 out of 31 sales representatives for these plans engaged in “potentially deceptive” marketing, like claiming a preexisting condition was covered when it wasn’t, in a 2020 secret shopper 

 from independent watchdog the Government Accountability Office.

Deceptive marketing can lead members to think they have full insurance coverage, then get shocked by hefty bills for 

, both of which ACA-compliant plans are required to cover.

And that marketing seems to be ramping up again.

“Purveyors of these products and arrangements will take advantage of shifts in public policy or periods of consumer confusion to market their products, often deceptively, to try to drive people to buy more,” Corlette said.

Insurance alternatives like healthcare sharing ministries—arrangements defined as nonprofits, not insurance, where members with shared religious beliefs pay a fee each month to cover each others’ medical bills—are using policy changes as a marketing hook to make their case to customers.

“With new ACA restrictions taking effect, many Americans are reevaluating their healthcare options. HCSMs offer a values-based, cost-sharing alternative,” a July 9 

 from self-described healthcare sharing ministry NetWell reads.

On Aug. 15, neither the release nor the main page of NetWell’s website disclosed that this arrangement isn’t insurance, though a small link at the bottom of the site led to disclaimers. After Healthcare Brew reached out for comment, the organization added a line to its main page saying it “is not an insurance company but a religious healthcare sharing ministry.”

A nondenominational crowdfunding company, 

, made a case for the benefit of its plans in a July 21 

 where it argues its ACA-exempt arrangement “shines for healthy families or individuals losing ACA subsidies.” CrowdHealth’s post specifies in the third paragraph that it isn’t insurance.

Netwell and CrowdHealth didn’t respond to requests for comment.

Promotional efforts will likely ramp up more when the ACA marketplace open enrollment period begins Nov. 1 and people see their 

If enough people are swayed away from the marketplace, 

 say the growth of arrangements like short-term, limited-duration plans could alter the risk pool and drive up premiums, which are already expected to 

Close up of a healthcare cross in a transparent box with "low cost" and "buy now!" stickers.

Insurance alternatives ramp up advertising ahead of ACA changes

With millions potentially set to lose coverage in 2026, it may just be their time to shine. 

Cassie McGrath

 to rise 9% in 2026, it seems employers and patients alike can’t expect a slowdown in spending anytime soon.

 have been proposed to establish price transparency about healthcare costs, so patients can know what they’re expected to pay up front.

Now, Trillium Health is giving a look into the numbers.

The healthcare analytics company published last month a 

 (2,659 hospitals and 3,491 ambulatory surgery centers across the nation) that provides some insight into these rising costs.

The report used data provided through the Centers for Medicaid and Medicare Services (CMS) 

, a 2020 regulation that requires health plans to share out-of-pocket cost information and negotiated rates. The idea was to give patients information about how much they’re expected to pay before care is delivered.

But when payers started reporting this information in July 2022, the data was hard to sort through due to the “complexity and extremely large” files, 

, which monitors health spending, reported in February. Trillium Health sorted through the data, and ultimately found great variation in what hospitals, payers, and patients spend on the same care.

While patients who are publicly insured pay rates set by CMS, commercially insured patients’ rates are individually negotiated between insurance companies and providers. As a result, patients with different health plans get billed different amounts for the same procedure.

For example, the report looked at negotiated rates for six inpatient treatments like coronary bypass, bowel movement procedures, and hip, knee, and ankle surgeries. Among 101 hospitals in Pennsylvania, UnitedHealthcare’s negotiated rates for a bowel procedure involving a complication or comorbidity could cost anywhere from $18,066 to $87,457.

There was even price variation within some hospitals, the report found. At Tufts Medical Center in Boston, the negotiated rates for a coronary bypass involving major complications or comorbidities were $95,989 with Aetna and $144,204 with United, according to the report.

The report also found care largely costs less at ambulatory surgery centers compared to outpatient hospital departments (e.g., $1,179 compared to $3,633, respectively, for a colonoscopy). This difference in price presents an annual $4.5 billion in “potential savings” for colonoscopies at ambulatory centers, according to the researchers.

Here are a few other things worth noting:

US health spending in 2023 was $4.9 trillion, or $14,570 per person.

Spend in the US is 139% higher than Switzerland, which has the next-highest spend per person.

The report found “no observable correlation” between cost and quality of care at 10 providers featured on three 

Large scale pill with a price tag attached lays on top of the US map. (Credit: Anna Kim)

Report: Healthcare costs could vary greatly depending on the health plan

Trillium Health pored over CMS data and found great variation in what patients pay for care, depending on their insurer. 

Another day, another example of CVS not beating the vertical integration 

Earlier this month, Aetna enacted a new policy for its commercial medical plans mandating drugs be supplied by third-party specialty pharmacies under CVS, the health plan’s parent company, and shipped directly to suppliers. Previously, these facilities have purchased drugs for patients independently and billed for them under a health plan’s medical benefit.

The policy, effective as of July 1, is a sign of vertical integration and puts infusion centers in a difficult financial position that could eventually lead to their closure, experts told Healthcare Brew.

Now, five drugs treating conditions like multiple sclerosis, uncontrolled asthma, and rheumatoid arthritis for Aetna patients are covered under a pharmacy benefit, meaning they will be delivered from a CVS specialty pharmacy.

An easy way to understand the challenges for infusion centers is comparing it to if customers brought their own steak to a restaurant and asked a chef to cook it, Robert Gelfand, founder and president of New York treatment facility American Infusion Centers, told us.

“Part of the business model we operate on is being able to buy the medication and bill for it,” Joshua Katz, director of Massachusetts-based medical clinic the Elliot Lewis Center, said. “If the specialty pharmacy buys the drug and bills for it, that eliminates that source of revenue for us. It’s hard to be profitable.”

Gelfand said his center runs on “relatively modest profits” and policies where a company yields higher returns on a few drugs (which can turn into more and more over time) like this are “insidious.”

 found clinics could lose out on nearly $2,000 per month if their drugs are delivered via an insurance company (aka “bagging”) rather than when they directly purchase the drugs. The study showed on average a $300+ per month rise in out-of-pocket payments for patients under the bagging method as well.

Right now, CVS is in the spotlight, but Gelfand is worried this kind of policy could spread to other drugs or payers. If it does, his business may no longer be able to sustain itself, he said, and may even be at risk of closure.

He may need to stop taking Aetna patients due to these financial challenges, Gelfand added.

Working with specialty pharmacies is also a “big administrative burden” on infusion centers, Katz said, as it requires phone calls, benefits verification, and shipment coordination. Without specialty pharmacies, the infusion centers can simply order drugs on their own.

If there’s a problem with drug temperatures or a drug is contaminated during shipment, or if a delivery is sent to the wrong address, the infusion center isn’t allowed to substitute a medication with another drug they have on hand, Elliott Warren, executive director of advocacy group Infusion Providers Alliance, said.

Considering that many patients at infusion centers have serious illnesses, Warren said he’s worried quality of care will suffer.

“It’s another example of a big payer and insurance company standing between a physician and their patient, all for, frankly, their own self-interest,” he said.

The Infusion Providers Alliance was informed about the policy before it went into effect and 

 on June 12 to Aetna outlining the group’s concerns, highlighting potential patient care, cost, legal, and supply chain issues.

When asked about the reasons behind the new rule, CVS spokesperson Phil Blando told us in an emailed statement the policy will allow the pharmacy chain “to better control the cost of the drugs and keep premiums more affordable, while still providing members with safe, convenient access” to certain drugs.

In recent years, CVS, UnitedHealth, and Cigna have 

 the healthcare industry. Essentially, these top three companies, which control 80% of the prescription medicine market, can set the cost of drugs while also operating the pharmacies that dispense them.

The infusion center leaders said this new Aetna policy is another practice in which CVS is pushing business into its own specialty pharmacy arm through beneficiaries covered under its health plan.

“It’s a theoretical death knell for infusion centers,” Glefand said.

Aetna’s new specialty drug policy ‘insidious’ for infusion centers, one leader says

Infusion center leaders accuse CVS of trying to funnel business back into itself. 

HCBR-ICHRAs-audio embed

An individual coverage health reimbursement arrangement (ICHRA) is an atypical way to cover health costs with a bold pitch.

Instead of offering a traditional group plan, employers give workers money before tax to buy whatever insurance plan works for them on the individual market, paying more or less depending on what they need. Think health insurance à la carte.

The idea is to give workers more freedom and give employers more predictable healthcare costs.

“It gets [employers] out of a one-size-fits-all mentality of picking a plan or a set of plans for all employees,” Zachary Sherman, managing director at public healthcare-focused research and consulting firm Health Management Associates, told us.

The concept first soft-launched to employers with 50 or fewer workers in 2017 with qualified small employer health reimbursement arrangements (QSEHRAs). ICHRAs then stretched health reimbursement arrangements to employers of all sizes in 2020 after an executive order by President Donald Trump.

While there’s no comprehensive public enrollment data, employers reportedly offered ICHRAs to 200,000+ employees and their dependents in 2025, according to data from 15 ICHRA/QSEHRA service providers 

 trade and advocacy organization the HRA Council. Uptake hasn’t been explosive, but the data shows it’s risen 19% overall since 2020 and 34% among large employers (50+ employees).

“It felt like, if one big employer took a leap, others might follow. But we hadn’t reached that point,” JoAnn Volk, co-director of Georgetown University’s Center on Health Insurance Reforms, told us.

Now some experts say health reimbursement arrangements might be about to hit a new set of speed bumps, just as the race against group plans was getting interesting. 

“The whole premise of an HRA is based on having a robust, healthy individual market, and that’s no longer assured. It’s very much at risk,” Volk said.

Experts told us changes proposed in July’s One Big Beautiful Bill Act and June’s Marketplace Integrity and Affordability Final Rule might make it more expensive and difficult to sign up for individual coverage, potentially keeping ICHRAs from living up to the hype.

People with lower medical costs may decide individual insurance isn’t worth the hassle, Volk said.

“The people who will persevere are the ones who say ‘I need this coverage no matter what it costs me, and no matter how many hoops I have to jump through,’” Volk said.

If those who choose to keep their health insurance coverage are sicker and use their coverage more, payers may raise premiums or cut everyone’s benefits to compensate.

 from nonpartisan health policy research group KFF predicts the average out-of-pocket payment will rise 75% for people who use Healthcare.gov or state-based 

. Enrollment is currently at a record 24 million, though that number could drop by more than 11 million based on actuarial group Wakely’s analysis of an earlier version of July’s bill. Among the changes:

Automatic re-enrollment ends starting in plan year 2028.

The open enrollment window shortens by two weeks beginning in plan year 2027.

Stricter eligibility verification requirements for the premium tax credit will be effective in plan year 2028.

, which are set to expire at the end of the year.

The minimum percent ACA-regulated plans must contribute toward patients’ costs lowers beginning in plan year 2026 (aka more cost-sharing for patients).

For ICHRAs to work, “there needs to be a healthy, robust, and vibrant individual market of ACA plans. And so, any actions that move us away from that don’t further that goal,” Josh Schultz, strategic engagement manager of Softheon, a healthcare technology company that provides enrollment, billing, and payment solutions to health plans and government agencies, told us.

The final version of the One Big Beautiful Bill also removed an earlier provision that would have codified ICHRAs and given $100 monthly tax credits to participating small employers.

Volk specifically pointed to one clause buried in the June marketplace rule that lowers the share of patient costs an ACA-regulated plan must cover, effective 2026.

This matters for ICHRAs because it has long been law that large employers must contribute a minimum to their employees’ health reimbursement arrangements in order for coverage to be considered “affordable”—otherwise, they’re fined. That minimum is calculated for each employee using, in part, the cost of the lowest-cost standard silver-tier plan on the marketplace that year.

So if silver plans cover less, employers can contribute less, which shifts more of the financial burden of premiums and out-of-pocket costs to employees. The rule’s text argues this could increase ICHRA adoption, making large employers more willing to get on board because it would be cheaper for them.

Alan Silver, president of Centene’s ICHRA offering, said he views this model as “the future of employer-sponsored healthcare” in a statement to Healthcare Brew, echoing a similar remark by Centene CEO Sarah London in a February earnings call. As of March 31, Centene touts nearly 28 million managed care members, of which people in ICHRAs make up a small portion.

Louis DeStefano, SVP of growth at insurer Oscar Health—which, according to DeStefano, has just under 2 million members primarily in the individual exchange marketplace—said he hopes Oscar can become “one of the leaders” in the ICHRA market.

He argues ICHRA is attractive because of its ability to really individualize insurance—the insurer has plans specifically for people with diabetes, for instance.

DeStefano added it’s possible that Trump or Congress might eventually extend premium tax credits or take other actions to otherwise incentivize ICHRA growth.

“The administration remains supportive of ICHRAs as a means to efficiently strengthen the individual market and expand employee insurance choices for small businesses. President Trump made meaningful progress during his first term to expand ICHRAs, and we are committed to building off that progress,” White House spokesperson Kush Desai told us.

A hand reaching out to medical crosses on a store shelf, with all different price points.

How recent policy could impact ICHRAs

A recent marketplace integrity rule could halt ICHRA momentum.

It’s no secret that the healthcare industry is a 

 experiencing cybersecurity incidents each year.

 in 2024, there were major attacks at Anthem, CareFirst BlueCross BlueShield, and UCLA Health Systems about 10 years prior that had set the industry ablaze. The trend was a wake-up call for providers who were increasingly using electronic health records but perhaps didn’t incorporate enough protections to keep patient data safe online.

Cyberattacks aren’t just invasive for patients—they’re also very costly. 

 last year, in fact, that healthcare data breaches cost an average of $9.8 million per incident.

These attacks were a lesson for the entire industry in 2015, and experts spoke with Healthcare Brew about how the approach to cybersecurity shifted after.

“The only thing that really moves the needle in cybersecurity is a high-profile attack,” Mark Stockley, a cybersecurity expert, said.

 in February 2014 but wasn’t disclosed until about a year later when health plan Anthem announced a hacker had stolen personal information—including names, health identification numbers, dates of birth, social security numbers, addresses, telephone numbers, email addresses, and employment and income information—of 78.8 million former and current members.

The hack was reportedly found by a database administrator who noticed his credentials were being used without his permission, according to the California Department of Insurance. The company said in January 2015 the database was shut down immediately following the discovery, and staff changed their passwords. The company paid 

 through 2020 to settle lawsuits related to the incident.

Soon after in June 2014, CareFirst, a BlueCross BlueShield company, experienced a cyberattack that exposed “a single database” associated with the company’s website and online services. The company announced in May 2015 hackers had stolen personal information about 1.1 million members and business associates.

Also in May 2015, UCLA Health confirmed it had been hit by a cyberattack that was suspected as early as October 2014, tech news site 

. The attack impacted 4.5 million patients. Data like names, social security numbers and medical information had been stolen, and UCLA Health paid a $7.5 million settlement in March 2019 for not reporting the breach sooner under the HIPAA privacy rule.

None of these companies provided comments on the attacks.

Part of the problem in the Anthem attack, in particular, was that the company 

 personal information, Leeann Nicolo, incident response lead at cybersecurity insurance company Coalition, who also worked on recovery for the Anthem attack, said. Encryption includes changing data and information into code, so it’s harder for hackers to determine the meaning.

Back in 2015, encryption and multi-factor authentication (MFA) were not norms like they are today, she added. (Some companies still don’t have MFA requirements, as seen in the Change 

“The breaches were wake-up calls that exposed how vulnerable this data could be,” she said, adding she remembers thinking healthcare lagged behind other industries in being prepared for hacks.

Cyberattacks against the healthcare industry are on the rise. A 2025 data breach 

 found that the industry saw 1,710 security incidents between Nov. 1, 2023, and Oct. 31, 2024—an increase from 1,378 security incidents the year before.

Since 2015, Nicolo said budgets for threat detection as well as investments in security operation centers and endpoint detection and response tools have increased “significantly.”

A survey of 273 healthcare cybersecurity professionals by the 

Healthcare Information and Management Systems Society

 found that 52% of respondents said their organizations “would increase” IT budgets from 2024 to 2025.

Attacks led to the establishment of other norms like remote desktop protocol for people working outside the office and robust offline backups, which are secondary secure places for data to be stored in case of emergency. There’s also been a push to move cybersecurity from a smaller IT concern to a “strategic board-level risk,” Nicolo said.

“[Execs] started planning for it financially—they put people in positions where that was their only role,” she said.

There’s also more awareness today compared to 10 years ago around phishing attacks, where a user is tricked into providing personal information, Nicolo said. However, she said these attacks have become “more sophisticated,” employing methods like using token theft, or a tactic through which a bad actor obtains MFA information to access accounts.

Regulations—such as stricter enforcement and fines from HIPAA and the FDA as well as state privacy laws like the 2018 California Consumer Privacy Act—have also created more protections for healthcare data.

“There’s “more regulations with more teeth,” Nadya Bartol, managing director at consultancy BCG Platinion, said.

While the industry has learned some lessons, this remains a continuous cycle: New tech emerges as fast as it can to beat its competitors to market, but as a result, sacrifices cybersecurity along the way.

When the inevitable attack comes and sensitive data that wasn’t properly safeguarded is compromised, then new regulations are drafted and safety protocols are adopted, Bartol said.