Kusserow on Compliance: Inova Health System another victim of ransomware attack

Inova Health System is the latest of a dozen health systems affected by a ransomware attack at a third-party software vendor. The Virginia-based health system issued a notice on September 9, 2002 notifying up to 1,045,270 patients and donors, according to a notification Inova submitted to the HHS Office for Civil Rights (OCR). The incident is traced back to Blackbaud Inc., a third-party service vendor used for fundraising and alumni or donor engagement efforts at non-profits and universities. Inova’s notice stated that it was notified by Blackbaud of a ransomware attack which it had discovered and stopped in May 2020.

The attack involved intermittently removing data from the Blackbaud system, which included certain information maintained for Inova. Investigation by Inova found that the personal information affected by the attack may have contained certain personal information of some patients and donors, including: full names, addresses, dates of birth, phone numbers, provider names, dates of service, hospital departments, and/or philanthropic giving history such as donation dates and amounts. The notice also stated there is no evidence that the data will be misused, disseminated or made publicly available and Inova was assured that all compromised data was destroyed and the vulnerability that allowed the incident was closed. The incident did not expose Social Security numbers, financial account information, payment card information, or electronic health records. Blackbaud reportedly prevented the cybercriminals from blocking its system access and fully encrypting its files, however the criminals were able to remove a copy of a subset of data. Blackbaud also reported paying a ransom so that the attackers would destroy their backup file of stolen information.


Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2020 Strategic Management Services, LLC. Published with permission.

CBO projects federal subsidies for health insurance coverage

The Congressional Budget Office (CBO) and the staff of the Joint Committee on Taxation has released a report which updates the CBO’s baseline 2018 to 2028 projections of the number of noninstitutionalized people under age 65 with health insurance and the federal costs associated with subsidizing this coverage through various programs and tax provisions. It is anticipated that these projections will be as the benchmark for assessing proposed legislation’s effects on the federal subsidies (CBO Report, May 24, 2018).


The CBO report provides projections for noninstitutionalized people under the age of 65 with health insurance and the federal costs associated with each kind of subsidy. Health insurance is subsidized by the federal government through a variety of programs and tax provisions. Medicaid and the Children’s Health Insurance Program accounts for 40 percent of federal spending on subsidized health insurance. Medicare accounts for 10 percent. Additional federal spending on health insurance is for coverage obtained through the marketplaces established by the Patient Protection and Affordable Care Act (ACA) (P.L. 111-148), as well as subsidies in the form of tax benefits for work-related insurance.

Cost projections

According to the CBO report, about 244 million noninstitutionalized Americans will have health insurance in an average month in 2018, while 29 million will not. By 2028, it projects that 243 million noninstitutionalized Americans will have health insurance while 35 million will be uninsured. In 2018, net federal subsidies for insured people will cost $685 billion, according to the CBO report. By 2028, federal spending will reach $1.2 trillion.

The following represents the 2018 cost projections for federal subsidies for noninstitutionalized people under the age of 65 in the below categories:

  • Work-related coverage: $272 billion
  • Medicaid and CHIP: $296 billion
  • Nongroup coverage and the Basic Health Program: $55 billion
  • Medicare: $82 billion
  • Taxes and Penalties: $21 billion

The projected expenditures over the 2019 to 2028 period under current law:

  • Work-related coverage: $3.7 trillion
  • Medicaid and CHIP: $4 trillion
  • Nongroup coverage and the Basic Health Program: $760 billion
  • Medicare: $1 trillion
  • Taxes and Penalties: $313 billion

Comparing previous projections

A comparison of the CBO’s latest 10-year projection to its comparable 2017 projections indicates the federal government will pay less money on subsidized health insurance and the number of uninsured people will increase. In September 2017, the CBO issued a detailed report comparable to this one. A comparison indicates that the projections have shifted. The CBO lowered its 2018 to 2027 net federal subsidies for health insurance by 5 percent.

Also, the projected number of people with subsidized coverage in 2027 under the ACA is projected to fall by 3 million. The elimination of the penalty associated with the individual mandate is expected to account for roughly half of the projected reduction in work-related coverage over the next decade. It is projected that 2 million fewer people will enroll in work-related coverage in most years after 2018. The CBO has modified its 2017 projections to estimate that 5 million more people will be uninsured in 2027.

CBO, JCT share methods for analyzing legislative proposals impacting health insurance coverage

The Congressional Budget Office (CBO) and the Joint Committee on Taxation (JCT) revealed in a recent report how they jointly analyze proposed legislation that would impact health insurance coverage for individuals younger than age 65, detailing how they develop analytic strategies, model a proposal’s effect, and finalize their analysis (CBO Report, February 2018).

Analytic strategy development

First, the CBO and JCT put together an analytic strategy. The agencies formally develop their strategy once the proposed legislation’s specifications become available, an official request for analysis has been made, and the CBO and JCT arrange the time to commence the analysis. However, the agencies also often work informally with Congressional staff during development of the proposal. The agencies begin by reviewing the policy specifications. The CBO and JCT consider how the proposed legislation would impact existing law and how the proposed legislation is different from earlier proposal drafts. The agencies work to verify that the Congressional staff’s intent is reflected in the language and then estimate the legislative effect by, namely, identifying how the proposal could affect health insurance coverage and the federal budget.

The CBO and JCT focus on the policy changes most likely to impact health insurance coverage or cost, ranging from the straight-forward to the more complex. Another key aspect the agencies consider is timing and what additional “administrative infrastructure” is necessary to bring about the changes of the proposed legislation—and how long it would take to do so. The timing element includes estimates of how other stakeholders (state governments, insurers, employers, etc.) would respond and how long it would take for them to implement the proposed changes. To help with their estimates, the agencies rely on past cases of legislative reform programs. Further, the agencies seek input from outside experts and existing evidence while maintaining the required confidentiality of a proposal.

Proposal effect modeling

Second, the CBO and JCT undertake modelling the impact of the proposed legislation. Primarily, the agencies rely on CBO’s health insurance simulation model (HISIM), Medicaid enrollment and cost models, and JCT’s individual tax model. These models use data on health insurance coverage information for everyone younger than 65, Medicaid enrollment and expenditures, and detailed tax return information. The agencies also draw estimates based on information HISIM cannot project, namely, the behavior of states, employers, and insurers. These initial projections are incorporated as inputs into HISIM (state, employer, and individual enrollee behavior) or assessed outside HISIM (insurer behavior). CBO and JCT also use HISIM to estimate stakeholder responses to new coverage options. Medicaid enrollment and cost projections use HISIM estimates in addition to a more detailed Medicaid model and other methods. JCT usually provides estimates of proposed tax liability changes using its individual tax model.


Finally, both the CBO and JCT engage in rigorous review of their respective analysis results in order to ensure objectivity and proper analysis. Specifically, they examine results of one or more years out of the 10-year projection period to ensure that the analysis is being computed as intended and compare results against previous analyses. The agencies also inspect for programming errors or unexplained results. The CBO and JCT consider changes to the results if there were different critical inputs. The agencies prepare a formal written estimate and explanation thereof and, before releasing it to Congress and the public, agency staff carefully review the report.

Eliminating individual mandate lowers cost of CHIP funding

The Congressional Budget Office (CBO) lowered its estimate of the deficit impact of legislation that would fund the Children’s Health Insurance Program (CHIP) for five years, finding that CHIP had become less expensive relative to the rising costs of providing alternative coverage through the federally-subsidized health insurance marketplaces (CBO Report, January 5, 2018).

Prior estimate

The CBO and the Joint Committee on Taxation previously reviewed S. 1827, the Keep Kids’ Insurance Dependable and Secure Act of 2017, in October, finding then that it would add $8.2bn to the deficit. The new estimate finds that the bill, which would also change the federal matching rate for the program and state eligibility requirements, would only increase the deficit by $0.8 billion over the next ten years.

Individual mandate

The change stems from Congress’s repeal of the Patient Protection and Affordable Care Act’s (ACA) (P.L. 111-148) individual mandate. Without CHIP, parents would have to seek alternative coverage, including federally-subsidized coverage offered through health insurance marketplaces set up by the ACA. Without the individual mandate, the CBO expects lower enrollment and higher costs for the insurance marketplaces, which increases the federal cost of enrolling a child in coverage through the marketplaces. The rising marketplace costs make CHIP a more cost-effective alternative to funding children’s health costs, the CBO found.