healthcarebriefing.com

Tag: First Opinion

  • Opinion: MyChart said I could opt out of sharing my health data. Figuring out how was maddening

    Opinion: MyChart said I could opt out of sharing my health data. Figuring out how was maddening

    STAT is co-publishing this investigation by CalMatters/The Markup.

    Shira Fischer, a physician who works in health policy in Boston, sought a speech pathologist for her child in 2022, when virtual appointments became the norm because of Covid-19.

    “I read their consent and they said they were going to record and use [our appointment] for training,” she said. “And I said, no, my kid has a lisp. The last thing she wants is videos of her lisping to be used for training for who knows how long and who knows what database.”

    Fischer said the clinic wouldn’t change the consent, and wouldn’t proceed with the appointment if she didn’t sign it. Eventually, she found a different speech pathologist. “It ended up being better. But what is that, that they require you to allow them to record for their training?”

    Every day, doctor’s offices across the country tell patients that if they want to see the doctor, they must allow their health data to be accessible by tens of thousands of hospitals and clinics. Often, doctors give out overly broad consent forms, asking patients to agree to anything from hospitals using patient files for training doctors to using patient data for training artificial intelligence.

    Practically speaking, when a patient doesn’t agree, doctors can turn them away.

    Other times, doctors’ offices tell patients they can opt out of sharing their data later — by contacting an email address or mailing a physical letter — but in reality, opting out can be so difficult and confusing that it isn’t really a choice at all.

    When I was pregnant with my child, I wondered why my gynecologists’ forms asked me to let another company, Phreesia, mine my health data for marketing. The authorization form was labeled “Required” even though it legally must be optional. I systematically opted out and kept my own records of this, but when I tried to confirm my opt outs with Phreesia, it said I did consent. After 81 days of back and forth, Phreesia admitted I had never authorized them to use my data. But it continued to use the misleading “Required” label on the authorization form. Months later, after complaining to the Department of Health and Human Services, and an episode of “The Indicator from Planet Money” on NPR, Phreesia changed how it labeled its forms. I found the process galling, but it spurred my curiosity, and I’ve been researching how opt outs work ever since.

    In the last year, I registered as a patient at 25 clinics and hospitals across seven states and spent hundreds of hours reviewing consent forms, privacy policies, and marketing forms to see whether I could actually opt out of sharing my data.

    For one hospital in Ohio, it took me 26 steps, a notary, and a flight to Las Vegas to learn how to opt out of the hospital’s many uses of my patient records. Despite my best efforts, the hospital will not follow its own policy, which ostensibly allows patients to refuse to allow the hospital to take and own photos and recordings of them.

    It started last January, when I sought a second opinion on a personal health issue with a specialist at University Hospitals in Westlake, Ohio. University Hospitals is a large, nonprofit hospital system that manages its electronic health records through MyChart, a widely used patient portal. MyChart is made by Epic Systems, a health care software company in Verona, Wis., that says it has more than 305 million patient charts, coming from patients in every state and more than a dozen countries.

    As I prepared for my appointment, the hospital asked me to sign its registration forms and to sign up for MyChart. In the dense terms of service, I spotted three different ways that as a patient, my data was about to be used, accessed, or shared:

    1. The hospital will share my health data through Epic’s proprietary health information platform, Care Everywhere.
    2. The hospital will share my data with CliniSync, an Ohio-based nonprofit health information exchange that facilitates the exchange of patients’ information, like lab results, across institutions.
    3. The hospital will own any photos, audio, or video they take of me and may use them for any lawful purpose.

    In each case, I was told that I could opt out or refuse, but the process felt like it was designed to keep me from doing so. Forms and websites lacked basic contact information; customer service didn’t respond; patients were required to find a notary, and hospital staff directly contradicted their own written policies and told me I wasn’t allowed to opt out.

    So I set out to see what it would truly take to say no to sharing my data, starting with Epic.

    There’s no button to revoke authorization everywhere

    Once a hospital makes a patient’s records available through Epic’s Care Everywhere, many clinicians who work with Epic across the country can pull up those records, with some exceptions.

    The most common way doctors use health exchanges is to get up to speed on a patient who is coming to see them. Sharing patient health records through exchanges has decreased duplicative tests on patients. It also allows emergency room doctors who have never seen a patient before to immediately get their health history and allergies, which can save a patient’s life, said Saurabh Rahurkar, a former assistant professor at Ohio State University College of Medicine.

    Individual hospitals can also restrict which doctors can see a patient’s files, such as by physical distance, or by adding an extra confirmation step before doctors can see the files of patients who have received psychological services.

    “If you say to your new doctor, ‘Please go get my records at this place that’s 3,000 miles away,’ Care Everywhere can do that, but not if the system has the settings to only look for records within a 50-mile radius,” said Lucia Savage, former chief privacy officer at the federal health IT office.

    But there are clear reasons why some patients don’t want their data to show up in these searches, and hospital protections, if they exist at all, are not always effective.

    For example, a patient who crosses state lines to seek an abortion treatment may not want her records to be searchable by her providers in her home state where that treatment is criminalized.

    “People who have had bad experiences with unauthorized access to their information and people who have sensitive health conditions and diagnoses, for very good reasons, are just mistrusting of the health care system,” said Julia Adler-Milstein, a leading researcher in health IT policy and a professor of medicine at the University of California San Francisco. They “don’t feel like the health care system has been a good steward of them and their information.”

    For example, researchers reviewing 1,138 breach cases found that almost 10% of patient health data breaches come from unauthorized access by health care employees who forward personally identifying information to personal accounts.

    Nichole Sweeney, who was recently the chief privacy officer and general counsel at CRISP Shared Services, which provides technology infrastructure to support health exchanges in more than 10 states, said she often encountered providers snooping in patient records in her job as a privacy officer: “Somebody, a provider in an office, looks up an ex, and we find that because we have monitoring software, and I have to call them and tell them not to do that anymore. They get fired sometimes.”

    Cason Schmit, a health law and policy professor at Texas A&M University, warned, “We’re at a place in time where data that are being collected to help people are now being used in ways that could actively and specifically harm them.” He pointed to Immigration and Customs Enforcement use of health data for immigration enforcement. Schmit has written about the role of state policy in fostering health information exchange and its benefits to the public, such as tracking measles outbreaks.

    In my attempt to opt out of Epic’s Care Everywhere, I first looked for a way to do it with MyChart. I navigated through 40-plus menu items, including the “Sharing Hub,” where I watched videos on Care Everywhere that explained its benefits but not how to restrict its uses. In the end, I found one section under “Authorize Sharing” that said I could “request that your information no longer be shared” by sending a message to customer service. I tried that. I got no response.

    Then I tried emailing and calling the hospital system’s ethics and compliance department to opt out of Care Everywhere. Crickets.

    After weeks of dead ends, I found something that worked. When I called MyChart’s patient support number, the representative said I could opt out by contacting the hospital’s medical records department. I called medical records, and they called back that day and confirmed I was opted out of Care Everywhere.

    But how are patients supposed to know about this process? I couldn’t find “contact medical records” described anywhere in MyChart or on the hospital’s website.

    I asked Epic for an interview, and they agreed to let me speak with Matt Doyle, who leads software development for Care Everywhere. Turns out, both of us were about to be in Las Vegas, for one of the largest health care tradeshow conferences in the country. I arrived early at the Epic booth, which was well-appointed among its peers in the exhibition hall with carpets and a private meeting room. Posters proudly announced that health providers exchange approximately 22 million patient records each day through Care Everywhere.

    Doyle walked over from a hub of Epic employees clicking through MyChart screens with conference attendees, and led me to the meeting room along with a colleague from public relations.

    “So when you check in for your appointment, the de facto position is you’re part of Care Everywhere,” Doyle confirmed, “unless you explicitly opt out.”

    I recounted for him everything I tried, and how there was nothing I could click in MyChart to opt out.

    “It’s not in the MyChart enrollment process,” Doyle clarified, “but as soon as your MyChart account is set up, you can immediately go opt out.”

    Doyle explained that there are two levels of opting out.

    “One is, ‘Revoke authorization, but I still want to be discoverable,’” he said. “And what that would mean is, let’s say today you’re in a car accident. You go to the emergency department. Your doctor’s office back in Ohio doesn’t have your authorization on file, but you’re discoverable.” Meaning, a doctor could see that a specific patient has a health record, and can ask the patient for his or her consent to access that record.

    The second level of opting out is to be completely undiscoverable through Care Everywhere. In this case, doctors who work in other hospital systems can’t see any record of the patient in Care Everywhere. It’s a choice only 112 patients have made since they rolled out the ability to opt out this way in August 2025, Doyle said.

    There’s one extra twist. Doyle confirmed that there isn’t a single place to revoke authorization everywhere. “You have to go to each custodian of your medical records,” he clarified. A patient would revoke access to Care Everywhere “with each place that you receive care.”

    “Can you show me how to opt out?” I asked.

    Doyle brought me back out to Epic’s booth, where employees have demos of MyChart on multiple screens. Doyle tried to find a demo where he could show me a new, patient-facing feature to revoke authorizations for data sharing. But the patient in the demo product had not signed any authorizations, so there was no way to show me how to revoke them.

    I asked the next public relations representative who joined us if I could see it on her MyChart. She pulled it up on her phone, went to the “Sharing Hub” menu options, but we didn’t see the “Revoke authorization” button. We looked at Doyle, who then explained that only organizations that have updated their Epic software would have the opt-out methods that he described. He offered to show me on a video call the following week.

    Until a patient’s health care provider updates their software from Epic, Doyle confirmed that a patient’s only option is to call the medical records department and tell them “I would like to opt out of Care Everywhere.”

    A week later, three Epic representatives joined my meeting with Doyle to show me how to opt out in the Sharing Hub section of MyChart. 

    “There’s two different places,” explained Sean Bina, vice president of access and patient experience at Epic, as he showed me the buttons in MyChart. “One is ‘managing my record authorizations.’ And then the second is how I can prevent other organizations from requesting a record.”

    After months of trying, I finally got to see actual buttons inside of MyChart that would let me opt out.

    After this interview, Epic did not respond to further questions from CalMatters and The Markup about Care Everywhere, including how many current patients have the ability to see the opt out buttons inside of MyChart.

    A prime example of using health data for profit involves companies that use what expecting parents search for or watch online and what they’ve shopped for to target them with baby ads.

    Mary Ebeling, a sociologist at Drexel University who wrote the book “Healthcare and Big Data,” had just learned in March 2011 that her doctor could no longer detect a heartbeat in her 11th or 12th week of pregnancy.

    “After learning that I lost the pregnancy, literally, I came home, and my mail carrier delivered the first issue of a year’s subscription [of the now-defunct magazine American Baby] for free,” she recalled. “I had not signed up for it — to American Baby. And I was like ‘I’m getting angry right now about it.’”

    The unsolicited baby-themed marketing continued, and she eventually discovered that the data broker Experian was selling her information in a database of “new parents.”

    Commercially gathered data, such as Ebeling’s online search or purchasing history, doesn’t have the same legal protections as health records at health care facilities, which are covered by HIPAA. But that protection isn’t bulletproof. Past Markup investigations have found that HIPAA-covered hospitals were sending sensitive patient data to Facebook through Meta’s tracking pixel.

    Federal law also allows confidential substance use disorder treatment records to be shared in certain circumstances, such as with probation officers.

    As a part of her work, Jacqueline Seitz, deputy director of health privacy at the Legal Action Center, frequently speaks with patients who use drugs, are in recovery, are living with HIV, or are in treatment for substance use disorders. She also regularly speaks with the health providers who treat them.

    “When I talk to providers and I ask them what they tell patients, they say, ‘We tell patients everything is confidential.’ And that is not the right thing to say. That is not true,” Seitz said.

    For patients who are mandated into treatment in order to maintain their employment, custody access, or probation, when asked, their medical records must be shared with probation officers or other legal authorities, Seitz explained. It’s why she increasingly sees electronic health records as a rap sheet.

    “I don’t think people are trying to trick patients,” she said, but she regularly sees examples of health care workers not fully understanding confidentiality rules in these cases.

    Opting out of CliniSync, Ohio’s statewide nonprofit health information exchange

    In addition to being asked to sign up for MyChart when I registered for my appointment at the University Hospitals, I was also asked to acknowledge my participation in CliniSync.

    CliniSync, Ohio’s statewide nonprofit health information exchange, facilitates the exchange of patients’ information, like lab results, across institutions. CliniSync is operated by the Ohio Health Information Partnership, an independent private nonprofit founded in 2009. Ohio’s governor designated the partnership to develop the statewide exchange.

    The hospital system posts many of its forms online, so I had time to research the general consent to treatment form in advance. That alerted me to how patients are defaulted into sharing their data with CliniSync.

    A quick online search for “UH privacy policy” (UH stands for University Hospitals) brought me to the hospital system’s HIPAA Notice of Privacy Practices. It said I can opt out of CliniSync if I contact their privacy officer over the phone, and it gave me an email and phone number. I emailed right away. I didn’t hear back before my appointment four days later.

    I also knew that CliniSync likely has its own policy, separate from the hospital system’s, so I also searched for its opt-out policy online. The instructions are simple but surprised me: CliniSync asks patients to notarize its opt-out form.

    “It’s a big time suck for people. They’re going to have to spend a lot of time finding a notary. They’re going to have to pay that notary, almost certainly, unless they happen to have a friend or family member who’s a notary public,” said Lior Strahilevitz, a legal scholar at the University of Chicago who writes about privacy and teaches health law. Not only is requiring a notary burdensome, it’s also legally questionable. General guidance from the federal government states that HIPAA authorizations do not need to be notarized.

    Still, I paid the $15 at UPS to get the form notarized and mailed it out.

    The Ohio Health Information Partnership, which operates CliniSync, declined to respond to questions about why it requires patients to get their opt-out requests notarized.

    Finally, on the day of my appointment, I tried what should have been the easiest method for patients: Asking the hospital to opt me out in-person.

    When I asked the receptionist at my appointment how I could opt out of CliniSync, she said she didn’t know, but she’d run my request up the chain while I was with the doctor. When I came back, she had an answer: Patients can’t opt out. A colleague at the hospital told her through email that CliniSync “ensures that providers across various hospital organizations are able to request and access patient medical records, as it relates to medical need and treatment. This is not feasible to be ‘removed’ from clinisync.”

    CliniSync does, in fact, have a form to let patients opt out. And clinic staff can sign the form so that patients don’t have to find a notary instead. It says so right on the CliniSync opt-out form.

    But in my research into how difficult it is for patients to opt out of processes like this, multiple hospital staff have given me inaccurate information. I wasn’t surprised.

    Strahilevitz described this as a common problem in any bureaucracy, a phenomenon known as “desk clerk law.”

    “Basically, there’s what the law is, and then there’s what the person at the DMV who’s actually interfacing with the consumer thinks the law is or what the person at the Secretary of State’s office is,” Strahilevitz said. “And so I would regard your experience with the receptionist as a classic instance of ‘desk clerk law.’”

    University Hospitals declined to respond to questions about whether its patients can opt out of CliniSync, and said it did not have an expert available for an interview.

    After my appointment, I called the hospital’s compliance office and a few days later, I got a voicemail asking for more information over email, or for me to call them back. Since I know that Ohio law requires requests to opt out be written, I emailed the hospital with what they ask for. When no one responded, I called and emailed again.

    Soon after my appointment, I got a hand addressed letter from CliniSync confirming my opt out and saying they processed it shortly after they received my notarized letter. I was pleasantly surprised, because I’ve followed many opt-out processes in the last year, and it’s uncommon to get verification like this.

    Two weeks after I saw the doctor, the hospital’s compliance office confirmed my opt out from CliniSync over email.

    Because CliniSync records a patient’s opt out centrally, one request blocks other providers from seeing a patient’s records through CliniSync’s network, but for many health exchanges, including Epic’s Care Everywhere, patients would have to discover and follow an opt-out process at each new provider.

    Sweeney, who was the chief privacy officer and general counsel at a company that supported health exchanges in more than 10 states, estimated that a typical patient might have to opt out of data-sharing at as many as 10 different places — wherever they seek care — for their opt out to be meaningful.

    In most states, she said, “the place to cut off the data exchange is at the provider because that’s where it starts.”

    In some rare cases, patients do not need to go through this complicated opt-out process, because their clinic refuses to share any patient data with health databases or platforms, simply because patients haven’t explicitly consented.

    Keith Smith runs the Surgery Center of Oklahoma, which markets transparent pricing and cash payment. The center does not accept insurance or Medicare, and it has tried to refuse government agencies’ requests for patient data, such as from the state health department.

    “There’s no shortage of people that will claim that they have a legal right to see how many patients operated on at Surgery Center of Oklahoma had breast cancer or had inguinal hernia repairs,” he said. “And the patients haven’t consented to the release of their records.”

    Because Smith’s surgery center does not accept federal dollars, he isn’t obligated to report as much information to the government. “We treat patients here as individuals. And I don’t think it’s right to violate the rights of an individual for the greater good,” he said. “All the individual cares about is that their rights have been violated.”

    Refusing to let the hospital own my photos, videos, or recordings

    In addition to asking me to share my patient records with multiple health exchanges in order to see my doctor, University Hospitals also required me to give it complete ownership over any photos, audio, or videos it takes of me. Its consent form states, “UH may, unless otherwise refused, photograph and/or audio or video record me or the Services I receive, including those in which I am identifiable. UH will own such images or recordings and may use them for any lawful purpose.”

    I have rarely pondered the possibilities: If the doctor takes a picture of a rash on my child’s body for diagnostic purposes, would I want the hospital to claim ownership over or have broad rights to use that photo?

    The consent form says I can refuse, but when I asked the hospital’s compliance and ethics office, they wouldn’t let me. “We are not able to accept modifications or partial withdrawals of specific provisions within the General Consent for Treatment itself,” said the hospital’s email. “This includes provisions related to incidental recording that may occur as part of delivering or documenting care.”

    That surprised me. In hospital systems, the compliance office is usually where staff have privacy expertise. The hospital refused to follow its own policy.

    University Hospitals declined to respond to questions about whether its patients can refuse giving the hospital ownership over images and recordings it takes of patients.

    “It’s misrepresentation,” said Strahilevitz, the University of Chicago expert. “So I think that’s just fraud to tell you you have a right and then telling you, ‘No, we were wrong. You don’t, in fact, have that right. And now your photograph and/or audio and/or video is going to be used.’”

    Fischer, who refused to see a speech pathologist because the doctor’s office insisted on a right to record her child’s lisp treatment, said she sees health providers requiring parents to agree to clauses like this all the time.

    “I can’t get a link to telehealth appointments for my kids without signing agreements that include things like ‘authorize the use of photos, videos, and/or recordings’ and ‘give permission for staff (including students) to participate and/or watch for training purposes’ or other things I don’t want to agree to,” she said. “But there is no option to not sign.”

    Experts say there are practical design and regulatory solutions

    Colin Gray, an assistant professor at Indiana University Bloomington and a leading expert on manipulative design said, “You start from the position of defeat rather than starting from the position where you’re making a rational choice … the attitude is, ‘Well, if you really cared about your data, then you would go through the extra steps to turn it off.’ And in this case, it’s like, ‘That’s an hour of my time or 26 steps or whatever it is that I don’t have.’ And so it looks so onerous from the beginning, like, why would you even try?”

    Experts like Stacey Tovino, a professor who teaches HIPAA privacy law at the University of Oklahoma College of Law, say there’s a clear and practical solution: “Amend these [federal] regulations to say covered entities shall not impose an undue burden on people trying to opt out.” Tovino suggested that when patients see that they can opt out in a form, the next sentence should include a link to do so.

    Some states have laws that require this type of solution. Under New York law, for example, providers need explicit consent from patients to access their data from health information exchanges. I saw it firsthand when I registered my son for an appointment in upstate New York. The check-in screens showed me a form labelled “Health Exchange,” and asked for my consent for the physician group to access all of the patient’s medical records through Healthix, a health exchange. When I clicked “No,” the next form showed the detailed consent form with “I DENY CONSENT” selected as one of my two choices. But when a provider in Virginia, which doesn’t have a state law with explicit opt-in or opt-out requirements, informed me I had the choice to opt out, it refused to let me. My only option was to click “I accept” and to follow an opt-out process after the fact.

    According to Seitz, the health privacy director who works with patients going through mandated treatment, one major challenge in privacy law is that it’s difficult to put a dollar amount on the type of harm people experience, such as when intimate details about their lives are stored in recorded therapy sessions on an unsecured database, like Confidant Health did in 2024. Individuals can’t file a civil lawsuit or sue their doctor for violating HIPAA, which means that only the federal government or state attorneys general can enforce it. As a result, Seitz said that the attitude in health care around data breaches is: “Yeah, I’m breaking the law. What are you going to do about it?”

    To make privacy violations actionable, Seitz said, “I would want statutory damages. Like, every corporate defense attorney’s nightmare where it says, ‘Every breach equals $2,000,’ and then all the client has to do is show the breach, and then it’s money.”

    At the end of the day, experts said one of the most important parts of the health data ecosystem is trust.

    “Every single health data custodian that exists should be doing everything that we can to nurture and protect and foster the trust of those whose data we protect,” said Schmit, the health law and policy professor who wrote about how health exchanges can benefit the public. “And one thing that will absolutely undermine that trust are structures and processes that are opaque and difficult to follow, that make patients feel like they aren’t cared for.”

    Alex Rosenbat is the director of sociotechnical research at CalMatters and The Markup. As a researcher and reporter, she writes about dark patterns, privacy, and product design in U.S. health care.  She is the author of “Uberland: How Algorithms Are Rewriting the Rules of Work.” Read her tips for opting out of sharing your health data.

  • Opinion: How CMS plans to fix a major flaw in the 340B drug discount program

    Opinion: How CMS plans to fix a major flaw in the 340B drug discount program

    By Casey B. Mulligan

    Oct. 8, 2026

    Mulligan is the chief economist and chief regulatory officer at HHS.

    Some Medicare patients owe more in coinsurance than the hospital paid for their drug. That arithmetic sounds impossible. It is a consequence of the 340B drug discount program and Medicare’s payment formula. Now the Department of Health and Human Services, where I work, is proposing to narrow that gap.

    Congress created the 340B drug discount program in 1992 to financially support safety net hospitals that serve low-income patients. Drug manufacturers must give them steep discounts. But Medicare, Medicaid, and commercial insurers generally reimburse them at the full amount, allowing these hospitals to keep the spread above the discounted purchasing costs.

    A new report from the Department of Health and Human Services shows other unintended consequences of this well-intended program. The spread grows with the price of the drug. It therefore rewards hospitals for using more and costlier drugs and makes physician practices and infusion clinics more valuable after a 340B hospital acquires them. The patient’s treatment needn’t change. The owner and billing site do.

    The 340B program has exploded: Eligible drug purchases rose from $12 billion in 2015 to $81 billion in 2024, mostly at hospitals, as shown in the report. Those purchases are now larger than net Medicare Part B and Medicaid drug spending overall and, among public prescription drug programs, are smaller only than Medicare Part D.

    A 340B hospital that buys another hospital or a physician practice can register more off-campus clinics and contract pharmacies and capture more spread. Hospital off-campus clinic sites grew from about 7,000 in 2013 to more than 34,000 in 2023, often in neighborhoods that are wealthier and better-insured than that of the parent hospital. Contract pharmacies grew from roughly 1,300 in 2010 to more than 31,000 by mid-2026, dominated by the largest chains.

    With greater bargaining power after acquisitions, hospital systems can negotiate higher commercial prices for health care services, which can in turn raise premiums. Newly acquired hospital outpatient sites can also add facility fees to non-drug services. The effects of 340B show up as larger, more expensive hospital systems and a bigger bill for patients, employers, and taxpayers. The program’s ripple effects contribute to the broader problems facing the U.S. health care system.

    Medicare payment for Part B drugs is typically based on average sales price (ASP). Beginning in 2018, the first Trump administration narrowed the spread in Medicare by paying hospitals for 340B drugs’ ASP minus 22.5% rather than the usual statutory standard of ASP plus 6%, based on an earlier estimate of their average minimum discount.

    Overall outpatient drug payments rose nearly 15% a year from 2015 through 2017. Once the lower rate was fully in effect, inflation-adjusted payments largely plateaued. Payments for the affected 340B drugs held near $7 billion from 2019 through 2021. It is clear that Medicare payment policy influences outpatient drug spending.

    The Supreme Court ruled in 2022 that HHS couldn’t vary payment rates by hospital group without first conducting the acquisition-cost survey required by statute. The court didn’t find that hospitals were economically entitled to the markup. It found that HHS lacked a procedural prerequisite. After the lower rate ended and ASP plus 6% returned for these drugs, annual payments for the affected drugs rose from $7.1 billion in 2021 to $10.7 billion in 2023 — a $3.6 billion increase. Overall outpatient drug payments rose from $14.3 billion in 2021 to $17.6 billion in 2023.

    Restoring the higher rate meant paying hospitals more for the same drugs. The $3.6 billion increase combines that direct payment effect with induced changes in hospitals’ dispensing quantities and drug manufacturers’ underlying prices. The larger spread also strengthens hospitals’ incentive to choose costlier drugs and move treatment into 340B billing sites.

    Off-campus hospital departments benefited too. From 2021 to 2023, payments for their affected 340B drugs rose about $800 million even as claims fell and the number of beneficiaries remained similar. Although these amounts do not tell us how many practices hospitals acquired because of the markup, they indicate the additional financial incentives for acquisitions.

    On April 18, 2025, President Trump directed HHS to obtain the cost information the statute requires. CMS surveyed hospitals from January through April 2026 and has proposed paying for affected 340B drugs at ASP minus 33.4% in 2027. CMS estimates that Medicare drug payments would fall by $4.55 billion in the first year and beneficiary drug copayments by $1.15 billion.

    For a drug with an ASP of $1,000, a beneficiary’s standard 20% coinsurance would fall from $212 to $133.20. The prescription hasn’t changed. The patient’s share of the hospital’s bill has. Narrowing the spread also weakens the incentive to steer patients toward costlier drugs and to acquire physician practices and infusion clinics — the very behaviors that have made care more expensive.

    There’s an important lesson here. A small, well-intended discount for safety net hospitals became a large institutional subsidy with expensive unintended consequences. Under the proposed rule, hospitals would still receive their 340B drug discounts. What would change is Medicare’s payment for those drugs at affected hospitals. Congress provided for a survey of hospitals’ acquisition costs, and CMS says its proposed rate would “more accurately align Medicare payments with hospital drug acquisition costs.”

    Medicare patients should not pay coinsurance as though the discount did not exist.

    Casey B. Mulligan is the chief economist and chief regulatory officer at HHS.

  • Opinion: I’m a doctor. Here’s what I want the public to know about AI tools and health care costs

    Opinion: I’m a doctor. Here’s what I want the public to know about AI tools and health care costs

    When Blue Cross Blue Shield recently published research suggesting that hospitals use artificial intelligence tools to extract more money from insurers without providing additional care, people were mad. Amid growing concerns about AI, one glimmer of hope has been its potential to improve health — and yet, here it was: inflating health care costs without yielding any benefits.

    As a doctor who has used the kinds of tools being criticized, I’m frustrated, too: We can document honestly and still wind up inflating hospital bills. This is because comorbidities function as an on-off switch with respect to billing, even though they affect patient care in nuanced ways.

    Although the problem warrants a systemic fix, the best short-term solution is for hospitals to create more nuanced documentation tools, and for clinicians to exercise judgment when using them.

    What did the research show?

    BCBS suggested hospitals are using automated tools to document secondary diagnoses — like anemia, malnutrition, and low sodium — which allow them to charge more for caring for these patients.

    For instance, a patient might be admitted for diverticulitis (primary diagnosis), but found on post-op labs to have acute blood-loss anemia (secondary diagnosis). Hospitals can use these secondary diagnoses to label a patient as having a comorbidity or a complication, allowing them to bill more for the hospitalization, whether or not they treated the patient’s anemia. These “bump codes” have cost BCBS hundreds of millions of dollars over the past two years, and these costs are presumably passed along to patients in the form of higher premiums.

    BCBS claims that bump coding has become more widespread because hospitals are using AI tools to identify secondary diagnoses. Automated tools can skim a patient’s chart and prompt physicians to document that the patient is, for instance, anemic, and what they are doing about it.

    Are doctors to blame?

    A few weeks after I started medical residency, I began getting emails from hospital administrators I had never met, whose signatures said they were risk adjustment specialists. The emails were generic and polite, advising me to review clinical documentation integrity (CDI) queries on inpatients I was caring for. If I didn’t respond quickly, the request would be forwarded to the attending physician supervising me. A typical CDI query would point out that my note hadn’t commented on, say, a patient’s low sodium level, and would ask me to document that they had low sodium and what (if anything) we were doing about it.

    Like most residents, I was already spending far more time on my computer than I was with my patients. Soon, CDI queries streamed into my inbox with such regularity that I turned to a more senior doctor to ask how I might stave them off. That doctor showed me an automated tool that I could include in my notes. This tool would assess a patient’s lab results, automatically detect any additional diagnoses a patient had (like anemia, malnutrition, or low sodium), and prompt me to specify whether we were monitoring, evaluating, or treating.

    I assumed it was lucrative to the hospital for me to document these diagnoses (why else would they be paying risk adjustment specialists to email me about them?), but we almost always were at least monitoring the secondary diagnosis in question, and I accurately documented as much.

    Including this tool’s outputs in my notes kept the risk adjustment specialists from hounding me and won me back several minutes of each day — enough time to poke my head into a patient’s room before I went home, or call a patient’s family member to give a quick update. I always answered the questions included in my tool honestly, but in the back of my mind, I wondered whether I was doing my patients a disservice: Was I inflating the cost of their hospitalizations without actually improving their care?

    Where bump codes come from

    In general, hospitals are reimbursed for hospitalizing patients on the basis of diagnosis-related groups, or DRGs. DRG payments are set by the Centers for Medicare and Medicaid Services by analyzing claims data. (Medicare uses DRGs to set payments, while many commercial insurers, including BCBS, use the DRG system to negotiate reimbursement rates with hospitals.) Let’s say a patient is admitted with diverticulitis requiring surgery (typically billed as DRG 331 if there are no complications). CMS has estimated how much it usually costs to care for one of these patients and insurers prospectively pay hospitals on that basis; a hospital generally won’t get reimbursed more for keeping the patient longer, administering more drugs, placing more IVs, and so on.

    However, some hospitals care for sicker patients than others. The typical diverticulitis patient at a tertiary medical center in a poor area will require more support than a diverticulitis patient at a community hospital in an affluent area. The government does not want to penalize hospitals that see more complex patients, and so it allows hospitals to seek additional reimbursement forcomorbidities or complications that increase the cost of their care.

    This is where bump codes come from: Hospitals can bill more complex diverticulitis admissions as DRG 330, which is reimbursed at a higher rate. Not all comorbidities or complications count: In 2007, the last time DRGs were substantially changed, CMS analyzed claims data and used this analysis to decide which conditions qualify and set reimbursement rates. CMS pays hospitals more for patients with conditions like low sodium because it has found that it costs hospitals more to care for these patients (perhaps because they tend to be hospitalized longer and more often require ICU admissions).

    However, although CMS adjusts DRG payments from year to year, the list of bump codes hasn’t been overhauled in nearly two decades.

    Bump codes can help identify complex patients and ensure hospitals are paid more for caring for them. These are good things, in part because they reduce hospitals’ incentive to seek out healthier, more advantaged patients. While BCBS claims that hospitals are increasingly using these codes to bill more without actually providing more care, hospitals would presumably counter that they were being insufficiently reimbursed before, and that their coding is accurate. After all, the BCBS study does not claim that hospitals are engaging in fraud; the question is just whether the lab abnormalities hospitals are billing for warrant higher reimbursements.

    So who’s right?

    This issue boils down to the following question: How much more does it cost to care for a patient with a secondary condition, and do current coding rules accurately reflect this?

    The answer is that it depends. For instance, not all low sodium levels are created equal. If a patient briefly has a sodium level that falls below the normal range, but their sodium immediately corrects once they’re able to eat again, they probably don’t require any additional resources, and hospitals shouldn’t be reimbursed more for caring for them.

    By contrast, a patient with dangerously low sodium levels requiring an ICU stay, frequent lab checks, and carefully titrated IV fluids undoubtedly does use more resources.

    This leaves doctors in a tough spot: Risk adjustment specialists ask us to document real diagnoses that we know could increase the cost of a patient’s bill, but we have no idea by how much. Moreover, there’s no medical school module on how much any of these comorbidities affects the true cost of the hospitalization. Against this backdrop, it makes sense that doctors try to just tell the truth: yes, this patient has low sodium, and we are monitoring it, even though this probably allows hospitals to code some patients as being more resource-intensive than they truly are.

    What we can agree on

    This entire enterprise — risk adjustment specialists spamming doctors, who are already nose-deep in documentation burden, to document diagnoses that often do not affect patient care, while insurers publish reports that fail to capture the nuance of the issue, leaving the public angry and confused — highlights a more general problem with respect to how the U.S. health care system works.

    By design, hospitals and insurers are meant to compete with each other, with hospitals trying to collect as much money as they can for providing care, and insurers trying to pay as little as possible. Hospitals bolster their side by hiring risk adjustment specialists and employing AI tools, while health insurers hire payment integrity specialists and employ different AI tools.

    Patients lose out because the administrative bloat inflates the cost of medical care, while making costs less transparent and harder to contest. Ultimately, the fix should be structural: At a minimum, we need to overhaul the list of secondary conditions that are eligible for bump coding. CMS attempted to do this in 2019, when it proposed downgrading or eliminating many bump codes based on new data showing they were not associated with increased costs. But hospitals pushed back, and the effort eventually stalled.

    What should we do in the meantime?

    Secondary diagnoses are supposed to be billed only when they are clinically significant — for instance, when they require further evaluation, treatment, diagnostic procedures, or monitoring. But in practice, the bar for clinical significance is probably lower than it should be. (Even rechecking a lab may qualify as monitoring.) Accordingly, I suspect the BCBS study is tracking a real problem, and that much of the documentation of secondary diagnoses isn’t linked to patient complexity.

    Early in residency, I was caring for an immunosuppressed patient who kept spiking fevers. My colleagues and I wondered whether he might have an indolent infection lurking somewhere and ordered an echocardiogram to rule out endocarditis. His heart valves showed no signs of bacterial growth, but trace backflow was detected across one of his valves, a finding present in most people.

    Soon, I received a CDI query inviting me to document his valve dysfunction in my note. I did not do this, because his incidental valve finding was irrelevant to his hospitalization. Instead, I typed out a response indicating as much. However, it would have been easier and quicker to click through the check boxes, and, despite answering them honestly, potentially inflate the patient’s bill.

    At least some CDI tools built into electronic medical records — including the one I have used — default to including secondary diagnoses in ways that are likely to lead to bump coding. One way to improve the status quo would be to ensure that such tools give physicians the option to document whether a secondary diagnosis is clinically significant or not, rather than simply asking them how they are addressing it (on the presumption that it is clinically significant).

    Hospitals should build such tools, and regulators should ensure they do. In the meantime, I’ll exercise clinical judgment when using my CDI tool — if the low sodium seems important, I’ll document it, and if it doesn’t, I’ll politely decline when a risk adjustment specialist invariably asks me to.

    Leah Pierson is a resident physician.

  • Opinion: Will Claude ever win a Nobel Prize for medicine?

    Opinion: Will Claude ever win a Nobel Prize for medicine?

    On Monday morning, the Nobel Prize for medicine was announced. This year, I wonder: Will Claude or a future artificial intelligence agent ever win the most prestigious award for medical discovery?

    Imagine a future AI agent responding to a scientist’s insightful prompt by successfully identifying a completely novel approach to curing cancer, along with a detailed and actionable plan for implementing it. Given the toll of cancer on our species, I suspect few today would consider that a bad outcome.

    But as a former medical school dean who was regularly called upon to adjudicate complex issues of credit, I’m uncertain how credit for such a future world-changing discovery would or should be assigned. Until today, human scientists have been the agents responsible for discovering cancer cures, and for doing so they (and key associates) have been showered with academic credit and awards, perhaps even a Nobel Prize. Are we now entering a world in which some (or all) Nobels will be awarded to Claude, ChatGPT, or their AI successors, rather than human scientists? And if so, would it matter?

    The Nobel statutes don’t mention “human” but refer instead to “persons.” In 2024, two of the three winners of the Nobel Prize in chemistry were given credit for their work on the AlphaFold model at DeepMind — even though many more were involved. So without changes to the rules, a future prize for a discovery made by AI would most likely go to some “persons” given credit for making the AI possible — at least at first. But the committee may elect to change the rules or interpret them differently. The Nobel Peace Prize, for instance, has gone to organizations rather than persons.

    Today, credit for discovery plays a central role in the reward structure of science. As “the currency of the realm,” credit powerfully influences the norms and practices of the research ecosystem. It’s required for scientists to secure appointments, promotions, funding, access to students, and other necessities. It’s also a mechanism for evaluating research impact and providing accountability for research claims.

    It didn’t always work this way. The current credit ecosystem arose in the mid-19th century, as science emerged as a profession alongside the rise of the modern scientific journal. It’s been further modified by many factors, from today’s online publishing platforms to new means for assessing and quantifying scientific impact, and the increasingly interdisciplinary and team-based nature of research.

    As we begin to acknowledge AI as a generator of scientific discovery, will the approach to scientific credit be transformed as well? Current and future scientists would certainly like to know.

    Despite many unknowns, it’s hard to imagine the status quo holding. In perhaps the most likely outcome, humans will continue to be responsible for many discoveries, often aided by AI along the way. The credit ecosystem will continue to recognize these human achievements, while finding ways to appropriately recognize the contributions of their AI collaborators.

    But if AI itself is recognized as the responsible agent for some discoveries — even profoundly important ones, such as a cancer cure mentioned above — how would credit be handled? Would assignment of credit as we know it today even matter?

    In that world, humans might retain (for a while) a desire to acknowledge the role of AI in those discoveries, even bestowing previously human-only awards upon the responsible AI agents. Perhaps some credit would also go to their human creators, those putting forth insightful prompts, and those creatively implementing the work.

    But in a world of predominantly AI-driven discovery, the current role of credit as an incentive for the human research ecosystem would dramatically change.

    In considering this future, we must consider another role that credit plays. Beyond serving as an incentive and accountability mechanism in the human academic research ecosystem, there are commercial incentives for discovery, and credit plays a different role in that setting. A major commercial incentive for biomedical research involves the awarding of patents for discovery, and today only humans are eligible to be named discoverers. If future laws change to allow recognition of AI agents and/or their human creators as discoverers (with or without human collaborators), how might this affect accountability, ownership, and the ability to profit from discoveries?

    For research conducted today in both academic organizations and for-profit companies, ownership of intellectual property is generally held by these organizations rather than the human discoverers now named in patents. Patent law might evolve to allow organizations to name AI agents — even proprietary AI versions — as discoverers. But assigning credit would remain complicated to the extent humans will likely play creative roles in successfully implementing AI-generated ideas, though efforts are underway to create AI-automated research systems.

    Today, the science community is composed of humans who seek and often compete with others for discovery as well as credit, and this feature of scientific culture is believed to play an important role in the success of the enterprise. As AI becomes a key enabler and even primary driver of discovery, the current culture of credit will evolve to accommodate that reality. Changes to the credit economy may be among the many trade-offs we accept to realize the benefits of AI-driven discovery, in biomedical research and other domains of human activity.

    Whether an AI agent will ever receive a Nobel laureate is, at least in part, a question about what jobs we want credit to perform. If it’s mainly an incentive for human scientists and the overall enterprise, its role will change as machines play a greater role in discovery. If credit continues to influence allocation of trust, resources, and responsibility, those needs will persist, necessitating decisions on how best to manage them in an AI dominated research ecosystem. This may be further complicated by recent debates about whether AI agents may evolve into moral agents whose status would justify their receiving credit for “their work.” 

    I don’t know how these questions will ultimately be resolved. And I suspect the answers will differ across diverse domains related to research: human scientific careers, journals, funders, universities, biopharmaceutical companies, patent offices, and yes, prize committees. The current system was designed for a world of human discoverers. Though that day may never be fully behind us, we must begin serious conversations about what changes the age of AI science will bring to scientific credit.

    Jeffrey S. Flier is a Harvard University distinguished service professor and the former dean of Harvard Medical School.

  • Opinion: Claude analyzed my genome in 30 minutes. Now we need standards for the results

    Opinion: Claude analyzed my genome in 30 minutes. Now we need standards for the results

    Unpacking from vacation a couple months back, I decided to give artificial intelligence a task. I paused folding my laundry, sat down with Claude, and asked it to analyze the entirety of my genome.

    Back in 2009, this was a task that quite literally took a village of 30 people — including me — working together to interpret the whole genome sequence of a colleague, friend, and fellow scientist named Stephen Quake. This endeavor brought together experts in genetics, computer science, pharmacology, and clinical medicine.

    We built an engine specifically designed for genome analysis, examined millions of genetic variants, reviewed the scientific literature, and debated which findings might matter most for his individual health circumstances.

    The resulting study, published in The Lancet in 2010, was among the first attempts to interpret the complete genome, and the first to translate that analysis into personalized medical recommendations. (About a year later, our team used a similar framework to analyze my own genome, though it was never officially published.)

    This month, Claude attempted the same task — sans the 30 people and nearly yearlong expenditure.

    In a prompt of 180 words, I asked Claude to follow the same framework our team had set forth back in 2009, probing it to identify rare variants that could cause an inherited disorder, genetic abnormalities that could impact my response to different medications, and whether it had enough data to estimate my risk for common diseases.

    Though it was a fairly simple prompt, the task was anything but. My genome file is more than a decade old, was generated using an earlier version of the human reference genome, and lacks information available in newer sequencing formats. These limitations could easily produce an analysis that is misleading or inaccurate.

    Despite that, Claude was able to re-identify many of the most important findings from our original analysis, including the most consequential result in my genome: I carry two copies of the APOE ε4 variant, which is associated with an increased risk of Alzheimer’s disease. It found no major gene-disrupting variant linked to a rare inherited disorder, matching the outcome reached by our original team. It also flagged variants in the DPYD and CYP2C19 genes, which can influence how we respond to certain medications. I asked it to calculate genetic risk scores for common diseases, but it rightfully warned me that my file did not contain enough information to do so reliably.

    Amazingly, this entire interaction used only around 400,000 tokens and cost approximately $5. Most of the half-hour was spent just waiting for scientific databases to load. All in all, a task that once took nearly a year and required a large, specialized team can now be attempted at home for roughly the price of a 2-liter bottle of soda.

    That accessibility opens doors once thought unimaginable. And as these doors open to the general public, the scientific community has a responsibility to develop clear standards for what makes up a medically reliable genome in the first place.

    A genome is not a definitive record

    It is tempting to think of a genome sequence as a permanent record that can be preserved forever after one read. In reality, though, every genome analysis is influenced by multiple factors, such as the reference genome used for comparison and the technology used to sequence the DNA itself.

    Sequencing technologies have seen enormous improvement over the past couple of decades. Scientists can now examine sections of DNA that were once inaccessible and detect forms of genetic variation that older methods may have missed.

    But limitations remain. Almost all existing genomes were produced using a technique called “short-read sequencing,” which breaks DNA into millions of fragments and uses software to reconstruct where these fragments belong. Though this approach works well across much of the genome, it can be less reliable in the regions where sequences can repeat, resemble one another, or contain large structural changes.

    Though difficult to sequence, those regions are by no means irrelevant: Disease-causing variants can occur where conventional sequencing struggles to pick them up. In turn, an interpretation may report that no concerning variant was found without making clear that the relevant gene was not fully examined.

    Another barrier is the reference genome itself. To date, most analyses have compared patients’ genomes against a standard DNA sequence constructed from a limited number of people. As it stands, that baseline does not adequately represent the full diversity or complexity of human genomes, making some variants more difficult to detect, especially in populations that remain under-represented in genomic datasets.

    Newer references now represent many different versions of the human genome through branching paths rather than forcing everyone’s DNA onto one template. This can improve variant detection, especially in complex regions and across diverse populations. Yet laboratories, databases, and clinical systems have not adopted them consistently.

    The call for clear standards

    Now, with the general public able to readily use AI for genomic interpretation that may impact the course of their life and future health decisions, we have never had a more urgent need to develop standards to determine what a high-quality medical genomic interpretation should actually include. 

    Current quality checks are efficient at detecting simple genetic changes, such as an altered DNA letter or a small piece of DNA that has been removed or added. Medically important changes, however, can be much trickier to detect. I liken it to proofreading a book: Finding a misspelled word is quite straightforward, while catching a sentence or paragraph that may not be in the right place takes a bit more nuance.

    A medical-grade genome test should therefore be evaluated on whether it can reliably detect the full range of genetic changes that may affect a person’s health, not only the simplest ones.

    This is an ask that will require a diverse set of exceptionally well-characterized genomes that laboratories, researchers, and AI developers can use as reference materials. These genomes should reflect the full sequence of both chromosome copies and the diversity of the global population, rather than relying on one person or one ancestral group as a universal standard.

    It is also important that the scientific community develops a shared, regularly updated catalog of medically significant genes that are historically difficult to sequence. For each gene, the catalog would ideally describe its technical complexity, identify which methods can reliably analyze it, and document when a specialized test is required.

    Standards must also reflect the task at hand. A test that is not sensitive enough can miss a finding entirely. For example, an inherited variant is present in nearly every cell, making detection fairly clear. Circulating tumor DNA, by contrast, may make up only a tiny fraction of the cell-free DNA in a blood sample. Each application therefore demands that clear minimum thresholds be set for what can be detected and how reliably, and what conclusions the result can support.

    The standards cannot lag behind the technology

    We are heading toward a world in which companies routinely give consumers access to their genomic data, including variant call files (digital files that list the genetic differences identified in a person’s DNA), that they can upload directly into systems such as Claude or ChatGPT.

    Consumer genetic testing was an important first step toward this kind of access, but the shift now is different in scale and interactivity. Services like 23andMe have largely focused on a relatively limited set of common genetic variants.

    A whole genome contains vastly more information. And with AI agents, consumers are no longer limited to a fixed interpretation of their results. They can ask follow-up questions, request additional analyses, and continue investigating particular findings. That kind of ongoing interaction with one’s own genomic data was simply not possible before.

    Now, imagine someone uploading their genome file into a system such as Claude or ChatGPT. Minutes later, alone at their laptop, they are told by AI that they may be at risk for Alzheimer’s disease or cancer.

    This may be true, but there is also the chance that the result is based on incomplete data, and the finding is much less definitive than the AI may suggest. Either way, they may feel completely blindsided, and there may not be a clinician available to talk through the result, whether it should be confirmed, or what the next steps should be.

    This is one of the most consequential challenges of accessible genomic interpretations. Interpretations are available before (or completely without) additional care and support.

    In my own experiment, Claude was able to recognize that my genome file did not contain enough information to make reliable conclusions regarding genetic risk scores for common diseases. This is encouraging — a trustworthy system should be able to pump the brakes and realize when data inputs are too unreliable to make accurate estimations. Even so, that judgment should also be governed by a shared medical standard, rather than left to the discretion of AI developers.

    Putting that standard into practice will require coordination across specialties. Professional societies and standards organizations will need to develop and regularly update the technical requirements. Labs and AI developers should have transparent disclosures on what their systems detect reliably, and which findings still require confirmation. Health systems, meanwhile, will need practical ways to support the increasing number of patients who may arrive with AI-generated results, including confirmatory testing and genetic counseling.

    In 2009, the scarce resources were expertise, time, and money. Today, however, what’s scarce may be reliability. As we embrace the new bioinformatics revolution, marked by incredible speed and accessibility in data interpretation, we must urgently work towards developing standards that increase the likelihood that a casual user can upload their genomic data into an AI system and receive a trustworthy response.

    Euan Ashley is chair of the Department of Medicine at Stanford University and a physician-scientist whose research spans genomics, precision medicine, digital health, and artificial intelligence. Rebecca Handler, a science writer and researcher at Stanford’s Department of Medicine, contributed to this piece.