News, Analysis, Trends, Management Innovations for
Clinical Laboratories and Pathology Groups

Hosted by Robert Michel

News, Analysis, Trends, Management Innovations for
Clinical Laboratories and Pathology Groups

Hosted by Robert Michel
Sign In

CDC Enlists Five Commercial Medical Laboratories to Bolster Avian Flu Testing Capacity in the United States

Move comes following criticism from public health experts over the federal agency’s difficulties creating clinical laboratory tests for COVID-19

Amid the ongoing outbreak of the Highly Pathogenic Avian Influenza A(H5N1) bird flu virus, the US Centers for Disease Control and Prevention (CDC) announced on Sept. 13 that it is awarding contracts to five clinical laboratory companies to bolster testing capacity for “new and emerging pathogens,” including HPAI A(H5N1).

Citing Nirav Shah, MD, MPH, Senior Scholar, Clinical Excellence Research Center at Stanford University School of Medicine and co-chair of the Data and Surveillance Workgroup (DSW) at the CDC, the Associated Press (AP), reported that the agency will initially spend at least $5 million on the effort, with “plans to scale up to $118 million over the next five years if necessary.”

The five medical laboratory companies the CDC chose are:

“Previously … CDC developed tests for emerging pathogens and then shared those tests with others, and then after that, commercial labs would develop their own tests,” Shah told CNN. “That process took time. Now with these new arrangements, commercial labs will be developing new tests for public health responses alongside CDC, not after CDC.”

In a news release announcing the contract, ARUP Laboratories also characterized the move as a shift for the agency.

“The new contract formalizes ARUP’s relationship with the CDC,” said Benjamin Bradley, MD, PhD, medical director of the ARUP Institute for Research and Innovation in Infectious Disease Genomic Technologies, High Consequence Pathogen Response, Virology, and Molecular Infectious Diseases. “We continue to expand our capabilities to address public health crises and are prepared to scale up testing for H5N1, or develop other tests quickly, should the need arise.”

“To be clear, we have no evidence so far that this [bird flu] virus can easily infect human beings or that it can spread between human beings easily in a sustained fashion,” Jennifer Nuzzo, DrPH (above), Director of the Pandemic Center and Professor of Epidemiology at Brown University School of Public Health, told CNN. “If it did have those abilities, we would be in a pandemic.” Clinical laboratory leaders will recall the challenges at the CDC as it developed its SARS-CoV-2 test early in the COVID-19 pandemic. (Photo copyright: Brown University.)

Missouri Case Raises Concerns

The first human infection of HPAI was reported in late March following a farmer’s “exposure to dairy cows presumably infected with bird flu,” the CDC stated in its June 3, 2024, bird flu Situation Summary. That followed confirmation by the USDA’s Animal and Plant Health Inspection Service (APHIS) of an HPAI outbreak in commercial poultry flocks in February 2022, and the CDC’s confirmation of the first known infections in dairy herds reported on March 25, 2024.

Concerns about the outbreak were heightened in September following news that a person in Missouri had been infected with the virus despite having no known contact with infected animals. CNN reported that it was the 14th human case in the US this year, but all previous cases were in farm workers known to be exposed to infected dairy cattle or poultry.

In a news release, the Missouri Department of Health and Senior Services (DHSS) revealed that the patient, who was not identified, was hospitalized on Aug. 22. This person had “underlying medical conditions,” DHSS reported, and has since recovered and was sent home. Both DHSS and the CDC conducted tests to determine that the virus was the H5 subtype, the news release states.

At present, the CDC states that the public health risk from the virus is low. However, public health experts are concerned that risks could rise as the weather gets cooler, creating opportunities for the virus to mutate “since both cows and other flu viruses will be on the move,” CNN reported.

Concerns over CDC Testing and FDA Oversight

In the months immediately following the first human case of the bird flu virus, Nuzzo was among several public health experts sounding an alarm about the country’s ability to ramp up testing in the face of new pathogens.

“We’re flying blind,” she told KFF Health News in June, due to an inability to track infections in farmworkers. At that time, tests had been distributed to approximately 100 public health labs, but Nuzzo and other experts noted that doctors typically order tests from commercial laboratories and universities.

“Pull us into the game. We’re stuck on the bench,” Alex Greninger MD, PhD, of the University of Washington Medicine Clinical Virology Laboratory, told KFF News.

KFF reported that one diagnostics company, Neelyx Labs, ran into obstacles as it tried to license the CDC’s bird flu test. Founder, CEO, and lead scientist Shyam Saladi, PhD, told KFF that the federal agency had promised to cooperate by facilitating a license and a “right to reference” CDC data when applying for FDA authorization but was slow to come through.

While acknowledging the need for testing accuracy, Greninger contended that the CDC was prioritizing caution over speed, as it did in the early days of the COVID-19 pandemic. “The CDC should be trying to open this up to labs with national reach and a good reputation,” he told KFF.

Another problem, KFF reported, related to the FDA’s new oversight of laboratory developed tests (LDTs), which is causing labs to move cautiously in developing their own tests.

“It’s slowing things down because it’s adding to the confusion about what is allowable,” American Clinical Laboratory Association (ACLA) President Susan Van Meter told KFF.

New Testing Playbook

Jennifer Nuzzo, DrPH (above), Director of the Pandemic Center and Professor of Epidemiology at the Brown University School of Public Health co-authored a June 2024 analysis in Health Affairs that called on the CDC to develop “a better testing playbook for biological emergencies.” The authors’ analysis cited earlier problems with the responses to the COVID-19 and mpox (formerly known as monkeypox) outbreaks.

If global surveillance networks have detected a novel pathogen, the authors advise, the US should gather information and “begin examining the existing testing landscape” within the first 48 hours.

Once the pathogen is detected in the US, they continued, FDA-authorized tests should be distributed to public health laboratories and the CDC’s Laboratory Response Network (LRN) laboratories within 48 hours.

Advocates of this approach suggest that within the first week diagnostics manufacturers should begin developing their own tests and the federal government should begin working with commercial labs. Then, within the first month, commercial laboratories should be using FDA-authorized tests to provide “high throughput capacity.”

This may be good advice. Experts in the clinical laboratory and healthcare professions believe there needs to be improvement in how novel tests are developed and made available as novel infectious agents are identified.

—Stephen Beale

Related Information:

CDC Adds Commercial Lab Contracts for Infectious Disease, Bird Flu Testing

Strengthening Response to Public Health Threats through Expanded Laboratory Testing and Access to Data

ARUP Awarded CDC Contract for Bird Flu Test Development

Test Surge and Data Sharing Multiple Award Indefinite Delivery Indefinite Quantity (IDIQ) Solicitation

Interim Guidance on Specimen Collection and Testing for Patients with Suspected Infection with Novel Influenza A Viruses Associated with Severe Disease or with the Potential to Cause Severe Disease in Humans

Current H5N1 Bird Flu Situation in Dairy Cows

The US Is Entering a Riskier Season for Spread of H5N1 Bird Flu. Here’s Why Experts Are Worried

Wastewater Testing Specifically for Bird Flu Virus Will Scale Up Nationally in Coming Weeks

Wastewater Surveillance for Influenza A Virus and H5 Subtype Concurrent with the Highly Pathogenic Avian Influenza A(H5N1) Virus Outbreak in Cattle and Poultry and Associated Human Cases

Two California Farmworkers Test Positive for Bird Flu

Avian Flu Spreading in California Raises Pandemic Threat for Humans

Bird Flu Is Spreading. Why Aren’t More People Getting Tested?

Why Fears of Human-to-Human Bird Flu Spread in Missouri Are Overblown

The United States Needs a Better Testing Playbook for Future Public Health Emergencies

COLA Clinical Laboratory Workforce Summit in Fort Worth, Texas, Engages Stakeholders in Effort to Train More Medical Laboratory Scientists

Representatives from almost 50 different clinical laboratories, professional associations, and societies came together this week to align efforts to expand the supply and retention of qualified laboratory scientists

FORT WORTH, TEXAS—Last week, representatives from a broad cross section of clinical laboratories, lab and pathology associations, public health laboratories, and lab regulatory bodies gathered specifically to identify ways to expand the number of skilled lab professionals.

COLA organized the “Workforce Action Alliance Summit,” a one-day gathering of key clinical laboratory stakeholders who share a common interest in developing initiatives that would directly increase the number of individuals choosing to pursue a career in laboratory medicine.

This is not a new problem, as the lack of trained laboratory scientists across all scientific disciplines has been acute for many years.

COLA Graphic
The logo above was developed by COLA to support the Workforce Action Alliance Summit. This year’s first work session took place last week in Fort Worth, Texas. Participants came from such organizations as the CDC Division of Laboratory Systems (DLS), American Society for Clinical Laboratory Science (ASCLS), American Society for Clinical Pathology (ASCP), Association of Public Health Laboratories (APHL), and American Association for Clinical Chemistry (AACC), along with a number of clinical laboratories. The goal of this initiative is to pull together wide-ranging interests within the profession of laboratory medicine and align specific efforts with projects that directly increase the recruitment, training, and retention of skilled laboratory scientists. (Graphic copyright: COLA.)

Call to Action

In a communication sent to invited participants, COLA’s CEO, Nancy Stratton, and COO, Kathy Nucifora, described the objective of the summit, writing:

“Clearly a call to collective action is required if we are to address the impending clinical laboratory workforce shortage. The past three years have demonstrated the significance of a resilient laboratory infrastructure, not only for the daily care of millions of Americans, but also during the global pandemic. The numerous efforts currently underway to resolve the shortage are unquestionably a component of the solution. Many, however, believe that these efforts are insufficient to close the gap between the projected number of new entrants into the profession, the rate at which those currently in the profession are departing, and the future demand for laboratory testing.”

Robert L. Michel, Editor-in-Chief of Dark Daily’s sister publication The Dark Report was a participant at COLA’S workforce summit. The Dark Report regularly profiles clinical laboratory organizations that have developed innovative and productive initiatives designed to increase the number of students choosing to train as medical technologists (MTs), clinical laboratory scientists (CLSs), medical laboratory technologists (MLTs) and other skilled lab positions.

In materials distributed at the summit, the ongoing gap between demand for skilled lab professionals and the supply was illustrated thusly:

“The US Department of Labor estimates 320,000 bachelors and associates degreed laboratory professionals are working in the United States. If each of those professionals worked a standard 40-year career, the natural annual attrition of 2.5% would require 8,000 new professionals to maintain their current numbers. This exceeds the current output of accredited educational programs by more than 1,000 annually.” 

Case Studies of Success

Over the course of the day, participants at the summit heard about the successes of certain laboratory organizations designed to get more students into training programs, supported by the educational courses required for them to become certified in their chosen area of laboratory medicine. These case studies centered around several themes:

  • Obtaining funding specifically to establish an MT/CLS training program to increase the number of candidates in a region. One example involved ARUP Laboratories and its success at working with a local Congressional representative to get a $3 million federal grant funded as part of a larger legislative package.
  • The medical laboratory scientist (MLS) program at Saint Louis University (SLU) worked with Quest Diagnostics to launch an accelerated bachelor’s degree program. The 16-month program combines online academic courses with intensive hands-on learning and clinical experiences in Quest’s Lenexa, Kansas, laboratory. The first students in this accelerated degree program began their studies in the spring semester of 2023.
  • By rethinking the structure of its existing didactic and experiential learning structure, NorthShore University HealthSystem’s MLS program, located at Evanston Hospital north of Chicago, doubled its enrollment capacity.

During the afternoon, working groups addressed ways that lab organizations can collaborate to increase recruitment and retention of laboratory scientists across all disciplines of lab medicine. This input was synthesized into action planning for the three priorities that can lead to expanding the lab workforce.

By day’s end, several working groups were organized with specific next steps. COLA is taking the lead in managing this initiative and giving it momentum. All clinical laboratory professionals and pathologists are welcome to participate in the Workforce Action Alliance (WAA). Anyone wishing to learn more can contact COLA by clicking here, calling 800-981-9883, or by visiting https://education.cola.org/contact-us-page.

Robert L. Michel

Related Information:

COLA Workforce Action Alliance Summit

Building the Capacity and Resiliency of the Laboratory Workforce

Industry Execs Will Convene to Address the Lab Workforce Shortage

Executives Convene to Address the Laboratory Workforce Shortage

Walgreens Continues Expansion into Primary Care as VillageMD Acquires Starling Physicians Group with 30 Locations in Connecticut

Expect there to be more clinical laboratory testing at pharmacies as retail pharmacy chains expand their primary care offerings

Walgreens Boots Alliance (NASDAQ:WBA) of Deerfield, Illinois, continues to expand its primary care footprint with VillageMD’s latest acquisition of Starling Physicians, a multi-specialty physicians group with 30 locations in Connecticut, according to a VillageMD news release. Walgreens is the majority owner of VillageMD, which now has more than 700 medical centers, Healthcare Dive noted.

This deal continues the trend of corporations acquiring physician practices. Already, the majority of physicians are employees, not partners in a private practice physician group. Under corporate ownership, these physician groups often decide to change their clinical laboratory providers. For that reason, managers and pathologists at local medical laboratories will want to explore how they might provide daily lab testing services to the corporate owners of these primary care clinics.

The Hartford Business Journal called VillageMD’s acquisition of Starling Physicians—which is subject to a state investigation for possible certificate-of-need requirement—one of Connecticut’s “more high-profile healthcare merger and acquisition deals in Connecticut in recent years.”

Starling Physicians locations offer full primary care services, as well as specialties that include geriatrics, endocrinology, nephrology, ophthalmology, and cardiology.

The Starling Physicians group acquisition comes just a few months after  

VillageMD paid $8.9 billion for Summit Health-CityMD of Berkeley Heights, New Jersey, with primary care services in the Northeast and Oregon. Walgreens invested $3.5 billion in that transaction, a Summit Health news release noted.

These acquisitions by Walgreens/VillageMD provide opportunities for local clinical laboratories to serve the physicians in these practices, though the operations may have a different patient flow and work process than traditional family practice clinics located in medical offices around community hospitals.

Tim Barry

“Starling shares our vision of being a physician-led model and they provide care in a compassionate and exceptional way to all the patients they serve. By integrating primary care with specialty care, we are able to optimize access to high-quality care for our patients,” said Tim Barry (above), CEO and Chair of VillageMD in the news release. “This is a natural extension of our growth in the Northeast, including our recent acquisition of Summit Health-CityMD. Together, we are transforming the way healthcare is delivered in the United States.” Clinical laboratories in these areas will want to develop a strategy for serving the physicians practicing at these non-traditional locations. (Photo copyright: The Business Journals.)

Primary Care at Retail Locations a Growing Trend

Dark Daily and its sister publication The Dark Report have reported extensively on the growing trend by pharmacy chains and other retail superstores to add primary care services to their footprint.

In “By 2027, Walgreens Wants 1,000 Primary Care Clinics,” The Dark Report covered how Walgreens had disclosed that it would spend $5.2 billion to acquire a 63% interest to become the majority owner of VillageMD. Fierce Healthcare reported that “[Walgreens] planned to open at least 600 Village Medical at Walgreens primary-care practices across the country by 2025 and 1,000 by 2027.”

In “Retail Chain Pharmacies Add CLIA-Waived Point-of-Care Blood Testing and Other Preventive Health Services to Their In-store Offerings,” we reported how eTrueNorth, a pharmacy‐based clinical laboratory services network headquartered in Mansfield, Texas, had partnered with Walmart (NYSE:WMT), Winn-Dixie, Kroger (NYSE:KR), and other retailers to offer their employees CLIA-waived point-of-care testing, preventive health services, wellness screenings, and other medical laboratory testing services through its eLabNetwork chain of retail pharmacies.

And in “Walmart’s Health and Wellness Chief Discusses Retail Giant’s Move to Healthcare/Telehealth Provider, a Step with Implications for Clinical Laboratory Testing,” Dark Daily pointed out that clinical laboratories need strategies to serve customers accessing healthcare in non-traditional settings, particularly as Walmart and the national retail pharmacy chains continue to expand the clinical services offered in their retail stores.

VillageMD

VillageMD is a primary care provider with same-day appointments, telehealth virtual visits, in-home care, and clinical laboratory diagnostic testing such as blood tests and urinalysis. Many VillageMD practices are located in buildings next door to Walgreens sites throughout the United States. (Photo copyright: Walgreens.)

Other Retailers Investing in Primary Care

Other retailers have recently taken deeper dives into healthcare as well.

According to Forbes, “The acquisition comes amid a flurry of acquisitions across the US for doctor practices, which are being purchased at an unprecedented pace by large retailers like Walgreens Boots Alliance, CVS Health, Amazon, and Walmart. Meanwhile, medical care providers owned by health insurers like UnitedHealth Group’s Optum and Cigna’s Evernorth are also in the doctor practice bidding war.”

In “Walmart’s Health and Wellness Chief Discusses Retail Giant’s Move to Healthcare/Telehealth Provider, a Step with Implications for Clinical Laboratory Testing,” Dark Daily reported on Walmart Health’s acquisition of MeMD, which was subsequently renamed in May to Walmart Health Virtual Care.

And in February, CVS announced plans to acquire for $10.6 billion Oak Street Health, a Chicago-based primary care company with 169 medical centers across 21 states that plans to have more than 300 centers by 2026.

Do Clinical Laboratories Want Retail Customers?

The question of whether clinical laboratories should pursue retail customers is at this point academic. Consumer demand is driving the change and labs that don’t keep up may be left behind.

“The trend of putting full-service primary care clinics in retail pharmacies is a significant development for the clinical laboratory industry,” wrote Robert Michel, Editor-in-Chief of Dark Daily and The Dark Report. “These clinics will need clinical lab tests and can be expected to shift patients away from traditional medical clinic sites for two reasons—lower price and convenience—since this new generation of primary care clinics will be located around the corner from where people live and work.”

Thus, healthcare system laboratories or large reference labs may want to reach out to Walgreens, CVS, Amazon, and Walmart for test referrals. These and other large retailers are investing heavily in the belief that consumers will continue to seek convenience in their healthcare.   

—Donna Marie Pocius

Related Information:

VillageMD Acquires Starling Physicians and Broadens its Footprint in the Northeast

Regulator Opens Inquiry into VillageMD-Starling Physicians Deal

VillageMD Acquires Summit Health-CityMD, Creating One of the Largest Independent Provider Groups in the US

Clinical Laboratory Trends: By 2027 Walgreens Wants 1,000 Primary Care Clinics

Walgreens-backed VillageMD Acquires Connecticut Medical Group

Walmart’s Health and Wellness Chief Discusses Retail Giant’s Move to Healthcare

CVS Health to Acquire Oak Street Health

CVS Reports $2.3B Q4 Profit, Will Buy Oak Street Health

India’s Central Government Tasks 15 Viral Research and Clinical Laboratories to Perform Monkeypox Surveillance Testing

South Asian nation aims to do what US, UK, and Europe failed to do during start of COVID-19 pandemic and slow spread of disease while case counts are low

With monkeypox quickly spreading around the world, India may be taking a lesson from western nations’ delayed response to COVID-19—including a sometimes slow availability of clinical lab testing for monkeypox—and preemptively increasing its national surveillance of the deadly social disease.

On Aug. 29, the Hindustan Times reported that in an attempt to slow the spread of monkeypox, India’s central government “has designated 15 viral research and diagnostic laboratories (VRDLs) spread across 13 states to monitor the incidence of monkeypox in the country.”

In the United States, the disease has spread with alarming speed, reaching all 50 states, as well as Washington, DC, and Puerto Rico. At 23,893 confirmed cases as of Sept. 14, the US now has the most cases in the world, according to the federal Centers for Disease Control and Prevention (CDC).

Reuters reported on Aug. 4 that the US Department of Health and Human Services (HHS) had declared a public health emergency. It was in May when monkeypox was detected in the United Kingdom (UK). Both the UK and several countries in Europe have struggled to control spread of the disease.

India hopes its decision to designate 15 VRDLs across 13 states to monitor the disease’s spread will enable it to do a better job than other countries at containing or eradicating monkeypox in the nation of 1.4 billion people, the Hindustan Times reported.

Anne Rimoin, PhD

“The probability of containment is diminishing daily,” American infectious disease epidemiologist Anne Rimoin, PhD, a monkeypox expert at the UCLA Fielding School of Public Health, told STAT. “It’s really unfortunate because we do have the tools. This is not an unknown virus … We have vaccines that are already available, even vaccines with indications for monkeypox. Therapeutics. And we know what’s needed to be done.’’ Clinical laboratory testing for monkeypox will certainly increase over the coming months. (Photo copyright: KTLA.)

Keeping Up Their Guard

“Fortunately, India has not seen a surge in cases and the situation here is well under control. However, we cannot drop the guard just as yet. Therefore, a network of VRDLs has been established for surveillance purposes,” a top government expert told the Hindustan Times, seeking anonymity. “It will help pick signs early in case more cases get reported.”

As of Sept. 19, 2022, India reported just 12 cases of monkeypox resulting in one death, while, as noted above, the US had 23,892 confirmed cases and one death, according to CDC statistics. In the UK, confirmed cases totaled 3,552 with no deaths. And, as of that date, the European Union reported 19,379 confirmed cases.

Until recently, monkeypox was endemic only in West and Central Africa. India reported its first case of monkeypox on July 14. So far, most, but not all, of its cases have been related to international travel.

“The isolated cases of monkeypox reported in Delhi with no prior travel history emphasize the importance of tracing the source of the infection, perhaps transmission through rodent population,” Diwakar Kulkarni, PhD, former Director and Principal Scientist at the Indian Council of Agricultural Research, National Institute of High Security Animal Diseases, told Think Global Health.

Homosexuality a Vector in India

While India’s scientists are focused on containing the monkeypox outbreak, the country’s government may encounter societal roadblocks because of the disease’s connection with homosexuality. Gay sex is believed to be fueling the spread of the disease, ABC News reported. Until a Supreme Court of India ruling in 2018, gay sex was punishable by up to 10 years in prison in India.

Virologist and noted HIV expert Ishwar Gilada, MD, who opened India’s first AIDS clinic in 1986, told Bloomberg “anti-gay stigma” in India is causing male patients to avoid getting tested and treated for the disease. He said even before the first monkeypox cases were reported in India, two of his patients—a gay man and a man who identified as bisexual—refused to get tested because they feared being the first monkeypox case in the country.

“They are going underground,” Gilada told Bloomberg.

Did the US Wait Too Long to Begin Testing for Monkeypox?

The rapid growth in cases worldwide and the geographic spread of the disease has left global health experts pessimistic monkeypox can be contained.

NPR reported in June that some experts believe public health agencies ran too few tests in the early months of the outbreak because state health officials used a narrow definition of monkeypox when determining who qualified for testing, and that the US had “dropped the ball” on monkeypox testing.

“I think we missed that train at this point,” Gary Kobinger, PhD, told STAT in mid-July when the number of cases outside of Africa had reached roughly 15,000. Kobinger is Director of the Galveston National Laboratory at the University of Texas Medical Branch and a member of an expert committee that advises the World Health Organization’s Emergencies Program.

And in “New Monkeypox Challenges Abound for Public Health Agencies as Virus Travels Beyond Traditional Hotspots,” Dark Daily reported on how monkeypox has spread beyond its traditional geography and that health officials are worried that diminishing smallpox vaccinations, which offered people some protection against the infectious disease, is contributing to increased spread of monkeypox.

As of Sept. 19, 2022, there were 62,406 confirmed cases worldwide, according to the CDC.

As clinical laboratories attempt to recover from the workload created by the COVID-19 pandemic, monkeypox appears to be the next endemic to test the mettle of lab professionals. Only time will tell if America and other western nations failed to act as expeditiously as India in curbing spread of this latest deadly disease.

Andrea Downing Peck

Related Information:

Monkeypox: 15 Virology Labs Designated for Surveillance of the Virus

US Declares Monkeypox Outbreak a Public Health Emergency

ECDC: Monkeypox Situation Update, as of 13 September 2022

With Monkeypox Spreading Globally, Many Experts Believe the Virus Can’t Be Contained

Determination That a Public Health Emergency Exists

Epidemiological Data on the 2022 Monkeypox Outbreak

CDC: Monkeypox 2022 Global Map and Case Count

Monkeypox Outbreak: Epidemiological Overview, 30 August 2022

Monkeypox in India—Facing the World’s Latest Health Threat

Monkeypox Cases Driven ‘Underground’ by Anti-Gay Stigma in India

Sex Between Men, Not Skin Contact, Is Fueling Monkeypox, New Research Suggests

Monkeypox Outbreak in US Is Bigger than the CDC Reports. Testing Is ‘Abysmal’

Nearly One Million Patient Records of Hospitals, Health Clinics, Medical Laboratories, and other Providers Stolen in Ransomware Attack on Medical Records Company

Clinical labs should proactively investigate how a vendor will respond to a data security incident and how quickly, says expert

Clinical laboratory managers in New York and surrounding areas should be aware that  almost one million protected health information (PHI) records from as many as 28 healthcare providers appear to have been stolen from a medical records company that services these providers.

Practice Resources LLC (PRL), a company that provides billing services for dozens of hospitals and medical providers in Central New York, announced in August they were the target of a ransomware attack that occurred on April 12 of this year. The Syracuse-based organization stated that hackers may have captured personally identifiable information (PII) such as names, home addresses, treatment dates, health plan numbers, and internal account numbers of 934,138 patients.

The data breach affected the patient records of dozens of medical providers and the clinical laboratories that service them, as well as physical therapists, pediatricians, gynecologists, orthopedic surgeons, and more.

Dark Daily’s sister publication The Dark Report covered a similar 2019 data breach in “Labs Should Heed Lessons from Huge Data Breach.”

Jim Giszczak, JD

“When a lab’s vendor has some type of breach, the lab entity that provided the compromised information could have some liability related to the breach,” explained Jim Giszczak, JD (above), McDonald Hopkins, in an interview with The Dark Report over a similar data breach in 2019. “That’s why every lab should be proactive and do a review to understand each vendor’s policies, procedures, training, and response in the event of a breach. Because your lab needs to know how a vendor will respond to a data security incident, and importantly, how quickly it will respond, it’s critical for lab officials to review the contracts they have with vendors that acquire, or have access to, PHI.” (Photo copyright: McDonald Hopkins.)

Not a Scam

“Unfortunately, it’s not a scam,” stated David Barletta, President and CEO of PRL, in an interview with local Syracuse news WSYR. “This really did happen in April—there was a ransomware attack on our system. We brought in forensic accountants and forensic information teams to come and look at what happened.”

PRL sent out more than 940,000 letters to potential victims of the cyberattack in August, noting that some patients may receive more than one letter.

The complete list of “healthcare entities on whose behalf Practice Resources LLC is providing notice of data incident,” according to PRL, includes:

Although their investigation did not uncover any evidence that personal data was misused, PRL has arranged credit monitoring services free of charge for one year from the date of enrollment. The company is also offering proactive fraud assistance to help people with any questions or in case they become a victim of fraud.

“There were no patient social security numbers that were taken. No medical record information was taken,” Barletta told WSYR. “We really, just out of an abundance of caution, felt that it was necessary that we provide them with credit monitoring for a year—just in case.”

Hundreds of Thousands of Patients Affected by Breach

When PRL discovered the data breach, the company took immediate steps to secure its systems and scrutinize the nature and extent of the incident. They then hired a forensic team to investigate what patient data may have been accessed by the hackers, a process that took several months.  

“It does take a long time because each client has hundreds of thousands of patients maybe,” Barletta explained. “We have several large clients that really bore the brunt of this.”

According to Barletta, PRL bills about $450 million annually for its clients, which include some major institutions in Central New York. The New York state Attorney General’s office is investigating the hacking incident and delving into whether PRL’s data security was adequate. 

As a result of the breach, FamilyCare Medical Group, which serves more than 80 physicians and thousands of patients, lost all of its laboratory data, according to the group’s CEO, Mitchell Brodey, MD. They had to close their lab for several months while their computer system was rebuilt. During this time, all their lab work was sent to another laboratory for analysis, MSN reported

The PRL ransomware attack was what is commonly known as a third-party data breach. This type of breach occurs when sensitive data is stolen from a third-party vendor, or when their systems are used to access and steal sensitive information stored on other systems.

In the United States, the Federal Trade Commission (FTC) is responsible for enforcing federal privacy and data protection regulations. If a breach affects 500 or more individuals, the company must issue a press release and notify the FTC and all affected consumers within 60 days of the discovery of the breach.

Clinical Labs Should Proactively Review Member Agreements

In 2019, our sister publication The Dark Report covered a major data breach affecting more than 20 million patients. That breach occurred when hackers gained access to the data systems of a third-party bill collector and impacted four of the nation’s largest clinical laboratories:

At that time, The Dark Report asked James Giszczak, JD, Chair of the Litigation Department and Co-Chair of the Data Privacy and Cybersecurity Practice Group at McDonald Hopkins, to provide insight on what steps clinical laboratory leaders should take to avoid and handle data breaches.

“One important lesson from this data breach is how critical it is for clinical labs and pathology groups to be proactive in making sure they review their vendor agreements,” Giszczak stated. “In that review, labs need to know the specific measures each vendor is taking to protect the information the lab is providing to their vendors.”

Giszczak suggested that clinical laboratory leaders make sure they understand each vendor’s policies, procedures, training, and response in the event of a data breach. He reiterated that labs could have some liability related to the breach.

-JP Schlingman

Related Information:

Labs Should Heed Lessons from Huge Data Breach

Hackers May Have Breached Medical Billing Records of Nearly One Million CNY Patients

List of Healthcare Entities on Whose Behalf Practice Resources LLC Is Providing Notice of Data Incident

Practice Resources, LLC Announces Data Breach Impacting the Information of 924,138 Patients

PRL Data Incident Notification

Your Stories: The Letter from Practice Resources, LLC is Legit

Third Party Data Breach: How to Prevent and What to Do

;