The Hospital's Hidden Infrastructure Part 2: SUSTAIN 340B Thursday August 13th, 2026

 

National Daily Hospital News

Executive Briefing — Thursday, August 13, 2026

The Hospital’s Hidden Infrastructure

Part II: The SUSTAIN 340B Act Protects Access—and Builds a New Compliance Operating System

Today

• A bipartisan Senate bill would protect point-of-purchase 340B discounts and codify contract-pharmacy access.
• The same legislation would establish a statutory patient definition and create new registration, documentation, reporting, audit, clearinghouse and financial-assistance obligations.
• Hospital leaders should treat the proposal as simultaneous access protection, margin exposure and enterprise compliance transformation.

Legislative status: The SUSTAIN 340B Act was introduced on August 5, 2026. It has not been enacted, and its provisions may change. The requirements described below are proposed requirements—not current law. Hospitals should use the bill for readiness assessment and scenario planning while continuing to follow existing 340B requirements.

Series navigation: Part I — Medicaid Coverage Loss  |  Part II — SUSTAIN 340B  |  Part III — AHRQ and Safety Learning  |  Part IV — Rural Maternity Standby Capacity

Four-Part Executive Series

Drug Access Is Infrastructure. So Is the System That Proves Every Discount Was Earned.

The 340B Drug Pricing Program is often described as a pharmacy program.

For many hospitals, that description is operationally incomplete.

340B savings may support medication access, specialty pharmacy, infusion services, behavioral health, care management, discharge prescriptions, rural clinics, uncompensated care and other services that ordinary reimbursement does not fully finance. The program can therefore affect patient access, service-line viability, cash flow and the hospital’s ability to sustain care for vulnerable communities.

On August 5, a bipartisan Senate group—Sens. Jerry Moran, Tammy Baldwin, Shelley Moore Capito, Tim Kaine, John Boozman and John Hickenlooper—introduced the Supporting Underserved and Strengthening Transparency, Accountability, and Integrity Now and for the Future of 340B Act, or SUSTAIN 340B Act.

The legislation attempts a difficult policy exchange:

Protect the access and financial value of 340B while making eligibility, contract-pharmacy operations, use of savings and program integrity more standardized, visible and auditable.

That exchange would bring meaningful protections. Manufacturers would have to offer covered entities the 340B ceiling price regardless of whether a drug is dispensed directly or through a contract pharmacy. The bill would restrict manufacturer conditions on access, preserve point-of-purchase discounts and sunset the federal rebate pilot within one year.

It would also create a new operating architecture. Covered entities would need to demonstrate patient eligibility at the prescription level, register arrangements, standardize contracts, maintain auditable records, submit claims-level data, report annually, extend financial assistance across sites and pharmacies, and accept expanded audit and corrective-action authority.

The governing principle is:

A hospital cannot protect 340B value with a pharmacy-only compliance model when eligibility is created by clinical care, documented in the medical record, transmitted through technology, reconciled through claims and certified by enterprise leadership.

The Bill Would Change Both Sides of the 340B Equation

Proposed provision	Protection or opportunity	Hospital operating consequence
Point-of-purchase discount	Preserves upfront 340B pricing and would end the rebate pilot within one year.	Reduces long-term working-capital exposure, but hospitals must remain ready for the currently scheduled 2027 pilot unless law or agency action changes it.
Contract pharmacies	Codifies their use without numeric or geographic caps and limits manufacturer restrictions.	Requires registered agreements, standard terms, patient-choice safeguards, annual independent audits and auditable records.
Patient definition	Creates statutory clarity and recognizes qualifying discharge and referral prescriptions.	Turns eligibility into a record-level control requiring reliable encounter, prescriber, order, referral and pharmacy data.
Child sites	Clarifies eligible relationships with parent covered entities.	Adds ownership, integration, registration and three-year record-retention controls; certain acquired sites could face an eligibility delay.
Transparency	Creates a more visible account of how the program supports patients and communities.	Requires annual reporting, standardized descriptions of savings use and executive attestation.
Data clearinghouse	Creates a common mechanism to prevent duplicate discounts.	Requires complete, accurate claims-level data from covered entities and contract pharmacies.
Financial assistance	Makes patient affordability more explicit.	Requires a transparent policy for patients at or below 200% of the federal poverty level, including a drug sliding scale as applicable.
Nondiscrimination	Restricts different payer or PBM treatment based on 340B status.	Creates a stronger basis for monitoring and challenging discriminatory reimbursement or network practices.
User fees	Finances stronger federal oversight and the clearinghouse.	Beginning in FY 2031, covered entities would share a national fee assessment based on 340B prescription volume.

The full SUSTAIN 340B bill text is 97 pages. Its importance lies less in any one provision than in the way the provisions connect.

1. Contract-Pharmacy Protection Would Come With Contract-Pharmacy Accountability

The bill would explicitly allow covered entities to use wholly owned and contract pharmacies. It would require manufacturers to offer covered outpatient drugs at or below the 340B ceiling price regardless of whether the drug is dispensed directly or through a contract pharmacy, allow delivery to covered-entity-requested pharmacy locations and limit manufacturer demands for claims data outside the proposed clearinghouse.

For hospitals serving large geographic regions, patients with transportation barriers or communities without a hospital-owned pharmacy, this could protect the practical reach of the program.

But protection would not mean passive continuation of current arrangements.

Covered entities would have to submit agreements and register each arrangement before implementation. Required contract terms would address pharmacy services, data submission, patient choice, patient eligibility, diversion safeguards, Medicaid duplicate-discount controls, audit rights and information access. Contract pharmacies would be subject to annual independent audits commissioned by the covered entity, and relevant auditable records would have to be retained for at least three years.

This means every contract-pharmacy relationship should be managed as a controlled extension of the covered entity—not merely as an external revenue channel.

Hospital leadership should be able to answer:

• Who owns each agreement and each registration?
• Which pharmacy locations are active, and which have not dispensed a qualifying prescription?
• Can the hospital obtain complete dispensing, reversal, payer and replenishment data?
• Are Medicaid fee-for-service and managed-care rules correctly configured?
• Are audit findings tracked through correction and validation?
• Can a patient obtain required financial assistance at the contract pharmacy?

2. The Patient Definition Would Become a Clinical-Data Control

The proposed definition generally requires that an individual have received an outpatient healthcare service from the covered entity within the preceding two years, that the covered entity create and maintain an auditable medical record demonstrating the relationship for each prescription or order, and that the prescription arise from the covered entity’s service or a qualifying referral.

The bill also addresses several areas that have produced operational uncertainty:

• Discharge prescriptions: An outpatient prescription following discharge from an emergency department or inpatient stay could qualify under the specified conditions.
• Referral prescriptions: Eligible covered entities could include certain prescriptions written by non-340B providers within 12 months of a documented referral, subject to consultation, documentation, dispensing and retention requirements.
• Service documentation: The outpatient service would need a documented order or referral and generally be reimbursable by Medicare or Medicaid, identifiable through CPT or HCPCS, or within the scope of an applicable grant or designation.
• Drug-only contact: Services consisting only of drug administration, dispensing or infusion generally would not establish the underlying patient relationship, subject to specified exceptions.

These rules cannot be administered reliably through employee memory or an isolated pharmacy spreadsheet.

The eligibility engine may need to connect:

• Patient identity and encounter date.
• Covered entity and child-site eligibility.
• Service code and site of care.
• Practitioner relationship.
• Prescription or order.
• Referral and consultation documentation.
• Discharge status.
• Payer and Medicaid status.
• Dispensing pharmacy.
• Reversal, replacement and duplicate-discount status.

The weakest link may not be pharmacy. It may be an interface, a missing referral note, an inconsistent discharge feed, an unregistered site, a provider-master error or a record that cannot be reproduced during audit.

3. The Clearinghouse Would Turn Data Quality Into Program Eligibility Infrastructure

The bill would direct HHS to contract with an independent third party to operate a national data clearinghouse intended to prevent duplicate discounts and support proper accounting.

Covered entities would submit claims-level information, including data available through contract pharmacies. The clearinghouse would assess completeness and accuracy, identify potential violations, support remediation and make certain claims information available for specified program-integrity purposes. Low-volume entities and hospitals facing feasibility constraints could receive aggregate-reporting or hardship pathways under defined conditions.

This is not simply a new report.

It is a new dependency between the hospital’s clinical record, split-billing logic, third-party administrator, wholesaler activity, pharmacy dispensing data, Medicaid exclusion files and federal reporting environment.

Executive implication: A covered entity may have a defensible policy and still fail operationally if the data supporting that policy are incomplete, delayed, inconsistent or irreproducible.

Data governance should therefore answer four questions:

1. Completeness: Did every relevant encounter, prescription, payer and dispensing event arrive?
2. Accuracy: Do source systems agree on patient, provider, site, drug and payer?
3. Timeliness: Are submissions and corrections completed within required windows?
4. Reproducibility: Can the hospital reconstruct the eligibility decision and supporting record years later?

4. Transparency Would Move 340B From the Pharmacy Report to the Executive Attestation

Within one year of enactment and annually thereafter, covered entities would report information covering the parent entity, child sites and contract-pharmacy arrangements.

The proposed reporting includes the number of individuals receiving 340B drugs, prescriptions by insurance type, charity care, a standardized description of how savings benefited patients and communities, patient financial demographics, medication-access policies, certain government contracts and third-party administrator relationships.

A CEO, CFO or COO would attest that the savings were used to benefit the patients and communities served by the covered entity.

That attestation changes the governance question.

Leadership would need a reconciled, documented bridge from:

340B purchase → qualifying patient → claim and dispensing event → realized savings → funded service or patient benefit → reported community impact

A description assembled once a year by pharmacy or government relations will not be enough if it cannot be reconciled to financial statements, cost-report data, community-benefit reporting and operational evidence.

Hospitals should begin building a 340B value ledger that distinguishes:

• Gross purchase-price benefit.
• Contract-pharmacy and third-party administrator fees.
• Reversals, true-ups and disputed transactions.
• Net realized program value.
• Patient financial assistance.
• Services and access supported by the net value.
• Communities and populations reached.

5. Financial Assistance Would Need to Follow the Patient Across the Network

The bill would require each covered entity to maintain a transparent financial-assistance policy available at the point of care and publicly reported. The policy would apply to patients served by child sites and contract pharmacies and generally include patients at or below 200% of the federal poverty level, with a sliding fee scale for covered outpatient drugs as applicable.

Auditable implementation records would be retained for at least three years. Application to child sites and contract pharmacies would begin three years after enactment.

This is both a patient-access requirement and a workflow requirement.

A policy is not operational merely because it appears on a website. Patients must be identified, informed, screened, approved, priced correctly and able to receive the benefit at the location where the prescription is filled. The covered entity must then be able to prove that the process worked.

Revenue cycle, financial counseling, pharmacy, health equity, patient access, information technology and contract management therefore share accountability.

6. The Rebate Debate Is Also a Working-Capital Debate

HRSA’s revised 340B Rebate Model Pilot Program is currently scheduled to begin January 1, 2027, for selected drugs and qualifying manufacturers.

The SUSTAIN 340B Act would prohibit expansion of that pilot, conclude it within one year of enactment and transition its data function to the clearinghouse. It also states congressional support for point-of-purchase discounts rather than rebates.

Hospitals should not assume the legislation will be enacted before the pilot’s implementation date.

They need parallel readiness:

• Current-path readiness: Prepare cash-flow forecasts, receivable controls, submission processes, denial management and reconciliation for the 2027 rebate pilot.
• Legislative-path readiness: Prepare for point-of-purchase protection accompanied by clearinghouse submissions, statutory patient logic and expanded reporting.

The prudent strategy is not to choose one forecast. It is to maintain both until the law, litigation and agency implementation pathway are resolved.

The Enterprise 340B Operating Model

Owner	Primary accountability	Evidence leadership should receive
Executive sponsor	Program value, risk appetite, resource allocation and attestation readiness.	Quarterly enterprise dashboard and unresolved high-risk exceptions.
Pharmacy	Purchasing, accumulation, replenishment, dispensing and contract-pharmacy oversight.	Transaction reconciliation, audit results, replenishment exceptions and drug-level exposure.
Compliance/legal	Policy, regulatory interpretation, contracts, audit response and corrective action.	Current obligation inventory, legal-change log and corrective-action status.
Finance	Net savings, fees, cash flow, rebate receivables and community-benefit reconciliation.	Gross-to-net value bridge and dual-path liquidity forecast.
Revenue cycle	Payer identification, Medicaid logic, assistance screening and discharge workflow.	Unresolved payer status, duplicate-discount exceptions and assistance completion.
Information technology/data	Interfaces, master data, lineage, completeness, security and reproducibility.	Interface failures, data-quality tests, access logs and clearinghouse readiness.
Clinical operations/medical staff	Encounter, order, referral, prescriber and discharge documentation.	Documentation defects and remediation by service line or site.
Internal audit	Independent testing of design, operation and corrective-action effectiveness.	Risk-based audit results and repeat-finding analysis.

Three Scenarios Every 340B Hospital Should Model

Scenario A: The Bill Does Not Advance Before the Rebate Pilot Begins

The hospital pays higher initial acquisition costs for selected products and waits for rebates. Early submissions produce denials, data corrections and timing uncertainty. Savings exist economically but are converted into receivables rather than immediately available cash.

Management response: Establish drug-level receivable aging, denial ownership, liquidity thresholds and daily reconciliation during implementation.

Scenario B: The Bill Advances With Materially Similar Requirements

Contract-pharmacy protections reduce manufacturer access restrictions, but the hospital discovers inconsistent patient logic, incomplete referral documentation, outdated agreements and weak savings-to-benefit reporting.

Management response: Launch an enterprise gap assessment before final regulations, prioritizing patient eligibility, pharmacy agreements, data lineage and executive attestation.

Scenario C: Contract-Pharmacy Access Expands Faster Than Governance

More prescriptions become operationally available through protected arrangements, but audit exceptions, duplicate discounts and financial-assistance failures grow with transaction volume.

Management response: Require governance capacity to grow before or with network expansion. Volume without control is not program strength.

Executive 340B Readiness Dashboard

Measure	Why it matters	Escalation signal
Net 340B value by entity, site and channel	Shows where value is created after fees, reversals and corrections.	Unexplained variance from budget or prior period.
Eligibility exceptions per 1,000 accumulations	Tests reliability of patient and prescription logic.	Rising rate, repeat cause or unresolved high-dollar exception.
Contract-pharmacy audit coverage and open findings	Measures control across the external network.	Missed audit, repeat finding or overdue corrective action.
Duplicate-discount exceptions	Protects Medicaid and manufacturer compliance.	Any systemic error or unresolved material claim set.
Data completeness and interface failures	Determines whether eligibility and clearinghouse reporting can be defended.	Missing source feed, late file or unexplained record loss.
Financial-assistance access and utilization	Shows whether patients receive the intended affordability benefit.	Site or pharmacy cannot apply policy; eligible patients are not screened.
Rebate receivable days and denial rate	Measures current-path working-capital exposure.	Aging or denials exceed the hospital’s approved liquidity tolerance.
Savings-to-community-benefit reconciliation	Supports transparency and executive attestation.	Reported narrative cannot be reconciled to finance and operations.

What Hospital Leaders Should Do Now

Within 14 Days

1. Name one executive sponsor and one operational owner for enterprise 340B readiness.
2. Create a provision-by-provision impact matrix identifying policy, workflow, contract, technology, data, financial and staffing implications.
3. Inventory every covered entity, child site, owned pharmacy, contract pharmacy, third-party administrator and Medicaid configuration.
4. Maintain two financial forecasts: implementation of the current 2027 rebate pilot and enactment of a point-of-purchase legislative pathway.
5. Escalate known audit findings and data defects that would affect patient status, referrals, discharge prescriptions, duplicate discounts or contract-pharmacy reporting.

Within 30 Days

1. Test a sample of prescriptions against the proposed patient definition and reconstruct the supporting record.
2. Compare all contract-pharmacy agreements with the proposed standard elements and confirm current registration.
3. Map data lineage from encounter and prescription through dispensing, replenishment, payer identification and reporting.
4. Build a gross-to-net 340B value ledger and link net benefit to services and communities supported.
5. Test whether financial assistance can be consistently accessed and documented at parent sites, child sites and contract pharmacies.
6. Present the board or appropriate committee with the dual-path financial exposure, major control gaps and remediation plan.

NDHN Recommended 340B Readiness Standards

These are management targets, not statutory or regulatory thresholds.

Management measure	NDHN recommended standard
340B prescriptions supported by complete eligibility logic and reproducible documentation	100%
Covered entities, child sites and pharmacy arrangements with verified current registration	100%
Contract pharmacies receiving risk-based independent audit coverage	100% annually
Material audit findings with assigned owner, due date and validation	100%
Repeat material findings after corrective action	Zero
Known systemic eligibility or duplicate-discount defects awaiting executive escalation	Zero beyond 1 business day
Material source-data feeds monitored for completeness and timeliness	100%
Eligible locations able to operationalize the approved financial-assistance policy	100%
Net 340B value reconciled to accounting records and supported patient/community benefits	Quarterly
Board or board-committee review of 340B value, access, compliance and legislative exposure	At least quarterly during material change

The Leadership Decision

The SUSTAIN 340B Act is neither simply a victory for hospitals nor simply a new compliance burden.

It is a proposed exchange.

Hospitals would gain clearer protection for contract-pharmacy access, point-of-purchase pricing, discharge prescriptions, qualifying referrals and nondiscriminatory payer treatment. In return, the program’s patient relationships, transactions, savings, assistance and community benefit would become more standardized, reportable and auditable.

The organizations most prepared for that future will not be those with the most aggressive accumulation logic.

They will be those that can demonstrate—transaction by transaction and community by community—that:

• The patient was eligible.
• The drug was properly purchased and dispensed.
• The duplicate discount was prevented.
• The patient could access needed assistance.
• The net value was real.
• The benefit supported access and care.
• The evidence can survive independent review.

340B is hidden infrastructure because its value appears at the pharmacy transaction but its purpose is realized across the hospital and community.

The program should be governed at the same level as the access, services and financial resilience that depend upon it.

---

Next in the series: As AHRQ’s national safety-learning capacity weakens, hospitals must determine whether they retain the evidence surveillance, improvement expertise, protected frontline time and learning systems needed to prevent harm rather than merely react to it.

Primary sources: Senate announcement and summary; SUSTAIN 340B Act text; HRSA 340B Rebate Model Pilot Program.

About the standards: NDHN recommended standards are management targets, not regulatory thresholds. Organizations should apply more stringent controls or timelines where patient risk, program requirements or legal advice demand them.

📍 Published at National Daily Hospital News
Published as part of the National Daily Hospital News series.
Visit the archive: https://nationaldailyhospital.blogspot.com/
LinkedIn: Spence Tepper
Facebook: Compirion
Number One Hospital Blog: Be the Number 1 Hospital

© 2026 National Daily Hospital News
Principle Author: ChatGPT5
Editor: Spence Tepper
Permission to share freely given

#HospitalLeadership #HospitalOperations #HospitalFinance #340B #SUSTAIN340B #PharmacyLeadership #DrugAccess #ContractPharmacy #HealthcareCompliance #RevenueCycle #PatientAccess #RuralHospital #CriticalAccessHospital #HealthcarePolicy #NDHN

The Hospital's Hidden Infrastructure Part I Wednesday August 12th, 2026

 

National Daily Hospital News

Executive Briefing — Wednesday, August 12, 2026

The Hospital’s Hidden Infrastructure

Part 1: Medicaid Coverage Loss Is Not Confined to Medicaid Patients

Today

• NDHN begins a four-part series examining the hospital capabilities communities depend upon but ordinary reimbursement and departmental accounting often fail to recognize as infrastructure.
• Today’s analysis examines how Medicaid coverage loss becomes an enterprise financial, clinical, capacity and regional-resilience event.
• The briefing includes a coverage-loss taxonomy, service-line modeling framework, executive dashboard, three scenarios, immediate actions and NDHN management standards.

Four-Part Executive Series

The Hospital’s Hidden Infrastructure: Who Pays for Coverage, Drug Access, Safety Knowledge and Standby Capacity?

Hospitals depend upon forms of infrastructure that do not always appear on a capital plan.

Insurance coverage allows patients to obtain care before illness becomes an emergency. The 340B program helps sustain medication access and services that ordinary reimbursement may not support. National patient-safety research allows hospitals to learn from evidence larger than their own experience. Rural maternity units preserve continuous clinical readiness even when the number of births is too small to finance that readiness through service volume alone.

These capabilities are different in form, but they share one management problem: the community depends upon them continuously while the financing and accountability surrounding them are often fragmented, unstable or incomplete.

This week, National Daily Hospital News will examine one component of this hidden infrastructure each day:

1. Medicaid coverage and the hospital-wide consequences of coverage loss.
2. 340B drug access and the enterprise compliance system proposed by the SUSTAIN 340B Act.
3. Patient-safety knowledge and the need for hospitals to preserve their own learning infrastructure as AHRQ capability weakens.
4. Rural maternity care and the economics of essential standby capacity.

The central executive question is:

Which essential hospital capabilities are being treated as ordinary expenses even though the community depends on them as permanent infrastructure?

Today’s first analysis begins with coverage. A patient can lose insurance administratively. The patient does not lose the condition, medication need, pregnancy, behavioral-health crisis or possibility of an emergency that made care necessary.

---

Hidden Infrastructure | Part 1

Medicaid Coverage Loss Is Not Confined to Medicaid Patients

A patient can lose insurance overnight.

The patient does not lose diabetes, pregnancy, heart failure, cancer, behavioral-health needs, prescription requirements or the possibility of an emergency.

Coverage can disappear administratively. Clinical need cannot.

That difference is where the hospital’s risk begins.

When Medicaid enrollment contracts, the consequences do not remain within the Medicaid program, the revenue-cycle department or a government-relations report. They move through emergency departments, physician practices, maternity services, behavioral health, pharmacy access, diagnostic testing, elective procedures, hospital throughput, bad debt, workforce budgets, capital plans, neighboring hospitals, ambulance systems and post-acute providers.

When coverage disappears, the patient’s need does not disappear—and neither does the hospital’s responsibility.

The Coverage Contraction Is Becoming an Operating Event

The Congressional Budget Office projects that the number of uninsured Americans will grow from approximately 30 million in 2026 to 37 million in 2036, largely because the 2025 reconciliation law is expected to reduce enrollment in Medicaid, CHIP and, to a lesser extent, the ACA marketplaces and Basic Health Program. CBO also projects that approximately 60% of uninsured people in 2036 will be eligible for some form of subsidized coverage but will not be enrolled.

Several provisions create distinct hospital exposures. They include new community-engagement documentation for certain adults, more frequent eligibility redeterminations, restrictions on states’ use of healthcare-provider taxes and future reductions in state-directed Medicaid payment limits.

CBO estimates that the community-engagement requirement alone will increase the number of uninsured people by 5.3 million in 2034. Its estimate includes people who will lose eligibility because they do not meet the requirement and others who are working or exempt but cannot successfully navigate the documentation process. CBO expects most people losing Medicaid under this provision to become uninsured rather than move into employer-sponsored coverage.

The same analysis estimates that provider-tax changes will increase the uninsured population by another 1.1 million in 2034. CBO expects states to respond to reduced financing capacity through some combination of lower provider payments and reduced enrollment.

CBO Federal Subsidies for Health Insurance, 2026–2036  |  CBO Medicaid supplemental cost estimate

Hospitals therefore face three overlapping risks:

1. Fewer patients retaining Medicaid coverage.
2. Lower or less flexible Medicaid financing for patients who remain covered.
3. Greater administrative volatility in determining who is covered on the date care is delivered.

This is not one financial adjustment. It is a change in payer mix, reimbursement, eligibility administration, patient behavior and state financing occurring at the same time.

California Shows How Quickly the Effects Can Spread

California offers an early view of the scale and interdependence involved. Current projections indicate that federal and state changes could cause approximately 2.2 million Californians to lose insurance by 2030, roughly doubling the state’s uninsured rate. California’s Legislative Analyst’s Office estimates that nearly two million people could be disenrolled from Medi-Cal by the end of 2030.

The California Hospital Association expects annual hospital uncompensated care to rise from approximately $2 billion to $4 billion. More than half of the state’s hospitals are already reported to be operating at a loss.

The Legislative Analyst’s Office independently concluded that hospital uncompensated care could increase by as much as several billion dollars annually by 2030. It estimates that aggregate hospital margins could decline by approximately one-half to several percentage points, with some clinics facing even greater deterioration.

CalMatters analysis  |  California Legislative Analyst’s Office

Those averages conceal the real management risk. A two-percentage-point decline does not affect every hospital equally.

For an organization with a healthy operating margin, it may constrain capital and growth. For a hospital near break-even, it may eliminate the margin required to replace equipment, recruit staff, maintain service lines or absorb a disaster. For a hospital already operating at a loss, it may accelerate closure.

The First Financial Effect May Be Lower Scheduled Volume

Executives should not assume that coverage loss will simply convert a Medicaid encounter into an uninsured encounter. Some encounters will disappear.

Patients without insurance frequently postpone primary care, specialist consultations, diagnostic imaging, laboratory testing, medication refills, physical therapy, behavioral-health treatment, prenatal care, elective procedures and follow-up after hospital discharge.

This creates a double financial effect:

1. The hospital or medical group loses reimbursed scheduled activity.
2. Some untreated conditions later return as higher-acuity emergency or inpatient demand.

HCA Healthcare’s second-quarter 2026 results provide a current example involving ACA marketplace coverage rather than Medicaid, but the operating mechanism is instructive.

HCA reported that rising uninsured volume following marketplace coverage losses reduced pretax income by approximately $400 million in one quarter. Emergency visits increased 3.6%, while inpatient surgeries declined 2.3% and outpatient surgeries declined 3.4%. The company increased its projected full-year adverse exchange-related effect to between $1 billion and $1.2 billion.

HCA Healthcare second-quarter results

The hospital may therefore lose both reimbursement and the opportunity to manage disease before it becomes expensive.

An Uninsured Patient Is Not a Medicaid Patient With a Different Payer Code

Medicaid reimbursement may be below the cost of providing care. No reimbursement is generally worse.

When a patient becomes uninsured, the hospital may lose the Medicaid base payment, managed-care payment, applicable supplemental payment, pharmacy reimbursement, physician-practice revenue, follow-up revenue and predictability of payment.

The hospital may still incur emergency screening and stabilization costs, physician and nursing expense, medications and supplies, diagnostics, inpatient costs, discharge planning, interpreter services, eligibility assistance, collection administration, readmission risk and follow-up outreach.

Under EMTALA, most Medicare-participating hospitals with emergency departments must provide an appropriate medical screening examination and stabilizing treatment or an appropriate transfer without denying care because an individual is uninsured or unable to pay.

CMS EMTALA patient protections

The financial obligation may move. The clinical obligation remains.

Coverage Loss Changes When and Where Patients Seek Care

Insurance does more than pay a bill. It organizes access.

It allows patients to establish relationships with clinicians, obtain medications, receive preventive services, schedule diagnostic tests and return for follow-up. When that structure is lost, care often becomes episodic.

The emergency department becomes the entry point not because it is the best place for the patient’s need, but because it remains visible, continuously open and legally accessible.

Hospitals should anticipate potential growth in medication lapses; uncontrolled hypertension and diabetes; behavioral-health crises; substance-use emergencies; delayed cancer diagnoses; inadequately managed pregnancies; complications from missed specialty care; dialysis instability; wound deterioration; avoidable readmissions; and admissions following delayed presentation.

The hospital must distinguish between more low-acuity emergency use because ambulatory access has become unavailable and more high-acuity emergency use because necessary care was delayed. Both patterns matter, but they require different interventions.

Discharge Becomes a Particularly Dangerous Transition

A patient may have Medicaid coverage when admitted and lose it during or soon after the episode. Another patient may remain technically eligible but be unable to complete renewal or work-requirement documentation. A third may be discharged uninsured with no affordable route to medication, rehabilitation, home care or specialty follow-up.

The discharge plan can be clinically appropriate on paper and operationally impossible in practice.

Hospitals should track coverage status at admission and discharge, pending eligibility decisions, prescription affordability, post-acute access, durable-medical-equipment access, follow-up appointment status, days from hospital discharge to clinic appointment, scheduled versus completed follow-up, and 30-day emergency returns and readmissions.

These measures should be stratified by Medicaid, uninsured, marketplace, Medicare and commercial coverage. An overall average can conceal a rapidly widening access gap.

Eligibility Operations Become Part of Clinical Continuity

Hospitals cannot control federal law or state eligibility policy. They can control whether an eligible patient loses coverage because the organization failed to recognize a solvable administrative problem.

Coverage assistance should no longer be treated only as a financial-counseling service after the bill is created. It should become part of access management.

Hospitals should identify patients approaching renewal, confirm contact information, screen for exemptions, help assemble documentation, connect patients with enrollment assistance, track pending applications, distinguish true ineligibility from procedural termination, recheck coverage at important transitions, screen uninsured patients for all available coverage and prevent collection escalation while eligibility or assistance remains unresolved.

The purpose is not to preserve inappropriate enrollment. It is to prevent administrative failure from creating unnecessary clinical and financial harm.

The Revenue Cycle Needs a Coverage-Loss Taxonomy

“Self-pay” is no longer a sufficiently informative category.

Coverage-loss category	Management significance
Ineligible for Medicaid	May require marketplace, employer or financial-assistance screening.
Eligible but procedurally disenrolled	Potentially recoverable through navigation and documentation.
Work requirement not met	Requires assessment of actual status and available exemptions.
Exempt but unable to document exemption	High-priority navigation opportunity.
Renewal pending	Collection and continuity decisions should reflect unresolved status.
Marketplace coverage lost because of affordability	Indicates payer-mix and elective-volume exposure.
Employer coverage lost	May involve special enrollment or COBRA options.
Address or communication failure	May be correctable quickly.
No apparent coverage pathway	Requires charity-care and clinical-continuity planning.

Without this taxonomy, leadership sees only the final financial outcome. With it, the hospital can see which losses are preventable, recoverable or likely to persist.

Uncompensated Care Must Be Modeled by Service Line

A single enterprise uncompensated-care percentage is necessary but insufficient. Coverage contraction does not affect every service equally.

Hospitals should model exposure in emergency medicine, obstetrics, behavioral health, pediatrics, trauma, oncology, dialysis, cardiology, orthopedics, rehabilitation, primary care, specialty clinics, pharmacy, home health, rural outreach and transport.

For each material service line, leadership should understand Medicaid and uninsured volume, revenue, supplemental-payment dependence, contribution margin, fixed and standby costs, charity and bad-debt expense, elective versus emergency utilization, sensitivity to delayed care, workforce requirements, community alternatives and regional consequences of reducing capacity.

A service may appear financially weak but remain essential to the performance of other services. Eliminating an outpatient clinic may reduce clinic expense while increasing emergency demand, admissions and readmissions. Reducing maternity capacity may destabilize emergency readiness. Cutting behavioral-health navigation may increase boarding.

The correct unit of analysis is therefore not always the department. It may be the complete patient pathway or the regional care system.

DSH and Supplemental Payments Are Not Automatic Shock Absorbers

Hospitals should not assume that disproportionate-share or supplemental payments will fully offset coverage losses. These arrangements vary by state, may be delayed, may depend on state financing capacity, may use historical data, may not rise in proportion to new uncompensated care and may themselves be affected by provider-tax and state-directed-payment restrictions.

Medicaid accounted for approximately 19% of all hospital spending in 2023 and about one-fifth of hospital discharges. It financed 41% of U.S. births and 47% of rural births.

KFF Medicaid and hospital facts

The Weakest Hospital Can Become the Entire Region’s Problem

When a financially fragile hospital reduces or closes a service, the patients do not vanish. They move.

The receiving organization may experience longer emergency waits, more transfers, more ambulance arrivals, higher occupancy, greater uncompensated care, more trauma or maternity demand, increased boarding, longer transport times and reduced access for its existing patients.

A hospital can be financially separate from its neighbors while remaining operationally dependent upon them.

Regional scenario planning should identify hospitals most exposed to coverage loss, services most likely to be reduced, current transfer dependencies, surge capacity, transport constraints, trauma and maternity alternatives, travel-time effects and the consequences if a neighboring hospital closes or converts.

Rural Hospitals Face Disproportionate Consequences

Rural hospitals may have fewer Medicaid patients than large urban systems, but those patients can represent a much larger share of the local population and available volume.

Medicaid covers approximately 16.1 million rural residents. Nearly half of rural children and approximately 18% of rural adults receive Medicaid, while Medicaid finances nearly half of rural births.

About half of rural hospitals experienced negative operating margins from patient services during 2017–2022. Rural communities already face longer travel distances, workforce shortages and limited alternatives.

AHA rural Medicaid fact sheet

A modest revenue reduction in a large system may be absorbed. The same reduction in a rural hospital can eliminate the only service within an hour’s drive.

Coverage-Loss Scenario Model

Scenario	Coverage assumption	Operational assumption	Management response
Lower impact	State implementation preserves most eligible enrollment; supplemental financing remains relatively stable.	Gradual increase in self-pay accounts and limited volume change.	Intensify enrollment assistance, monitor payer mix monthly and protect high-risk access points.
Moderate impact	Procedural disenrollment and marketplace losses meet projections; provider payments tighten.	Uninsured emergency demand grows, scheduled care declines and uncompensated care rises materially.	Reforecast liquidity, labor and service lines; expand navigation and charity-care capacity.
Severe impact	Enrollment losses exceed projections, supplemental payments decline and regional providers reduce services.	Simultaneous payer deterioration, emergency-volume growth, high-acuity presentation and regional displacement.	Activate enterprise command, preserve essential services, coordinate regional capacity and brief the board frequently.

Each scenario should quantify Medicaid encounters lost, conversion to other payers, patients becoming uninsured, scheduled encounters deferred, emergency and acuity effects, net revenue loss, charity care, bad debt, cash, operating margin, supplemental-payment sensitivity, navigation staffing, service-line exposure and neighboring-hospital spillover.

Executive Coverage-Loss Dashboard

Leadership should review:

• Medicaid enrollment and encounter volume.
• Medicaid-to-self-pay conversions.
• Marketplace-to-self-pay conversions.
• Procedural disenrollments.
• Eligibility applications pending.
• Coverage restored through navigation.
• Uninsured emergency visits and admissions.
• Scheduled-procedure cancellations.
• Charity-care and bad-debt expense.
• Uncompensated care as a percentage of net patient revenue.
• Net revenue per encounter.
• Supplemental-payment performance.
• Emergency visits for ambulatory-care-sensitive conditions.
• Medication-access failures.
• Days from discharge to completed follow-up by payer.
• Readmissions after coverage disruption.
• Regional services reduced or closed.
• Days cash on hand under each scenario.

Leadership should receive both totals and trend velocity. A change from 5% to 6% uninsured volume may appear small. If it occurred in two months and is concentrated in maternity, behavioral health or emergency care, it may represent a significant warning.

Immediate Executive Actions

Within 14 days:

1. Appoint an executive owner for coverage-contraction readiness.
2. Establish a finance, operations, clinical, revenue-cycle, strategy and community-health workgroup.
3. Quantify current Medicaid, marketplace and uninsured exposure.
4. Identify service lines most dependent on Medicaid and supplemental payments.
5. Separate procedural disenrollment from true ineligibility.
6. Build lower-, moderate- and severe-impact financial scenarios.
7. Measure uncompensated care by service line.
8. Review eligibility and financial-assistance team capacity.
9. Establish discharge workflows for patients with unstable coverage.
10. Begin reporting days from discharge to completed follow-up by payer.
11. Identify neighboring providers at greatest risk of service reduction.
12. Brief the executive team and board finance committee on direct and regional exposure.

Within 30 days:

1. Integrate payer-mix scenarios into the rolling financial forecast.
2. Add coverage indicators to access, quality and workforce dashboards.
3. Establish a formal coverage-loss taxonomy.
4. Create rapid referral pathways for enrollment assistance.
5. Update charity-care presumptive-eligibility practices.
6. Review collection holds for pending Medicaid or financial-assistance cases.
7. Test the effect of coverage loss on high-risk service lines.
8. Protect essential navigation, case-management and community-health capacity.
9. Coordinate with health centers, counties, pharmacies and community organizations.
10. Conduct a regional scenario involving reduction or closure of a neighboring service.
11. Define escalation thresholds for uncompensated-care growth and coverage-loss velocity.
12. Report corrective actions, owners and deadlines to the board.

NDHN Recommended Coverage-Resilience Standards

These are management standards, not statutory or regulatory requirements.

Management measure	NDHN recommended standard
Material Medicaid and marketplace provisions assigned to an executive owner	100%
Major service lines included in coverage-loss sensitivity modeling	100%
Self-pay encounters classified by cause of coverage loss	At least 95%
Pending Medicaid cases screened before collection escalation	100%
Apparently eligible patients offered navigation	100%
High-risk discharges with coverage and medication access verified	100%
High-risk patients assigned a clinically appropriate follow-up interval before discharge	100%
Major service lines reporting discharge-to-clinic percentile performance by payer	100%
Uncompensated care reported and trended by service line	100% of material service lines
Coverage-loss scenarios incorporated into liquidity, workforce and capital planning	At least three scenarios
Material corrective actions without an owner and deadline	Zero
Board review of coverage-contraction exposure	At least quarterly and when a material threshold is crossed

The Leadership Decision

Coverage contraction is often presented as a question about who qualifies for a public program.

For hospital leaders, the question is larger:

What happens to the care system when millions of people still need treatment but no longer bring a reliable source of payment, access or continuity with them?

The answer will not remain inside Medicaid.

It will appear in emergency queues, delayed diagnoses, missed medications, canceled procedures, avoidable admissions, unpaid bills, workforce reductions and communities losing services.

It will reach commercially insured patients when appointment availability shrinks. It will reach Medicare patients when emergency departments board patients and inpatient capacity tightens. It will reach employers when premiums rise or local services disappear. It will reach regional hospitals when weaker organizations reduce care.

Hospitals cannot solve national coverage policy alone. They can determine whether they see the effects early, preserve preventable coverage, protect clinical continuity, model financial consequences honestly and coordinate before a neighboring failure becomes a regional crisis.

Coverage is not merely a payer category. It is part of the infrastructure that allows care to occur before illness becomes an emergency.

When that infrastructure contracts, every hospital—and eventually every patient—feels the loss.

---

Next in the series: The SUSTAIN 340B Act would protect contract-pharmacy access while requiring a more public, auditable and enterprise-wide compliance operating system.

About the standards: NDHN recommended standards are management targets, not regulatory thresholds. Organizations should apply more stringent timelines where patient risk or applicable requirements demand them.

📍 Published at National Daily Hospital News
Published as part of the National Daily Hospital News series.
Visit the archive: https://nationaldailyhospital.blogspot.com/
LinkedIn: Spence Tepper
Facebook: Compirion
Number One Hospital Blog: Be the Number 1 Hospital

© 2025 National Daily Hospital News
Principle Author: ChatGPT5
Editor: Spence Tepper
Permission to share freely given

#HospitalLeadership #HospitalOperations #HospitalFinance #Medicaid #HealthCoverage #UncompensatedCare #RevenueCycle #PatientAccess #CareTransitions #RuralHospital #CriticalAccessHospital #HealthcarePolicy #NDHN

National Daily Hospital Executive Briefing Thursday August 6th, 2026

National Daily Hospital News

Executive Briefing — Thursday, August 6, 2026

The hospital operating model is moving. Management accountability must arrive before the risk does.

Today’s Executive Brief

Four developments require more than a departmental response. CMS has finalized the FY 2027 hospital payment rule; demand is shifting toward outpatient, virtual, home and post-acute settings while inpatient work becomes more acute; identity-based attackers are turning trusted help-desk processes into a path across cloud systems; and a high-risk emergency-device recall is testing whether hospitals can see beyond the central storeroom.

The common management question is whether authority, measurement and operational controls have moved to the same places as care, data and risk.

Briefing Contents

1. FY 2027 IPPS: The 2.3% Increase Is Not the Story
2. Healthcare Demand Is Moving Beyond the Hospital
3. The Help Desk Has Become Part of the Hospital’s Security Perimeter
4. The BD Intraosseous-Needle Recall Tests Emergency Readiness
5. Early Morning Briefing Highlights
6. Executive Dashboard, Benchmarks and 30-Day Agenda

---

Principal Analysis 1 | Payment, Quality and Operating Accountability

CMS Final Rule: The 2.3% Increase Is Not the Story—The Hospital Operating Model Is Changing

CMS has finalized a 2.3% FY 2027 IPPS payment-rate increase for hospitals that successfully participate in the Hospital Inpatient Quality Reporting Program and are meaningful electronic-health-record users. The update reflects a projected 3.2% market-basket increase reduced by a 0.9-percentage-point productivity adjustment.

CMS estimates that the payment-rate changes, together with other finalized changes, will increase hospital payments by approximately $2.1 billion. New-technology add-on payments are expected to rise by approximately $779 million. The rule becomes effective October 1, 2026.

Those numbers will receive the most attention. They are not the most important management conclusion.

A 2.3% increase does not mean a 2.3% improvement in margin. The hospital must reconcile the national update with its own wage index, case mix, quality-program status, technology payments, payer composition, labor costs, supply inflation, service-line performance and reporting readiness.

Executive test: Can the hospital explain the rule as a hospital-specific earnings, quality, technology and operating plan—not merely as a national percentage?

The Full Update Must Be Earned

Hospitals must meet Hospital IQR requirements and demonstrate meaningful EHR use to earn the full rate update. Failure in data capture, validation, certification, submission or governance can therefore become a direct financial event.

The rule adds three Hospital IQR measures and expands the use of Medicare Advantage data in claims-based measures. CMS also finalized a sepsis readmission measure for the Hospital Readmissions Reduction Program. These changes extend accountability beyond a narrow fee-for-service view and require hospitals to understand performance across a larger share of their Medicare population.

Finance cannot model the rule accurately without quality and clinical data. Quality cannot protect performance without operational ownership. IT cannot treat electronic reporting as a technical submission detached from bedside documentation. The payment system increasingly rewards or penalizes the complete management chain.

CJR-X Moves Accountability Across the Entire Episode

CMS is expanding the Comprehensive Care for Joint Replacement model. CJR-X will be mandatory nationwide beginning January 1, 2028, and will include eligible lower-extremity joint replacements performed in both inpatient and hospital outpatient settings.

Hospitals should not wait until 2027 to begin preparation. A 90-day episode crosses surgery, anesthesia, inpatient or outpatient recovery, rehabilitation, home health, skilled nursing, primary and specialty follow-up, emergency use and readmission. The financial result depends on whether these settings function as one managed pathway.

The hospital should establish baseline episode cost, quality, complications, post-acute utilization, avoidable emergency visits, readmissions and days from discharge to completed follow-up. Orthopedics, finance, case management, ambulatory care, post-acute partners and data teams need one shared view of the episode.

Rural Hospitals Need Two Financial Scenarios

Additional payments for Medicare-Dependent Hospitals and the temporary low-volume payment policy are scheduled under current law to expire December 31, 2026. CMS estimates that an extension through the end of FY 2027 would provide approximately $300 million in additional payments.

Hospitals exposed to these policies should not build a single budget that assumes congressional action. They need a base case without extension and a second scenario with extension, together with predefined operating and capital responses for either outcome.

Immediate Executive Actions

1. Build a CFO-led bridge from the national 2.3% update to the hospital-specific net payment effect.
2. Validate every Hospital IQR and Promoting Interoperability requirement, accountable owner and submission date.
3. Test source data, calculation logic and submission workflows before the reporting deadline.
4. Compare the payment update with expected wage, contract-labor, drug, supply and technology cost growth.
5. Establish baselines for the new and modified quality measures.
6. Expand quality analytics to include Medicare Advantage where required and operationally useful.
7. Build a 90-day CJR-X episode baseline across inpatient, outpatient and post-discharge settings.
8. Model rural-payment provisions under both extension and expiration scenarios.
9. Identify service lines in which the rule changes margin, capital need or strategic importance.
10. Report material gaps, owners and deadlines to the executive team and board finance or quality committee.

NDHN Recommended Payment-Readiness Standards

Management area	Recommended standard
Hospital-specific reconciliation of material payment provisions	100%
IQR and EHR requirements assigned, tested and documented	100%
New or modified measures with baseline data and operational owners	100%
Eligible CJR-X episodes represented in the preparation baseline	100%
Material rural-policy scenarios included in the budget	100%
Material payment or reporting risks without an owner and deadline	Zero

CMS FY 2027 IPPS/LTCH PPS final-rule fact sheet

The leadership decision: The rule is not a finance memo. It is an enterprise operating specification. The hospital earns the update—and protects the margin—only when finance, quality, clinical operations, ambulatory care and technology execute it together.

---

Principal Analysis 2 | Demand, Capacity and Continuity

Healthcare Demand Is Moving Beyond the Hospital—But the Hospital’s Most Difficult Work Is Intensifying

Vizient forecasts that outpatient demand will grow 20% and inpatient demand 7% over the coming decade. Adult emergency-department visits are projected to rise 6%. Post-acute volume is expected to increase 31%, and one in five evaluation-and-management visits may occur remotely by 2036.

The strategic conclusion is not that the hospital is disappearing. It is that the system of care is becoming more distributed while the patients remaining inside the hospital are likely to be more acute, more complex and more dependent on reliable transitions.

Organizations that simply move capacity outward may underbuild the high-acuity core. Organizations that defend the historical inpatient model may miss the growth in ambulatory, virtual, home and post-acute care. The operating plan must do both: expand the distributed care network and protect the hospital capabilities that cannot be replaced.

Average Demand Is Not the Same as Required Capacity

Capacity must be planned for the peaks that place patients at risk—not only for the annual average. A service line can show flat yearly volume while experiencing larger daily peaks, greater acuity, longer procedures, more complex staffing needs and greater dependence on scarce beds or specialists.

Every major service line should maintain three-, five- and ten-year forecasts that distinguish:

• Annual volume from daily and seasonal peaks.
• Inpatient, outpatient, virtual, home and post-acute demand.
• Patient count from workload, acuity and staffing intensity.
• Physical beds from staffed and usable beds.
• Facility capacity from access to diagnostics, transport, pharmacy, procedural support and post-acute placement.
• Community need from the portion of demand the organization can realistically serve.

Ambulatory Growth Creates a New Continuity Obligation

Growth outside the hospital does not improve access if patients cannot cross the boundary from inpatient discharge to timely follow-up. A discharge instruction that says “follow up” is not a completed transition.

Days from Hospital Discharge to Clinic Appointment should become a core system measure. It reveals whether inpatient, ambulatory, scheduling, referral-management and care-management processes function as one pathway.

The hospital should report scheduled appointments and completed appointments separately, using the median, 75th percentile and 90th percentile rather than the mean alone. Results should be segmented by service line, diagnosis, payer, risk level, discharge destination, language and geography. High-risk patients should have a clinically appropriate follow-up interval assigned, and the organization should schedule the visit before discharge whenever clinically and operationally possible.

Averages can hide the patients who wait longest. The 90th percentile shows whether continuity is reliable for nearly everyone or only for the easiest cases.

Post-Acute Growth Will Affect Inpatient Flow

A projected 31% rise in post-acute volume is not merely a market-development opportunity. It is a warning about discharge capacity. Hospitals should map regional skilled-nursing, rehabilitation, home-health, behavioral-health and community-support capacity against expected demand.

The most important planning question is not simply how many beds the hospital owns. It is how many patients can move safely through the complete care continuum without avoidable waiting, deterioration or return to the emergency department.

Immediate Executive Actions

1. Build local three-, five- and ten-year demand forecasts for every material service line.
2. Separate annual averages from daily, weekly and seasonal peak requirements.
3. Measure staffed, usable and constrained capacity—not licensed beds alone.
4. Map outpatient, virtual, home and post-acute growth to workforce and capital plans.
5. Identify the inpatient capabilities that must be protected as acuity rises.
6. Report discharge-to-clinic days using median, 75th and 90th percentiles.
7. Separate scheduled follow-up from completed follow-up.
8. Assign every high-risk discharge a clinically appropriate follow-up interval.
9. Create outreach and escalation rules for missed high-risk appointments.
10. Attribute avoidable hospital days to a defined cause and accountable owner.
11. Reconcile every major capital project with the site-of-care forecast.

NDHN Recommended Capacity and Continuity Standards

Management area	Recommended standard
Material service lines with three-, five- and ten-year local demand forecasts	100%
Capital projects reconciled to site-of-care forecasts	100%
High-risk discharges with a clinically appropriate follow-up interval assigned	100%
Major service lines reporting median, 75th and 90th percentile discharge-to-clinic days	100%
Missed high-risk follow-up appointments receiving defined outreach and escalation	100%
Avoidable hospital days assigned to a cause and owner	At least 95%

Vizient 2026–2036 demand forecast

The leadership decision: The hospital should not choose between inpatient strength and distributed care. It must build a system in which capacity, workforce and follow-up move with the patient while high-acuity capability remains dependable.

---

Principal Analysis 3 | Identity, Cloud Security and Clinical Continuity

The Help Desk Has Become Part of the Hospital’s Security Perimeter

ShinyHunters-branded threat activity is demonstrating how a telephone call can become an enterprise cloud breach. Attackers use voice phishing, victim-branded credential-harvesting sites and plausible support stories to obtain SSO credentials, MFA codes or approval to enroll an unauthorized device.

The attack does not necessarily exploit a vulnerability in the hospital’s software. It exploits the organization’s decision to trust a caller and convert that trust into a password reset, MFA change, device enrollment or application approval.

Once a trusted identity is compromised, the attacker may enter multiple SaaS environments, use native export and API capabilities, create persistent OAuth access and remove large quantities of sensitive data without deploying traditional ransomware.

Operating principle: Clinical urgency should accelerate secure verification—not eliminate it.

Authentication Recovery Must Be a Controlled Process

A hospital should prohibit password, MFA and device changes based solely on an unsolicited inbound interaction. The support team should end the inbound call and use a known, independently maintained callback number or another high-assurance, out-of-band verification method. High-impact and privileged identities should require additional approval.

Employee ID numbers, Social Security numbers, manager names and information from prior breaches should not be treated as sufficient proof. The verification standard must be designed around the possibility that the attacker already knows ordinary identity facts.

Containment Requires More Than a Password Change

Because the attacker may hold valid sessions, tokens, enrolled devices or OAuth permissions, changing the password alone may leave access intact. Confirmed containment should include disabling the affected identity, revoking active sessions and OAuth authorizations, removing unauthorized authentication factors and devices, restricting reset pathways, reviewing privileged changes and searching downstream SaaS activity.

The hospital should be able to perform these actions across priority systems rapidly and from a tested playbook. Mandiant’s guidance emphasizes session and OAuth revocation because valid session artifacts can permit continued access after the password has changed.

Cybersecurity Containment Can Become a Patient-Care Event

Disabling SSO, suspending a cloud service or revoking access from a large user group may interrupt clinical communication, scheduling, referrals, telehealth, workforce operations, patient outreach, document access and care coordination.

For every critical SaaS application, the hospital should know what patient care depends on it, what happens if SSO is unavailable, whether emergency authentication exists, how long the service can be unavailable safely, which manual process replaces it and who can authorize suspension and restoration.

The cybersecurity response plan and clinical downtime plan must intersect. The CISO should not have to choose between leaving an attacker connected and disabling a service without understanding the care consequences.

OAuth and Third-Party Connections Extend the Exposure

Hospitals should inventory authorized OAuth applications, third-party integrations, service accounts, persistent tokens, permissions, accessible data, accountable owners, review dates and revocation methods. Every material connection should have a documented purpose, minimum required permissions and a termination date or recurring review.

Unknown cloud connections are unmanaged risk.

Immediate Executive Actions

1. Brief the executive team and help desk on the current vishing-to-SSO attack pathway.
2. Prohibit password, MFA and device changes based solely on an inbound call.
3. Implement verified callback and out-of-band identity proofing.
4. Identify accounts requiring step-up or dual approval.
5. Inventory SSO-connected applications and map high-risk identity blast radius.
6. Prioritize phishing-resistant MFA for privileged and high-impact users.
7. Alert on new authentication-factor and device registration.
8. Correlate help-desk changes with identity-provider and SaaS activity.
9. Confirm logging of file access, API activity, OAuth changes and bulk exports.
10. Test cross-platform session, token, device and OAuth revocation.
11. Inventory third-party integrations and service accounts.
12. Reconcile cyber-containment procedures with clinical downtime plans.
13. Conduct a simulated vishing and identity-compromise exercise.

NDHN Recommended Identity-Control Standards

Management area	Recommended standard
Authentication changes completed solely through an unverified inbound interaction	Zero
Privileged and high-impact accounts protected by phishing-resistant MFA	100%
Priority SSO applications included in the identity blast-radius map	100%
Critical SaaS applications with tested session-revocation and continuity procedures	100%
Confirmed high-risk incidents capable of cross-platform session and token revocation	Within 15 minutes of the containment decision
Identity-compromise exercises	At least twice annually

Mandiant defensive guidance  |  HHS Healthcare and Public Health Cybersecurity Performance Goals

The leadership decision: The hospital’s most powerful credential is not the password. It is the institution’s decision to believe that the person requesting access is who they claim to be.

---

Principal Analysis 4 | Emergency Readiness and Recall Control

The BD Intraosseous-Needle Recall Is a Test of Whether Emergency Readiness Extends to the Last Device in the Last Cart

An intraosseous needle may remain untouched for months. Then, without warning, it may become the fastest available route for delivering medication, fluids or blood products to a critically ill patient.

BD is recalling specified lots of its Intraosseous Vascular Access System Needle Sets because some users experienced difficulty removing the obturator after placement. FDA reports that affected lots were manufactured with dimensions outside tolerance. Rotation or locking may occur at the obturator-needle hub interface, potentially delaying therapy while another IO needle or alternate vascular-access method is obtained.

As of July 22, 2026, BD had reported 45 serious injuries and four deaths associated with the issue. FDA characterized it as a potentially high-risk device issue. Affected kits include five sizes, with catalog numbers D015151NK, D015251NK, D015351NK, D015451NK and D015551NK. Only specified lots are affected; the powered driver is not included.

This Is Not Primarily a Central-Storeroom Recall

The devices may be stored in emergency departments, trauma rooms, adult and pediatric code carts, rapid-response bags, ICUs, operating rooms, labor and delivery, radiology, ambulances, air-medical units, off-campus clinics, disaster caches, education spaces and unofficial department reserves.

The recall therefore creates two simultaneous risks:

1. An affected device may remain available for use.
2. Removing affected devices may leave a critical location without a reliable vascular-access alternative.

The recall is complete only when every potentially affected unit has been located and removed or quarantined—and every emergency location retains a clinically acceptable access pathway.

The Hospital Needs a Recall Command Structure

One accountable leader should maintain a location-level control record showing catalog and lot identifiers, purchase history, distribution, locations searched, quantities found, disposition, unresolved inventory, replacement status, clinical alternatives, staff notification, related events and executive sign-off.

A general email asking departments to check supplies is not a controlled search. Every search should identify the location, person, date, time and result. High-risk clinical locations should be checked first.

Sealed Emergency Carts Require Controlled Inspection

Hospitals should stage replacement supplies, open each potentially affected cart under supervision, remove recalled product, verify alternatives, restore contents, document the new inventory, reseal the cart and maintain temporary coverage while it is unavailable.

Out-of-service, expired and disaster-reserve carts also require review because they may later be redeployed during a surge.

A New Device Without Competency Is Not Replacement Capacity

Alternative systems may use different needles, drivers, connectors, techniques, landmarks and procedures. Clinical leadership must determine whether the substitute is appropriate, where it can be used, who is qualified to use it and what immediate hands-on instruction is required.

Technique reinforcement is appropriate for unaffected and replacement devices. It does not justify continued use of recalled lots.

The Recall Should Trigger Clinical Review and Simulation

The hospital should examine prior malfunction reports, code and trauma documentation, failed IO placement, repeated attempts, access delays, device complaints and serious events that may warrant clinical, manufacturer, risk-management or regulatory review.

Recall completion should be paired with a focused simulation that tests whether clinicians can locate the approved alternative, select compatible equipment, establish access, administer the first required therapy, document the device and restock the kit correctly.

Immediate Executive Actions

1. Appoint one recall-response leader and obtain the complete lot list.
2. Block affected catalog and lot numbers from issue and use where systems permit.
3. Search trauma rooms, emergency departments, code carts and rapid-response kits first.
4. Extend the search to transport, satellite, procedural and disaster-storage locations.
5. Quarantine or destroy all affected units according to recall instructions.
6. Document every location searched, result and unresolved quantity.
7. Confirm an approved alternative in every emergency location.
8. Review replacement systems for clinical suitability and component compatibility.
9. Provide focused instruction to clinicians who may establish emergency access.
10. Notify downstream organizations that received affected product.
11. Review prior incidents and report relevant complaints to BD and FDA.
12. Maintain daily executive review until inventory and clinical readiness are reconciled.

NDHN Recommended Emergency-Recall Standards

Management area	Recommended standard
Affected products remaining available for use	Zero
High-risk locations physically inspected after a potentially high-risk recall	100% within 8 hours
All potential enterprise locations reconciled	100% within 24 hours
Emergency carts and kits with a verified vascular-access alternative	100%
Affected inventory without documented disposition	Zero
Recall closures independently verified	100%

FDA Early Alert and affected-lot list  |  FDA MedWatch

The leadership decision: A recall is not complete when the affected product is gone. It is complete when the hazard is gone and the hospital remains ready to save the patient.

---

Early Morning Briefing Highlights

Hospital Rankings Are Moving Closer to the Outcomes Patients Experience

U.S. News & World Report’s 2026–2027 Best Hospitals release recognizes 20 Honor Roll hospitals, 505 Best Regional Hospitals, 73 hospitals for community access and four new regional specialty rankings. The methodology gives greater statistical weight to risk-adjusted outcomes, including survival and complications.

Leadership should reconcile the external results with internal mortality, complications, patient experience, access, discharge destination and service-line performance. A ranking is an external signal; the underlying care and management processes are the operating system.

Leadership question: If the hospital’s ranking changed, can leadership explain which measurable outcomes caused the change and what action will follow?

2026–2027 Best Hospitals announcement

The Federal SBOM Standard Expects Software Transparency to Be Operational

CISA, NSA, FBI and international partners have updated the minimum elements for a Software Bill of Materials. New elements strengthen information about SBOM authorship, format, generation context, tools, versioning, component hashes, licenses, dependencies, updates and unknown or withheld information.

Hospitals should require current, machine-processable, version-specific SBOMs for material software and connected devices, together with update duties, vulnerability-notification timeframes, support periods, secure delivery, remediation commitments and end-of-life notice.

Leadership question: If a critical software vulnerability were disclosed this morning, could the hospital identify every affected clinical and operational system before the end of the day?

CISA 2026 Minimum Elements for an SBOM

CMS Final Rules Tighten Rehabilitation and Psychiatric Operating Requirements

CMS finalized a 2.3% FY 2027 payment update for inpatient rehabilitation facilities and inpatient psychiatric facilities. IRF requirements include therapy initiation within 36 hours of admission, the first interdisciplinary-team meeting by the fourth day, weekly meetings thereafter and a shorter future quality-data submission window. IPF changes include a future facility-level outlier limit for certain facilities and implementation of a standardized patient-assessment instrument with CMS-application or FHIR-based submission pathways.

Each final rule should become an owned operational workplan covering payment, workflow, staffing, assessment, technology, reporting and compliance.

Leadership question: Has the organization converted each final rule into an operational-readiness plan—or merely distributed the CMS summary?

CMS FY 2027 IRF final rule  |  CMS FY 2027 IPF final rule

---

The Integrated Executive View

The stories involve payment, distributed care, identity, emergency supplies, external quality recognition, software dependencies and post-acute operating rules. They are connected by one management problem:

The hospital operating model is moving faster than many of the controls built to manage it.

Executive Decision Dashboard

Domain	Principal risk	Immediate decision	Core evidence
Medicare payment	Treating a rate update as margin improvement.	Joint finance, quality, IT and operations plan.	Net effect; full-update eligibility; reporting validation; CJR-X readiness.
Site of care	Moving care outward without preserving high-acuity capacity and continuity.	Reconcile demand, workforce and capital plans.	Peak capacity; ambulatory access; avoidable days; discharge-to-clinic days.
Identity	One help-desk interaction creates enterprise access.	Treat identity as Tier 0 infrastructure.	MFA coverage; reset exceptions; application map; containment time.
Emergency recall	Recalled stock remains—or removal eliminates clinical capability.	Maintain recall command through readiness verification.	Locations searched; unresolved units; alternatives; simulation.
Software supply chain	Unable to identify systems containing a vulnerable component.	Adopt current SBOM procurement requirements.	Current SBOMs; dependency coverage; update and vendor performance.
IRF and IPF	Final rules remain inside finance or regulatory departments.	Multidisciplinary readiness workplans.	Therapy and team timing; assessments; submission; payment forecast.

Leadership Action Table

Priority action	Accountable leadership	Target
Complete FY 2027 IPPS financial-impact model.	CFO	14 days
Validate IQR and Promoting Interoperability eligibility.	Chief quality officer and CIO	30 days
Produce discharge-to-clinic report with percentile distribution.	CMO, CNO and ambulatory leader	14 days
Harden password, MFA and device-recovery processes.	CIO and CISO	7 days
Test cross-platform identity containment.	CISO	30 days
Reconcile IO-needle recall and alternative access.	CNO, supply chain and patient safety	Immediate
Review priority contracts against the 2026 SBOM standard.	CIO, CISO, supply chain and legal	30 days
Convert IRF and IPF rules into operating workplans.	Rehabilitation and behavioral-health executives	14 days

Thirty-Day Executive Implementation Agenda

Days 1–7: Establish Control

1. Name executive owners.
2. Complete the emergency-device search and protect alternative access.
3. Prohibit unverified inbound authentication changes.
4. Confirm FY 2027 reporting requirements.
5. Identify high-risk discharges without assigned follow-up.
6. Create one enterprise corrective-action register.

Days 8–14: Build Visibility

1. Calculate the hospital-specific IPPS effect.
2. Produce the first discharge-to-clinic report.
3. Map high-risk identities to connected applications and data.
4. Inventory priority SBOM availability.
5. Reconcile capital projects with site-of-care changes.
6. Evaluate IRF and IPF readiness.

Days 15–21: Test the Operating Model

1. Simulate help-desk impersonation and containment.
2. Conduct an alternative-vascular-access drill.
3. Trace high-risk patients through completed follow-up.
4. Test quality and EHR data from source through submission.
5. Compare external rankings with internal outcomes.
6. Identify conflicting demand, workforce and capital assumptions.

Days 22–30: Commit Resources and Accountability

1. Approve the FY 2027 implementation plan.
2. Set service-line access and continuity targets.
3. Approve prioritized phishing-resistant MFA deployment.
4. Adopt SBOM procurement and contracting requirements.
5. Correct emergency-inventory traceability gaps.
6. Approve IRF and IPF operating changes.
7. Report unresolved risks, owners and deadlines to executives and the board.

The Executive Conclusion

The common danger is not that hospitals are unaware of change. It is that responsibility remains organized around yesterday’s boundaries.

Finance manages payment. Quality manages measures. IT manages systems. Security manages cyberattacks. Supply chain manages recalls. Ambulatory care manages clinic access. Inpatient leaders manage beds.

But the patient, attacker, software vulnerability, recalled device and payment model all move across those boundaries.

The hospital operating model must manage complete pathways: from payment rule to clinical workflow; from discharge to completed follow-up; from identity change to every connected application; from receiving dock to the last device in the last cart; and from software component to every system that depends on it.

The hospital operating model is moving. Management accountability must arrive before the risk does.

---

About the standards: NDHN recommended standards are management targets, not regulatory thresholds. Organizations should apply more stringent timelines where patient risk or applicable requirements demand them.

📍 Published at National Daily Hospital News
Visit the archive: https://nationaldailyhospital.blogspot.com/
LinkedIn: Spence Tepper
Facebook: Compirion
Number One Hospital Blog: Be the Number 1 Hospital

© 2025 National Daily Hospital News
Principle Author: ChatGPT5
Editor: Spence Tepper
Permission to share freely given

#HospitalLeadership #HospitalOperations #CMS #Medicare #HospitalFinance #HealthcareQuality #PatientFlow #CareTransitions #Cybersecurity #HealthIT #SupplyChain #PatientSafety #RuralHospital #CriticalAccessHospital #NDHN