The Hackers Behind Ryuk; $50K Trauma ‘Activation’ Fee; Conspiracy to Defraud FDA

Welcome to the latest edition of Investigative Roundup, highlighting some of the best investigative reporting on healthcare each week.

Ruthless Hackers Wreak Havoc on U.S. Hospitals

The Wall Street Journal takes a behind-the-scenes look at the hackers involved in the notorious Ryuk ransomware, which has wreaked havoc on at least 235 hospitals and inpatient psychiatric facilities and dozens of other healthcare facilities in the U.S. since 2018, resulting in suspended surgeries, delayed medical care, and the loss of millions of dollars.

WSJ tracked the attacks to “a notorious gang of Eastern European cybercriminals” that has ties to Russian government security services, according to threat analysis and former law enforcement officials cited in the article. The group is “the most prolific ransomware gang in the world,” according to WSJ. In 2020, Ryuk was responsible for one-third of 203 million ransomware attacks in the U.S., according to data from the bitcoin analysis firm Chainalysis cited in the article. That amounted to at least $100 million in ransom paid last year.

Ryuk targets large organizations and installs malicious software that locks all the files on the organization’s computers. An encryption key, or uncrackable password, is required to unlock the files. Ryuk demands six and seven figure ransoms in exchange for handing over the encryption key.

Some ransomware gangs avoid hospitals because of life and death issues, while others turn over the encryption key when lives are at stake. But Ryuk is more brazen.

“They do not care. Patient care, people dying, whatever. It doesn’t matter. Other groups you can at least have a conversation. You can tell them, ‘We’re a hospital, someone’s going to die.’ Ryuk won’t even reply to that email,” Bill Siegel, CEO of the ransomware recovery firm Coveware, said in the article.

Trauma Drama: Alleged Money Grab by Nation’s Largest Hospital Chain

For-profit HCA Healthcare, the nation’s largest hospital chain, appears to be cashing in by expanding trauma centers and charging high-priced trauma team “activation” fees (sometimes 10 times higher than other hospitals’ fees, as high as $50,000 per patient), according to Kaiser Health News.

In the alleged “money grab,” such charges have turned trauma centers into a “key part of the company’s growth and profit-generating strategy,” according to corporate officials cited in the article. Trauma centers are mostly exempt from laws intended to curb excessive hospital spending and expansion, the article states.

“Once a hospital has a trauma designation, it can charge thousands of dollars in activation fees for the same care seen in the same emergency room,” said Stacie Sasso, executive director of the Health Services Coalition, an organization that is opposing trauma center expansion in Nevada.

Over the past 3 years, HCA’s stock has doubled. The company says it now runs 1 of every 20 trauma facilities in the U.S. The expansion into trauma centers “alarms health policy analysts who suggest its motive is more about chasing profit than improving patient care,” the article states. According to data collected by the state of Florida and analyzed by KHN, trauma cases and bills for trauma care spike after an HCA trauma center has opened, suggesting that some patients with relatively minor injuries are being reclassified into more profitable trauma patients.

An HCA spokesperson Harlow Sumerford said the HCA trauma center expansion is making “superior care available to more patients.” But Ed Jimenez — who was part of a “largely unsuccessful” attempt to block HCA’s trauma center expansion in Florida and is CEO of the University of Florida Health Shands — said, “There’s no question it’s a money grab.”

Drugmaker Charged With Conspiracy to Defraud FDA

Pennsylvania generic drug manufacturer KVK-Tech and two of its executives, Murty Vepuri (KVK-TECH’s de facto owner) and Ashvin Panchal (KVK-TECH’s head of Quality Assurance), have been charged with conspiracy to defraud the FDA, according to a press release from the U.S Department of Justice.

The indictment arises from activities that took place between October 2010 through at least March 2015, and were related to “alleged distribution of unapproved drugs as well as alleged efforts to mislead the FDA and conceal information which could impact drug safety and effectiveness,” according to the release. KVK-TECH was also charged with one count of mail fraud, for the alleged sale of unapproved drugs to customers who were led to believe the drugs were FDA approved.

According to the indictment, Vepuri is charged with “hiding his involvement in KVK-TECH” by representing that he was just an advisor or consultant to KVK-TECH, “when in reality he exercised unchecked authority over the company,” according to the press release. Vepuri is the former owner of a generic drug manufacturer in New Jersey that has a restraining order due to ongoing FDA violations.

The indictment highlighted KVK-TECH’s distribution of 383,000 bottles of unapproved hydroxyzine “without the FDA’s knowledge or approval” between 2011 and 2013. Hydroxyzine is a KVK-TECH prescription drug for the treatment of anxiety, for which the active pharmaceutical ingredient was purchased from Dr. Reddy’s Lab in Mexico, a source that was not FDA approved.

If convicted, Vepuri and Panchal could face a maximum of 5 years in prison, 3 years of supervised release, a $250,000 fine, and other financial penalties. KVK-TECH could be fined up to $4 million, along with penalties such as forfeiture and probation.