Thursday, May 28, 2015

FBI’s ‘Operation Ghost Click’ takes out operators of DNS Changer malware network 11/28/11 LulzSec

FBI's 'Operation Ghost Click' takes out operators of DNS Changer malware network | Naked Security | DailyDDoSe™

FBI's 'Operation Ghost Click' takes out operators of DNS Changer malware network | Naked Security

The FBI is cock-a-hoop today, having just announced the bust of six Estonians for malware-related cybercrimes.

The case goes back to 2007, with the investigation itself apparently having taken two years.

The FBI claims that the gang infected 4,000,000 computers in 100 different countries – with 500,000 infections in the USA alone.

The crooks are also said to have raked in at least US$14,000,000 of fraudulently-obtained income as a result.

The investigation and bust was dubbed Operation Ghost Click because the cybercrooks used DNS Changer malware to take victims to sites they didn't expect. By changing the DNS settings of infected computers, the crooks could redirect clicks intended for site A to site B instead, or fraudulently convert adverts for service C into ads for service D.

Another thorn in the side of Ghost Click victims, as the FBI points out, is that once cybercrooks control your PC's DNS lookups, they can sneakily direct you away from security websites, anti-virus updates and more. This increases your overall exposure to danger and lets them fleece you for longer.

DNS is short for the Domain Name System. It provides the "lookup tables" which tell your computer where to find what on the internet.

For example, DNS will advise you that the website known by the human-friendly name of nakedsecurity.sophos.com can be found by computer-friendly number at 72.233.104.123, or 76.74.255.117, or, as it happens, at a range of other numbered servers online.

DNS will also tell you how to send mail to people with sophos.com email addresses, will tell you where Sophos sends its email from, and much more besides.

Most computer users rely on a DNS server provided by their employer or their ISP. The location of this server is typically configured automatically every time you reboot your PC.

(You can tell what DNS server or servers you're using by using the ipconfig /all command on Windows, or the Networking icon from System Preferences on OS X. You may see two or more DNS servers listed. That's for resilience, in case one of them fails.)

The correctness of your internet browsing experience is entirely dependent on the correctness of the DNS server you use. A dishonest DNS server can take you to fraudulent substitutes of any sites it likes.

And a dishonest DNS server can be hard to spot – most dodgy servers tell the truth most of the time, telling you strategic lies when a money-making opportunity arises. Crooks can replace legitimate adverts with shonky ones for a fee, or deliver pay-per-install malware instead of a trustworthy file download.

The FBI is advising that the dodgy DNS servers seen in this investigation fall into the following IP ranges:

64. 28.176.0   to   64. 28.191.255 67.210.  0.0   to   67.210. 15.255 77. 67. 83.0   to   77. 67. 83.255 85.255.112.0   to   85.255.127.255 93.188.160.0   to   93.188.167.255 213.109. 64.0   to  213.109. 79.255

The Feds also have a guidance document which tells you how to check your DNS settings if you are using Windows or OS X. (Yes, DNS Changer malware exists for the Mac, too.)

Unfortunately:

* if your DNS server is inside one of these ranges, you aren't necessarily infected;

* if your DNS server is outside these ranges, you aren't necessarily clean;

* resetting your DNS server if it's wrong won't fix the malware problem which changed it in the first place; and

* the DNS Changer malware family referred to in the FBI's article is just one of many thousands of malware families, each consisting of many thousands of samples.

If you're worried, check that your anti-virus is up-to-date, and verify your DNS server settings match what you'd expect for your PC. Your IT helpdesk or your ISP should be able to tell you what to look for.



Sent via iPad 3

Yahoo hack steals 400,000 passwords. Is yours on the list?

Yahoo hack steals 400,000 passwords. Is yours on the list? - CSMonitor.com

Yahoo hack steals 400,000 passwords. Is yours on the list?

Yahoo, which has taken its share of hits in the last few years, added another black mark against it today when the theft of more than 400,000 accounts and as many as 450,000, including email addresses and passwords, was discovered.

The hacked emails and passwords were posted in a large text file.

The theft has been credited to a black-hat hacking crew called D33D, who most likely breached the server for Yahoo Voices, previously known as Associated Content, with an SQL injection hack. Because Yahoo purchased Associated Content in 2010, many non-Yahoo identities have been breached, including some with Google and AOL emails.

According to the Guardian, some names date back to 2006 and may be from an old list.

Seeing one's users hacked is bad news to begin with for any company, but it appears that the passwords stolen from Yahoo were not encrypted. As Information Week noted, this could put Yahoo in position to be prosecuted. Yahoo has claimed publicly that the information was protected. However if it turns out that such data was not encrypted properly, a court may find those claims to be fraudulent. As security researcher Christopher Soghoian tweeted, "Strong chance of FTC deception case re: Yahoo password breach via claim it maintains reasonable electronic safeguards."

CNET sorted through the hacked passwords to discover sequential numbers were used 2,295 times. Among the most popular passwords in the file were "123456," "111111," "password" and  "password" plus numbers.

The hackers told several publications "We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call." By so doing, D33D make a claim for being do-gooders. "There have been many security holes exploited in webservers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage."

If you have used Yahoo Voices or Associated Content, Dazzlepod has made the information searchable by account name.



For iPhone, iPad privacy, here's how to turn on encryption in just one minute

For iPhone, iPad privacy, here's how to turn on encryption in just one minute | ZDNet

For iPhone, iPad privacy, here's how to turn on encryption in just one minute

If the feds ever come looking for your iPhone or iPad data, they won't go knocking on Apple's door. They'll be coming straight to you.

Since the introduction of iOS 8 almost a year ago, Apple has included a new device encryption feature, aimed at securing device data from hackers, thieves, and government agencies, while at the same time removing itself from the equation. After the company was (wrongly) accused of cooperating with the US government's PRISM surveillance program, Apple wanted to ensure that it couldn't be forced to hand over data stored on its customers' devices. In doing so, it gave its customers the encryption keys to their device's data.

How? A simple lock-screen passcode.

The reality is that most iPhones and iPads, running the latest iOS 8 software, are probably already protected. But reports show that about one-third of all smartphone owners have never set a four-digit passcode to lock their phones.

Even if you have a four-digit passcode, it can be manually bypassed in hours (if you found a hacker or government agent who is determined enough). If you set a longer numerical passcode, it greatly reduces the odds of you losing control of your data.

Turning on device encryption is easy. Here's how you do it.

1. Go to your iPhone or iPad's settings

The first step is to gain access to your device settings. Usually, you can find "Settings" on your iPhone or iPad home screen. From there, go to Touch ID & Passcode. (Older devices without a fingerprint scanner will just say "Passcode.")

2. Make sure your passcode is turned on

Once you get into your passcode area, make sure the simple passcode option is turned off. Then, tap the button that says "Turn Passcode On." From here, you will be able to set either a strong four-digit or longer numerical passcode, or alphanumeric password.

3. Set a strong passcode

From this screen, you can set a simple or longer passcode. You have a great deal of flexibility. Remember: the stronger the user passcode is, the stronger the encryption key becomes.

Setting a numerical password is easy: simply type in a memorable passcode of four numbers or longer. Alternatively, you can add letters to your passcode, which significantly improves your device's security. According to Apple, setting a six-digit alphanumeric passcode with lower-case letters and numbers would take about five years to break if every combination was tried.

4. Ensure data protection is enabled

Once your passcode is set, you will return back to the Settings menu. By scrolling down to the bottom of the page, you should see written: "Data protection is enabled." That means your device is now encrypted, and nobody except you can access the data on that device.

Other how-to stories and galleries:

Zack Whittaker is a writer-editor for ZDNet, and sister sites CNET and CBS News. He is based in the New York newsroom. His PGP key is: EB6CEEA5.



Sent via iPad 3

Wednesday, May 27, 2015

Find the IP address of your home router | Computerworld

Find the IP address of your home router | Computerworld

Find the IP address of your home router

In an upcoming blog I expect to write about configuring a home router, which requires logging on to it. This, in turn, requires knowing the IP address of the router. Non-techies typically don't know anything about IP addresses, let alone the one assigned to their router. Since I expect the upcoming blog to be fairly long, I decided to start with this cheat sheet for learning the IP address of a router.

All routers have a web-based interface and, thus, are configured with a web browser. While some routers can be accessed by name (they typically intercept DNS queries), they all can be accessed by their IP address. 

Full access to the router requires a userid and password, but to even get prompted for this, you need to know the IP address. 

An IP address is written as four numbers separated by periods. Typical home networks use IP addresses that start with 192.168. Often the router will have an IP address such as 192.168.1.1 or 192.168.2.1. 

If your Internet Service Provider (ISP) installed your router, they know both its IP address and the userid/password for it. In my experience, the ISP never tells the customer any of this information up front. 

With a self-installed router, you can get the IP address (assuming it wasn't changed at installation) from the manufacturer's documentation. Sometimes it is on a label on the bottom of the router. 

Once a network has been set up, each computing device on the network knows the IP address of the router and will spill the beans if you know the secret handshake. Terminology can get in the way however.  

Apple devices refer to the router as "Router". Windows refers to it as the "Default Gateway", a term borrowed from TCP/IP. Chrome OS refers to the router as "Gateway". Android won't tell you the IP address of your router, forcing you to install an app. 

WINDOWS

Windows users can start a command prompt and type in "ipconfig" to see the Default Gateway. The output will look like this on Windows 7: 

Windows IP Configuration

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :

   IPv4 Address. . . . . . . . . . . : 192.168.5.29

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . : 192.168.5.1

The output of the command Windows XP is almost identical. On either system, if the computer is using Wi-Fi rather than Ethernet, look for "Wireless Network Connection" instead of "Local Area Connection".

The same ipconfig command works on the desktop side of Windows 8, which also identifies the router as "Default Gateway". A wireless connection on Windows 8 is called "Wireless LAN adapter Wi-Fi", while a wired connection is identified as "Ethernet adapter Ethernet".

iOS

On an iOS 6 device, go to settings, then Wi-Fi, then click on the arrow to the right of your network name. You will then see something like that shown below where the router IP address is identified as "Router". 

The instructions for iOS version 5 are identical to those for version 6. 

ios6.routeripcrop2.jpg

On iOS 7 (tested with 7.1.1), go to settings, then Wi-Fi, then click on the name of the wireless network you are connected to. The interface has not changed from version 6, the routers IP address is still identified as "Router" in the DHCP section.  

On iOS 8 (tested with 8.1.2), the procedure is the same as with version 7.

The instructions above assume that the iOS device was assigned its IP address using DHCP. In the rare case where it has a static IP address, click on the Static tab (shown above) and, again, look for "Router".   

OS X

In Snow Leopard, go to Network preferences, click on the Advanced button, then on the TCP/IP tab. As with iOS, the router is identified as "Router". 

In Yosemite you can get the IP address of the router a few ways. 

One approach is a terminal command. Run terminal with Go -> Utilities -> Terminal, then enter: 

  netstat -nr | grep default

The output looks something like 

  Default 192.168.3.1   UGSc   317    2    en0

In this example, the routers IP address is 192.168.3.1. 

Another terminal command you can try is 

  route -n get default

Look for "gateway" on a line by itself. To the right of it is the IP address of the router. 

If using Wi-Fi on Yosemite, Option clicking on the Wi-Fi indicator causes the system to display more data than a normal click. Included in this additional data is the IP address of the router, identified as "Router". Option clicking did not display the router IP address in Lion, I'm not sure which release of OS X introduced it. 

A normal click on the Wi-Fi indicator also produces the router IP address if you look hard enough. Click on Open Network Preferences, then on the Wi-Fi network interface in left side column (should say "connected"), then click the Advanced... button, then the TCP/IP tab and look for "Router". Whew. 

If not using Wi-Fi, then: System Preferences -> Network -> click on the "connected" network interface in the column on the left -> Advanced... button -> TCP/IP tab and look for "Router". 

If that's not enough, the IP address is also available in the System Information utility (Go -> Utilities -> System Information). Click on Network in the left side column, then Wi-Fi in the top pane (not the left pane), and look for "Router" in the IPv4 section.

ANDROID

Android 2.3 and 4.x devices, do not report the router IP address as part of the Wi-Fi settings display. My favorite app for network information is Fing, which I wrote about last year. Fing is designed to take an inventory of the computing devices on your network. Run Fing and click on the top line, the one with the network name. It refers to the router as "Gateway" and the IP address is below the Local Address and above DNS. 

Another great app that shows the IP address of the router as a side benefit is WiFi Analyzer by farproc. In WiFi Analyzer, go to the AP list screen and click on the top line, the one showing the name of the network you are connected to and your IP address. Look for the "Gateway" IP address (it is above the Netmask). 

Update June 28, 2014: As of version 4.4.2, Android still does not report the IP address of the router as part of the Wi-Fi settings display.

Update Nov. 6, 2014:  As of version 4.4.4 still no router IP address. What it does show is the IP address of your device. 

CHROME OS

On a Chromebook, enter "chrome://system" in the address bar and scroll down to network-status. Click on the gray Expand button. If the Chromebook is connected via Ethernet, look for the clump of data identified as "eth0". If you are connected wirelessly, look in the "wlan0" section. The router is identified as "Gateway".

Update June 23, 2014: As of version 35 of Chrome OS the above is still true.

So as not to have go through this again, I suggest writing the IP address of the router, along with the userid/password, on a piece of paper taped to the router face-down. 

Updates
June 23, 2014: There are a couple additional ways to learn the IP address of a router. More and more router manufacturers are offering smartphone apps to manage their routers. Very likely these apps will report the IP address of the router. Another management option for some routers is the website of the router manufacturer.   

June 23, 2014:  Added iOS version 7.

November 6, 2014:  Added OS X Yosemite and a note about Android 4.4.4. 

January 5, 2015:  Updated OS X Yosemite section.

January 7, 2015:  Added iOS version 8.

February 20, 2015: Added a second OS X terminal command. 

Did Google goof with the Flash player in Chrome?

Saturday, May 9, 2015

Applying Federal Law to Support Mandatory Healthcare Coverage

Applying Federal Law to Support Mandatory Coverage

by Elyssa Durant, my.barackobama.com
July 25th 2009 9:59 AM

Underwriting the Social Contract: Distributive Justice & Health Care Reform

The Problem Statement

As health care costs climbed exponentially in the 1980's, so did the cost of health insurance plans. As a result, employers began to enroll their employees in managed care organizations, and many Americans were forced to leave their traditional indemnity type plans. With the advent of the health maintenance organization, there is a financial incentive for the underutilization of care. (Blumstein, 1996; Davis & Shoen, 1996).

In order to reduce financial risk, health insurance companies have restricted enrollment to individuals in poor health. By covering the minimal standards of treatment and excluding high risk groups altogether, major US insurance companies have realized that the health insurance market can a be an extremely profitable industry. The public sector absorbs the cost of unreimbursed care for chronic care in America (Robert Wood Johnson Foundation, 1996). Based upon these findings, it seems clear that the money being removed from the health care marketplace is fattening the pockets of CEOs and majority stockholders.

Recent trend towards localized government leaves individuals without a financial safety net. This is the least efficient manner to handle health care costs, and evades the premise that medical care is a natural right in a civilized society. Few Americans feel secure within the current system. The rising costs of medical care contributed to the recent market changes in both the administration and delivery of health services. The financial incentive to cover only the healthiest individuals ignores the fact that medical care is a social good.

Health Insurance Portability Act of 1996

Two years after the Clinton Health Plan was defeated in Congress, Senator Ted Kennedy and Nancy Kassebaum introduced the Kennedy-Kassebaum Bill in response to growing concerns about selective enrollment procedures used by health insurance companies in the private sector. In the final version of the Bill, insurance companies must limit preexisting condition clauses to twelve months. It has been estimated that this provision of the Bill will help an estimated 150,000 Americans obtain health insurance coverage.

There are many levels of the underinsured, including those without any coverage; effective policy must address the needs of the total population without shifting costs from one disadvantaged person to another. Kennedy-Kassebaum fails to address the cost issue—the primary concern for those at risk for losing their health insurance. It does nothing to help the uninsured acquire a decent health policy, and then provides no solution to the critical issue at hand— cost

Since Kennedy-Kassebaum does nothing to control the cost of health insurance and medical care in America, the Bill fails to respond to the issue of greatest concern to the citizens of this country: the cost of medical care. The Bill looks towards the states to develop consumer protections and weakens the regulatory role of the federal government. The majority of the American public is unaware of the fancy footwork involved with this legislation, and the demographics of the population it is intended to protect. In order to assess the utility of this Bill, it is critical to identify the populations at risk for loosing health insurance coverage and the underinsured.

Kassebaum-Kennedy focuses on a slim portion of the uninsured population, and those who would be eligible for COBRA continuation (Consolidated Omnibus Reconciliation Act of 1974). Of the 41 million uninsured Americans, only about 150,000 are expected to benefit from this legislation. The Health Insurance Portability and Accountability Act of 1996 is really nothing more than smoke and mirrors since it fails to address the true issue at hand—the simple fact that the cost of quality health care in America is becoming a privilege that only the wealthy can afford.

The Cost of Care for Pre-existing Conditions

An individual with high blood pressure may just require prescription medication. Cancer patients in remission may require chemotherapy, and a person suffering with a degenerative disease may be involved in treatment studies. Each condition requires individualized treatment that cannot be based upon the simple economic/cost-benefit analysis used in the utilization review process by large insurance companies. Clearly, the most effective treatment for one patient may not be the best for another. The time required for utilization review may present additional health risks and complications to a patient suffering from a chronic health condition.

Twelve months without insurance coverage may be financially devastating to some patients, and 63% of Americans have already forgone some type of medical treatment within the last year due to financial constraints. Publicity surrounding Kennedy-Kassebaum has hailed the bill as the "be all and end all in progressive legislation, however, in actuality it will only help about 150,000 people.

Recent studies have found that the majority of the uninsured population simply cannot afford to pay the premiums (Donelan et. al., 1996; Hoffman & Rice, 1996). According to their data, only 1% of the Uninsured population is due to current health status and exclusionary preexisting clauses, yet an overwhelming number of insured respondents reported an inability to receive medical care for chronic conditions. The majority of Americans with chronic illness are covered by some type of insurance, yet they are still subject to the utilization review process and access problems that deny or delay medically necessary treatment (Donelan, et. al., Hoffman & Rice, 1996).

Underwriting the Solidarity Principle

Traditional forms of insurance underwriting required that the contract explicitly state which illness or services are not covered by the policy, in advance. If the underwriter did not specifically state a certain condition in the contract, the insurer was held to the terms of the contract and required to pay for services utilized by the policyholder (Stone, 1994, as cited in Durant, 1996).

Increasing numbers of for-profit and non-profit insurance companies began to control costs by refusing to insure individuals who they felt would utilize more services. Insurers began to require health survey status questionnaires (refer to attachment A), and even began implementing AIDS and genetic testing to identify high-risk individuals (Brunetta, as cited in Gutmann & Thompson, 1996). In the 1980s, large insurance companies began including sexual orientation as a high-risk category, by using actuarial sound criteria. Such criteria concluded that gay men were a higher risk for contracting AIDS virus and refused to write policies for anyone believed to be homosexual, (Stone, 1994 as cited in Durant, 1996).

By limiting enrollment to the healthiest members of society, selective enrollment undermines the solidarity principle of health insurance (Davis & Shoen, 1996; Snow, 1996; Stone, 1994). By eliminating those who were suspect of using more services than their healthier counterparts use, insurance companies are able to offer rock bottom prices for young, healthy individuals. By excluding preexisting conditions and requiring certain individuals to purchase high-risk policies, the number of uninsured and underinsured Americans continues to grow exponentially (Durant, 1996).

More individuals are choosing not to purchase insurance simply because they cannot afford it. Even among those with employer based health coverage, the policies frequently exclude coverage for long-term illness or care of chronic conditions (MSNBC News Forum, 1996). Without a standard definition of preexisting conditions, these clauses serve as "wildcards" since they allow insurers to deny coverage for any illness that "manifested itself before the issuing date of the policy (Stone, 1994 as cited in Durant, 1996).

This statement allows insurers to deny treatment for benefits and services for the policyholder for undiagnosed illnesses or conditions of which they were unaware. As a result, the insurers began to demand medical histories of applicants and their families in order to identify high risk individuals (please refer to attachment A).


Legitimacy of Distributive Justice

While there is a legitimate role of government to distribute scarce resources among the nation's neediest individuals, sadly this is not the cause for the mismanagement of medical dollars in the United States today. There is a big distinction between an individual being denied prescription medication at their local pharmacy due to a cost-effective formulary developed by their Managed Care Organizations (MCOs), than an individual being denied a liver transplant because healthy livers are a scarce resource. While both may have equally devastating consequences, it is more difficult to rationalize a lost life based upon rigid cost benefit analysis and utilization decisions made according to formulas and cost-benefit analysis of treatment protocols.

"The political controversy over the distribution of health care in the United States is an instructive problem in distributive justice. Good health is care is necessary for pursuing most other things in life. Yet equal access to health care would require the government to not only redistribute resources from the rich, healthy to the poor, and infirm, but also restrict the freedom of doctors and other health care providers. Such redistributions may be warranted, but to what level, and to what extent?" Gutmann & Thompson (Page 178).

Blendon and his colleagues have reported similar findings in public opinion polls from 1992 and 1994 (Blendon et. al., 1992; Blendon et. al., 1994). A recent study by the American Medical Association found cost to be of paramount concern to an overwhelming number of Americans (Donelan et. aI., 1996). Of the 40 million uninsured Americans, only 1% attributes their failure to acquire health insurance coverage to their preexisting conditions. Among the uninsured, cost is cited as the primary obstacle in obtaining health insurance coverage. Only 1% of the uninsured attributes their lack of coverage to a preexisting condition.

Based upon these democratic principles of distributive justice, consistent opinion polls demonstrate the legitimate role and public desire for government regulation of the health care industry. It has become obvious that the federal government must intervene in order to protect natural law rights, the social contract, and the Constitution of the United States. Regulation is needed to protect the individual freedoms, liberty, and the pursuit of "health, happiness, and the American Dream."

If America is to be the "Land of Opportunity," then clearly individual health and wellness should be an ideal to reach for. Current models of distributive justice emphasize public consensus as a legitimate role for government intervention. According to a number of studies by Blendon and his colleagues, the public has reported an overwhelming general concern about health care in this country, (1992, 1993, 1994, 1995, 1996).

State civil courts are backed up with cases where HMOs have violated the First Amendment (gag orders), the Fourteenth Amendment (due process), and the rights of protected classes under the Americans with Disabilities Act. Countless examples of "anecdotal" evidence appear as headlines everyday across the country. (New York Times, 1996; The New York Daily News, 1996; Long Island Newsday, 1996; LA Times, 1996; Picayne Times, 1996; Columbia Spectator, 1996; Columbia University Record, 1996; US News & World Reports, 1996; Newsweek 1996; Healthline, 1996; The Tennessean, 1996; The Albany Times, 1996; The Nashville Scene, 1996). In their entirety, these case reports represent the human tragedy that lies beneath the web of the very worst of American capitalism: corporate greed.

Identifying Populations At-Risk

A study by The Lewison Group in 1996 reveals insight into the private individual health insurance market. Clearly, individuals choosing to purchase health insurance policies for several hundred dollars each month expect their health care needs and expenditures to exceed that amount Regardless of health status, a young healthy 25 year old who purchases an individual health insurance policy can expect to pay well over $300.00 monthly for a health insurance policy with Empire Blue Shield Blue Cross (based upon 1996 rates, current rates available from the New York State Insurance Department).

Since individual policies are not addressed in the Health Insurance Portability and Accountability Act of 1996 (HIPA), an individual policy with Blue Cross Blue Shield of Tennessee excludes preexisting conditions for 24 months (enrollment booklet available upon request). The critical markets in need of reform are the adversely selected individual insurance market, and the state's most vulnerable populations: children; the elderly; the chronically ill; the uninsured; and the underinsured.

For the millions of individuals who have lost their employer based coverage, the cost of private health insurance is prohibitively expensive. Many individuals opt out of the individual market and apply for public assistance when the need arises. Those who have retained their health insurance coverage through their employers are being moved into managed care despite their efforts to retain their indemnity style plans (Davis & Shoen, 1996; The Lewison Group, 1996).

Access to Medical Care

As routine practice, HMOs deny or delay care for all services that are not outright medically necessary. Growing numbers of individuals have suffered irreparable harm, and many have died awaiting approval from their HMO's (The New York Times, 1996; Long Island Newsday, 1996; The Tennessean, 1996; Healthline, 1996). It is hardly a secret that HMOs have fallen short of their promise to provide comprehensive health care for the "whole" individual by emphasizing preventative medicine, using medical management to coordinate care. There is substantial evidence that individuals with chronic conditions receive substandard care in HMOs.

A four-year longitudinal study of medical outcomes found that the elderly, the poor, and persons with chronic conditions were in better health when covered by fee-for-service plans compared with a control group covered in HMOs (Ware et. al., 1996). New statistics released in Washington, DC by the American Medical Association and the Robert Wood Johnson Foundation revealed the direct costs of individuals with chronic conditions account for 75% of direct medical expenditures in the United States (Hoffman & Rice, 1996; based upon the National Medical Expenditures Survey; raw data available on CD from the Department of Health and Human Services Washington, DC). 45% of the American population suffers from at least one chronic illness.

If managed healthcare has been found to deliver inadequate care to this population, then we are looking at 100 million individuals who are potentially facing personal and financial crisis as they are moved into managed care. The public already accounts for the largest payment of direct medical expenditures, which means the millions of dollars being made by for-profit insurance companies are not being circulated into the economy to assist in public health costs care. The industry made a 14.8% profit in the 3rd quarter of 1996, however these medical dollars were removed from health care and used to fatten the pockets of CEO's and majority stockholders (Healthline, 1996).

Based upon a new report from the Robert Wood Johnson Foundation, the direct costs for persons with chronic conditions represent 69.4% of national expenditures in personal health care (Robert Wood Johnson Foundation, 1996). Their direct medical costs are estimated at $4672.00 annually compared with $817.00 annually for individuals with acute illness (Hoffman & Rice, 1996; based upon National Medical Expenditures Survey 1987, not adjusted for inflation). This population is the most vulnerable to complications in their health and with their source of payment. Large insurance companies only provide adequate coverage for acute illness (Donelan et al., 1996; Hoffman et. al, 1996).

Medicaid Managed Care

Following Tennessee's lead, many states have enrolled their medically indigent populations in Medicaid Managed Care Organizations (MCOs). In Daniels v. Wadley, (926 F. Supp. 1305), the court held that TennCare violated the Due Process Clause of the Fourteenth Amendment since such procedures eliminate fair hearings and independent medical review of disputes. The court found the pattern of routine denials of care by MCOs participating in the states TennCare program to violate the Medicaid Act since it compounded the problem of institutionalized waiting periods for medical appeals pending independent review by the Medical Review Unit (MRU), (42 U.S.C. § 1396 (a)(8)).

Furthermore, the court ordered federal injunctive protection to participants and beneficiaries because no state law may preempt federal law by depriving individuals of their constitutional rights. The Department of Health and Human Services (HHS) was ordered to revise its utilization review procedures for TennCare recipients in keeping with the Medicaid Act (42 U.S.C. § 1396 (a) (8)) ensuring due process protections for all covered beneficiaries by requiring "services are provided with 'reasonable promptness,'" (926 F. Supp. 1305).

This case is one of 543 civil suits pending in the state courts for violations of the Medicaid Act (based upon a Lexis-Nexis search performed December 26, 1996). With the passing of H.R. 3507 into public law, (The Welfare Reform Bill) private citizens will find little reprieve in the federal courts, so any attempts to hold states accountable for violations of federal law will be feeble at best (Denkeret. al., 1996).

Managed care has shown itself to be a farce of "medical management" in light of all the condemning evidence to the contrary. Timothy Icenogle, a medical doctor in the state of Arizona commented in 1981, "We play sort of an advocacy role. I think the public demands something more from physicians than to just be a blob of bureaucrats, and I think we have to take a stand now and then. Our role essentially as patient advocate, is to tell them, well, just because the insurance company is not going to pay, that is not the end of all the resources," (Icenogle, as cited in Gutmann & Thompson, 1996). Never has this statement been needed more than it is today. Unfortunately, as more insurance companies refuse to pay for medical treatment, fewer resources become available for patients in desperate need of financial assistance. As Judge Kessler eloquently stated as she handed down her decision in Salazar v. District of Columbia, No. 93-452, December 11, 1996, "behind every fact found herein is a human face and the reality of being poor in the richest nation on earth, (936 F. Supp. Slip op. At 3).

Perhaps most distressing is the lack of accountability for mismanaged healthcare and improper denials of medically necessary treatment. HMOs claim immunity under ERISA, and leaving individuals without recourse in a sea contractual language and lengthy court calendars. It is evident that individuals protected under the Medicaid Act are not fundamentally different from other populations entrapped in the maze of managed care. They are simply those who have "had their day in court."

Due Process Protections

Since all Americans are theoretically entitled to due process protections under the constitution of the United States, it seems the federal courts are long overdue for making such a public statement. We are wasting precious time and losing millions in valuable human resources as we await decisions to be handed down from state courts. The Supreme Court of the United States has agreed to hear New York's request for an ERISA (Employee Retirement Income Security Act of 1985) waiver, making health maintenance organizations liable for medical malpractice in the state of New York.

When HMOs deny care from patients, it is ludicrous to hold individual physicians liable for the utilization decisions made by decentralized corporate review boards. It is time to take a serious look at tort reform, and demand action by the Supreme Court as they approach the date of New York's ERISA hearing. A blanket court ruling upholding Daniels v. Wadley, and Salazar v. District of Columbia is desperately needed to avoid an avalanche of liability suits filed in state courts. The court must uphold Daniels v. Wadley, and Salazar v. District of Columbia if further lives are to be saved in medicine rather than wasted away in the utilization review procedures. While we wait patiently for District of Columbia circuit court to order injunctive relief, the number of individuals suffering irreparable harm due to the systematic denial of medical care grows larger each day.

The history of Medicaid Managed Care does not provide a very optimistic look into the future of TennCare recipients and Medicaid beneficiaries in states around the country. Dating back to the implementation of the Arizona Health Care Cost Containment System (AHCCCS) in 1981, there are documented cases where "people reportedly died for lack of medical treatment before their eligibility was determined," (Varley, as cited in Gutman & Thompson, I 996). This leaves me to wonder why the states continue to enroll their most vulnerable populations into a system of managed care that has proven to be a disaster.

Perhaps worthy of comment is that Arizona is the only state to have voted Republican in every election since 1948—certainly provides insight into the conservative morale of the state. Although Arizona was the last state to accept the Medicaid cost sharing incentive proposed by the federal government in 1966, it was the first state to force its medically indigent population into managed care in 1981.

Violating Federal Law

Rigid pre-certification requirements and nonspecific utilization review procedures place strategic barriers to access medical treatment and services in Health Maintenance Organizations (HMOs). Pre-certification requirements are strategic barriers incorporated into the "black box" of utilization review that institutionalizes exclusionary waiting periods and routine denials of medically necessary treatment. According to federal law, "care and services are to be provided in a manner consistent with the simplicity of administration and the best interests of recipients," (42 U.S.C. § I 396a (a) (19)). Clearly, such rigid pre-certification requirements that complicate administrative processing and paperwork on the part of the enrolled beneficiaries is a violation of United States Code.

Furthermore, using primary care providers as a mechanism to limit access to specialists not only complicates administrative processing, but limits enrolled beneficiaries choice of health professionals beyond what is available to the general public in the geographic area (42 U.S.C. § 1 396a (a)(30)(A)). Certainly referral procedures do not "assure that recipients will have their choice of health professionals within the plan to the extent possible and appropriate," (42 U.S.C. § 434.29). Under this provision, it seems that any individual, especially those with chronic health conditions or disabilities should be allowed

Original Page: https://my.barackobama.com/page/community/post/elyssadurant/gGMP3Q