The Impact Advisor Q1 2022

The Impact Advisor Q1 2022

The Impact Advisor - Impact Advisors' Quarterly eNewsletter

The Impact Advisor newsletter is focused on the latest healthcare topics, trends, and disruptors. Subscribe now so we can continue to share our industry insights and thought leadership with you.


View Back Issues

February 2022


According to the “2022 State of the Industry Survey” from Healthcare Innovation, “the COVID-19 pandemic has jumbled a lot of predictions that industry analysts had been making regarding the advancement of value-based and especially risk-based contracting.”  Although the article cites “mixed news on the value-based delivery and payment front,” it is worth noting that overall, more respondents “are participating in some sort of value-based program” than last year.  Additionally, the percentage of respondents who indicated that more than 15% of their organization’s revenue comes from downside risk contracts was roughly double the percentage from last year’s survey (16% in 2022 vs. 8% in 2021).  See chart below (created by Impact Advisors based on data cited in the article).

Source: Adapted from data in “Doors to the Future: 2022 State of the Industry Survey,” Healthcare Innovation, Jan 14, 2022

Why It Matters:

We think these excellent comments in the article from Impact Advisors’ very own John Klare sum things up perfectly on the risk-based contracting front.  Per John: “That data [from the survey] suggests that the relative amount of risk that providers are taking on is increasing; that makes sense to me.  A broader construct that’s interesting is that my gut sense tells me that there are advantages and disadvantages in taking on partial risk. The advantage is you reduce the downside risk exposure, but the disadvantage is that it’s hard to hold onto the benefits… so I think that providers should consider full-risk contracts. I think if they keep taking partial risk, over time, you can’t win that game with payers. Whereas if you take full risk and keep the contracts aligned and are able to perform well, you can gain the advantage. There are benefits in taking full risk in certain markets.”


The last few months have dramatically underscored the impact of rapidly evolving cyber threats – and information security vulnerabilities – in healthcare.  In mid-December, a ransomware attack on Ultimate Kronos Group “disrupted payroll for thousands of employers.”  According to a recent article from NPR, the outage impacted a total of “about 8 million employees” across all industries, but “health care employers [were] hit particularly hard,” with the outage serving as “an unneeded administrative nightmare timed precisely as the omicron surge [was] hitting hospitals.”  Also in December of last year (but unrelated to the cyberattack on Kronos), researchers disclosed “critical vulnerabilities” in the Log4j logging tool.  Per a recent guide from HHS, “Log4j is a Java-based, ubiquitous logging tool now known to have multiple vulnerabilities, including multiple remote code execution flaws that can provide an attacker total control of a system.”  While HHS notes that there had not been any major compromises in healthcare at the time when their Log4j guide was published (1/20/22), the agency warns that “the health sector remains highly vulnerable, as do other industries.”

Top 20 Countries with Most Log4j Exploit Attempts

Image source: “Log4j Vulnerabilities and the Health Sector,” HHS, Jan 20, 2022

Why It Matters:

The recent news serves as an important reminder that cybercriminals are not just trying to infiltrate hospitals and health systems directly; they are also gaining access to health delivery organizations by targeting providers’ business partners.  It is obviously paramount that hospitals and health systems continue to make their own information security a top priority, but it is also critical for health delivery organizations to evaluate the security posture of their vendors and trading partners as well.  However, there is no way to ensure complete and total protection against ransomware and other cyber threats – and no provider organization or any third-party vendor is immune.  For this reason, incident response and business continuity plans in the event of a ransomware attack are critical.  Providers can (and should) try to get assurances that their vendors have proper incident response and business continuity controls in place if an outage occurs due to a ransomware attack – but that alone isn’t enough.  Health delivery organizations still need to take it upon themselves to prepare for the worst-case scenario of any key system becoming encrypted by cybercriminals, regardless of whether the provider owns the product and controls the environment, or whether the provider subscribes to a cloud-based solution that is centrally hosted and managed by a third party.  In other words, successful incident response and business continuity planning starts at home.  It isn’t enough just to ask vendors “what is your plan” to respond to an outage from a ransomware attack or to address a newly discovered information security vulnerability; hospitals and health systems need to be able to answer “what is our plan” as well.

Related Reading
Can healthcare improve third-party vendor security, business continuity?
Incident Response – Are you Prepared for a Security Event? Scottsdale Institute Webinar


According to the latest M&A report from Kaufman Hall, “throughout 2021, there was one consistent trend in partnership, merger, and acquisition transactions between hospitals and health systems: the number of transactions was down, but the size of transactions was up.”  More than 16% of the deals announced in 2021 were “mega mergers,” which Kaufman Hall notes is the largest percentage “in the last six years” – and “almost double the percentage (8.9%) in 2020.”

Number of Hospital and Health System M&A Transactions, 2000-2021

Data sources: Adapted from “2021 M&A Year in Review,” Kaufman Hall (Jan 2022) and “2017 M&A in Review,” Kaufman Hall (Jan 2018)

Percentage of “Mega Mergers” – i.e., “Announced Transactions in Which Seller’s (Smaller Party’s) Annual Revenue Exceeded $1B,” 2016-2021

Image source: “2021 M&A Year in Review,” Kaufman Hall, Jan 10, 2022

Why It Matters:

It is important to note that the increased size of hospital and health system M&A events of late translates into more complexity in terms of the organizations involved being able to identify and realize value from the transaction.  Even with higher complexity due to a larger percentage of “mega mergers” – and despite the increased scrutiny that hospital consolidation is receiving from the federal government – M&A activity is still certain to continue.  In fact, because of the additional complexity, consolidation has become a significant focal point to achieve opportunities, with other strategies such as new construction and joint ventures now becoming more prevalent as well.  For any hospital or health system specifically considering an M&A event, the ability to effectively – and realistically – identify the value from bringing the two organizations together is critical.  That process goes beyond just assessing how well the two organizations’ services and patient populations complement each other.  The combined go-forward organization also needs to meticulously evaluate current business process, payer mix, and financial performance to identify where economies of scale are achievable.  Actually achieving those economies of scale is by no means a forgone conclusion though.  From a revenue cycle perspective alone, there are a wide range of elements that need to be carefully and deliberately consolidated and standardized (such as CDMs, payer contracts, tax IDs, forgiveness and write-off policies, etc.) in order for the two organizations to truly operate as a single integrated entity.  The time and resources required for those initiatives can be significant.  Every deal will obviously be different, but the bottom line is that hospitals and health systems need to have a well-defined path for operationalizing the necessary business changes in order to realize any performance value from a merger or acquisition.


At the company’s 2021 “Investor Day” event in December, CVS Health announced plans to expand further into traditional primary care – and health delivery overall – which will include launching new physician-led CVS primary care clinics.  Per a recent article from Healthcare Dive following CVS Health’s Q4 earnings call: “The retail pharmacy giant in November announced it was creating new health-focused store formats, along with closing roughly 900 locations between 2022 and 2024, to meet shifting consumer demand as it moves from a more episodic to longitudinal care approach. Those new formats include physician-led primary care clinics to serve as the ‘quarterback’ of patients’ care, along with enhanced HealthHUBs for specific lower-risk use cases and pharmacies to provide ancillary services, like next-best action plans.”

Image source: 2021 Investor Day Presentation, CVS Health, Dec 9, 2021

Image source: 2021 Investor Day Presentation, CVS Health, Dec 9, 2021

Why It Matters:

CVS Health’s aggressive efforts to expand further into traditional primary care – and health delivery overall – is obviously major news given the company’s unique assets and strong brand name recognition with consumers.  To us though, the key takeaway isn’t whether this latest initiative ultimately gains traction.  Rather, we think the importance of the announcement is that it clearly underscores the continued willingness – and ability – of nontraditional competitors (whether CVS Health, Walgreens, Walmart, or others) to quickly pivot and embrace bold changes in order to capitalize on perceived opportunities in health delivery.  Providers should fully expect that trend to continue, regardless of the success or failure of any individual near-term initiative or announcement from one of those firms.


On December 20, 2021, Oracle and Cerner “jointly announced an agreement for Oracle to acquire Cerner through an all-cash tender offer for $95.00 per share, or approximately $28.3 billion in equity value.”  Per comments from Oracle in the press release, “with this acquisition, Oracle’s corporate mission expands to assume the responsibility to provide our overworked medical professionals with a new generation of easier-to-use digital tools that enable access to information via a hands-free voice interface to secure cloud applications.”  Oracle’s announcement adds that “Cerner will be a huge additional revenue growth engine for years to come as we expand its business into many more countries throughout the world.”  According to this interesting analysis from Chilmark Research though, “it remains to be seen how Oracle will treat Cerner going forward, as they have set up Cerner as a stand-alone division within Oracle that may provide some autonomy.”  The article from Chilmark also hypothesizes that “the acquisition will not accelerate the move to cloud for Cerner; if anything, this will disrupt advances to date” – with Chilmark citing Cerner’s existing contract with AWS as a hurdle (among other factors).

Why It Matters:

The deal is major news given the two companies involved and the price tag alone.  The long-term implications of this acquisition (both in the U.S. and abroad) will certainly be interesting to keep an eye on in the coming years, but despite the headlines and premature speculation that the announcement generated, the reality is that in the near-term, Oracle buying Cerner will likely have only a minimal impact (at best) on most hospitals and health systems in the United States.  It is clear from the initial announcement that Oracle sees this acquisition (in part) as a catalyst for more international growth – and that will definitely be a key area to watch.  It is also worth noting that there has been a lot of attention about Oracle’s plans to “modernize Cerner’s systems” by migrating them to Oracle’s Gen2 Cloud and to make “Oracle’s hands-free Voice Digital Assistant the primary interface to Cerner’s clinical systems.”  Despite the potential benefits of those developments in the future though, change on that kind of scale is easier said than done.  Changes of that magnitude will require significant time, resources, and organizational commitment from Oracle – especially given Cerner’s complex product suite and large, diverse client base.   


Timothy Lehmann, Principal

Question: How can our organization extend our analytics program to support the Social Determinants of Health and improve outcomes?


From U.S. Department of Health and Human Services, the Social Determinants of health (SDOH) are:
1. Economic Stability
2. Education Access and Quality
3. Health Care Access and Quality
4. Neighborhood and Built Environment
5. Social and Community Context

When I was a population health committee member for a health care system in Loma Linda, California, we had a guest speaker who was a pediatrician and researcher who saw firsthand the impact of the SDOH. Interstate 10 was the only thing dividing the communities of Loma Linda and San Bernadino, yet the life expectancy of residents in Loma Linda was 10 years higher than the national average while residents in San Bernardino were living well below that average. The researcher’s main point was “It’s not your genetic code but your zip code that best determines your life expectancy”. Understanding this variation and the data collection needed to support a team focused on SDOH requires an analytics program to align with the goals for improved outcomes. To identify the most at risk populations and prescribe what is needed for the communities served, organizations must commit to internal collaboration and utilizing analytics to support this program.

The three keys to extending analytics for SDOH revolve around People, Process, and Technology.

People: Extending or creating a governance program that is focused on SDOH is key. Members of this work group should include:

1. An existing population health leadership team that includes clinician champions
2. Case management
3. Analytics joined at the hip with the EHR application team
4. Finance
5. Quality / patient safety
6. Patient transport

Each of these members represent key groups that have expertise in the data domains or processes that control how data is collected and analyzed. Key goals of this work group are to 1) collaborate to ensure roadblocks are removed for data collection and 2) proactively manage data quality.

Process: A key goal of governance is to streamline the process to initiate or alter workflows to capture the data needed to identify at risk populations tied to the factors of SDOH. Resources are assigned from the application and analytics team to review, design, and implement data collection and then publish data for the analysts and clinical teams to use and measure improvements over time. Establishing a baseline and outcome improvements is key and quality teams should have expertise in establishing and utilizing existing metrics.

Technology: Finally, the key to extending an analytics program for SDOH should be focused on data integration and data quality management. Different systems and opportunities to identify your at-risk members starts when the patient arrives and is registered. Work streams and other instruments must be altered or developed to be tailored to capture data or flag a member for follow up. This requires a pragmatic approach with a robust analytics architecture to support integration and data streaming and advanced analytics to develop algorithms that blend demographic data, real time patient clinical data, and financial data. Data quality management is another key capability that is focused on master data management and reference data management to ensure data between the different systems is usable and maintainable. The initial steps are small but a long-term vision to implement fully over two to three years is the right mindset.

Blending the right People, Process, and Technology will allow the full capture of data and analysis that can address identifying patients at risk for not showing for appointments, in need of financial assistance, access to education programs, or proactive interventions with improved nutrition. Your strategic planning and marketing teams can use the information to implement mobile health care units or select optimum locations for community clinics. With the right data, the possibilities for improvements are endless.


Upcoming Events
3/1 – Simplify Your Data Analytics: Insights from Lee Health – Scottsdale Institute webinar
3/10 – Supply Chain and Revenue Cycle Virtual Briefing – Modern Healthcare webinar

Change Management: Techniques to Drive Enablement in Your Organization
Transforming Your Physician Enterprise – 5 Key Drivers
What Value Does an Epic Support Desk Bring?
An Epic Community Connect Program: M&A Without the A
Electronic Health Information (EHI) Made Simple
TEFCA: Framework and Common Agreement Version 1 Released

Impact Advisors Receives 24th Best in KLAS® Distinction in 15 Years