Jay Radcliffe breaks into medical devices for a living, testing for vulnerabilities as a security researcher.

He’s also a diabetic, and gives himself insulin injections instead of relying on an automated insulin pump, which he says could be hacked.

“I’d rather stab myself six times a day with a needle and syringe,” Radcliffe recently told security experts meeting near Washington, D.C. “At this point, those devices are not up to standard.”

Concern about the vulnerability of medical devices like insulin pumps, defibrillators, fetal monitors and scanners is growing as health care facilities increasingly rely on devices that connect with each other, with hospital medical record systems and —directly or not — with the Internet.

Radcliffe made headlines in 2011 by showing a hackers’ convention how he could exploit a vulnerability in his insulin pump that might enable an attacker to manipulate the amount of insulin pumped to produce a potentially fatal reaction. Now he talks about going without a pump to raise awareness about the potential for security lapses and the need for better engineering.

While there have been no confirmed reports of cyber criminals  gaining access to a medical device and harming patients, the Department of Homeland Security is investigating potential vulnerabilities in about two dozen devices, according to a Reuters report. Hollywood has already spun worst-case scenarios, including a 2012 episode in the Homeland series portraying a plot to kill the vice president by manipulating his pacemaker.

“The good news is, we haven’t seen actual active threats or deliberate attempts against medical devices yet,” said Kevin Fu, a University of Michigan researcher who has made his career testing the vulnerability of medical systems.

The bad news is that hospital medical devices may be vulnerable to hackers simply because they can be the weak link that gives a criminal access to a hospital’s data system — especially if the devices haven’t been updated with the latest security patches, said Ken Hoyme, a scientist at Adventium Labs, a cybersecurity firm in Minneapolis.

In the real world, he said, a hacker is more likely interested in stealing records he can sell than in harming a patient.

“There are not that many bad…guys whose goal in life is to go and randomly mess with patients in hospitals,” Hoyme said. “They want money, not to shut off the ventilator of a particular patient.”

Hospitals are targets because they collect so much data, from patients’ Social Security numbers and financial information, to diagnosis codes and health insurance policy numbers.

Radcliffe estimates that medical identity information is worth 10 times more than credit card information —about $5 to $10 per record on the black market compared to 50 cents per account for credit card information.

Crooks can use it to apply for credit, file fake claims with insurers or buy drugs and medical equipment that can be resold.

And unlike the victims of credit card theft, those with stolen medical identities might not know for months or even years, giving the thieves more time to use their information.

New FDA Guidelines

Yet there are few cybersecurity standards for medical devices.

In October, the FDA issued guidance outlining what security features developers should bake into their products when seeking approval for a new device.

The guidelines, which aren’t binding, say that when seeking approval for a new device, manufacturers should detail cybersecurity threats they considered and create better ways to detect when it might have been hacked.

They should also build in protections, such as limiting access to authorized users and restricting software updates only to products with authenticated coding.

While a good start, some security experts say the guidelines should be binding. Others fear that giving them the force of regulation could be more harmful because they would become outdated quickly.

Nonetheless, the FDA’s guidance has, in effect, changed the conversation among device makers from, “‘Do I believe this is a real threat?’ to ‘What do I have to do to satisfy the FDA?’” said Hoyme.

By the end of the year, the agency is expected to issue similar recommendations for devices already on the market.

Common Vulnerabilities

One reason many existing devices might be vulnerable is they run on defunct operating systems like Windows XP, which Microsoft stopped supporting in April, meaning there won’t be any new security patches. Other, newer devices may have built-in passwords that are difficult to update. Gaining access to them can be fairly easy which could make them more vulnerable to attack, researchers say. In addition, sometimes, a password is intentionally disabled so it’s easily accessible to medical staff in an emergency.

Hackers can also get into some inadequately protected hospital systems when staff members click on links in emails, not knowing they contain malicious code. Once transmitted to a hospital’s intranet, that malware could find its way into unprotected device software and cause malfunctions, said Hoyme and Fu.

“If cyber criminals decide they can hack into a device to get health records, they won’t think about whether they’re messing with device performance: They’re going after the money,” Hoyme said.

Security experts warn that some of the same design flaws that make medical devices vulnerable would also make breaches hard to track.

“If your iPhone is compromised, it’s a lot more straightforward for someone to determine if it’s been tampered with. We’re not there yet” with medical devices, said Billy Rios, a former Google software engineer turned security consultant.

He describes how he was able to buy a secondhand EKG machine, used to measure the heart’s electrical activity, for just $25 online. Some infusion pumps and patient monitoring systems go for less than $100. That makes devices more readily available to those who want to figure out vulnerabilities to exploit.

“The effort required is so much lower,” he says. “That’s not a good position to be in.”

What Hospitals Are Doing

Hospitals are loathe to talk about device security publicly, but many are working to ensure their systems are stronger.

In a two-year test of information security, experts working for Essentia, a large Midwestern health system, found that many devices were hackable. For instance, they found settings on drug infusion pumps could be altered remotely to give patients incorrect doses, defibrillators could be manipulated to deliver random shocks and that medical records could be changed.

Stephen Curran, acting director of the Division of Resilience and Infrastructure Coordination with the Department of Health and Human Services, could not say how many facilities have a chief security officer or someone in charge of cybersecurity.  But even small facilities have some relatively simple options for boosting the security of devices on their networks, he said, including “routine backups and patching of the systems and the use of anti-virus firewalls.”

Still, while “we definitely see a trend in hospitals to improve their security,” says Mike Ahmadi, global director of critical systems security at cybersecurity firm Codenomicon, vendors have to do more to engineer security.

“The bigger issue is that vendors are not held accountable for writing insecure code,” says researcher Rios. “There’s no incentive…so they don’t invest.”

Pressure On Vendors

A few hospitals, including the Mayo Clinic, have started to write security requirements into their procurement contracts.

At the University of Texas MD Anderson Cancer Center in Houston, any new software application has to be approved by the hospital’s security team, headed by Lessley Stoltenberg, chief information security officer.

He says device makers also will have to meet a slew of security requirements: Can the device be encrypted?  Is there a unique identification for users? If the vendor is hosting the device, what does their system look like in terms of firewalls and other protections? Will the manufacturer provide up-to-date security patches?

Some companies, like Ahmadi’s Codenomicon, specialize in selling software to detect software bugs that could lead to security holes.

While Codenomicon has a number of device makers as customers, those are a fraction of the more than 6,500 medical device manufacturers in the U.S., some of which may not be doing even the most basic testing. Most vendors are small — 80 percent have fewer than 50 employees — and many are startups without the capital to invest in a security expert.

So, could hackers target infusion pumps or ventilators?

“Is it possible?” Stoltenberg mused. “Yes. Is it likely? No.  No device in the world is absolutely 100 percent secure.”

Kaiser Health News (KHN) is a national health policy news service. It is an editorially independent program of the Henry J. Kaiser Family Foundation.

Earlier this month, Arizona voters approved a referendum that allows terminally ill patients to receive experimental drugs and devices. It’s the fifth state to approve a “right-to-try” law this year.

Supporters say the laws give dying patients faster access to potentially life-saving therapies than the Food and Drug Administration’s existing “expanded-access” program, often referred to as “compassionate use.” But critics charge they’re feel-good laws that don’t address some of the real reasons patients may not receive experimental treatments.

The legislatures in Colorado, Louisiana, Michigan and Missouri also passed right-to-try laws this year as part of a nationwide effort spearheaded by the conservative Goldwater Institute, which hopes to get right-to-try laws on the books in all 50 states. The measures generally permit a patient to get access to an experimental drug after it’s passed through phase 1 of a clinical trial, the initial testing in which a drug is given to a small group of people to evaluate its safety and side effects.

“For people with terminal illness, for whom nothing else has proved effective, they don’t have the luxury of waiting four to five months to get through the FDA’s compassionate-use program,” says Victor Riches, vice president of external affairs at the Goldwater Institute. Riches says that timeframe includes a lengthy application by the patient’s physician, FDA review and approval of the request and a federally required review by an institutional review board, a group of medical experts that evaluates the risks and ensures the patient understands them as well.

Between 2009 and 2013, the FDA received roughly 1,000 expanded-access applications annually and approved virtually all of them. Among other things, the FDA considers the severity of the patient’s condition and whether other avenues of treatment have been exhausted. Some patient advocates and policy experts say that while the FDA process could be sped up, they support the agency’s continued oversight because of its critical role in ensuring drug safety and effectiveness.

But even if the FDA approves a request for an experimental drug, the patient might not get it. Drug companies are not obligated to provide the drug to patients who request it.

Right-to-try laws are no different.

“We take a free market approach to problem solving, and we would never mandate that the drug companies provide these medications,” says Riches.

Without any assurance of access to an experimental drug or device, and with no financial support to help patients cover the costs, right-to-try laws give patients false hope, say critics of the laws.

“There’s no money in these laws, and no provision for companies to supply anything,” says Arthur Caplan, director of the division of medical ethics at New York University’s Langone Medical Center’s Department of Population Health. Caplan has been a vocal critic of right-to-try laws.

In addition to the cost of the drug, if the drug company doesn’t cover it, patient advocates say expenses can be a significant burden on people who have to travel to get access to an experimental drug.

“It’s a big issue for patients with rare diseases,” says Diane Dorman, vice president of public policy at the National Organization for Rare Disorders. NORD has historically been supportive of the FDA expanded-access program. It doesn’t take a position on right-to-try laws.

The degree to which insurers cover drugs and medical services under FDA’s expanded-access program varies, say health policy experts. According to the FDA website, some companies charge patients for the experimental drug, and medical services may or may not be covered.

The right-to-try model legislation developed by the Goldwater Institute explicitly states that insurers are not required to cover the costs of either the drug or device, or other services related to its use.

In addition to questioning whether right-to-try laws will make any meaningful difference in ill patients lives—Riches says he’s unaware of any patients who have taken advantage of the laws to date—critics voice a broader concern about the potential impact on the drug development process.

The decision by drug companies whether to provide a drug to one very sick individual is wrenching. How do they balance the needs of that person against the potential to introduce the drug to a broader patient population? Terminally ill individuals who receive experimental drugs may well suffer serious adverse events, potentially setting back the drug approval process.

“The concern is that these laws don’t really address the risks to the companies,” says Brenda Huneycutt, a director of regulatory strategy and FDA policy at Avalere Health, a research and consulting firm.

In addition, if more people get access to drugs through right-to-try laws, they may be less likely to participate in the clinical trials that are essential to new drug development, say experts. Why risk being given a placebo when patients can be assured of getting the drug under a right-to-try law?

“For us, the most important thing is that the clinical trial process remains robust so products can be approved most quickly,” says Dorman.

Please contact Kaiser Health News to send comments or ideas for future topics for the Insuring Your Health column.

Kaiser Health News (KHN) is a national health policy news service. It is an editorially independent program of the Henry J. Kaiser Family Foundation.

When it comes to expanding health coverage to its poorest residents, California could be taking two steps forward and one step back.

Even as the state celebrates its enrollment of more than 2.7 million low-income Californians in Medi-Cal in 2014, it may drop an unusually high number of beneficiaries from its rolls by year’s end.

That is because Medicaid eligibility standards relating to income and household size changed under the Affordable Care Act, forcing the 8.6 million people who had been on the program before Jan. 1 to apply under the new rules. (Medi-Cal is California’s version of the federal Medicaid program.)

Beneficiaries always have to renew their coverage annually, and there is always some churn in enrollment as people’s circumstances change. But this year, the forms asked for a host of new information, and many more people than usual haven’t responded, according to state officials, county welfare directors and advocates.

In past years, depending on the county, about 20 to 40 percent of Medi-Cal beneficiaries do not renew their coverage. But this year, the numbers are running as high as 50 percent in some counties, according to state Health Care Services Director Toby Douglas. Los Angeles County reported 38 percent hadn’t returned applications sent in August, compared to 15 to 20 percent in previous years.

Although the state isn’t yet giving out estimates, advocates say this reduced response rate could translate into as many as a million or more additional people cut from the Medi-Cal rolls this year.

On Monday, the Western Center on Law & Poverty, along with several other advocacy groups, sued the California Department of Health Care Services in Alameda Superior Court, charging that Medi-Cal beneficiaries are being unfairly dropped from coverage. The groups are also applying for a temporary restraining order to stop the state from canceling coverage for Medi-Cal recipients who haven’t been properly notified.

The problem is coming to a head now in part because the state granted people a six-month grace period past their usual renewal dates to re-enroll. In November and December, many of the renewals are coming due – and those who don’t respond are being told they will be cut off.

“A lot of people will be getting a notice right before Thanksgiving telling them that they’re losing their Medi-Cal,” says Jen Flory, a senior attorney at the Western Center on Law & Poverty. “Our concern is that a lot of them don’t really understand what’s going on and haven’t had an opportunity to provide the adequate information.”

Recipients who do not return their packets and receive a termination can be reinstated if they send in their information within 90 days.

The California Department of Health Care Services declined to comment on the lawsuit. Before the suit was filed, Rene Mollow, deputy director of healthcare benefits and eligibility at the health services department, said that renewing Medi-Cal benefits “was always a very involved process.” This year, the department was under a compressed timeline to develop the new forms but worked to make the forms as simple as possible, she said. Next year’s form should be easier to use, she added.

“We do have remedies in place where people can come back into coverage,” said Morrow. “2014 was a year of change. Our goal here is to continue working with our counties and beneficiaries to make sure the people who are eligible retain coverage.”

Consumers can seek help by phone or at their local health department office, and the forms provide a number to call if the recipient speaks another language, Morrow said.

The California Department of Health Care Services sent everyone who needed to renew the necessary application in the mail, but advocates like Flory say people have struggled to complete it. The form is complicated, asks for information the recipients hadn’t provided in the past and is available only in English and Spanish.

“There’s a lot of confusion, and it’s a language access issue,” said Connie Lo, health programs coordinator at Asian Americans Advancing Justice Los Angeles. “Most of our clients are limited English proficiency. They don’t even know what these packets are for and why they’re receiving so many documents together that they can’t even read.”

“There’s going to be a lot of people who lose coverage. That’s bad for them, but it’s also bad for the medical program and trust in DHCS,” Lo said. “We had this big push to get people enrolled in health insurance this year, and now we’re just terminating people.”

Language isn’t the only barrier, advocates said.

“It’s a very confusing form even in English, and it looks very different from what it looks in past years,” said Cori Racela, a staff attorney at Neighborhood Legal Services of Los Angeles County, which runs a consumer helpline. “We believe it’s very burdensome to consumers.”

Flory said she doesn’t think the terminations are an accident. “When people fail to jump through these hoops to stay on the program, the state saves money,” she said.

The population who were already on Medi-Cal before Jan. 1 is a lot more expensive for the state to cover, she said. The federal government pays only half of their health care costs, compared to 100 percent of the costs for those who qualify under the ACA’s broader eligibility guidelines.

Some counties have been doing additional outreach this year to help people with previous Medi-Cal coverage renew in time. San Mateo County Health System director Iliana Rodriguez says the county has been working with health plans to call recipients, make robo calls in their primary languages and send out additional reminders.

“We’re leaving no stone unturned in terms of getting them in the door,” says Rodriguez, who adds that San Mateo is on track to hit about a 76 percent rate for Medi-Cal renewals this year.

Blue Shield of California Foundation helps support KHN coverage of California.

Kaiser Health News (KHN) is a national health policy news service. It is an editorially independent program of the Henry J. Kaiser Family Foundation.

A Los Angeles furniture store worker who had never had health insurance enrolled in a plan for $75 a month that will cover both him and his son.

An unemployed accountant in Charlotte, N.C., who tried and failed to sign up last year found coverage for $11.75 a month.

A self-employed house contractor from West Palm Beach, Fla., found a health plan that will cost him nothing.

They were among more than 100,000 Americans who signed up for coverage Saturday through the Affordable Care Act’s online insurance exchanges, which launched this weekend with far fewer problems and less fanfare than last year. Many people qualified for federal subsidies that kept their monthly premiums well under $100.

“The vast majority of people coming to the site were able to get on and do what they were intending to do,” Health and Human Services Secretary Sylva Burwell said Sunday on NBC’s Meet The Press, adding that 500,000 people had signed onto the website.

By most accounts, the federal marketplace that handles enrollment for 37 states ran smoothly — a far cry from last year’s disastrous rollout that turned www.healthcare.gov into an embarrassment for President Barack Obama, spurred several staff departures and made the site virtually unusable for two months.

State exchanges that had encountered big problems last year — including Maryland, Massachusetts and Hawaii—all reported no major issues this weekend.

Still, there were some hiccups, with consumers and enrollment counselors facing sporadic delays accessing the website to set up an account and buy coverage. Some of those who bought coverage last year had trouble getting into their accounts because they had forgotten their passwords.

Meanwhile, the insurance exchanges run by 13 states and the District of Columbia functioned well — with the exception of the one in Washington state, which was shut down Saturday because it was giving out incorrect subsidy information. The site was fixed and back online Sunday morning.

To give consumers assistance, enrollment events were held across the country over the weekend, at hospitals, clinics, churches, community centers, malls, libraries – even at the Rock and Roll Hall of Fame in Cleveland.

“It was awesome,” said Joy Floyd after she got help buying a plan for $11.75 a month at the Children and Family Services Center in Charlotte, N.C. She had tried and failed to sign up for coverage last year because of website problems.

Like most enrollees, Floyd will face additional cost-sharing as a result of deductibles and co-pays when she sees doctors, gets tests or buys prescriptions.

Uncertainties Ahead

Despite this year’s far smoother opening, the enrollment process continues to face plenty of uncertainties, including the response of a confused and still uninformed public, among them 20 million uninsured who did not enroll the first year; a shorter enrollment period and premium increases that many of the 7 million people who bought coverage last year will face unless they shop around.

Recent political and legal developments also cast a shadow, including a hostile GOP taking control of Congress in January and the Supreme Court’s decision to hear a challenge to the subsidies that millions of people have relied upon to reduce the cost of their coverage.

Ricot Telcy, 37, a West Palm Beach, Fla., security guard, knew nothing about the legal challenge, but was pleased to learn he and his wife could get coverage for about $300 a month—about the same price his wife had been paying for herself.

Across town, at an event at a medical society office, Rick Pierre, 40, enrolled in about an hour in a plan that will cost him nothing in premiums because he qualifies for a large subsidy. “I’m very excited,” he said.

The Obama administration expects about 9 million people to get coverage on the exchanges before open enrollment ends Feb. 15. The marketplaces are a cornerstone of the health law because they help expand health coverage to millions of Americans who do not get health coverage at their jobs. More than eight in 10 people buying policies last year received a government subsidy to lower their premiums.

People must enroll by Dec. 15 if they want their coverage to start in January. In most states, those who bought coverage last year will be re-enrolled automatically if they do nothing by that date – a scenario that could result in higher costs since most premiums and benefits are changing.

The exchanges and the publicity around them also spurred millions of people to sign up for Medicaid, which has expanded eligibility under the health law in 27 states.

Some Wrestle With Higher Premiums, Confusion

In Philadelphia, Joseph Krakauskas, a retired 62-year-old, showed up two hours early at an enrollment event to secure a place at the front of the line. He has just found out that his current premiums were going to triple next year and he needed help finding a new plan. “This is almost like a bait and switch,” he said of the rate increase. “I can’t believe they’re getting away with this.”

Krakauskas wasn’t able to access his account through the website, however. Still, a counselor found him an HMO plan for $128 a month, higher than he was paying last year, but about half of what his old plan would cost in 2015.

Despite the government’s efforts to streamline the application, confusion and difficulty navigating the website also brought in many people, including Sarah White of Philadelphia, a mother of two.

“I have a doctoral degree,” she said. “The fact that this is so complicated for even someone with [her education] is ridiculous. But here I am trying to get help and I have hope.”

Demand for coverage was particularly high in California, where 1.2 million residents signed up for coverage last year.

By 9 a.m. Saturday, dozens had lined up for a festive enrollment event in Los Angeles sponsored by SEIU-United Healthcare Workers West. Most of the applicants came prepared – holding envelopes with pay stubs, birth certificates and Social Security cards. As each finished signing up, volunteers cheered, applauded and snapped photos.

Alejandro Irigoyen, 45, said he missed the deadline last year and didn’t want to risk doing that again. When he injured his foot recently, he paid about $500 for a doctor’s visit, X-rays and medicine. With the help of an enrollment counselor, Irigoyen signed up for a plan which will cover both him and his 23-year-old son for about $75 a month.

“I feel much more secure,” Irigoyen said.

The enrollment event took place in a heavily Latino neighborhood, and most of the counselors spoke Spanish. California exchange officials had been heavily criticized last year for not doing enough to reach out to the state’s large Latino population. Several of the families at Saturday’s event said they hadn’t previously enrolled in coverage because they have family members who are in the country illegally and feared telling the government too much.

After being reassured their information wouldn’t be given to immigration authorities, Crescencio Lorenzo, 48, a legal resident, came to the enrollment event with his daughter, Andrea, a U.S. citizen, and his wife, Susana Lorenzo, 48, who is in the country illegally. He and his daughter enrolled in Medicaid. “They told us not to worry,” about jeopardizing his wife, he said.

Weather And Glitches Are Issues In Ohio, Washington

Some enrollment events failed to draw consumers, including the “Rock Enroll” event at Cleveland’s Rock and Roll Hall of Fame. Officials blamed snow flurries. By mid-afternoon, Barb Wynveen, a navigator with the Carmella Rose Health Foundation, said she’d had no walk-ins, and all of her half-dozen scheduled appointments had been a bust.

There was more foot traffic at Northeast Ohio Neighborhood Health Services, a clinic primarily serving the poor. Counselor Khalil Ismail met with Prempal Kaur, a woman in her 50s who spoke mostly Punjabi, and her daughter, Ravinder Kaur, who translated.

“She’s a citizen. She’s a widow, a single mother,” explained Ravinda Kaur, who had traveled from Chicago to help her mother apply for insurance coverage. “And she works at the Convenient Food Mart, where she makes minimum wage.”

Before she left, Prempal Kaur was enrolled in Medicaid.

In Washington state, meanwhile, the shutdown of the website to fix a glitch led people to start filling out applications the old-fashioned way — with paper and pen.

“It’s incredibly frustrating,” said Gary Zablocki, a 51-year-old carpenter at an event at the Southcenter Mall in Tukwila, a Seattle suburb.

Joanna Richards at WCPN in Cleveland , Elana Gordon at WHYY in Philadelphia, Ann Doss Helms at The Charlotte Observer, Nick Nehamas at The Miami Herald, Lisa Stiffler and Patrick Marshall at The Seattle Times, Jordan Shapiro at the St. Louis Post-Dispatch, Wes Venteicher at The Chicago Tribune and Robert Calandra at The Philadelphia Inquirer also contributed.

Kaiser Health News (KHN) is a national health policy news service. It is an editorially independent program of the Henry J. Kaiser Family Foundation.

As Americans begin shopping again for health insurance under the Affordable Care Act on Saturday, they’ll be wrangling with premiums, deductibles, out-of-pocket costs and other vague and confusing insurance-speak.

Believe it or not, that’s the easy part compared to figuring out what the overall cost of health care is.

Sal Morales of Miami bought insurance in March during the ACA’s first enrollment period on healthcare.gov.

“I got my cards and it was like amazing,” Morales says, “like if I got an American Express Platinum card. That’s how I felt.”

Morales was unemployed at the time. Money was tight. And he knew he needed regular doctor visits to manage his high blood pressure. He diligently researched what he would get for the price before settling on a plan.

“Instead of me paying $560 [a month] for COBRA, I found out that I would have insurance for $145. I have a network deductible of $500,” Morales says. “My first three visits to a primary care physician, they’re zero dollars. Then it’s $5 out of my pocket.”

Morales understands his end of the health care equation, but what he sees doesn’t necessarily reflect what gets paid to doctors and hospitals for his care, says Bruce Rueben, president of the Florida Hospital Association.

Here’s how he breaks it down: “There’s one party, the hospital who provides the service. There’s a second party, the patient, who receives the service. And there’s a third party, the insurance, who pays for the service.”

That third part is where health care pricing gets really squirrelly.

Every hospital has its own “master list” of charges for different services. Those charges are different from hospital to hospital.

But insurance companies don’t pay those listed charges. The listed charges are almost fiction. Instead, each insurer negotiates for lower prices with each hospital and doctor on every plan. And insurers can have multiple plans with multiple agreements for the same hospitals or doctors.

Even if two patients have the same insurer, if their plans are different, the insurer may pay the doctor differently for the same care for each of the patients.

All of this means there are about as many pricetags for that hypertension checkup as there are insurers and providers.

“For an individual consumer I am completely sympathetic that it’s very confusing,” says Dr. Ezekiel Emanuel, who was an adviser to the president during the drafting of the health law and is now a health policy expert at the University of Pennsylvania.

“There are at least six different prices for a hospital day. And then there’s the cost of actually delivering the service, which, for most of these things, even hospitals don’t know what that is. So when you say, ‘What’s the price?’ It’s almost a meaningless question, because there [are] all these different prices.”

Those negotiated rates—the prices insurance companies really pay hospitals—are treated like trade secrets. Insurers and many hospitals don’t want their competitors to know what  the payments are

It is only on an individual basis that people can see the prices their insurer paid for their care. And it’s after the care has been delivered and only if the person is already insured.

It’s buried in a statement called an explanation of benefits. These are the letters from insurers that look like a bill but say “this is not a bill.”

Efrain Monzon helps patients interpret those explanations for Florida Blue, the largest insurance company in the state of Florida.

“We’re identifying the procedure, we’re identifying the provider, the date of service and then making sure the amount, the member responsibility has to be in there,” Monzon says.

Wedged into that statement somewhere between the billing code and the member deductible, is a column for the amount paid.

This is the secret number the insurance company and the provider have worked into their contract, says Monzon. The industry terms are usually “adjusted rate” or “negotiated rate.”

In Florida Blue’s explanation of benefits to patients, it’s called simply “amount paid.”

To get a clearer sense of what health care costs, someone would have to collect enough of those statements from patients at all different hospitals with all different insurance.

There are companies and crowdsourcing projects trying to do just that around the country. And Massachusetts has a law that says insurers have to disclose some of these prices in a way that is accessible to patients.

But so far, that’s not happening in South Florida.

Kaiser Health News (KHN) is a national health policy news service. It is an editorially independent program of the Henry J. Kaiser Family Foundation.