IHA Daily Briefing: December 9

CMS Issues Community Engagement Requirement Guidance
On Dec. 8, the Centers for Medicare & Medicaid Services (CMS) issued guidance to states on Medicaid community engagement requirements under the One Big Beautiful Bill Act (OBBBA, Public Law 119-21). Specifically, as a condition of Medicaid eligibility, certain individuals will have to meet community engagement requirements for a minimum period of time preceding their application for and during their enrollment in Medicaid. Applicable individuals include adults enrolled under Medicaid expansion or an 1115 waiver. Community engagement generally refers to work, enrollment in an educational program, community service, participation in a work program, or a combination of these things for 80 hours per month.

The guidance outlines a number of exceptions to the requirements, including specific individuals who are excluded from the community engagement requirements. This exception includes parents, guardians, caretaker relatives, or family caregivers of a dependent child who is 13 years of age and under, or who are family caregivers of a disabled individual. Additional exceptions to the requirements include an opportunity for states to deem an applicable individual as one who demonstrates community engagement for a month if, for part or all of the month, the individual is receiving inpatient hospital services, nursing facility services, services in an intermediate care facility for individuals with intellectual disability, inpatient psychiatric hospital services, or such other services of similar acuity as deemed appropriate by the Secretary.

States must implement community engagement requirements by Jan. 1, 2027. There is federal funding available for states in fiscal year 2026 totaling $200 million to establish systems related to conducting eligibility determinations and redeterminations. CMS will distribute $100 million equally among all 50 states and the District of Columbia (D.C.), and the remaining $100 million based on each state and D.C.'s share of individuals subject to community engagement relative to the total number of such individuals nationally as of March 31, 2025.

CMS will provide additional information via required interim final rulemaking and additional guidance.

Staff contacts: Cassie Yarbrough, Jennifer Koehler

CISA Alerts of Critical Vulnerability After Confirmed Active Exploitation
Hospitals and health systems are advised to fix a cybersecurity flaw that received the highest vulnerability score possible. The Cybersecurity and Infrastructure Security Agency (CISA) on Friday formally added a critical security flaw impacting React Server Components (RSC) to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation. The unauthenticated remote code execution vulnerability, known as React2Shell, impacts applications using versions of React 19, a free, open-source JavaScript library commonly used for building web and native user interfaces.

The vulnerability is also listed with a maximum score of 10 by the Common Vulnerability Scoring System, which extremely rare. This is an easily exploitable vulnerability and there are Chinese actors actively using it, according to Amazon's threat intelligence teams. If this vulnerability exists in your environment, it is critical that mitigations be applied as soon as possible, and if no mitigations are available discontinue use of the product.

IL Public Libraries to Stock, Administer Opioid Overdose Reversal Agents
The Illinois Dept. of Public Health (IDPH) has issued an updated standing order that adds Illinois public libraries to the list of locations permitted to keep a supply of opioid overdose reversal agents on hand. Library staff are now permitted to administer the medication after undergoing training that includes how to recognize the signs of an overdose, how to properly dispense the reversal agent, and the need to call 911 for continued care of the overdose victim.

The order builds on a January 2024 standing order that allowed schools to maintain a supply of reversal agents to help counteract the effects of an opioid overdose. A standing order is a pre-approved written protocol from a physician that allows healthcare providers to provide certain care, medications, or other treatments without needing a new, individual order for each patient, improving efficiency and timely care. Under the updated standing order, libraries can now obtain naloxone or nalmefene, FDA-approved opioid reversal agents, without a prescription. In the event someone on the premises shows signs of a possible overdose, the medication can be administered by library staff who have undergone appropriate training.

Additional information about the standing order can be found at Illinois Opioid Overdose Reversal Agents Standardized Procedure on the IDPH website.

Blood Pressure Drug Recalled Due to Possible Cross-Contamination
The Food and Drug Administration (FDA) has announced the recall of a popular high blood pressure medication. The agency said that bottles of bisoprolol fumarate and hydrochlorothiazide tablets, under the brand name Ziac, may have been cross-contaminated with other drugs. The FDA said testing of reserve samples showed traces of ezetimibe, a cholesterol drug made by the same company. The recall affects 2.5-mg to 6.25-mg dosages of certain lots. This is a Class III recall, meaning "use of or exposure to a violative product is not likely to cause adverse health consequences." More information can be found here.