Reminder: Update Your Hospital or Health System Contact Information
IHA’s advocacy and member communications rely on timely, direct outreach to the right individuals within each hospital and health system. As we respond to rapidly evolving industry and policy developments, accurate contact information is essential to ensure important updates reach the appropriate leaders on your team.

We ask that you review your organization’s current IHA member record and provide any updates, including changes to individuals, titles, email addresses, and phone numbers. Please review and update your organization’s IHA member record. This information is available in an Excel spreadsheet in IHA’s C-Suite portal on the IHA website. You must be registered on IHA’s website to access this information; click here if you need to register. Your assistance ensures you and your colleagues receive the information needed to stay informed and engaged with IHA’s work on your behalf. 

Staff contact: Anne Stilwell 

Appeals Court Affirms Louisiana’s 340B Contract Pharmacy Statute
The U.S. Court of Appeals for the Fifth Circuit yesterday upheld a lower court decision sustaining Louisiana’s 340B contract pharmacy law. The statute bars pharmaceutical manufacturers from withholding 340B pricing for drugs dispensed through community pharmacies when those same discounts would apply if the drugs were provided through a hospital’s in-house pharmacy. AbbVie, AstraZeneca, and the Pharmaceutical Research and Manufacturers of America (PhRMA) had challenged the law, claiming it violated multiple constitutional provisions. The appeals court rejected those claims, concluding the statute is not preempted by federal law, did not violate the Fifth Amendment’s Takings Clause, did not violate the Constitution’s Contract Clause, and is sufficiently clear to withstand a vagueness challenge. In its decision, the court emphasized that regulating pharmacies and drug distribution has long been a state responsibility, noting that Louisiana’s Act 358 falls well within that established authority.

IDFPR Adds Six Additional License Types to Licensing System
Building on last week’s announcement, the Illinois Dept. of Financial and Professional Regulation (IDFPR) today said six additional license types have been added to the state’s modernized regulatory platform, CORE (Comprehensive Online Regulatory Environment), as part of the ongoing transition from legacy systems to an integrated, online system. IDFPR said this most current update added to the onboarding of mental health professionals, including social work and counseling professionals. As the transition continues, the Department said all social work and counseling license types will gradually see their licenses appear on the platform, with new, streamlined tools coming soon.

IHA has actively collaborated with IDFPR as part of the ongoing transition to the new online licensing system. With this most current update, 121 new applications for licensure are now being accepted on CORE; the Department is prioritizing transition of healthcare licenses to the online system. IDFPR said individuals whose professions are now available on CORE should utilize IDFPR’s new licensing system to apply for licensure.

AHA: RFI on Phishing-as-a-Service Scheme, Tycoon 2FA
Yesterday, the American Hospital Association (AHA) sent a Cybersecurity Advisory warning it has received credible reports of a widespread and ongoing phishing-as-a-service (PaaS) threat. Due to reports that the Tycoon 2FA platform poses a threat to healthcare organization infrastructure, potentially leading to ransomware attacks, a trusted national cybersecurity partner is requesting information from the field on Tycoon 2FA. In response, AHA encourages sharing this Advisory with your cybersecurity and information technology teams.

The Tycoon 2FA platform can enable attackers to bypass multi-factor authentication tools, including advanced authenticator apps. Tycoon 2FA is used to target many sectors, including healthcare, and has been used to facilitate account takeovers, business email compromise and highly disruptive ransomware attacks.

As part of a threat assessment, AHA asked member organizations to review the listed domains associated with Tycoon 2FA phishing and further review email and network activity and logs from Oct. 1, 2025, for any signs of phishing activity from these domains. Please share any findings from your review with John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org, and Scott Gee, AHA deputy national advisor for cybersecurity and risk, at sgee@aha.org. AHA said individual member organization responses and identity will remain confidential and not be identified in any threat assessment.

Additional technical mitigation guidance for Tycoon 2FA and general guidance for detecting phishing emails can be found here.