Что такое вирус cascade

Формально вирус RС-1701 - файловый резидентный вирус, поражающий файлы типа СОМ. Функционирует на версиях MS DOS, начиная с 2.0 (в теле вируса имеется проверка). Распространяется как на PC XT, так и на PC AT. Стратегия заражения - при запуске файлов на выполнение. Файлы заражаются однократно.

Длина тела вируса 1701 (6А5h) байтов. Максимальная длина заражаемого файла составляет 63803 (F93Bh) байта. Минимальная - не проверяется.

Подобно вирусу С-648, при заражении RС-1701 дописывается в конец программы и одновременно вставляет в первые три байта COM-файла команду перехода на тело вируса. При этом размер файла увеличивается на 1701 байт, дата создания файла и атрибуты файла не меняются. Так же, как и вирус С-648, вирус RC-1701 не проверяет, находится ли заражаемая программа (которая загружается на выполнение) на защищенной дискете или нет, и пытается выполнить запись на защищенную от записи дискету. При этом операционная система выдает сообщение:
Write protect error writing device Abort, Retry, Ignore, Fail?

Этот эффект можно использовать для обнаружения данного и некоторых других резидентных вирусов, поскольку на зараженной ими машине попытка загрузить программу с защищенной дискеты всегда приводит к выдаче указанного выше сообщения. В то же время, как уже указывалось, это сообщение часто воспринимается неопытными пользователями не как предупреждение о попытке выполнить какие-то несанкционированные действия, а как просьба снять защитную наклейку.

Механизм функционирования данного вируса существенно отличается от С-648. В частности, для того, чтобы различать зараженные и незараженные файлы, используется не время создания, а первые три байта файла. Кроме того, вирус по BIOS определяет фирму-изготовитель для того, чтобы в случае, если таковой является IBM, сразу передать управление зараженной программе, не проявляя никаких признаков активности (латентная фаза). Возможно, разработчик опасался санкций со стороны такой могущественной фирмы, как IBM. Однако при программировании указанной проверки допущена ошибка, и вирус заражает и ПЭВМ фирмы IBM.

При запуске зараженной программы RС-1701 сначала проверяет, имеется ли уже резидентная копия данного вируса с помощью подфункции FF (не используемой в существующих версиях MS DOS). функции 4Bh прерывания 21h. Если нет, вирус инсталлируется в младших адресах свободной оперативной памяти, перехватывая прерывания 1Ch, 21h и 28h. В результате, при запуске любой программы вирус получает управление, проверяет, является ли запускаемая программа зараженной, и если нет, то заражает данную программу на диске. В процессе заражения файла вирус создает в памяти свою копию, кодирует ее и дописывает в конец заражаемого файла. Затем у файла изменяются первые 3 байта (организуется переход на начало тела вируса).

При выполнении зараженной программы управление командой JMP (начинающейся с байта Е9h) передается на начало вируса. Первыми командами вирус узнает длину исходного файла и раскодирует свое тело. Затем вирус восстанавливает измененные им при заражении файла первые три байта программы, проверяет, заражен компьютер или нет, и если не заражен, то посредством манипуляций с MCB, PSP и 2 раза копируя себя, остается резидентным в памяти. Чтобы по окончании работы программы-вирусоносителя резидентная часть вируса не была удалена из памяти, данный вирус выполняет достаточно тонкую операцию, заключающуюся в сдвиге загруженной программы в область старших адресов, записи себя на освободившееся место и соответствующей корректировке системных блоков.

Демонстрационный эффект привязан к часам, причем условие запуска выбрано так, что он проявляется в основном на машинах типа XT, при установленной дате. На AT визуальный эффект в обычных условиях не наблюдается, хотя вирус успешно размножается. По некоторым данным, он возникает при установке даты на третий квартал 1988 г. В указанных случаях, если загружается файл COMMAND.COM и он отмечен как зараженный, то вирус демаскируется, демонстрируя свое присутствие с помощью эффекта "падающих букв" на экране монитора. Сеансы опадания букв происходят через определенные интервалы времени. В процессе падения букв клавиатура блокируется и работать с компьютером становится невозможно до полного опадания букв на экране. При этом падение каждой буквы сопровождается характерным звуком, напоминающим шорох. На неспециалистов эта "шутка" часто производит впечатление аппаратной неисправности.

Никаких других несанкционированных действий вирус не выполняет, поэтому в целом его деятельность можно было бы охарактеризовать как мелкое хулиганство, если бы не одно обстоятельство. При заражении некоторых системных программ, используемых преимущественно в AUTOEXEC.BAT, он может вызывать блокировку загрузки MS DOS. Эта блокировка, в частности, возникает на ПЭВМ ЕС-1840 при заражении программы E1840.COM (EDISK.COM), которая обычно включается в состав AUTOEXEC.BAT и обеспечивает разделение одного физического диска на два логических, по 360К каждый (А и С на одном дисководе, B и D на другом). Этот эффект не был предусмотрен разработчиком вируса, что, впрочем, не освобождает его от ответственности. Вместе с тем, ситуация с EС-1840 может служить наглядной иллюстрацией того факта, что при заражении системных программ любой вирус может создавать опасные побочные эффекты. Поэтому любые компьютерные вирусы следует немедленно удалять, как только они появились, даже если путем анализа или из надежных источников установлено, что никаких разрушительных действий они не выполняют.

Резидентная часть вируса легко обнаруживается путем просмотра списка резидентных программ (с помощью утилит MAP, SMAP, MMAP и т.д.). Как видно из приводимой ниже карты памяти, в списке загруженных программ появляется дополнительная строка, описывающая безымянную программу, не имеющую имени родителя.

Вирус RC-1701 является одним из первых вирусов, в которых предприняты определенные усилия, направленные на усложнение процесса его дизассемблирования. В частности, основная часть тела вируса шифруется с помощью операции "исключающее ИЛИ". Поэтому непосредственное дизассемблирование зараженной программы пакетным дизассемблером полной информации о структуре вируса не дает. Ключ шифровки зависит от длины файла, поэтому два зараженных файла разной длины не имеют общих подстрок, за исключением начала инсталлятора. По той же причине текстовых строк тело вируса не содержит.

Исторические сведения. Данный вирус появился в Западной Европе в первой половине 1988 г. (см., например, статью [Computing88]). Об этом также свидетельствуют даты создания версий программы Serum. Вирус также распространялся на вирусной дискете В.Бончева в файле V1700.COM, датированном 16 января 1989 г.

В СССР впервые был выделен в конце 1988 г. в Институте прикладной математики имени М.В.Келдыша АН СССР. B Киеве появился в начале 1989 г. Средства защиты появились примерно одновременно с вирусом, поэтому существенного вреда вирус не нанес.

В Киеве первым фагом для данного вируса была австрийская программа Serum3, которая может также работать и в режиме детектора. Среди отечественных программ, использовавшихся на начальной стадии борьбы с вирусом, следует отметить детектор В.С.Ладыгина (ИПМ АН СССР) Virus_D1.

Неформальные названия. Данный вирус имеет порядка десяти неформальных названий. Среди них отметим следующие: Falling Letters (Падающие буквы), LetterFall (Буквопад), Rash (Сыпучка), вирус падающих букв, 1701, Letters (Буквы - О.Г.Котик), "Слезы капали". Полидетектор Scan называет данный вирус "1701/1704 Virus - Version B [170X]".

Методы и средства защиты. Попытки записи вируса в запускаемый СОМ-файл детектируются всеми имеющимися сторожами. Сторож Anti4us2 не срабатывает на попытку вируса стать резидентным, поскольку вирус предварительно перехватывает прерывание 21h. При использовании системы управления доступом к винчестеру (Disk Manager, Advanced Disk Manager и т.д.) вирус не в состоянии попасть в разделы винчестера, для которых установлен статус READ ONLY. Специальные средства защиты от данного вируса принципиально могут включать детектор, фаг для резидентной части, резидентный и пакетный фаги для зараженных файлов, активную и пассивную вакцину. Контекстный детектор может быть создан только на основе поиска начальных 16 байтов вируса, поскольку остальная часть вируса шифруется. Рекомендуемые фаги приведены в прил.1.
Фрагмент дампа программы MORE.COM, зараженной вирусом RC-1701

000: E90E009090909090 9090909090909090 .
+- J-сигнатура | (программа раскодировки) |
010:|01FA8BECE800005B 81EB31012EF6872A .[..1.*
020: 0101740F8DB74D01 BC82063134312446 ..t. M.141$F
030: 4C75F8
+- закодированная часть | тела вируса | 3A575901DE 4243CC634242DEDE Lu.:WY..BC.cBB..
040: A23236062FCF3672 24DF3EBC2CDF362E .26./.6r$.>. 6.
. .. .. .. .. .. .. .. .. .. .. . . . . . . . . .
050: 3212361732290FB7 43289D1602020EE7 2.6.2)..C(.

Пример карты памяти зараженного компьютера. В приводимой ниже карте памяти резидентная часть вируса занимает последнюю строку (1E1E) таблицы резидентных программ. Ее длина, указанная в графе "bytes", не соответствует действительной. Перехватываемые прерывания также не указаны.
Addr Program Parent Sg Bytes Hooked Vectors
- - - - - -(1A66) DOS N/A 3 5504
(1B4E) E1840 DOS 2 1280
(1BE2) DOSEDIT DOS 2 2032
(1E1E) N/A N/A 1 64

Cascade Manor continues to take every precaution necessary to protect our residents and staff from coronavirus infection. This includes all federal, state, and local guidelines and restrictions, as well as any additional actions recommended by our infectious disease expert and healthcare team.

Because of these measures, we are once again reporting zero confirmed cases at our community.

We appreciate all that friends and family members have done to keep our residents safe, and we recognize the emotional toll separation like this can take. Thankfully, we have technology to fill the gap, and our residents have been using FaceTime and other programs to keep in touch with their loved ones. This past Friday we distributed a resource guide to keep residents connected, active, and engaged during this time from the comfort of their home. We are also providing meal service to residents’ homes, and making sure your loved ones’ nutritional needs are being met.

Many have been asking about bringing goods/packages to residents, and yes, we are happy to accept them. Our concierge will take them and our Facility Services team will leave them outside of the resident’s door.

For any other questions, comments, or concerns, please email prs@retirement.org, and include CMR in the subject line so we can route your email to the appropriate person. We are thankful for all that everyone continues to do to keep our residents and staff safe!

March 16, 2020 5:00 pm

Yesterday we announced new restrictions on visitations to our Skilled Nursing Facility. Today, due to rapidly developing guidelines from federal, state, and local health authorities, we are extending those restrictions to all areas of our campus. To reiterate, all visitors and non-essential health care personnel are now restricted, including those to our independent living residences. Exceptions will be made for end-of-life and other compassionate care situations as needed. In those cases, visitors will be limited to a specific room only.

We continue to encourage family members, friends, and non-essential caregivers to communicate by other methods including phone, video chat, and social media.

Please continue to monitor this page for developments, and thank you for your patience and understanding as we adapt new guidelines to protect the health and well-being of our residents and staff.

Please direct your questions to prs@retirement.org.

We appreciate your help in keeping our community free from infectious diseases like COVID-19.

Links to additional resources:

March 15, 2020 11:30 am

Maintaining the health, wellness, and safety of our residents and staff is our number one priority.

Visitors are encouraged to communicate by other methods like telephone, video chat, and social media.

Please continue to monitor this page for the latest updates regarding guidelines.

March 13, 2020 2:00 pm

Our community remains free from any COVID-19 infections at this time. We will continue to follow CDC, state, and local guidelines for mitigation, as well as the protocols outlined below.

March 11, 2020 1:40 pm

Cascade Manor understands the seriousness of the COVID-19 outbreak and is taking every possible precaution to protect our residents and staff. From the outset, we have been following CDC, state, and local guidelines and as of today, March 11, 2020, we have no reported cases of a COVID-19 infection. We have also taken and will continue to take the following precautionary steps to mitigate the risk to our residents and staff:

• Visitor restrictions: we are restricting non-essential visitors, including those that have not recorded a case of COVID-19 infection. Visitors are being carefully screened for respiratory and other associated symptoms, travel history to affected regions, and exposure to someone with COVID-19.
• Staff education: we have updated, distributed, and trained staff on infection-control guidelines, and have campus-wide surveillance for COVID-19 symptoms and identifying high-risk individuals to monitor. We have also updated and disseminated appropriate mitigation techniques for staff in all departments.
• Work restrictions: staff are being screened for symptoms and may not be permitted to work, as well as any staff member who has traveled to a high-risk country in the past 14 days or who has been exposed to COVID-19.

If you have a family member in our community, we are ready to answer any questions you may have. Please bookmark and continue to monitor this page for the latest information, as well as our Facebook page. Please direct your questions to prs@retirement.org.

We appreciate your help in keeping our community free from infectious diseases like COVID-19.

This post has been written by Vittorio Vallero and Barbara Lunel.

Critical infrastructures indicate all those technological infrastructures that are relevant for the welfare of our countries. We need to think 1 infrastructure systems using concepts drawn from complex adaptive system (CAS) theory. Seeing our critical infrastructure as a CAS will help to recognize existing interdependencies between demand and supply, between different sectors of the infrastructure and how infrastructural systems agents tend to change and evolve over time. CAS can be defined as containing a large number of agents which interact, learn and most crucially, adapt to changes in their selection environment in order to improve their future survival chances (Holland, 2006) 2 . Agent-Based Models overcome limitations of equation-based approaches and are a powerful tool to study socioeconomic systems. ". Computer simulation can combine the useful flexibility of a computer code – where we can create agents acting, making choices, and reacting to the choices of other agents and to modification of their environment – and its intrinsic computability. In this way we can combine the descriptive capabilities of verbal argumentation and the ability to calculate the effects of different situations and hypotheses. From this perspective, the computer program is a form of mathematics. In addition, we can generate data – that is, time series – from our models and analyze them employing statistics and econometrics. In summary, we have: 1) verbal argumentations; 2) mathematical equations with statistics and econometrics; 3) agent-based computer simulations. " 3 . Here follows a definition chosen by CIPSEC to define cascading effects: “… cascading effects are the dynamics present in disasters, in which the impact of a physical event or the development of an initial technological or human failure generates a sequence of events in human subsystems that result in physical, social or economic disruption. " 4 . In general, the interdependencies increase the vulnerability of the critical infrastructures although the integration and the synergy in its usage provides valuable benefits in terms of efficiency, service quality and cost reduction. Interdependencies lead to avalanche effects in distribution of errors from one critical infrastructure to another. A simple outage caused by a problem can lead to cascading outages and possibly to the whole system collapse. Many examples of cascading problems of infrastructure dependencies can cover wide geographical areas. Communication technologies improve productivity, efficiency and competitiveness and the use of the Internet reduces operating costs but the interdependence arise and along with the benefits we also have easy access from cyber criminals and terrorists with all negative consequences further complicating the final scenario. This creates a wide variety of parameters that can influence the reference infrastructure. We will use as an example a simulation of the application of an antivirus product within an information system as we consider this type of simulation suitable to exemplify cascade effects. In this solution a series of parameters can be applied so as to guarantee a wide range of use cases in order to highlight any critical points that can be found. The simulation is therefore able to highlight, for example, the case in which the antivirus is used incorrectly and how the target environment is able to respond to the eventualities. Today we can use theoretical models in the social sciences using computers. Agent-based models (ABM) are a potential "third way" in advancing the study of social sciences, in addition to arguments and formalization. With computer simulations, unlike other methods, it is possible to formalize complex theories about processes, carry out experiments and observe the occurrence of emergence 5 . Mathematical and statistical models have some disadvantages; e.g., many of the equations which one would like to use to represent real social phenomena are simply too complicated to be analytically tractable like when the phenomena being modelled involve non-linear relationships: the advantages of mathematical formalization are not there. A common solution is to make simplifying assumptions until the equations do become solvable but these assumptions are often implausible and the resulting theories can be misleading 6 . Netlogo 7 is an agent-based programming language with an integrated modelling environment appeared in 1999. This application can modulate and simulate complex system over a period and it offers an area for creating a user interface with buttons, sliders and monitors for implementing the different functions of the interface elements. Inside Netlogo -> File -> Models Library -> Sample Models - > Networks Virus on a Network 8 9 it is possible simulate the behavior of virus inside a network environment. This model demonstrates the spread of a virus through a network. Each node represents a computer, and we are modeling the progress of a computer virus or worm through this network and each node may be in one of three states: susceptible, infected or resistant. The links in the networks represent the connection between computers and their neighbors. Infected nodes are the ones that currently have the virus. They try to send it to all their neighbors who are susceptible. Infected nodes have a recovery chance and can either become susceptible again or resistant. A node can become resistant by a resistance probability that is set in the model. The susceptible nodes are the nodes that are vulnerable to the virus. When a neighbor of a susceptible node is infected, it can get infected too depending on the virus spread probability, which is a parameter specified in the model. When an infected node becomes resistant, it stays resistant, and it is not possible for the virus to spread through its links. For instance, in a first realistic scenario, the defenses are lowered, decreasing the control frequency about the scheduled virus-scan procedure, or do not worry if human noticing something fishy about how the computer is behaving. Tick is a term used in NetLogo to describe the current number of time-steps of the simulation.

After a few ticks when I do not bother to defend the nodes of the network from the spread of the virus, cascade effects occur and I find the entire area of interest completely infected. In a second scenario by changing the initial number of infected nodes to the maximum value but keeping the anti-virus periodic control constant to 1 tick on the nodes, it is possible to keep the diffusion under control until it is reset to zero.

An important increase in the number of connections of each single node causes a decisive slowdown in the effectiveness of the antivirus. Cascading effects certainly have an impetus from the number of intra and inter dependencies of the reference structure. Simulation with Netlogo helps us understand this phenomenon. Through a tool suitable for simulations based on ABM, NetLogo, we wanted to demonstrate the effectiveness of an antivirus in the management of a computer network subject to the spread of a computer virus and the possible consequences and countermeasures obtainable with the use of an antivirus for contain a possible cyber-attack.

One of the problems that emerges in the approach of cybersecurity related to our technological environment is due to the difficulty of making clear the importance of certain behaviors towards procedures and practices that can impact our security, from the personal one to that of our work environment as well as the critical infrastructures so important for our life. ABMs like Netlogo can make us understand how important are these methodologies and systems capable of protecting us from the dangers of the application of technology for malicious purposes. Although the techno-social systems evolve over time, it is the result of combinations that are often underestimated or misunderstood by us and that the simulation with ABM highlights. In socio-economic systems, emphasis is put on importance of connectivity between the elements of the system itself and the interaction that derives from the fact that these elements are always connected. The ABMs make it possible to associate the time not as a component of the environment itself, which flows continuously for all the components, but as a component of the individual objects present in the model and which, therefore, change their status asynchronously. How many times have we wondered why we have to update our antivirus and why we have to choose an effective antivirus. With agent-based models we can see in an effective and elegant way that the choices we make do not only influence the technology we possess but determine the stability and resilience of the technological system in which we live. By simulating ex-ante the criticalities of a critical infrastructure we are able to foresee organizational or instrumental steps able to remedy any failures or emergency situations caused by both endogenous and exogenous agents.

"Based on National Health and Nutrition Examination Survey (NHANES) data from 1999 through 2002, approximately 3.2 million people in the U.S. have chronic HCV infection [22]. Since NHANES did not sample high-risk groups, particularly incarcerated, homeless, or institutionalized individuals, the actual prevalence of chronic HCV infection was estimated to be 3.5 million [22]. This estimate was used for cascade step 1 (Figure 2)."

"9,581 articles were identified, 117 were retrieved for full text review, and 10 were included. Among the remaining
10 articles 23, three focused exclusively on U.S. Veterans.. Overall, 3.5 million people were estimated to have chronic HCV in the U.S.
Fifty percent (95% CI 43-57%) were diagnosed and aware of their infection, 43% (CI 40-47%) had access to outpatient care,
27% (CI 27-28%) had HCV RNA confirmed,
17% (CI 16-17%) underwent liver fibrosis staging,
16% (CI 15-16%) were prescribed treatment, and
9% (CI 9-10%) achieved SVR."

"In summary, our results suggest that continued efforts are needed to improve HCV care in the U.S. In a field that is changing rapidly, with increased attention on HCV screening and approval of new, effective direct-acting antiviral agents, this proposed HCV treatment cascade provides a framework for identifying gaps in care. This framework will be useful in monitoring the impact of new public health initiatives, care models, and treatments. Only by increasing the number of persons completing each step in the cascade can the goals of the U.S. Action Plan for the Prevention, Care, and Treatment of Viral Hepatitis be achieved."

The Treatment Cascade for Chronic Hepatitis C Virus Infection in the United States: A Systematic Review and Meta-Analysis

1 Department of Medicine, University of Pennsylvania Perelman School of Medicine, Philadelphia, Pennsylvania, United States of America, 2 Leonard Davis Institute of Health Economics, University of Pennsylvania, Philadelphia, Pennsylvania, United States of America, 3 Center for Clinical Epidemiology and Biostatistics, Department of Biostatistics and Epidemiology, University of Pennsylvania Perelman School of Medicine, Philadelphia, Pennsylvania, United States of America, 4 Department of Medicine, New York University School of Medicine, New York, New York, United States of America, 5 Center for Evidenced-Based Practice, University of Pennsylvania Health System, Philadelphia, Pennsylvania, United States of America

Identifying gaps in care for people with chronic hepatitis C virus (HCV) infection is important to clinicians, public health officials, and federal agencies. The objective of this study was to systematically review the literature to provide estimates of the proportion of chronic HCV-infected persons in the United States (U.S.) completing each step along a proposed HCV treatment cascade: (1) infected with chronic HCV; (2) diagnosed and aware of their infection; (3) with access to outpatient care; (4) HCV RNA confirmed; (5) liver fibrosis staged by biopsy; (6) prescribed HCV treatment; and (7) achieved sustained virologic response (SVR).

We searched MEDLINE, EMBASE, and the Cochrane Database of Systematic Reviews for articles published between January 2003 and July 2013. Two reviewers independently identified articles addressing each step in the cascade. Studies were excluded if they focused on specific populations, did not present original data, involved only a single site, were conducted outside of the U.S., or only included data collected prior to 2000.

9,581 articles were identified, 117 were retrieved for full text review, and 10 were included. Overall, 3.5 million people were estimated to have chronic HCV in the U.S.

Fifty percent (95% CI 43-57%) were diagnosed and aware of their infection,
43% (CI 40-47%) had access to outpatient care,
27% (CI 27-28%) had HCV RNA confirmed,
17% (CI 16-17%) underwent liver fibrosis staging,
16% (CI 15-16%) were prescribed treatment, and
9% (CI 9-10%) achieved SVR.

ABSTRACT

Objectives: Effective screening, diagnosis, and treatment are needed to reduce chronic hepatitis C virus (HCV) infection–associated morbidity and mortality. In order to successfully increase HCV treatment, it is necessary to identify and understand gaps in linkage of antibody-positive patients with newly identified HCV to subsequent HCV RNA testing, clinical evaluation, and treatment.

Study Design: To estimate attainment of HCV care cascade steps among antibody-positive patients with newly identified HCV, we conducted chart reviews of patients with a new positive HCV antibody test at 3 academic medical centers participating in the Birth-Cohort Evaluation to Advance Screening and Testing of Hepatitis C (BEST-C) study.

Methods: We tracked receipt of RNA testing, clinical evaluation, treatment initiation, and treatment completion among individuals born between 1945 and 1965 who were newly diagnosed as HCV antibody–positive between December 2012 and October 2015 at 3 BEST-C centers, predominantly from the participating medical centers’ primary care practices and emergency departments.

Results: Of the 130 HCV-seropositive individuals identified, 118 (91%) had an RNA or genotype test, 75 (58%) were RNA-positive, 73 (56%) were linked to care, 22 (17% overall; 29% among RNA-positive) started treatment, and 21 (16%; 28% among RNA-positive) completed treatment.

Conclusions: This analysis showed that although linkage to care was largely successful in the target birth cohort, the largest gap in the HCV care cascade was seen in initiating treatment. Greater emphasis on linking patients to clinical evaluation and treatment is necessary in order to achieve the public health benefits promised by birth-cohort testing.

Am J Manag Care. 2018;24(9):421-427

Takeaway Points

In this analysis of patients with newly diagnosed hepatitis C between December 2012 and October 2015, linkage to care was largely successful in the 1945-1965 birth cohort, but treatment initiation remained low.

• The largest gap in the hepatitis C virus care cascade was initiating treatment.
• Greater emphasis on linking patients to clinical evaluation and treatment is needed.
• Managed care is well poised to address barriers to initiating treatment.

Chronic hepatitis C virus (HCV) infection is undiagnosed in 50% of those infected. 1,2 Hoping to increase HCV case identification, in 2012 the CDC recommended a 1-time HCV antibody test for persons born between 1945 and 1965, the birth cohort that contains approximately 80% of individuals with HCV antibodies. 1,2 In 2013, the US Preventive Services Task Force recommended testing for the same group. 3,4 The Birth-Cohort Evaluation to Advance Screening and Testing of Hepatitis C (BEST-C) experimental evaluation demonstrated that birth-cohort testing interventions increase HCV case identification at a reasonable cost compared with that of other testing strategies. 5,6 However, observational studies have identified persistent gaps in the subsequent cascade of treatment services that are needed to achieve a virologic cure: confirmatory testing (HCV RNA), clinical evaluation, and antiviral treatment. 7-13 One meta-analysis estimated that only 50% of the 3.5 million Americans living with chronic HCV had been tested for HCV antibodies, 27% received confirmatory RNA testing, 16% had been treated, and 9% achieved sustained virologic response (SVR), defined as undetectable viral load at 12 weeks following end of treatment (EOT). 7 A second study found that only 29% of high-risk primary care patients who tested positive for antibodies were evaluated for treatment, less than 4% started treatment, and only 2% achieved SVR. 12 The end of the BEST-C experiment, which compared testing interventions to promote birth-cohort testing with standard-of-care HCV antibody testing at 3 academic medical centers, created the opportunity to assess the rates of linkage to care in primary care and emergency departments affiliated with these centers.

Studying attainment of "care cascade" steps among patients identified at BEST-C medical centers is instructive in understanding the possible impact of future HCV testing interventions, especially in managed care settings. These settings have a long history of proactive health promotion activities, such as patient education and care coordination, that may be effective in addressing gaps in care experienced by patients with newly diagnosed HCV.

In this paper, we used electronic health records (EHRs) to examine HCV care and treatment among antibody-positive patients identified at BEST-C study centers during the study period.

METHODS

Study Population

Patients included in this analysis were those who tested HCV antibody–positive during the BEST-C study period (December 2012-October 2015) at any of the 3 participating healthcare systems (“centers”) as an enrolled participant of the BEST-C study or as an unenrolled patient who was identified during the same study period. All evaluated patients were born between 1945 and 1965 and had no previous record of being tested for HCV in the EHR. 5,6,14 Information about BEST-C has previously been described. 5,14 This study received institutional review board approval from the University of Alabama, Henry Ford Health System, Mount Sinai Hospital, and NORC at the University of Chicago.

Measures

We defined the care cascade as consisting of the following 7 consecutive steps: (1) a positive HCV antibody test; (2) a confirmatory test, defined as a qualitative or quantitative RNA or HCV genotype test; (3) receipt of a positive RNA result or genotype; (4) clinical evaluation (either concurrently with receipt of confirmatory RNA test result or at a subsequent encounter), defined as a visit with a specialty provider (hepatologist, gastroenterologist, or infectious disease specialist) or other HCV treatment provider (primary care provider trained to treat HCV); (5) initiation of antiviral therapy as indicated in the EHR; (6) treatment completion as indicated in the EHR by a provider; and (7) EOT virologic response, defined as an undetectable viral load at treatment completion (within 2 weeks of the end of intended course of treatment). Only 1 patient received a liver biopsy. Sustained viral load 12 weeks following EOT was not available at the end of the study; we therefore do not report on this step or the final outcome of the cascade.

Data Collection and Analysis

Using a standardized abstraction form, center coordinators collected data from the EHR of each patient from the date of his or her first positive HCV antibody test from December 1, 2012, through October 31, 2015. Coordinators identified relevant laboratory orders, encounters, and pharmacy records associated with each step of the HCV care cascade and sent deidentified person-level data to the coordinating center (NORC at the University of Chicago). Because of small sample sizes, the care cascade steps were not stratified by center. Data were analyzed using Microsoft Excel 2013 and SAS version 9.4 (SAS Institute, Inc; Cary, North Carolina).

We calculated the proportion of persons who progressed along the HCV care cascade as the number of individuals who completed each step (numerator) divided by the number of individuals with a positive HCV antibody test (denominator). We also calculated the proportion of individuals completing each step (numerator) divided by the number of individuals completing the previous step. Due to problems extracting pharmacy information from their EHR systems, 1 center did not report treatment of any patients. Therefore, we also calculated the care cascade and the percent of patients initiating treatment using data from the 2 centers with accessible treatment records (“treating centers”).

We estimated patients’ liver disease stage at initial evaluation using their first recorded AST (aspartate aminotransferase) to Platelet Ratio Index (APRI) scores. Disease stage was categorized using the following values: 0.0 to 0.54, 0.55 to less than 1.0, 1.0 to less than 2.0, and 2.0 or greater (ranging from no liver disease at 0.0 to advanced fibrosis/cirrhosis). 15 Using χ 2 tests and Fisher’s exact tests and data from the 2 treating centers, we compared differences in treatment initiation by sex, race, birth year, insurance type, APRI score categories, and HCV genotype. A P value ≤.05 was considered statistically significant.