March 1, 2024

Yesterday during our Thursday morning call, we discussed the Change Health cyberattack and the immediate fallout for our members.  As promised I am in touch with state regulators and leaders at the state agencies, including DoH, pressing for recognition and support for our portion of New York’s safety net system of care.  

Earlier this week, DoH sent an email to providers including Hospitals, Home Care, Nursing Homes, Article 28 (FQs, D&TCs) and Adult Residential Facilities licensed under the Department of Health, encouraging providers to complete a survey embedded in the state’s Health Commerce System.  I am unaware of anything similar directed at mental health and addiction agencies licensed under OASAS and OMH.  As you might expect, the NYS Council is pressing hard for recognition and (presumed) action by the state for ALL provider types.   If you receive anything from OMH and/or OASAS regarding the CHANGE cyberattack, please let me know.  

Here’s an article from yesterday’s STAT News discussing the ongoing Change Health outage and a new OptumPay loan program.  Details are sketchy on the Program although more information is expected to come out today.  It appears loans will only be available to providers that use the CHANGE clearinghouse exclusively, but again there are no details yet.  Finally, I am in touch with colleagues that represent providers from across the healthcare continuum of care.  More on this shortly.

———————-

Change Healthcare cyberattack outage could persist for weeks, UnitedHealth Group executive suggests

• By Brittany Trang Feb. 29, 2024, STAT News

The outage caused by the Change Healthcare cyberattack could last weeks, a top UnitedHealth executive suggested in a Tuesday conference call with hospital cybersecurity officers, according to a recording obtained by STAT.

UnitedHealth Group Chief Operating Officer Dirk McMahon said the company is setting up a loan program to help providers who can’t submit insurance claims while Change is offline. He said that program will last “for the next couple of weeks as this continues to go on.”

That timeline, while vague, still provides more clarity than UnitedHealth has offered publicly since the outage began Feb. 21. Change’s website said until Thursday that the outage would last “through the day.”

Change ferries claims and payments between providers and insurers, and helps providers check on patients’ insurance information. Before Optum acquired Change in 2022, it served 1 million physicians, 39,000 pharmacies, 6,000 hospitals, and connected with 2,400 insurers. In response to the cyberattack last week, UnitedHealth unplugged Change’s connection to every hospital, medical office, and pharmacist that used it to execute one of those functions, whether those organizations interfaced with Change directly or through the complicated insurance claims bucket-brigade.

McMahon’s remarks about the loan program highlight the scope of UnitedHealth’s damage control. UnitedHealth maintained it has “not determined the [cyberattack] incident is reasonably likely to materially impact our financial condition or results of operations,” according to its annual report to investors this week. But doctors and pharmacists are scrambling to find ways to get patients what they need, and to get paid. As of 2022, Change facilitated $1.5 trillion in health care transactions.

The uncertain timing is making it hard for hospitals and health systems to figure out their own response, said Walter Connors, chief information officer at Community Care Partners, a company that runs more than 90 urgent care and primary care clinics in seven states.

“[Those companies are] trying to figure out, ‘OK, if this comes back online on Friday, we’ve been down a week and a half; we can kind of play catch-up,’” he said. But if the system is going to be down for a few more weeks, the workaround calculus changes, he said. That’s not possible without more information from UnitedHealth.cy

UnitedHealth did not immediately return a request for comment Thursday.

The new loan program, administered through UnitedHealth’s Optum Pay, would disburse weekly amounts to providers based on their claim history in the last year, McMahon said on the call. UnitedHealth would expect providers to pay it back after Change resumes normal operations. UnitedHealth plans to share more details with its customers March 1, he said on the call.

The loans are supposed to help providers who exclusively use Change’s mechanisms to file claims and receive payment. Most of the attention on the Change outage has focused on pharmacies. On Tuesday’s call, McMahon also said the company has set up a “new e-prescribing environment completely separate from the existing Change environment,” designed to reduce the burden of filing manual prescriptions and other workarounds.

In previous statements, UnitedHealth has said the outage hasn’t affected patients being able to get their medications and emphasized that many hospitals and pharmacies have implemented workarounds. But therapists, doctors, consultants, and hospital executives who spoke with STAT said the workarounds are time-consuming and sometimes futile.

Even though providers may have switched from Change to another company to get claims to their insurers, if the insurer uses Change to pay the provider, the whole process is moot, explained Arna Meyer, a dental billing and claims consultant who also chairs a subgroup in the Workgroup for Electronic Data Interchange, which advises the Secretary of Health and Humans Services on health IT issues.

Shelby Turner-Imholt, a billing specialist for several small multi-specialty clinics in Oregon, said that out of the approximately 25 insurers she works with, only four don’t use Change. She can submit paper claims to all 25, but the 21 that use Change either can’t process the claims further, or don’t have the staff to process a mountain of paper claims.

UnitedHealth has also said doctors and hospitals shouldn’t see their cash flow affected by the outage, even with delays in claims processing, because it normally takes 1-2 weeks to process and pay insurance claims.

Ashley Drogs, a therapist in Oakland County, Michigan, said this delay will make the ripple effects even longer. “In the health care billing world, one week equals two weeks” because of processing delays, she said. If she can’t submit a claim this week and Change is down for another three weeks, it might be six weeks before she gets paid for this week’s visit, not even accounting for the backlog of claims everyone will be trying to work through at that point.

“And that I truly don’t have words for … because before this, providers were getting payments weekly, two times a week, or depending on insurance carriers, sometimes daily,” Drogs said. “So going from that, to nothing is … scary.”

The uncertain timing has also frustrated people like Angela Adamcik, a mental health counselor who owns her own practice in South Carolina. Though she doesn’t contract with Change, her electronic records system does, preventing her claims from going out.

“We don’t know where anything stands. Are we talking a month? Are we talking a week? Are we talking that there’s data loss and we need to start with the beginning?” she asked. “In a month, I’m not going to have the money to be able to stay open the way I am now. Something has to change.”

Providers told STAT they’re appealing to the federal government for further assistance. The Medical Group Management Association, representing more than 15,000 group medical practices, sent a letter to HHS Secretary Xavier Becerra on Wednesday detailing problems its members have experienced due to the Change outage and asked HHS to “utilize all the tools at its disposal” to mitigate the effects. “Guidance, financial resources, enforcement discretion, and more are needed to avoid escalating an already serious situation,” the group said.

Meyer, who advises HHS on IT, said “health care is considered critical infrastructure by the U.S. government, and this is a critical infrastructure failure right now that we’re dealing with.”

Experts told STAT that this cyberattack, and the number of processes it brought down, shows the dangers of consolidation in the industry and outlines just how fragile a company like Change is.

“We’re in a state now where cybersecurity and cyberattacks…it’s not a matter of if it’s going to happen, it’s a matter of when,” Meyer said.