March 8, 2024
The $500M noted in the Governor’s Press Release (below) is actually funding from a procurement that was issued in November 2023, for hospitals:
(from the press release, 3/8/24)
“Every New Yorker deserves to feel confidence that their financial information, and sensitive medical data, are safe from digital attacks and the dark web,” Governor Hochul said. “Health care insurers and providers must work together to guarantee that any digital event doesn’t stop people from receiving appropriate care, and my administration has allocated $500 million to help hospitals rapidly and aggressively enhance their systems and safety protocols. ”
———- Forwarded message ———
From: Press Office <Press.Office@exec.ny.gov>
Date: Fri, Mar 8, 2024 at 1:36 PM
Subject: GOVERNOR HOCHUL ANNOUNCES NEW PROTOCOLS TO ENSURE NEW YORKERS RECEIVE CONTINUITY OF HEALTH CARE SERVICES FOLLOWING CYBERATTACK
| For Immediate Release: 3/8/2024 | GOVERNOR KATHY HOCHUL |
GOVERNOR HOCHUL ANNOUNCES NEW PROTOCOLS TO ENSURE NEW YORKERS RECEIVE CONTINUITY OF HEALTH CARE SERVICES FOLLOWING CYBERATTACK
Change Healthcare Continues to Restore Systems Following Unprecedented Cyberattack
State Department of Financial Services Issues Letter Outlining Protocols for Health Insurers
Governor Hochul today announced that health insurers were directed to follow new protocols and assist healthcare providers to ensure New Yorkers have access to uninterrupted healthcare services. This action was taken after a cyberattack on health care platform Change Healthcare, part of UnitedHealth Group, which saw disruptions from the cyberattack to the claims and payment systems on February 21, 2024.
“Every New Yorker deserves to feel confidence that their financial information, and sensitive medical data, are safe from digital attacks and the dark web,” Governor Hochul said. “Health care insurers and providers must work together to guarantee that any digital event doesn’t stop people from receiving appropriate care, and my administration has allocated $500 million to help hospitals rapidly and aggressively enhance their systems and safety protocols. ”
Change Healthcare, a technology platform used by a substantial number of health care providers in New York, disconnected its systems during the cyberattack. The New York State Department of Financial Services (DFS) has issued a letter to health insurers and other health benefit issuers to ensure continuity of care following these disruptions. The letter provides guidance for how they should work with providers to avoid disruptions in care, which may include suspending certain utilization review requirements, appeal timeframes, claim submission timeframes, and eligibility verifications. The circular letter also strongly urges insurers to work with providers to address cash flow disruptions to avoid disruption of health care services.
New York State Superintendent of Financial Services Adrienne A. Harris said, “Under Governor Hochul’s leadership, DFS has taken action to ensure New Yorkers do not experience interruptions in care or a delay in receiving critical prescription drugs because of a cyber incident. With vicious cyberattacks and emerging threats on the rise, strong cybersecurity protocols are more critical than ever to maintaining the safety and soundness of our healthcare system.”
New York State Health Commissioner Dr. James McDonald said, “The Department of Health has worked closely with the Department of Financial Services as well as other agency partners to assess impact and help promote continuity of care for health care systems. It is evident health care providers have prioritized patient care during this cyberattack and minimized impact on their patients.”
As a result of the cyberattack, some providers are currently unable to request preauthorization; engage in concurrent or retrospective reviews; submit internal appeals, external appeals, or claims for payment within the requisite timeframes; verify an insured’s eligibility for coverage; and obtain timely payment for health care services. Governor Hochul has directed state agencies to actively monitor the impact of this cybersecurity incident.
A copy of the circular letter can be found on the DFS website.