Cyberattack cripples America’s largest healthcare payment system

An Ohio urgent care chain may be forced to stop paying rent and other bills to cover salaries. In Florida, a cancer center is scrambling to find money for chemotherapy drugs to avoid delaying crucial treatments for its patients. And in Pennsylvania, a primary care physician is cutting costs and pooling all her money — including her personal bank stash — in hopes of staying afloat for the next two months.

These are just a few examples of the severe cash shortages facing medical providers — from large hospital networks to the smallest clinics — in the wake of a cyberattack two weeks ago that crippled the nation’s largest U.S. billing and payment system. The attack forced the shutdown of parts of the electronic system operated by Change Healthcare, a significant unit of UnitedHealth Group, leaving hundreds, if not thousands, of health care providers unable to obtain insurance approval for services ranging from drug prescribing to mastectomy – or to be paid for these services.

In recent days, the chaotic nature of this sprawling collapse of daily, often invisible transactions has led top lawmakers, powerful hospital industry executives and patient groups to pressure the U.S. government to provide relief. On Tuesday, the Department of Health and Human Services announced it would take steps to ease financial pressure on some of those affected: hospitals and doctors who receive Medicare reimbursements would especially benefit from the new measures.

U.S. health officials said they would allow health care providers to apply to Medicare for accelerated payments, similar to the advanced financing made available during the pandemic, to tide them over. They also urged health insurers to eliminate or relax much-criticized prior authorization rules that have become a barrier to receiving care. And they recommended that insurers offering private Medicare plans also provide advanced financing.

HHS said it was trying to coordinate efforts to avoid disruptions, but it remained unclear whether these initial government efforts could bridge the gaps left by the still-offline mega-operations of Change Healthcare, which serves as a digital clearinghouse that connects doctors , hospitals and pharmacies. to insurers. It processes as many as one in three patient files in the country.

The hospital sector was critical of the response and called the measures inadequate.

In addition to news of the damage caused by another healthcare cyberattack, the closure of parts of Change Healthcare has once again focused attention on the consolidation of medical companies, physician groups and other entities under UnitedHealth Group. United’s acquisition of Change in a $13 billion deal in 2022 was initially challenged by federal prosecutors but went ahead after the government lost its case.

So far, United has not provided a timetable for reconnecting this crucial network. “Patient care is our top priority, and we have multiple solutions to ensure people have access to the medicines and care they need,” United said in an update on its website.

But on March 1, a bitcoin address linked to the alleged hackers, a group known as AlphV or BlackCat, received a $22 million transaction that some security firms say was likely a ransom payment United made to the group, according to a news article Wired. United declined to comment, as did the security company that initially noticed the payment.

Yet the long-lasting effects of the attack have once again exposed the vast interconnected networks of electronic health information and the vulnerability of patient data. Change processes approximately 15 billion transactions per year.

The closure of a number of Change activities has disrupted the digital role that connects providers and insurers when submitting bills and receiving payments. That has delayed tens of millions of dollars in insurance payments to providers. Pharmacies were initially unable to deliver many patients’ medications because they could not verify their insurance, and providers have racked up large sums of unpaid claims in the two weeks since the cyberattack.

“It absolutely highlights the fragility of our health care system,” said Ryan S. Higgins, an attorney at McDermott Will & Emery, who advises health care organizations on cybersecurity. The same entity alleged to be responsible for the cyberattack on Colonial Pipeline, a pipeline from Texas to New York that carried 45 percent of the East Coast’s fuel supplies, is believed to be behind the Change attack in 2021. “They have historically focused on critical infrastructure,” he said.

In the early days after the Feb. 21 attack, pharmacies were the first to struggle filling prescriptions because they couldn’t verify a person’s insurance coverage. In some cases, patients could not receive medications or vaccinations unless they paid in cash. But they apparently solved these problems by turning to other companies or developing solutions.

“Now almost two weeks later, the operational crisis is over and essentially over,” said Patrick Berryman, senior vice president of the National Community Pharmacists Association.

But as the shutdown extends, doctors, hospitals and other providers are struggling to pay the costs because the steady revenue streams from private insurers, Medicare and Medicaid simply aren’t coming in.

Arlington Urgent Care, a chain of five urgent care centers around Columbus, Ohio, has about $650,000 in unpaid insurance reimbursements. The chain’s owners are concerned about cash and wondering how they will pay bills, including rent and other expenses. They have taken out lines of credit from banks and used their personal savings to set aside enough money to pay employees for about two months, said Molly Fulton, the chief operating officer.

“This is even worse than when Covid hit because even though we didn’t get paid for a while then either, at least we knew there would be a solution,” Ms Fulton said. “There is no end in sight here. I have no idea when Change will be back on the market.”

The hospital industry has labeled Change’s infiltration as “the most significant cyberattack on the U.S. health care system in American history” and has urged the federal government and United to provide emergency funding. The American Hospital Association, a trade group, has sharply criticized United’s efforts to date and its latest initiative offering a loan program.

“It is not nearly enough to close the gaping holes in funding,” Richard J. Pollack, chairman of the trade group, said Monday in a letter to Dirk McMahon, United’s president.

“We need real solutions – not programs that sound good when announced but are fundamentally inadequate when you read the fine print,” Mr. Pollack said.

The loan program has not been well received in the country.

Diana Holmes, a therapist in Attleboro, Massachusetts, received an offer from Optum to lend her $20 a week, even though she says she has been unable to file about $4,000 in claims for her work since February 21. “It’s not like we have reserves,” she said.

She says there has been virtually no communication from Change or the main insurer for her patients, Blue Cross of Massachusetts. “It’s just maddening,” she said. She was forced to find a new payment center with an upfront payment and a one-year contract. “You had to move quickly without information,” she said.

Blue Cross said it was working with providers to find various solutions.

Florida Cancer Specialists and Research Institute in Gainesville resorted to new contracts with two competing clearinghouses as it spends $300 million a month on chemotherapy and other drugs for patients whose treatments cannot be delayed.

“We don’t have that kind of money in a bank,” says Dr. Lucio Gordan, president of the institute. “We’re not sure how we’re going to recover or collect the duplicate fees that we’ll incur if we have multiple clearinghouses.”

Dr. Christine Meyer, owner and operator of a 20-physician primary care practice in Exton, Pennsylvania, west of Philadelphia, piled “hundreds and hundreds” of pages of Medicare claims into a FedEx box and sent them to the agency. Dr. Meyer said she wondered how she could save money by cutting costs, such as potentially reducing the supply of vaccines the clinic has on hand. She said if she could get all her money together and her line of credit, her practice could survive for about two and a half months.

Through Optum’s temporary financing program, Dr. Meyer that she received a $4,000 loan, compared to the roughly half a million dollars she typically provides through Change. “That’s less than 1 percent of my monthly claims and, to make matters worse, the notice came in a big red font that said, you’ll have to pay all of this back when this is resolved,” said Dr. Meyer. “It’s all a joke.”

The hospital industry has pushed Medicare officials and lawmakers to address the situation by freeing up money for hospitals. Senator Chuck Schumer, Democrat of New York and the chamber’s majority leader, wrote one letter On Friday, federal health officials were urged to make accelerated payments available. “The longer this disruption continues, the more difficult it will be for hospitals to continue providing comprehensive healthcare services to patients,” he said.

In a statement, Senator Schumer said he was pleased with the HHS announcement because “money will flow to healthcare providers as our healthcare system continues to reel from this cyberattack.” He added: “The work cannot stop until all affected healthcare providers have sufficient financial stability to weather this storm and continue serving their patients.”