Loading ...

Change Healthcare, which suffered a ransomware attack last month cutting providers off from payer reimbursements, is offering doctors a temporary loan program to tide them over until the UnitedHealth Group (UHG) technology company's systems can be fixed.

The financial lifeline comes as hospitals and medical practices struggle to maintain cash flows, check insurance eligibility, and get life-saving treatments and prescriptions approved for patients.

"Claims are not going out, claims are not being processed, claims are not being paid," said Graig Straus, DNP, APRN, CEN, president of Rockland Urgent Care in West Haverstraw, New York. He told Medscape Medical News his practice is pulling from reserve funds to cover the delayed insurance reimbursements, but he will consider applying for the temporary loan if necessary.

While the cyberattack initially appeared to disrupt only pharmacy operations, its effects have spread to many other providers, underscoring the vulnerability of the nation's interconnected and digitized health system.

The Department of Health and Human Services (HHS) also said on Tuesday that CMS is encouraging Medicare Advantage organizations, Part D sponsors, Medicaid, and CHIP managed care plans to expedite payments to cash-strapped providers by temporarily removing or relaxing prior authorization and timely filing requirements.

It also urged facilities to submit accelerated payment requests, like those issued during the pandemic, to their Medicare Administrative Contractor for individual consideration.

A Ransom Paid?

UHG alleges the February 21 cyberattack was carried out by AlphV/BlackCat, a hacker group on the radar of multiple government agencies worldwide. In December, the Department of Justice (DOJ) issued a decryption tool to assist more than 500 victims of the ransomware group in restoring their systems, thwarting $68 million in ransom demands that targeted health organizations and other networks supporting critical US infrastructure.

Change Healthcare, part of UHG subsidiary Optum, is a central player in insurance claims processing. As the largest electronic data interchange (EDI) clearinghouse in the United States, the platform processes 50% of all medical claims, according to a DOJ lawsuit that unsuccessfully sought to prevent UHG's acquisition of the company in 2022.

Change Healthcare's "pervasive network" encompasses 900,000 physicians, 33,000 pharmacies, and 5500 hospitals, meaning that even payers who choose not to be Change customers have no choice but to have their claims data pass through its EDI, court records said.

On March 1, Wired reported that a Bitcoin account connected to AlphV received the equivalent of $22 million, raising speculation that UHG paid a ransom to regain control of their system.

But almost a week later, the system still isn't back online.

In an update on Wednesday, UHG said that workarounds have 90% of claims processing as usual, and the new e-Prescribe system has returned pharmacy volume to near-normal levels. The healthcare conglomerate has not announced a recovery timeline but anticipates the medical network will take longer to return to normal than pharmaceutical operations. UHG said other business lines, like UnitedHealthcare, have not been affected.

Physicians, Hospitals Plead for Help

Industry groups are pleading for more aid and a greater government response amid what American Hospital Association president and CEO Rick Pollack described as "the most significant and consequential incident of its kind" in US history.

American Medical Association president Jesse M. Ehrenfeld, MD, MPH, expressed concern over the "thin margins" on which physician practices operate, particularly those in rural areas or caring for underserved populations. In a written statement, he urged federal authorities to offer more financial assistance for physicians, including advanced payments.

UHG's loan program, administered through Optum Financial Services, offers financial assistance to providers whose payer payments are processed through Change's EDI. The loan amount is based on average prior claims volume and how much a provider's payment distributions have been affected. No interest or fees will be charged, but the funds must be repaid.

In a series of LinkedIn posts, a Pennsylvania primary care physician called Optum's loan offering "ludicrous." Christine Meyer, MD, said her practice's daily insurance reimbursements dropped to the lowest ever — just $1600 — a mere fraction of the daily deposits typically approaching $70,000. "My practice is losing $500,000 in charges each month, and we were offered a $4000/mo loan," she said.

Jeffrey B. Miller, JD, director-in-charge of healthcare consulting firm Granite GRC in Lancaster, Pennsylvania, said the breach has blindsided the industry and should serve as a wake-up call to shore up vulnerabilities. Without electronic systems to conduct many financial and administrative processes, he told Medscape Medical News that providers are shifting to labor-intensive decades-old methods, like direct data entry into payer portals, for claims submission.

In December, HHS released details of a four-pronged plan to strengthen the healthcare industry's cybersecurity measures.

Meanwhile, Heather Bassett, MD, chief medical officer with Tennessee-based utilization management software company Xsolis, said that health systems should have documented downtime procedures and ensure vendors can adequately safeguard data, as demonstrated by HITRUST and Service Organization Control Type 2 certifications.

She told Medscape Medical News that cybercriminals are becoming more sophisticated with the advent of generative artificial intelligence.

"It used to be easier to detect if an email was a phishing attempt, but personalization now makes it much more difficult to detect," she said. In the future, Bassett anticipates phishing attempts will use voice and video prompts as bait in addition to texts and emails.

Steph Weber is a Midwest-based freelance journalist specializing in healthcare and law.