Loading ...

In the month since the large-scale cyberattack on the Change Healthcare claims clearinghouse, some clinicians have devised workarounds, applied for advanced payments to keep their practices running and/or gone back to using — yes — paper. 

Leaders at UnitedHealth Group, which owns Change Healthcare, and federal officials estimate about 95% of medical claims and 99% of pharmacy claims are processing again. 

UnitedHealth Group announced March 22 that it is processing $14 billion in delayed claims through Relay Exchange, its largest clearinghouse. Efforts include restoring additional real-time transactions, benefits verification and authorization capabilities the week of March 25-29. Pharmacy claims for medical visits will also resume.

"Obviously, we are well aware, as you are, of the impacts that this Change cyberattack has had on the healthcare sector. Mitigating the cash flow issues that the healthcare system is experiencing is our top priority," said Andrea Palm, deputy secretary of the US Department of Health & Human Services (HHS), during an agency webinar last week to update clinicians.

Officials are focusing on "the last mile": the last group of clinicians who continue to experience cash flow issues. Palm said: "We're doing the work that is necessary to get them through this the next couple of weeks, so they are able to remain viable and serve patients." 

For Marianne Webb, APRN, the help cannot come quickly enough. 

"I have all kinds of nightmare scenarios playing out in my head, like how am I going to pay my bills? I'm probably going to have to take a distribution from my retirement account to try to stay afloat for another month," said Webb, a psychiatric nurse practitioner in solo practice in rural northeastern Colorado.

Webb and about 30 other practices relied on the same billing service, one that submitted claims through Change Healthcare. 

"My biller is doing paper claims at this point," she said. 

It could take 30 days for some insurers to review these paper claims, Webb added, and it remains unknown how much time after that it will take to get paid. She also applied for loan assistance but has yet to hear back. 

In the meantime, Webb said, she has "almost no revenue" except from people who pay cash or from a minority of claims she can put through her state Medicaid portal directly. 

"Along with the Medicare cuts, it's like a perfect storm happening," she said, "one that's making me reevaluate whether I want to take insurance at all. If doctors and nurses don't get paid, it really does shake the healthcare system."

Christine Meyer, MD, told Medscape Medical News that her billing team had to start sending out claims through the mail, among a "hodge podge" of other approaches. 

"It started out terribly. We really were paralyzed," said Meyer, an internist who runs a large primary care practice in Exton, Pennsylvania. "We…immediately started to see a decline in our collections. Even now, we are still not getting paid as we should even though we've been able to get some claims out." 

An advance payment from her accountable care organization and financial assistance from Optum have helped, Meyer said, although the Optum aid took extra effort, 

"When the Optum financial assistance loan came out, it was a joke. It was going to $4000 a month for my practice against about $600,000 of claims," Meyer said. 

After pushback from Meyer and other physicians who called the loans insufficient, Optum increased her monthly advance to $200,000, "which is still not great for one month, but it's way, way better," Meyer said.

"Some doctors, pharmacies, and other practices may have been frustrated by that initial offering and didn't try it again," Meyer said. "But, definitely, they should."

Even though Change Healthcare began restoring some services, Meyer's billing vendor decided not to wait and switched clearinghouses for their claims.

Susie Tushingham, RN, of ChoicePoint Health Addiction Treatment Centers, worries that the cyberattack may have compromised data associated with her group's claims. "What scares me is that the hackers may use and sell the information on the dark web," she said.

The Official Response 

The scope of the impact "even if it was 'just' Change, was quite massive," said Syed Mohiuddin, DO, counselor to the HHS Deputy Secretary. It was also unusual. This attack did not target hospitals, health systems, or suppliers. 

"A clearinghouse is not your typical cyberattack that we deal with." Mohiuddin said that the HHS is working closely with UnitedHealth Group, not only to hold them accountable but also to support their recovery from the attack.

Medical practices still scrambling to recover from the attack tend to be those working to help unserved communities, Margaret-Mary Wilson, MD, chief medical officer for UnitedHealth Group, said during the webinar.

"Our direct outreach has been focused on the populations that are most at risk, including those served by federally qualified health care centers, infusion centers and home- and community-based programs," Wilson said. 

Children's hospitals, safety net hospitals, rural health clinics and Indian tribal clinics are also more likely to experience ongoing disruptions from the cyberattack, she added. 

"We know that many providers…are struggling," Wilson said.

Minimizing Medicaid and Medicare Mayhem

"We have heard from so many providers over the last several weeks who are really struggling to make ends meet right now or who are worried that they will not be able to make payroll in the weeks to come," said Hannah Katch, senior advisor, Office of the Administrator at the Centers for Medicare and Medicaid Services (CMS) who focused on the Medicaid impacts during the provider webinar. 

Practices serving Medicaid populations should contact their Medicaid managed care plans, Katch said. These plans can provide interim payments and loans, pay older pending claims, and support clinicians in transitioning to a different clearinghouse.

"If you have already reached out to them and you did not hear back or did not get what you need, I would encourage you if it's been more than a week to reach out again," said Katch. 

The CMS is also asking private plans, including Medicare Advantage and Part D plans, to make prospective payments to clinicians, said Will Harris, senior advisor, Office of the Administrator at CMS, who focused on the Medicare fallout during the webinar.

CMS has posted a fact sheet and a list of frequently asked questions to help guide providers. 

Harris recommended that any clinicians still experiencing financial difficulties contact their Medicare Administrative Contractor (MAC). CMS instructed MACs to expedite requests to change clearing houses and any new Electronic Data Interchange enrollments. MACs also must accept paper claims. 

The agency also implored Medicare Advantage and Medicare Part D plans to continue to provide access to covered benefits without disruption. Actions include relaxing or removing utilization review filing requirements and prior authorization requirements "while folks like you are dealing with this crisis," Harris added. 

What Is UnitedHealth Group Doing?

"We have literally hundreds and hundreds of people working on this currently to restore services because we understand the impact that is that is having," said Roger Connor, chief executive officer of Optum Insight/UnitedHealth Group. He said that UnitedHealth Group "is making good progress, but there is some work to do."

"Since the cyberattack the company has engaged with several thousand provider organizations to help them with their short-term cash flow challenges," Connor said, "from large regional health systems to small, rural, independent physician practices. 

The company recommends that clinicians who are still experiencing issues watch their series of webinars that explain how to reconnect to claims and payment networks and how to apply for temporary funding assistance. Applications for funding need to be resubmitted each week as needs change. 

Connor said that UnitedHealth Group will not ask for repayment of temporary funds until 45 days after the situation is resolved. 

For clinicians who find UnitedHealth Group's initial estimate of relief money insufficient, the company is offering an additional form to request more through their exception process. 

'No Provider Left Behind'

HHS is talking with all stakeholders, Palm said, "to make sure that no provider is left behind and that we are doubling down all of our efforts to make sure we do the outreach and make the connections with providers who still are struggling."

"I keep questioning how does this keep happening?" Webb asked. Many programs that she uses include certifications that they are safe. "Well, something's not safe, or the hackers are faster at it than the security people are at building barriers." 

"I'm pulling as much off of computers as I can — which is super old school and not really even an option for bigger practices," Webb added. "I'm really wondering if I should just go to paper again."

Send any questions with any questions or concerns for the HHS about the Change Healthcare cyberattack via email.

Damian McNamara, MA, is a staff journalist based in Miami. He covers a wide range of medical specialties, including infectious diseases, gastroenterology and critical care. Follow Damian on Twitter:  @MedReporter.