The Washington PostDemocracy Dies in Darkness

Officials rush to help hospitals, doctors affected by Change Healthcare hack

Updated March 5, 2024 at 6:30 p.m. EST|Published March 5, 2024 at 12:45 p.m. EST
Christine Meyer, who owns a primary care practice near Philadelphia, has watched payments from insurers dwindle after a cyberattack. (Rachel Wisniewski for The Washington Post)
8 min

Federal officials and health-industry executives Tuesday said they were racing to help hospitals and health-care providers that are at risk of running out of cash after a cyberattack knocked out the nation’s largest processor of medical claims and put pressure on patient care.

The Department of Health and Human Services unveiled a strategy that encouraged private health plans to advance funding to the hardest-hit organizations and relax requirements that often slow the billing process, among other steps. The Centers for Medicare and Medicaid Services (CMS) said it would consider individual requests for accelerated payments, akin to those made during the coronavirus pandemic, recognizing that “hospitals may face significant cash flow problems from the unusual circumstances impacting hospitals’ operations.”

Aledade, the nation’s largest network of independent primary care practices, also announced that it would advance up to $100 million to its physician practices across the country.

Many physician practices are facing “catastrophic” funding shortfalls, Farzad Mostashari, Aledade’s CEO, said in an interview with The Washington Post, estimating that as many as 25 percent of physician practices are exhausting their cash reserves. Mostashari added that his company stood up an emergency-response team last week — just like in the early days of the coronavirus pandemic, when elective procedures across the country were canceled and health-care revenue dried up.

“It felt very much like it did on March 11, 2020,” he said.

Many hospitals and health-care providers have been unable to bill for services since the Feb. 21 hack of Change Healthcare, part of UnitedHealth Group, and it is unclear when the situation will be resolved. Industry and government officials have said the hack is among the most serious cyberattacks ever made on the health-care system. Federal officials, including HHS Secretary Xavier Becerra and Deputy Secretary Andrea Palm, have held emergency meetings with administration leaders and UnitedHealth about how to address the widening health-care payment crisis, officials told The Post.

Health-care advocacy groups Tuesday said the Biden administration’s response has been insufficient, with the American Hospital Association urging the government to do more following “the most significant and consequential incident of its kind against the U.S. health care system in history.”

“The magnitude of this moment deserves the same level of urgency and leadership our government has deployed to any national event of this scale before it,” Richard J. Pollack, the hospital association’s CEO, said in a statement. “The measures announced today do not do that and are not an adequate whole of government response.”

Frustration with UnitedHealth and federal officials has mounted as hospitals and medical practices, unable to submit medical claims and get paid by insurers, say cash reserves are drying up. Patients in some cases are experiencing delays in care and have been unable to use discount cards or patient-assistance programs that run through the electronic clearinghouse operated by Change Healthcare, according to health-care providers and industry officials.

Meanwhile, physicians said emergency funding UnitedHealth made available last week, offering short-term loans through its Optum health services arm, is woefully insufficient. Some doctors who are waiting for hundreds of thousands of dollars in bills to be paid have reported receiving offers of several hundred or a few thousand dollars.

UnitedHealth did not respond to questions about Optum’s loans and other criticism.

The company “is working diligently” to respond to the federal government’s recommendations, UnitedHealth said, adding that “we look forward to the additional guidance forthcoming on how we can be helpful to providers during this challenging time.”

Christine Meyer, who owns a primary care practice outside Philadelphia that serves 20,000 patients, has watched payments from insurance companies dwindle by the day. Typically, her practice gets between $20,000 and $70,000 a day in deposits, but Tuesday it received barely $1,600 — the lowest in 20 years, Meyer said.

“I’m terrified our cash will only last so long,” said Meyer, who has applied for a loan to buy time.

The impact varies across the country. Providence, a large health system headquartered outside Seattle, said Monday it had “resumed normal operations,” although some of its pharmacies are having to take extra measures to bill insurance and dispense medications to patients.

Some lawmakers said Tuesday that they believe congressional hearings are necessary.

“I plan to participate in all relevant hearings and briefings related to this breach to determine what went wrong and where we can make improvements to thwart future attack,” Rep. Gus Bilirakis (R-Fla.), who chairs a House panel that oversees health-care data, wrote on Facebook.

The cyberattack has gripped the health industry, with officials saying it underscores the growing digital risks facing the health system.

“For years we’ve complained that health care wasn’t more digitized and needed to be,” said Jim Parker, a senior HHS official during the Trump administration. “And of course, there’s always a downside to that, which is that it also needs to be secure.”

The hackers stole data about patients, encrypted company files and demanded money to unlock them. Change Healthcare subsequently shut down most of its network as it tried to recover. UnitedHealth has declined to address reports that the ransomware gang ALPHV received a $22 million payment. “We are focused on the investigation,” the company said in a statement Monday.

Change Healthcare processes 15 billion medical claims a year, far more than any other company, and is a critical pipeline connecting health-care organizations with insurance companies who review their claims, pay for their services and determine the costs of care for patients.

CMS has told providers to contact their Medicare administrative contractors to enroll in a new electronic clearinghouse to process claims and has instructed the contractors to expedite the onboarding and billing process. Many organizations have taken advantage of a bare-bones electronic platform set up by Availity, a rival to Change Healthcare that also operates a vast clearinghouse for medical claims.

Availity said its volume of claims has surged by up to 70 percent since the Change outage, as it works through backlogs resulting from the cyberattack. It has connected more than 300,000 providers through this platform, which the company said it is offering for free.

“We’re building some really strong relationships with people in need right now,” Russ Thomas, Availity’s CEO, said in an interview. He is particularly worried for smaller health operations, saying the current outage could be even more disruptive than the coronavirus.

“As a physician, you’ve got to provide care for the patients. They just can’t bill for it right now,” Thomas said.

Meyer, the Philadelphia-area physician, said switching to a platform such as Availity’s free service isn’t an option, because it requires an electronic file with patient claim information that her software vendor can’t generate. So her staff is manually entering claims into the electronic portals of insurance companies that offer this, while submitting claims on paper to Medicare.

Meyer said she has so far managed to avoid impact on patient care but worries that if her cash continues shrinking, she might have to send doctors home.

“For this to happen in the blink of an eye, without any warning, for me to be scrambling to pull together cash, it’s ridiculous,” Meyer said.

HHS said Tuesday that payers — such as insurance companies — are extending funds to providers whose billing systems have been knocked offline.

AnneMarie Czyz, CEO of Rome Health, said her health-care system in central New York has been unable to process 3,200 claims totaling $13.4 million since the hack and is facing a loss of $2.3 million a week. Optum offered $11,700 a week, which must be repaid, she said, calling it a “a lot of work for a very low return on our crippling circumstances at the moment.”

Czyz’s staff is trying to submit claims manually, she said. “It’s like going back to the stone ages in health care, hand-entering everything we’re doing,” she said.

UnitedHealth executives have been scrambling to develop a response as the crisis has deepened.

Patrick Conway, a senior UnitedHealth executive, canceled his keynote address at a health-care conference Tuesday in New York because of the evolving situation, organizers said.

Conway’s keynote was replaced by a roundtable on cyberthreats in health care, where panelists — including Virginia McFerran, a former Optum executive — bemoaned the situation facing the industry.

“There’s so many different ways that bad things can happen,” McFerran said.