Change Healthcare hack cripples payment systems across health providers – The Washington Post

The fallout from the hack of a little-known but pivotal health-care company is inflicting pain on hospitals, doctor offices, pharmacies and millions of patients across the nation, with government and industry officials calling it one of the most serious attacks on the health-care system in U.S. history. Get a curated selection of 10 of our best stories in your inbox every weekend. ArrowRight The Feb. 21 cyberattack on Change Healthcare, owned by UnitedHealth Group, has cut off many health-care organizations from the systems they rely on to transmit patients’ health-care claims and get paid. The ensuing outage doesn’t appear to affect any of the systems that provide direct, critical care to patients. But it has laid bare a vulnerability that cuts across the U.S. health-care system, frustrating patients unable to pay for their medications at the pharmacy counter and threatening the financial solvency of some organizations that rely heavily on Change’s platform.Change Healthcare is a juggernaut in the health-care world, processing 15 billion claims totaling more than $1.5 trillion a year, the company says. It operates the largest electronic “clearinghouse” in the business, acting as a pipeline that connects health-care providers with insurance companies who pay for their services and determine what patients owe. It supported tens of thousands of physicians, dentists, pharmacies and hospitals, handling 50 percent of all medical claims in the United States, the Justice Department wrote in a 2022 lawsuit that unsuccessfully tried to block UnitedHealth from acquiring the company.AdvertisementCiting internal company documents,

prosecutors wrote that Change had concluded that the “health care system … would not work without Change Healthcare.”The hackers, a ransomware gang once thought to have been crippled by law enforcement, stole data about patients, encrypted company files and demanded money to unlock them. The company shut down most of its network in February as it tries to recover.Quantifying the impact remains a moving target, with the severity depending on how much organizations relied on Change. But three senior officials at the Department of Health and Human Services described it as serious.Adding to the urgency was Senate Majority Leader Charles E. Schumer, who sent a letter to the Centers for Medicare and Medicaid Services on Friday, asking it to make accelerated payments to hospitals, pharmacies and other providers who have been impacted by the outage. Patients can’t get information on whether insurance will cover a treatment, while hospitals are struggling to bill patients and receive payments, the New York Democrat wrote.Advertisement“The delay in payments is costing hospitals across America millions for every single week this continues, and people are even struggling to get prescriptions filled at their local pharmacy,” Schumer said in a statement Sunday. “That’s why I am calling on CMS to use its authority to cut through the red tape and provide accelerated and advanced payments to impacted health care providers just as they did during covid.”“We recognize the impact this attack has had on health-care operations,” an HHS spokesperson told The Washington Post, adding that the agency is working with UnitedHealth to avoid

disruptions to patient care. The incident underscores the “urgency of strengthening cybersecurity resiliency across the ecosystem,” the spokesperson said.Molly Smith, group vice president for public policy at the American Hospital Association, said Sunday that as of now: “Our assessment is that this is the most significant attack on the health-care system in U.S. history.”AdvertisementAt one point, Smith said, the association heard from hospitals that were not discharging certain patients because they couldn’t get their medications filled. Much of that disruption is being worked out, as health-care providers resort to submitting claims manually, she added.WorkaroundsOptum, a health-services company that is also owned by UnitedHealth, said it has established a temporary assistance program to extend cash to organizations whose payment systems have been affected — short-term loans that would need to be repaid once Change is back up and running. A senior HHS official said the agency is working with UnitedHealth to make sure the program is effective.A UnitedHealth spokesperson said it had no updates Sunday but noted it has enlisted consultants and is working with law enforcement. Since the hack, UnitedHealth has said that it has made “multiple workarounds to ensure people have access to the medications and the care they need.”AdvertisementSimply switching from Change to another vendor is sometimes complex, according to industry officials and pharmacists, due to contractual agreements and technical reasons. In addition to routing claims to insurance companies, Change also scrubs the claim information to make