Change Healthcare, a unit of UnitedHealth Group (UHG), was impacted by a cybersecurity incident in late February that has sent waves through the healthcare industry. Change Healthcare is the largest revenue and payment cycle management provider in the U.S. healthcare system.
According to the New York Times, thousands of healthcare facilities and clinics have experienced disruptions from the cyberattack which took down parts of the company’s system. The disruption prevented healthcare providers from obtaining insurance approval for procedures leading to delays in treatment and payments.
The U.S. The Department of Health and Human Services (HHS) stated that it recognized the impact this attack has had on healthcare operations across the country. The agency vowed to help coordinate efforts to avoid disruptions to care throughout the healthcare system.
HHS is in regular contact with UHG leadership, state partners, and with numerous external stakeholders to better understand the nature of the impacts and to ensure the effectiveness of UHG’s response. HHS has made clear its expectation that UHG does everything in its power to ensure continuity of operations for all healthcare providers impacted by the disruptions.
HHS is also leading interagency coordination of the Federal government’s related activities, including working closely with the Federal Bureau of Investigations (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the White House, and other agencies to provide credible, actionable threat intelligence to industry wherever possible.
According to a Wired report, there is evidence that Change Healthcare paid a $22 million ransom to hacker group BlackCat. If true, it would be among the largest ransoms ever paid from a ransomware attack.
More worryingly, a hacker who was contracted by BlackCat to help penetrate Change Healthcare’s systems alleged that they were not paid for their participation, leaving open the possibility that the sensitive data obtained in the cyberattack could still be publicly released.
Numerous hospitals, doctors, pharmacies and other stakeholders have highlighted potential cash flow concerns to HHS stemming from an inability to submit claims and receive payments. HHS has heard these concerns and is taking direct action and working to support the important needs of the healthcare community.
HHS announced immediate steps that the Centers for Medicare & Medicaid Services (CMS) is taking to assist providers to continue to serve patients. CMS will continue to communicate with the healthcare community and assist, as appropriate. Providers are being told to continue to work with all their payers for the latest updates on how to receive timely payments.
