Our Take: Fallout from Change Healthcare cyberattack reaches critical point for some providers; UHG says full functionality still over a week away
What began as a network outage that seemed initially to affect mostly pharmacy services could soon have a devastating effect on countless providers and physician practices.
The BlackCat/ALPHV ransomware attack on Change Healthcare on Feb. 21 has touched every facet of the U.S. health care system, from hospitals and health systems to pharmacies, payers, and patients. While UnitedHealth Group (UHG), who owns Change Healthcare, continues working to restore its IT systems so that all services are once again available, the repercussions of the attack could prove fatal for relatively small providers that don’t have sufficient cash reserves to keep them afloat in the meantime.
Change Healthcare processes 15 billion health care transactions annually and touches one in every three patient records, according to the American Hospital Association. Providers use the clearinghouse to verify patients’ eligibility, determine copays and cost estimates, request prior authorizations, submit claims for payment, and process prescriptions.
According to an update on the UHG website, claim submission and payment transmission services for electronic prescribing were restored and the Change Healthcare Pharmacy Network was back online as of late last week.
But Change Healthcare’s electronic payment functionality isn’t expected to be available until March 15, and the company anticipates starting to test and reestablish connectivity to its claims network and software on March 18, “restoring service through that week.” Those timelines are only estimates; it could take longer to get all of Change Healthcare’s services operating normally.
As a workaround, some providers have been using other clearinghouses if they already had an established relationship. Enrolling with a new clearinghouse, though, takes time.
Other providers have resorted to filing paper claims, if that’s an option, but it can take several months to receive payment that way. Other processes, such as confirming eligibility and obtaining prior authorization, can be handled by phone — but these methods are more labor- and time-intensive, which means hiring more staff or pulling existing staff away from other work they would normally be doing.
UHG’s Optum launched a temporary funding assistance program on March 1 to help providers experiencing cash flow issues. At first the program was open only to providers who received payments from payers that were processed by Change Healthcare, but the company expanded the program to include other providers on a case-by-case basis as a “funding mechanism of last resort.”
UnitedHealthcare is advancing funds on a weekly basis for its provider partners in an amount representing the difference between their historical payment levels and what they’ve been receiving since the attack. UHG urged other payers to do likewise.
The Department of Health and Human Services (HHS) said in a press release that it has instructed providers participating in Medicare to contact a Medicare Administrative Contractor (MAC) if they need to switch to a new clearinghouse, noting that CMS has instructed the contractors to expedite the electronic data interchange enrollment process.
CMS has put other “flexibilities” in place as well, such as encouraging Medicare Advantage (MA) organizations and Part D sponsors to remove or relax prior authorization, other utilization management, and timely filing requirements until the outage is resolved, and encouraging MA plans to offer advance funding to providers most affected by the cyberattack.
HHS advised providers to take advantage of funds that payers are making available while billing systems are offline and said hospitals could submit accelerated payment requests to the servicing MACs for individual consideration.
Rick Pollack, president of the American Hospital Association, said in separate statements that UHG’s and HHS’ actions thus far are inadequate and that hospitals will need more assistance.
Dr. Jesse Ehrenfeld, president of the American Medical Association (AMA), said the actions taken by HHS and CMS “are a welcome first step” but urged federal officials to include financial assistance, such as advanced payments, for physicians. He said the “unparalleled cyberattack and disruption threatens the viability of many practices, particularly small practices and those in rural and underserved areas.”
The AMA press release mentioned an estimate from First Health Advisory that placed the outage’s cost to health care providers at more than $100 million daily.
Larger health systems may have experienced only minimal disruptions, as some have been able to rely on backup options already in place. They are also likely to have enough financial reserves to see them through until normal operations resume.
But smaller providers, including community oncology practices and independent physician groups, aren’t in a position to weather this storm for more weeks. Some have had to obtain loans to make payroll, and some have begun to wonder how they’re going to keep the doors open.
Our Take: The ramifications of Change Healthcare’s breach won’t be fully known for months or longer.
It appears that BlackCat/ALPHV received a payment of approximately $22 million in bitcoins, according to Reuters and WIRED, leading to speculation that UHG paid the ransom — though that has not been officially confirmed.
UHG has limited its comment to stating that it is “focused on the investigation and the recovery.”
If the ransom was paid, BlackCat/ALPHV and other hackers will be emboldened, especially after witnessing how widespread the disruption has been and how effectively they have crippled the country’s health care system. The health care industry was already a prime target for cyberattacks. If health systems weren’t motivated to increase their IT security, they are now.
While UHG may have shelled out $22 million, smaller providers and patients are also paying a steep price as a consequence of the cyberattack on Change Healthcare.
Unless UHG suddenly steps up and allocates some of its billions in profits to rescuing provider practices on the brink of closing, or the federal government intervenes with immediate financial assistance, it’s a safe bet that there will be casualties.
At least half a dozen lawsuits have been filed in Tennessee and Minnesota, where Change Healthcare and UHG are based, and most are seeking class-action status. Some were filed by patients who had difficulty accessing (or could not access) prescription medications or health care services they needed because of the outage.
And at least one lawsuit contends that Change Healthcare/UHC did not have adequate security measures in place to protect patients’ personal information. If millions of records were accessed during the cyberattack, as BlackCat/ALPHV asserted, then all of the people named in those records have been exposed to an indefinite risk for identity theft and fraud.
“Born out of UHG’s negligence, patients and health care providers alike will feel the immediate effects of the network outage for some time,” the lawsuit alleges. “And to make it worse, patients who had their PHI stolen will feel the sting of this data breach for their lifetime. All the while, defendants continue to rake in billions of dollars off the backs of the patients and providers whose confidential and highly sensitive information they promised to protect.”
On a closing note, we’ll point out that the Department of Justice did try to block UHG’s acquisition of Change Healthcare a couple of years ago. Would the ransomware attack still have taken place, had the acquisition not been completed? Maybe. But the ripple effect wouldn’t have been nearly as wide-reaching.
This article published by New York Magazine’s Intelligencer provides additional insight into how “corporate greed” exacerbated the situation.
What else you need to know
Wausau, Wis.-based Aspirus Health and Duluth, Minn.-based St. Luke’s completed their affiliation, forming an expanded nonprofit health system with 19 hospitals, 130 outpatient locations, and nearly 14,000 staff members, including 1,300 employed physicians and advanced practice clinicians. The health system serves patients across northeastern Minnesota, northern and central Wisconsin, and Michigan’s Upper Peninsula. Headquarters for the newly combined organization are in Wausau, supported by a corporate office in Duluth. Matt Heywood will continue to serve as president and CEO of Aspirus Health, and Dr. Nicholas Van Deelen and Eric Lohn will continue to serve as co-presidents of St. Luke’s. The health systems announced their intention to affiliate last summer. Under their agreement, Aspirus will invest at least $300 million in St. Luke’s over eight years and expand Aspirus Health Plan into St. Luke’s service area within two years, according to a press release.
Walgreens will undertake a strategic review in April, CEO Tim Wentworth revealed during a session at the TD Cowen Health Care Conference. He said the review would entail evaluating the future footprint of Walgreens’ retail stores, in terms of both the number and types of stores by market, noting that “a big piece of work” during the review process will be to clarify the company’s strategy for the back and the front of the stores, referring to pharmacy and retail. The review will encompass other Walgreens assets as well, including the VillageMD primary care centers, Summit Health/CityMD, CareCentrix, and the Shields Health specialty pharmacy business. Addressing recent speculation that Walgreens is considering selling Shields, Wentworth said, “Whatever you may have read, don’t believe it.” Wentworth said the strategic review would serve as a starting gun for the work Walgreens needs to deliver and that the ensuing process would not be “a 12-month turnaround story,” indicating it could take substantially longer.
Separately, as part of the $1 billion cost-cutting initiative Walgreens announced last fall for this year, the company will close its six VillageMD locations in Illinois by mid-April, including one that just opened in Elk Grove in August, Healthcare Dive reported.
Community Health Systems is the first national health system to sign an agreement to buy pharmaceutical supplies from Mark Cuban Cost Plus Drugs. Initially, the Franklin, Tenn.-based health system’s affiliated hospitals in Texas and Pennsylvania will buy drugs commonly used in the emergency department and intensive care unit, such as epinephrine and norepinephrine, according to a press release. Eventually, the plan is to scale the partnership “in numerous and meaningful ways.” In addition to lowering costs, CHS said its collaboration with Cost Plus Drugs would address drug supply issues in the hospital setting, such as mitigating shortages, reducing pharmaceutical waste, and preventing dosage errors. Altogether, CHS’ subsidiaries own or lease 71 affiliated hospitals and operate more than 1,000 sites of care across 15 states.
The timing of the CHS announcement dovetailed with the opening of Cost Plus Drugs’ $11 million manufacturing plant in Dallas last week. The two drugs that Cost Plus Drugs will supply to CHS’ hospitals are the first to be manufactured at the facility, with pediatric oncology drugs soon to follow, Dr. Alex Oshmyansky, the company’s CEO and co-founder, said during a roundtable at the White House. Dr. Oshmyansky said the plant’s advanced robotic and AI computer vision technology will make it possible to pivot from making one type of drug to another within a few hours, which will help ease drug shortages as they occur.
UnityPoint Health achieved more than $100 million in savings and revenue enhancements over the span of eight years through “dozens and dozens” of projects centered on data analytics, Health Catalyst told attendees of the annual Healthcare Analytics Summit. According to a news release, the health system saved $41 million in costs over a two-year period by decreasing length of stay, reduced spending by $32 million in one year as the result of AI-enabled care management improvements, and lowered direct costs by $17.4 million during six years by decreasing unnecessary red blood cell transfusions. The health system also had a 39% relative reduction in emergency department visits and a 54% relative reduction in inpatient admissions. Since 2012, UnityPoint Health has had $31 million in average annual shared savings, according to the release, and a 15:1 benefits-to-cost ratio over the last seven years. The health system serves communities in Iowa, Illinois, and Wisconsin through a network of 39 hospitals and more than 400 clinics and other facilities.
A federal court in Delaware ruled against AstraZeneca in the drugmaker’s attempt to challenge drug pricing provisions in the Inflation Reduction Act. In his ruling, Judge Colm Connolly wrote that drug companies are not “entitled to sell the government drugs at prices the government won’t agree to pay,” Reuters reported. “AstraZeneca’s ‘desire’ or even ‘expectation’ to sell its drugs to the government at the higher prices it once enjoyed does not create a protected property interest,” he added. In response to the ruling, AstraZeneca said it would evaluate its path forward, according to Reuters. A court in Texas dismissed a similar lawsuit brought by the Pharmaceutical Research and Manufacturers of America (PhRMA) last month, and an Ohio court dismissed a similar case in September filed by the U.S. Chamber of Commerce. Meanwhile, Bristol Myers Squibb, Janssen, Novartis, and Novo Nordisk presented oral arguments against the Drug Price Negotiation Program in a New Jersey federal court on Thursday, and PhRMA appealed its loss in Texas on Friday.
Danville, Pa.-based Geisinger has a new president: Dr. Terry Gilliland, who will also serve as CEO when Dr. Jaewon Ryu, Geisinger’s current CEO, transitions to the role of CEO at Risant Health. Most recently, Dr. Gilliland was chief medical officer and chief science officer at Cogitativo, an AI and machine learning company with a focus on health care. He has also held senior leadership roles at Blue Shield of California and Norfolk, Va.-based Sentara Healthcare, according to the announcement. Risant Health is a nonprofit organization based in Washington, D.C., that Kaiser Foundation Hospitals launched last year to expand and accelerate the adoption of value-based care in multi-payer, multi-provider, community-based health system environments. Pending regulatory approval, Geisinger is set to become the first health system to join Risant Health; Dr. Ryu will become Risant Health’s CEO at that time.
What we’re reading
Blind Spots, Shortcuts, and Automation Bias — Researchers Are Aiming to Improve AI Clinical Models. JAMA, 2.28.24
Hospitals’ Drug Price Markups Incentivize Consolidation And Reduce Funding For Pharmaceutical Innovation. Health Affairs, 3.6.24
