Cyberattack on Change Healthcare
On February 21, a cyberattack on Change Healthcare, a subsidiary of UnitedHealth Group, put the U.S. healthcare system in a tailspin. The medical technology company, which specializes in revenue and payment cycle management under the Optum umbrella, handles approximately 15 billion healthcare claims transactions per year. Given the footprint of the company, disruptions to patient care have been widespread. Many hospitals and healthcare providers are now at risk of running out of cash, unable to process medical claims. Patient care has suffered as the attack has prevented providers from obtaining prior authorizations for care as well as checking insurance eligibility.
HHS Issues Guidance to Health Plans
The U.S. Department of Health and Human Services (HHS) released a statement in response to the attack, noting that the agency’s first priority is to prevent disruptions to care. The announcement stated the immediate steps that the Centers for Medicare & Medicaid Services (CMS) is taking to aid healthcare providers in caring for patients. Of those steps that are relevant to patients, CMS has promised to issue guidance to Medicare Advantage (MA) plans and Part D sponsors encouraging them to alleviate or ease prior authorization and utilization management requirements (e.g., step therapy and non-medical switching). CMS will encourage Medicaid and CHIP plans to do the same.
UnitedHealth Group Proposes “Workarounds” for Providers
UnitedHealth Group has proposed “workarounds” for providers to submit claims through alternative methods while the company works on restoring its services. However, implementing the new procedures has put a strain on pharmacists and healthcare providers. Some providers have reported approximating patients’ copays for prescriptions due to their inability to check insurance information, while others are charging patients full price to receive their medications. Consequently, patients have reported going without their medications as the full price of their prescriptions are unaffordable without insurance.
Cyberattacks on the Rise
In HHS’s statement, the agency noted, “[t]his incident is a reminder of the interconnectedness of the domestic health care ecosystem and of the urgency of strengthening cybersecurity resiliency across the ecosystem.” The Change Healthcare attack, which has been labeled as the most serious cybersecurity incident against a U.S. healthcare organization in history, highlights the increasing cyber threats faced by our healthcare industry. Ransomware attacks are on the rise, and healthcare organizations are a prime target for cybercriminals. The Infusion Access Foundation and our sister organization, National Infusion Center Association, are urging Congress to respond to this attack and encouraging healthcare organizations to take the proper precautions in response, including contingency plans to mitigate disruptions to patient care.
