Government and industry experts describe the hacking of a small but vital health-care company one of the biggest attacks on the U.S. health system. It harms hospitals, clinics, pharmacies, and millions of patients.
Details of the Attack:
The Feb. 21 cyberattack on UnitedHealth Group-owned Change Healthcare cut off several health-care businesses from their claims transmission and payment systems. No vital patient care systems were affected by the interruption, but it has revealed a vulnerability that spans the U.S. health-care system.
The attack impacted millions of patients and organizations: Patients struggling to pay for medications at pharmacies; and Financial stability of organizations relying on Change’s platform.
Change Healthcare and its Role in the System:
Change Healthcare processes 15 billion claims worth $1.5 trillion annually. It manages the largest electronic “clearinghouse” in the industry, connecting healthcare providers with insurance companies
Response to the Attack:
A ransomware organization seized patient data, encrypted company files, and demanded money to unlock them. Change Healthcare shut down most of its network in February to recover. The impact of the attack depends on how heavily organizations relied on Change Healthcare.
Calls for Action:
- Senate Majority Leader Charles Schumer urged the Centers for Medicare and Medicaid Services to expedite reimbursements to affected providers.
- The Department of Health and Human Services (HHS) is working with UnitedHealth to prevent patient care disruptions and highlights the need for stronger cybersecurity.
Industry Reaction:
- American Hospital Association called the attack “the most significant attack on the health-care system in U.S. history.”
- Hospitals are struggling to discharge patients and obtain payments due to the attack.
- Industry executives say switching vendors is difficult due to contracts and technical issues.
Workarounds and Challenges:
- UnitedHealth created a temporary program to lend money to affected companies.
- Submitting claims on paper forms is used as a workaround, but it has limitations.
- Switching clearinghouses is not a viable solution due to technical challenges and lack of functionality.
Financial Impact:
- Hospitals are facing cash flow problems due to delayed payments.
- The Association of American Physicians and Surgeons sees the attack as evidence of problems with the current payment model.
Impact on Hospitals:
- The cyberattack affected midsize to big hospital systems nationwide.
- Hospitals are struggling to process claims and obtain reimbursements.
- The attack places a significant burden on the financial sustainability of the healthcare system.
Specific Examples of Impact:
- University Hospital system in Cleveland faced challenges with patients getting prescriptions filled.
- Florida hospitals are facing hundreds of millions of dollars in lost billings.
- Smaller hospitals are particularly vulnerable due to limited cash flow reserves.
