Outages from Change Healthcare cyberattack causing financial ‘crisis’ for doctors

Small private practices and healthcare providers are facing increasing financial pressures as key reimbursement processes are down for a ninth day, following a cyberattack on Change Healthcare.

Change Healthcare provides billing and cash cycle management tools that help streamline transactions between providers and major insurance companies. Its parent company UnitedHealth Group discovered that a cyber attack breached part of the unit’s information technology network on February 21, according to a request from the US Securities and Exchange Commission.

As a result, the company isolated and disconnected the affected systems “as soon as it detected” the threat, the filing said.

The fallout caused widespread disruption throughout the US health care system.

Doctors told CNBC that the outages have left them unable to assess patients’ eligibility for treatment or fill prescriptions electronically, creating more administrative responsibilities for already overburdened staff. ministry. Perhaps more importantly, providers are unable to receive payments from insurers, effectively grinding the revenue of many health systems to a halt.

Small and medium-sized businesses that rely on cash flow returns to operate make difficult decisions about how to stay afloat. If the outage lasts too long, experts say some practices may have to close their doors for good.

Dr. Purvi Parikh, an allergist and immunologist with a private practice in New York City, told CNBC that the crime has been “chaos” and “a lot of stress.” Like many others, he said his practice has not been able to receive payments from insurers for patient visits, making it difficult for the practice to cover operating costs. such as wages and medical supplies.

Switching to the new platform could take weeks, Parikh said, so there’s no immediate action. As of Thursday, Change Healthcare has not shared an update on when it expects its services to come back online.

“The most frustrating thing is that no one has any answers or solutions,” Parikh said. “We’re kind of stuck.”

Change Healthcare on Thursday said the Blackcat ransomware group was responsible for the attack. Blackcat, also called Noberus and ALPHV, steals sensitive data from organizations and threatens to publish it unless a ransom is paid, according to a December release from the United States Department of Justice.

The company said it is working with legal investors and third-party consultants such as Mandiant, which is owned by Google, and cybersecurity software vendor Palo Alto Networks to investigate the breach.

“Patient care is our top priority and we have many ways to make sure people have access to the medicines and care they need,” Change Healthcare said in a statement to CNBC. .

Dr. Kiranjit Khalsa, an allergist and immunologist who runs a private practice in Scottsdale, Arizona, said his staff has been working long hours to try to handle the extra work due to the crime, as well as taking orders. by hand.

He said the reimbursement issues have been a “huge burden,” as he worries about how he can continue to support his patients and staff. Khalsa is considering reducing staff hours and even closing the clinic for a few days.

“I’m worried about taking care of them,” Khalsa told CNBC in an interview. I also worry about: How will I get this money if it doesn’t arrive? Do I need to borrow money to keep the clinic running?

Even as Change Healthcare processes come back online, there are many unanswered questions about what will happen next, according to Dr. Dan Inder Sraow, an interventional cardiologist with a private practice in Phoenix, Arizona. He said it was unclear whether Change Healthcare would take on the responsibility of processing all the claims or would need to hire additional staff to help.

“I don’t think people know that the real people who provide the services can’t withdraw money for those services,” Dr. Sraow told CNBC. “We don’t know how long that will take, and it’s a dangerous thing, so dangerous.”

Dr. Jesse Ehrenfeld, president of the American Medical Association, said he spent days fielding calls from concerned colleagues.

He said he spoke to one doctor who specializes in oncology treatment and he only has two weeks’ worth of money. If a cutoff occurs, the practice will not be able to purchase the chemotherapy that its patients depend on for treatment.

With many providers still operating with thin blades, Ehrenfeld says there is a chance that some will go out of business.

“We have a lot of unexpected trends, especially small trends, where they’re breaking it,” Ehrenfeld told CNBC in an interview. “Any change in the system where, ‘Oh, you don’t get your checks for two weeks,’ is obviously a situation that puts practices at risk.”

In 2022, Change Healthcare merged with provider Optum, which serves more than 100 million patients in the United States and is owned by UnitedHealth, the nation’s largest health care company. at market price.

The American Medical Association strongly opposed the merger, writing in a letter to the DOJ that the organization could restrict competition, give UnitedHealth access to large data stores and harm patient care.

The merger eventually ended, but the DOJ recently launched an antitrust investigation into UnitedHealth, according to a Wall Street Journal report Tuesday.

“It’s like a perfect storm of regulatory issues [and] lack of competition – and unfortunately, the people who will really suffer are the patients and the individuals who work in the health system,” said Dr. Ravi Parikh, a retinal specialist with a good practice and practice New York City.

The cyberattack has left Parikh’s clinic with no way to get payments for the expensive medicines it supplies. He said he has been thinking about contingency plans, such as looking for cheaper drugs and asking other patients to pay in advance, but his goal is to provide the best care possible.

“The health system may come to a halt because many clinics and pharmacies may not function,” said Parikh.