Change Healthcare cyberattack called ‘most significant’ on health sector in U.S. history

The ripple effects of the Change Healthcare cyberattack are becoming more clear, and hospitals and health systems are losing billions of dollars.

Hospitals are seeing serious financial difficulties that are worsening by the day, and threatening the solvency of some providers, officials say. Change Healthcare provides a wide array of services to hospitals, including billing, prescription orders, and solutions for insurance authorizations for treatments. Medical groups are struggling with delays in cash payments.

Hospitals have been dealing with the fallout for nearly two weeks. United HealthGroup, Change Healthcare’s parent company, said the cyberattack was discovered Feb. 21.

Mary Mayhew, president and CEO of the Florida Hospital Association, tells Chief Healthcare Executive® that Florida hospitals alone are losing hundreds of millions of dollars each week of the disruption. So the impact can quickly surpass $1 billion, she says.

“You have a number of large hospitals and health systems in Florida that are 100%, dependent on Change Healthcare to submit and process claims,” Mayhew says. “Hospitals are banking on daily payments to support their operations to meet payroll.”

While hospitals received some payments from claims submitted prior to the attack, Mayhew says, “We're now in day 13. That's coming home to roost, that you are no longer getting those payments. And so there is no way to overstate this, this is a massive attack on the healthcare delivery system with incredible ramifications.”

The American Hospital Association sent a letter Monday to legislative leaders, including Senate Majority Leader Charles Schumer and House Speaker Mike Johnson, urging Congress to take steps to help hospitals. The AHA says billions of dollars have stopped flowing to hospitals and other providers. The association describes the incident as ‘the most significant cyberattack on the U.S. health care system in American history.”

“We are now on day 13 of this crisis and urgently need your support to help minimize further fallout from this attack,” the letter states.

• Read more: Hospitals criticize UnitedHealth Group assistance program

The association is calling on Congress to press the U.S. Department of Health & Human Services to speed up Medicare payments to hospitals, and to push UnitedHealth Group to offer financial assistance and communicate directly with providers. The AHA says the attack requires a “whole of government response.”

“We therefore urge Congress to consider any statutory limitations that may exist for any federal agencies that can assist hospitals at this critical moment. If such limitations exist, the Executive Branch may be unable to provide solutions to ensure our nation’s provider network remains solvent and serves patients,” the AHA letter states.

• Read more: A look at the group that’s behind the Change Healthcare cyberattack

Fallout could last for months

Schumer has also reached out to the Centers for Medicare & Medicaid Services imploring the agency to take steps to speed payments to hospitals, providers and pharmacies. He noted the fallout from the attack on hospitals in New York and across America.

“Hospitals, pharmacies, and healthcare providers are facing an immediate and rapidly intensifying adverse impact on their cash flow and, ultimately, on their financial solvency,” Schumer wrote in his letter to CMS. He added, “Many hospitals are approaching a financial cliff where they will no longer be able to rely on their cash on hand.”

The Massachusetts Hospital Association says its members report that “the disruption ranged from minimal to significant depending on how many Change Healthcare systems the hospital was using.”

“This is a serious disruption for every Massachusetts healthcare organization that relies on Change Healthcare for their daily operations – especially those that are now unable to get paid for the various services they provide to patients,” Karen Granoff, the senior director of managed care for the Massachusetts Hospital Association, said in a statement.

Nicole Stallings, president & CEO of the Hospital & Healthsystem Association of Pennsylvania, said Monday that the ramifications may be felt for some time.

"This unprecedented cyberattack has the potential to cause significant negative operational and financial consequences on hospitals, other providers, and the communities they serve for months to come,” Stallings said. “Hospitals are reporting a range of disruptions to patient care including difficulties verifying patient eligibility and coverage, confirming cost-sharing, and communicating pharmacy prescriptions. “Hospitals relying on the Change Healthcare platform are still unable to submit claims or receive payments,” Stallings added. “As the situation continues, more hospitals will be in financial jeopardy and patient care could be impacted.”

The Washington State Hospital Association said it is seeing some of the problems others are experiencing around the nation.

“We are most concerned with how this may disrupt patient care,” the association said in a statement. “We have heard of patients unable to fill prescriptions, which can lead to health crises and emergency room visits. As the extent of the attack unfolds, we are also concerned about pre-authorizations, referrals and eligibility checks. We are already hearing serious concerns about the impact on hospitals to receive payments for their services, which is further stressing hospitals that are already struggling financially.”

Brian Peters, CEO of the Michigan Health & Hospital Association, said the Change Healthcare cyberattack illustrates that healthcare is a “top target for cybercriminals due to the high-value of sensitive health information healthcare organizations are required to share across the healthcare continuum.”

“We are aware the cybersecurity event has impacted healthcare services, including patients’ ability to receive prescriptions and hospital billing,” Peters said in a statement. “However, the impact varies by organization, depending on each hospital’s or health systems’ existing relationships with Change Healthcare.”

The Ohio Hospital Association says it hasn’t surveyed all of its members, but said it has heard anecdotal reports of patients who “have struggled to obtain prescriptions or have faced delays in scheduling care as well as disruptions on hospitals’ cash flows.”

• Read more: These are the 11 biggest health data breaches in 2023

‘An immense crisis’

The American Medical Association is also speaking out about the financial fallout for physicians and urging the government to move to support doctors. The AMA pointed to an analysis from First Health Advisory stating that the disruption from the cyberattack is costing healthcare providers $100 million each day.

Jesse M. Ehrenfeld, the AMA’s president, said in a statement, “This massive breach and its wide-ranging repercussions have hit physician practices across the country, risking patients’ access to their doctors and straining viability of medical practices themselves.”

“This unparalleled cyberattack and disruption threatens the viability of many practices, particularly small practices and those in rural and underserved areas. This is an immense crisis demanding immediate attention,” Ehrenfeld said.

Change Healthcare has begun a temporary assistance program offering funds to some providers, which providers will need to repay when systems are restored, the company says. The American Hospital Association has said some providers won’t be eligible to participate, and also said the terms of the assistance are onerous.

Change has also launched a new version of its ePrescribing service, which it says it has tested with multiple retail pharmacies.

Mayhew, head of the Florida Hospital Association, says some of the workarounds Change Healthcare has developed include manual processes for submitting claims that are time-consuming.

“It is not easy to take sophisticated automated claims processing systems and revert back to manual submissions,” Mayhew says. “You don't just flip a switch and change from one claims clearinghouse to another. It's not practical. It's not realistic. And it's incredibly time consuming and expensive.”

The disruptions have been especially costly to smaller hospitals, and physician practices, Mayhew says.

“I've got a lot of small rural hospitals where this is going to be a significant financial change,” Mayhew says. “I've got large health systems, 100% dependent on Change Healthcare, and again, they might have some flexibility to lean in on their reserves, which rarely do you want to use your reserves for operating expenses.

“But when you talk about private independent physician practices, small and midsize, some of them may not be able to weather the storm,” she says.

• Read more: Emerging cybersecurity threats in healthcare