A suspected ransomware attack on a major health technology company resulted in estimated daily losses of $100 million for providers, leaving the healthcare industry in turmoil.
The cyberattack, initially reported by Change Healthcare, a subsidiary of UnitedHealth Group, disrupted billing processes, prior authorizations, and essential patient services, leading to difficulties in obtaining medication and scheduling surgeries.
The U.S. Department of Health and Human Services (HHS) responded by unveiling assistance programs for affected healthcare providers, aiming to mitigate the impact on healthcare accessibility and affordability. Additionally, officials urged insurers like UnitedHealth to address mounting unpaid bills, emphasizing the need to stabilize the healthcare system amidst the payment crisis.
First Health Advisory, a digital health risk assurance organization, estimates that the suspected ransomware assault on a major health technology company last month cost providers $100 million every day while payment problems persist. The incident has left the health care industry reeling.
First Health Advisory, a digital health risk assurance organization, estimates that the suspected ransomware assault on a major health technology company last month cost providers $100 million every day while payment problems persist. The incident has left the health care industry reeling. (Photo : by EMMANUEL DUNAND/AFP via Getty Images)
UnitedHealth Group, a vast conglomerate, owns Change Healthcare, a Tennessee-based firm that is a member of Optum, Inc., a supplier of health services. In February, it first claimed having connection issues throughout the whole organization.
Impact of Cyberattack on Healthcare Providers and Government Response
Dr. Gounder highlighted the myriad challenges confronting healthcare providers in the aftermath of the cyberattack, notably impacting billing processes and the handling of prior authorizations. The disruption extends to essential patient services, such as obtaining medication or scheduling surgeries, as uncertainties arise regarding insurance coverage and treatment estimates.
Patients also encounter difficulties in filling prescriptions, with some hospitals only able to provide a two-week refill supply, necessitating multiple return visits. Consequently, certain patients are forced to cover refill costs out of pocket, compounding the strain on healthcare accessibility and affordability.
Nearly two weeks after Change Healthcare initially reported a cybersecurity "issue," the U.S. Department of Health and Human Services (HHS) unveiled assistance programs for affected healthcare providers on March 5. Dr. Gounder elaborated that these initiatives aim to bolster healthcare systems, recognizing the pivotal role of revenue from billing processes in meeting operational expenses, including payroll for staff members essential to healthcare delivery.
Moreover, the disruption extends to procurement processes for medications and supplies, exacerbating the strain on healthcare facilities. Particularly vulnerable are Medicaid providers with limited financial reserves, who face heightened challenges amid the ongoing crisis.
To address these pressing concerns, HHS Secretary Xavier Becerra and White House domestic policy chief Neera Tanden, alongside other administration officials, convened a meeting with United Health CEO Andrew Witty.
Addressing Unpaid Healthcare Bills and Stabilizing the System
During the discussion, officials urged insurers like UnitedHealth to address mounting unpaid bills faced by healthcare providers nationwide, emphasizing the imperative of stabilizing the U.S. health system amidst the payment crisis.
Dr. Gounder warns of potential vulnerabilities in healthcare systems despite stringent controls around patient records. She highlights the susceptibility of devices like medical equipment or HVAC systems, which, when connected to a hospital's internet network, could serve as entry points for hackers to exploit. These devices, according to Gounder, create backdoors that hackers can utilize to infiltrate and compromise the internet systems of healthcare facilities.
