New Haven Register (New Haven, CT)
Dan Haar: Health care providers scramble to fix billing system attack in state, nation
Imagine a coast-to-coast crisis that shuts down billing, work approvals and payments for upwards of half of all transactions in the largest industry sector in the nation. You’d hear about it almost nonstop in the news, especially if it were in health care, affecting hospital procedures, doctor visits and drug purchases.
It would make big local headlines if it were happening in Connecticut.
That exact crisis has unfolded across the United States since Feb. 21, when hackers pulled off the largest ever ransomware attack in the health care sector. The target: A business called Change Healthcare, which operates the management platform for some 14 billion transactions a year valued at $1.5 trillion.
The attack shut down the main systems of Change Healthcare, a unit of insurance and health management giant UnitedHealth Group.
“On the claims side it continues to be a huge crisis for hospitals that cannot submit claims,” Paul Kidwell, senior vice president for policy at the Connecticut Hospital Association, when we spoke Monday. “It’s a huge cash flow issue for hospitals already facing significant financial headwinds .... It could be hundreds of millions of dollars in Connecticut.”
The Change Healthcare shutdown is also hitting pharmacies and physician groups. And yet, it hasn’t really pierced the public obsession with Taylor Swift and the Kelce brothers, the Princess of Wales’ recovery from surgery or former President Donald Trump’s countless legal battles.
The reason: As they desperately scramble to fix the problem alongside government officials and insurance carriers, health care providers have kept doing what they do, provide health care.
We the patients have seen some inconveniences — for example, you probably won’t know for a while exactly how much you’ll owe for your share of a service and you might have seen some delayed approvals — but for the most part, the folks in the back rooms at hospitals and pharmacies have kept the medical lights on.
That’s a credit to the industry whose nurses, doctors and assistants risked their lives for us during the pandemic that landed in Connecticut exactly four years ago today, on March 6, 2020, at Danbury Hospital. The scramble over the shutdown at Change Healthcare continues two weeks after a group known as BlackCat, or ALPHV, made the attack.
“Cash flow is going to be significantly impacted for us and I think for every hospital or almost every hospital in Connecticut because the bills aren’t being sent out,” Dr. John Murphy, CEO of Nuvance Health, the parent comnpany of Danbury Hospital, told me Friday.
But, said Andrea Rynn, spokesperson at Nuvance,
“We’re here to serve. …We’re still providing the care.”
To make a patchwork system go, Kidwell, at the hospital association, told me, the industry is working on several fronts including attempts to quickly certify new vendors to replace Change Healthcare; and various workarounds, including old-fashioned entry of transactions just like in the old days when ransomware wasn’t a word.
“In some cases,” he said,
“you have to manually submit claims,” he said.
They’re also arranging for waivers with both Medicaid and private insurers to allow hospitals to submit estimated bills, which would then be trued up later. That’s what happened in the early days of the Covid-19 pandemic. It was unclear Tuesday whether a waiver was in place for Connecticut’s HUSKY Medicaid program, which pays $8 billion a year.
Gov. Ned Lamont convened meetings of seven state agencies soon after the ransomware attack happened, spokeswoman Julia Bergman said. “We have been in touch with hospitals and carriers to monitor the situation,” she said, but neither she nor the state Office of Health Strategy, which regulates hospitals, was able to give me details.
“Many providers and insurers report that they have work-arounds in place to bypass the impacted systems. We are working with the stakeholders to understand which providers may still be experiencing delays,” Tina KumarHyde, spokesperson for the health strategy agency, said in a written response.
Several large providers and pharmacy companies told me and my colleague Vincent Gabrielle that the effects on patients have been minimal, though for some, the backoffice crisis remains intense.
“Trinity Health Of New England is unable to connect to prescription insurance providers for matters such as billing, manufacturer coupon processing or co-pay checks,” Kaitlin
Rocheleau, spokesperson for Trinity, the parent of Saint Francis Hospital in Hartford and Saint Mary’s Hospital in Waterbury, said in a written response. “We have continued to maintain disconnection from applications specified by Change Healthcare.”
Yale New Haven Health System said it was “minimally impacted” and the statewide primary care clinic Community Health Center Inc. said it was “not impacted” by the shutdown. I visited a CVS, where a pharmacist told me there had been bottlenecks but those were mostly straightened out.
On its website devoted to the outage, UnitedHealth Group said recovery of the medical network will take longer than the pharmacy network. “As workarounds continue to be deployed, our latest data shows 90 percent of claims are flowing uninterrupted,” the company said in an update Tuesday.
Kudos to the industry for heroically keeping this backoffice crisis in the back office. Still, it raises serious, ongoing issues. Cyberattacks are only going to get worse and some have, and will again, affect the life-and-death services we rely on every day.
While we’re on the subject: Why is the nation’s largest health insurer also the owner of the nation’s largest healthcare billing system, for which it contracts with the same hospitals it negotiates against for basic medical services?
The U.S. Department of Justice tried unsuccessfully to block UnitedHealth Group’s takeover of Change two years ago. Last week the Wall Street Journal reported that DoJ is again looking into possible antitrust violations by UnitedHealth Group, which is based in Minnesota and has significant operations in Connecticut.
This possible conflict may be unrelated to the attack and Change Healthcare shutdown. But the two events both remind us, if you think UnitedHealth Group is too big and powerful, you’re probably right.