By Kristin Rowan, Editor
**March 6, 2024 Update** As the previously reported cyberattack on Change Healthcare continues, the US Department of Health and Human Services issued a statement on March 5, 2024 outlining immediate steps CMS is taking to assist providers. CMS is strongly encouraging Medicaid and CHIP plans to waive or relax prior authorization requirements. They’ve also urged providers to offer advance funding to providers.
According to feedback from NAHC members, the impact of this cyberattack on home health and hospice providers has remained minimal. However, for those experiencing delays in claims processing and payments, some providers are unable to meet payroll or pay for patient care items.
**February 29, 2024 UPDATE** We’ve just been contacted by a home care agency out of Charlotte, NC who told us, “For our home care agency we can’t submit claims for VA clients (ChangeHealthcare [sic] has been totally taken off line), and we aren’t having remittance records from Optum feed through ChangeHealthcare [sic] to Wellsky.”
February 28, 2024
The news broke last week that another cyberattack is impacting healthcare. This time, it is Change Healthcare, a division of UnitedHealth Group, that processes insurance claims and pharmacy requests for more than 340,000 physicians and 60,000 pharmacies. In response to this attack, UnitedHealth Group separated and isolated the effected systems, causing delays in claim payments and backlog pharmacy orders.
The attack was first reported on February 21, 2024 and the outage is still ongoing. Former FBI cyber official and current adviser for cybersecurity and risk at the American Hospital Association warns that the longer this outage persists, the worse it will get and it will start to impact patient care. UnitedHealth Group claims that fewer than 100 pharmacy orders and claims have been interrupted across its insurance and pharmacy plans. But, at least on health insurer is claiming a 40% drop in claims since the system went down.
Source of the Attack
Initially, UnitedHealth Group blamed an unknown “nation state” for the cyberattack. The FBI found no evidence of this and has since named Blackcat ransomware gang culpable in the attack. Blackcat ransomware gang has attacked numerous hospitals and the FBI seized their website and servers in December, 2023. Blackcat accessed the Change Healthcare system through vulnerabilities in the ConnectWise ScreenConnect remote desktop and access software.
Implications
The American Hospital Association has urged all healthcare organizations that work with Optum, Change Healthcare, and UnitedHealth Group to weigh the risk of the connection to Change Healthcare against the possible clinical and business disruptions cased by severing that connection.
Health-ISAC anticipates additional cyberattack victims in the coming days. ConnectWise has alerted its users to the remote code execution flaw and has urged all users to update immediately to prevent attacks.
Point of View
This is not the only story this week about UnitedHealth Group. Backlogged pharmacy orders, healthcare claims, and payments, add further credence to the Antitrust probe filed this week by the Justice Department, investigating UnitedHealth and Optum. Should one healthcare group have this much influence over insurance, physicians, pharmacies, and home care?
# # #
Kristin Rowan has been working at Healthcare at Home: The Rowan Report since 2008. She has a master’s degree in business administration and marketing and runs Girard Marketing Group, a multi-faceted boutique marketing firm specializing in event planning, sales, and marketing strategy. She has recently taken on the role of Editor of The Rowan Report and will add her voice to current Home Care topics as well as marketing tips for home care agencies. Connect with Kristin directly kristin@girardmarketinggroup.com or www.girardmarketinggroup.com
©2024 by The Rowan Report, Peoria, AZ. All rights reserved. This article originally appeared in Healthcare at Home: The Rowan Report.homecaretechreport.com One copy may be printed for personal use: further reproduction by permission only.
Sources:
Fox. February 22, 2024. Change Healthcare Experiencing a Cyberattack. Retrieved from: https://www.healthcareitnews.com/news/change-healthcare-experiencing-cyberattack
Fox. February 27, 2024. Change Healthcare Cyberattack Still Impacting Pharmacies, as H-ISAC Issues Alert. Retrieved from: https://www.healthcareitnews.com/news/change-healthcare-cyberattack-still-impacting-pharmacies-h-isac-issues-alert
Pashankar & Tozzi. February 28, 2024. Change Healthcare Cyberattack is Still Disrupting Pharmacies, Other Providers. Retrieved from: https://finance.yahoo.com/news/change-healthcare-cyberattack-still-disrupting-211913516.html
Satter & Bing. February 26, 2024. US Pharmacy Outage Triggered by ‘Blackcat’ Ransomware at UnitedHealth unit, Sources Say. Retrieved from: https://www.reuters.com/technology/cybersecurity/cyber-security-outage-change-healthcare-continues-sixth-straight-day-2024-02-26/
