How a cyberattack on a large health insurance processor could affect you

COLUMBUS, Ohio (WCMH) – A cybersecurity attack on the largest billing and payment system for the U.S. healthcare industry is wreaking havoc on medical providers across Ohio.

Change Healthcare, which processes insurance information for medical providers, suffered a ransomware attack Feb. 21, forcing the company to disconnect its systems. The clearinghouse, part of UnitedHealth Group’s subsidiary Optum, handles a third of all patient records in the country. For small providers, it’s often the only system used to process claims.

The attack has left pharmacies, hospitals, nursing homes, and private practices unable to process thousands of dollars in insurance claims – and it’ll be weeks until the systems are fully running again.

“It is more than just transactions. You’re talking about people’s lives and people’s health care,” said John Palmer, spokesperson for the Ohio Hospital Association.

Palmer said the attack has had a “devastating hit” on hospitals across the state. Some providers, including the Ohio State Wexner Medical Center, are using other clearinghouses to process claims. 

Others are submitting claims directly to insurance companies, but manual submission requires significant manpower, Palmer said. Every day Change Healthcare systems remain down, the patient claims snowball.

The financial liability snowballs for providers, too, who also can’t receive payment. It’s particularly fear-inducing for pharmacists, said David Burke, executive director of the Ohio Pharmacists Association. 

Change Healthcare’s systems hold information that pharmacies need, including prescription drug coverage, copayment information, refill dates and the patient’s general insurance status. When the systems went down, Ohio pharmacies didn’t stop filling prescriptions; they started taking on the cost of medications and hoping insurance companies will pay them later.

The sticker price of drugs can run thousands of dollars. With many patients needing multiple prescriptions, a single patient could walk out the door with more than $12,000 worth of medications, Burke said.

When Burke ran his own pharmacy, he often accrued $200,000 in drug bills every two weeks. Large pharmacies like CVS contract with multiple clearinghouses and can easily pivot, but independent pharmacies can’t afford weeks of unprocessed claims, he said.

Pharmacists have been operating on “good faith,” Burke said, filling prescriptions for patients under the assumption that their insurance status hasn’t changed and the medication is still covered.

“If your insurance company decides they're not going to pay for you, and you’ve already swallowed those pills or taken that injection, the drug store takes the hit,” Burke said. “And that’s because Change Healthcare is down.”

According to Change Healthcare’s website, as of Thursday, electronic prescribing is “fully functional,” and pharmacy claim submission is available. Electronic payment is expected to be operating by March 15, but the company won’t begin reestablishing connectivity for medical claims until the week of March 18.

A spokesperson for the Wexner Medical Center said while some insurers have had trouble paying claims, the hospital system is “able to complete our daily work.” 

“We will resume activity with Change Healthcare when we are confident the threat has been mitigated,” the spokesperson said in a Friday email.

A spokesperson for Nationwide Children’s Hospital said it experienced difficulties transmitting electronic prescription information to some pharmacies, but Change Healthcare is not one of the hospital’s primary clearinghouses for medical claims. Outside partners who use Change Healthcare are having “some issues,” but no procedures or treatments have been canceled because of it. 

OhioHealth referred NBC4 to the Ohio Hospitals Association. Mount Carmel did not respond to a request for comment.

In a March 4 letter to the president of UnitedHealth Group, the president and CEO of the American Medical Association sharply criticized the company’s response as falling “far short of plugging the gaping holes in funding caused by the Change Healthcare outage.” While UnitedHealth Group is offering loans through Optum Financial Services, AMA President Richard Pollack wrote that an “exceedingly small” number of providers are eligible – and the loans don’t address the unprocessed claims piling up.

“UnitedHealth Group, which is a Fortune 5 company that brought in more than $370 billion in revenue and $22 billion in profit in 2023, can – and should – be doing more to address the far-reaching consequences that result from Change Healthcare’s inability to provide these essential hospital revenue cycle functions nearly two weeks after the attack,” Pollack wrote.

Last week, the Center for Medicare and Medicaid Services began directing payers, including state Medicaid and Children’s Health Insurance Program agencies, to remove or relax prior authorization practices and timely claims filing requirements during the system disruption.

ALPHV, the hacking group thought to be responsible for the attack, received a $22 million ransomware payment last week, according to NBC News. Change Healthcare would not say whether it made the payment.

While systems begin returning online over the next few weeks, Palmer said he’s concerned about the future. Ransomware attacks on the healthcare system have risen more than fourfold in the past five years, according to data from the U.S. Department of Health and Human Services. 

“Healthcare continues to be a prime target for these assaults,” Palmer said. “And in this case, you’re talking about people’s health care, getting access to medications, jeopardizing livelihoods.”