The Ripple Effects of a Healthcare System Hack

Change Healthcare Cyber Attack

The obvious place to begin this month’s letter is with the far-reaching Change Healthcare hack and service disruption. It has been top-of-mind for nearly every provider over the past month.

Change, a subsidiary of United Healthgroup and Optum, had their systems hacked by Russian cybercriminals on February 21. By bringing the Change systems down, the cyber attack affected nearly every hospital, medical group, and health plan in the country.

The industry relies on Change, and its competitors like Experian, for everything from insurance eligibility checks to authorizations e-prescribing of meds to to the-important billing and payment process.

The implications are further reaching than you may realize. Change Healthcare’s clearinghouse services are not only used by health systems and health plans, but by many vendors, pharmacies, third-party administrators, and medical groups too. Even if a provider is not a Change clients, the odds are that some of their partners or vendors are.

Change offered a funding assistance program that many providers balked at, as they deemed the terms and conditions associated with the funding as being too restrictive – particularly on taking potential remedies off the table and the vague payback terms.

Medicare also stepped-up with a temporary funding program (because many Medicare payments also run through the Change systems and as a result are disrupted) - but it only applies to Medicare billings. Its terms are friendlier, and for providers who have a heavy Medicare mix, it can make a lot of sense to use it.

When will this issue resolve itself? The all-important Electronic Payment Platform was restarted on March 15. That only means that the system is working again going forward, it does not indicate when overdue cash will be made up. I expect about two more months of choppy cash receipts for providers, followed by three to four months of higher denials because of the unclear eligibility and authorization processes over the past month.

Long-term, this is a big wake-up call for the industry. If a company with the resources of United/Change can be affected like this, then everyone needs to rethink their security protocols. While CIO’s have focused on their internal IT security, this attack highlights the dramatic reach if some of the enabling conduit in our healthcare system, like Change, gets it.

Redundancy is on the minds of many providers I talk to, ensuring they have backup systems for their primary functions in case any of the big vendors’ systems go down. With more platforms offering pay-per-use options, it feasible to have a low-cost backup in place in case your primary gets hit by a cyber attack.

Legislative Update

Congress and State Legislatures are in the thick of their 2024 sessions, and I’m watching a few items:

Nurse staffing ratio bills – and variations of them – are on many state legislatures’ agendas this session.  During 2023, Washington and Oregon signed versions of the nursing ratio bills into law. At least four other states considered them. In 2024, Hawaii, New Jersey, Minnesota, and other states are considering some version of the bills, and the U.S Senate held its first-ever hearing on the subject in January, signaling federal interest.

CMS and the Department of Labor have been visible in relation to the Change Healthcare problems. Federal agencies have pressed Change for transparency around and prompt rectification of the issue, but CMS also made available an accelerated payment option for Part A and B programs. Once the dust settles, I expect congressional committees to study what happened, suggesting potential guardrails and backstops anticipating future, similar issues in the industry.

The “Sustain 340B Bill” was introduced by six U.S. Senators in February. It would formally preserve the 340B pricing access for hospitals by dealing with the restrictions drug manufacturers have been increasingly placing on the discounts’ access. The bill gets specific on the use of contract pharmacies, defining who 340B patients are, and how child sites can use the program. It also focuses on program transparency and reducing duplicate discounts. 340B provides deeply discounted pricing on many drugs for hospitals and doctors who serve lower-resourced geographies.

Graph of the Month

For-profit healthcare providers have been beating the market over the past year, with the exception of Community Health Systems, which has gotten pressure from poor earnings and a DOJ investigation.

Recommended Listen:

This interview with the legendary talent agent Michael Ovitz is a fun listen.. It has nothing to do with healthcare, but offers lessons on how good things come to those who maintain their professional networks. There are also some great stories about movies and stars that are now household names.