UnitedHealth Group Inc. services are starting to be restored more than two weeks after a cyberattack on its Change Healthcare subsidiary snarled the entire U.S. health system.
Some parts of the network that handle payments and medical claims will come back online in mid-March, while electronic prescribing services are now restored, the company said in a statement late Thursday.
Frustration has been building for weeks among doctors, pharmacies, hospitals and patients facing delays and confusion from the system shutdown with little information about when they might be fixed. Even when the services are fully restored, the health care system will still have to work through backlogs of unpaid claims that have slowed payments to doctors, pharmacies and hospitals.
"We are committed to providing relief for people affected by this malicious attack on the U.S. health system," said Andrew Witty, the UnitedHealth Group chief executive officer.
UnitedHealth had no projection for when the problems would be fully resolved and operations would return to normal.
"Despite the challenges posed by the ransomware attack, pharmacists in both community and health systems have demonstrated remarkable resilience, acting in good faith to ensure the well-being of their patients throughout the outage," Arkansas Pharmacists Association Chief Executive Officer John Vinson said Friday in a statement.
"Change Healthcare, UnitedHealth ... should do the right thing and ensure that these frontline healthcare providers are made whole to avoid additional interruptions in patient care," Vinson said.
The Feb. 21 cyberattack prompted UnitedHealth to suspend operations of the electronic data clearinghouse at Change Healthcare, which is estimated to have processed half of all U.S. medical claims, including those from pharmacies, hospitals and clinics in recent years.
The company initially disclosed the incident by saying a "nation-state associated cyber security threat actor" had accessed some information technology systems at Change Healthcare and then said it was apparently perpetrated by ALPHV/Blackcat. This group is notorious for encrypting data to hold it hostage in order to secure huge cryptocurrency payouts.
Earlier this week, there were signs that a ransom might have been paid to an account connected with ALPHV.
CLAIMS STALLED
David W. Wroten, executive vice president of the Arkansas Medical Society, said physicians and others using the system haven't been able to file their claims.
"That is more than likely to create a huge cash flow problem," he said via email. "Switching to a different clearinghouse is not a quick solution. And, since many carriers will no longer accept paper claims, printing and mailing the claims is not a viable solution."
UnitedHealth said it would aid medical providers facing cash-flow interruptions. It also said it would help patients and doctors by relaxing some requirements for prior approval related to prescriptions and care. Those demands have been harder to meet with networks down.
"We're trying to provide relief for providers to minimize administrative burden as they navigate this event," UnitedHealth Chief Operating Officer Dirk McMahon said in an interview.
U.S. health agencies urged insurance companies to suspend some of those hurdles to care earlier this week because of the failure of Change Healthcare's services that transmit the requests.
Other major insurers including Elevance Health Inc. and Humana Inc. didn't respond to questions this week about whether they would relax authorization rules. A CVS Health Corp. spokesperson said the company would ensure access to care but didn't address questions about whether authorizations would be suspended.
UnitedHealth said prior authorization rules in its Medicare Advantage plans would be paused for most outpatient procedures and limits on inpatient admissions would be relaxed through the end of March.
While Change Heathcare systems are being repaired, the company still wants hospitals and clinics to try workarounds such as connecting to other systems that handle medical claims.
UnitedHealthcare will offer funding to medical providers based on the company's estimates of what they're owed for care provided, and those payments will be reconciled when services are restored, McMahon said. He urged other insurance companies to do the same.
Provider groups whose payments have been interrupted by the Change Healthcare cyberattack have called the responses from UnitedHealth and the federal government insufficient, and the American Hospital Association has asked Congress and regulators for more support.
UnitedHealth expects Change Healthcare's payments platform will be back online March 15, and testing on its medical claims network will begin March 18, it said in the statement.
McMahon offered no clear timeline on when backlogs of payments and claims would be resolved, though.
UAMS HURDLES
"There's a lot of variables in that process and I can't make an estimate," he said.
The University of Arkansas for Medical Sciences used Change Healthcare to process pharmacy, medical and professional claims. Chief Financial Officer Amanda George said Friday that UAMS implemented a secondary clearinghouse this week to submit commercial insurance claims but has not found a solution for Medicare claims. Medicaid claims have had to be processed manually.
The financial hit hasn't come yet but will in a few weeks, George said, as there's a delay between submission of claims to insurers and then they pay cash back. UAMS receives about $4 million a day in payments, and, since Medicaid pays out every week, the situation is already having an effect. George said there are capital reserves to tap into and that no staff furloughs are planned.
The Centers for Medicare & Medicaid Services is allowing health care systems to request accelerated payments, similar to how they did during the pandemic. UAMS made such a request on Tuesday and was waiting to hear back as of Friday afternoon. George said UAMS is examining its options and will determine whether to retain more than one clearinghouse in the future.
"I think from an [information technology] standpoint, it's probably the right thing, but we don't know the cost of it yet," George said. "It takes a long time to stand up a clearinghouse: There's a lot of IT programming that goes into getting that to function correctly. I think we will deal with that once we get through the crisis, but on a long-term basis, we probably need to decide if we need to have two."
A DOCTOR CLOSES
Dr. Anthony Davis said the hack of Change Healthcare was a factor in his decision to close his independent Russellville neurology practice. It will close in June, at which point he'll be working as a hospitalist at the University of Arkansas for Medical Sciences in Little Rock. There will be no more neurologists practicing between Fort Smith and Conway.
His wife, who manages his practice, has been unable to send any claims since the hacking, thus requiring her to turn in claims individually through insurance company portals.
"Every one of our claims went through this system," he said. "We've been without sending in any claims now for several weeks, ever since it started. We're trying to catch up, but it's greatly increased the labor intensiveness on sending claims."
Earlier this week, Jennifer Jones, who owns the Dierks Pharmacy in Howard County, said her business had switched to use an alternative company to process claims. The issue was affecting only a few manufacturing coupons, which pharmacies apply to the copays insurers charge after they get billed for prescriptions. The switch that handles applying particular coupons has been affected by the hack.
"The first day was a long day, but after the first day, we've been OK," she said. "I've got two or three claims that I've sent back that I know are going to go through that I can't bill right now: [there's] not a lot of money at this point that I'm sitting around waiting for.
"I know I'm one of the lucky ones. I know there're ones where their software's not compatible with the other company, so they just can't switch over and use it. We were lucky we could."
The same thing was happening in Saline County. Jon Martin said Bryant Family Pharmacy's biggest problem was patients' copay cards not working.
"Manufacturing coupons have been a struggle for sure," he said. "Fortunately, there's been a limited number of patients who are affected, but with the patient volume that we have, it's still several people."
Patients who can't use their copay cards were without a lot of other options for help, other than waiting for the problem to resolve or paying a higher out-of-pocket copay amount.
Martin said earlier this week that he was waiting to be able to use a couple hundred coupons, each one belonging to one of his patients. "A couple hundred here in Bryant and who knows how many thousands across the country," Martin said. "It's a significant issue; ultimately, we're trying to get it all back up and running. And once it is, hopefully we'll be able to settle stuff out pretty quickly."
Information for this article was contributed by John Tozzi of Bloomberg News, Aaron Gettinger of the Arkansas Democrat-Gazette and Christopher Snowbeck of the Star Tribune.