The Fallout from a Devastating Cyberattack on Change Healthcare
One of the Most Serious Attacks on the U.S. Healthcare System
The fallout from the hack of a little-known but pivotal health-care company is inflicting pain on hospitals, doctor offices, pharmacies, and millions of patients across the nation, with government and industry officials calling it one of the most serious attacks on the health-care system in U.S. history. The Feb. 21 cyberattack on Change Healthcare, owned by UnitedHealth Group, has cut off many health-care organizations from the systems they rely on to transmit patients’ health-care claims and get paid. The ensuing outage doesn’t appear to affect any of the systems that provide direct, critical care to patients. But it has laid bare a vulnerability that cuts across the U.S. health-care system, frustrating patients unable to pay for their medications at the pharmacy counter and threatening the financial solvency of some organizations that rely heavily on Change’s platform.
The Importance of Change Healthcare
Change Healthcare is a juggernaut in the health-care world, processing 15 billion claims totaling more than $1.5 trillion a year, the company says. It operates the largest electronic “clearinghouse” in the business, acting as a pipeline that connects health-care providers with insurance companies who pay for their services and determine what patients owe. It supported tens of thousands of physicians, dentists, pharmacies, and hospitals, handling 50 percent of all medical claims in the United States, according to a 2022 lawsuit by the Justice Department that unsuccessfully tried to block UnitedHealth from acquiring the company.
The Devastating Cyberattack
The hackers, a ransomware gang once thought to have been crippled by law enforcement, stole data about patients, encrypted company files, and demanded money to unlock them. The company shut down most of its network in February as it tries to recover.
The Impact and Urgency of the Attack
Quantifying the impact remains a moving target, with the severity depending on how much organizations relied on Change. But three senior officials at the Department of Health and Human Services described it as serious. The delay in payments is costing hospitals millions for every single week this continues, and people are even struggling to get prescriptions filled at their local pharmacy. Senate Majority Leader Charles E. Schumer has called on the Centers for Medicare and Medicaid Services to provide accelerated and advanced payments to impacted health care providers.
Working Towards Recovery
The Department of Health and Human Services is working with UnitedHealth to avoid disruptions in patient care, while UnitedHealth has made multiple workarounds to ensure people have access to medications and care. Nevertheless, switching from Change to another vendor is complex due to contractual agreements and technical reasons. Possible alternatives lack the same cleanup function, leading to persistent rejections and cash flow problems for providers.
The Urgency of Strengthening Cybersecurity
The incident has highlighted the urgency of strengthening cybersecurity resiliency across the health-care ecosystem. The impact of the attack has been widespread, affecting midsize to large hospital systems and causing hospital billing systems to grind to a halt. The financial stability of the health care system is at risk and small to medium-sized hospitals are experiencing significant distress. The incident serves as a warning to the entire United States, emphasizing the need for robust cybersecurity measures.
The Lingering Fallout
Hospitals are scrambling to set up alternative payment pathways with insurance companies, but the lack of substantial information from UnitedHealth has worsened the situation. Many community hospitals are finding themselves victimized by the attack on a business entity that created vulnerabilities through its marketplace dominance. As a result, the financial sustainability of the health care system is increasingly at risk.
