/cloudfront-us-east-1.images.arcpublishing.com/bostonglobe/LTPYWKFIXEBWJHCXP2JRXJGDRM.jpg)
Hospitals, pharmacies, and other health care providers are getting stuck in an insurance processing logjam after UnitedHealth Group disclosed a cyberattack within a recently acquired subsidiary that serves as a central hub for payments across the industry.
The severity of the attack started to become more apparent Thursday after UnitedHealth disclosed a “suspected nation-state” is behind the cyberattack, which began on Wednesday. The cyberattack and subsequent system outage within UnitedHealth’s Change Healthcare has caught the attention of federal law enforcement agencies.
UnitedHealth has “retained leading security experts, is working with law enforcement, and notified customers, clients, and certain government agencies,” the company said in its investor disclosure. The company took down its Change Healthcare payment systems, which remain out.
Advertisement
UnitedHealth’s Change Healthcare is one of the most vital payment networks in the country — electronically connecting 900,000 physicians, 33,000 pharmacies, and 5,500 hospitals with health insurers and providing numerous other services that help providers collect money. Change Healthcare’s technology also allows insurers to analyze, verify, and pay providers’ medical claims, and it serves as an important repository of that claims data.
The American Hospital Association is urging hospitals to “consider disconnection from Optum,” the UnitedHealth subsidiary that now houses Change Healthcare, “until it is independently deemed safe to reconnect.”
An outage involving this many parties within the health care system is bound to create widespread disruptions, but the effects have been exacerbated by one company controlling such a large portion of the health care payment system — an issue that antitrust enforcers were worried about.
Not all payments between insurers and providers have been halted during the outage — some are reverting to paper claims, which take a lot more time and are more expensive to process. But many pharmacies and hospitals have said their claims have been put on ice while UnitedHealth attempts to secure its systems.
Advertisement
CVS Health connects with Change Healthcare for pharmacy prescriptions. The company said it is still filling prescriptions where possible, but the cyberattack is slowing down operations.
“In certain cases, we are not able to process insurance claims, which our business continuity plan is addressing to ensure patients continue to have access to their medications,” CVS spokesperson Mike DeAngelis said in a statement.
However, large corporations with billions of dollars in the bank, like CVS, are able to absorb some payment delays. Consultants in the field worry that smaller pharmacies could run out of cash to cover their operations if UnitedHealth doesn’t quickly resolve the cyber threat.
“Pharmacies on the edge with cash flow issues will likely go under if things don’t get fixed soon,” said Brandon Butler, a compliance and technology consultant for specialty pharmacies.
UnitedHealth completed its acquisition of Change Healthcare in 2022 after the Department of Justice sued to block the deal. Federal antitrust attorneys argued UnitedHealth would have too much control of the health insurance claims processing market, but the DOJ ultimately lost. UnitedHealth sold the claims-editing division of Change Healthcare to private equity firm TPG Capital as a condition of the deal.