Patients across the nation are grappling with the harsh reality of choosing between out-of-pocket expenses for essential medications or going without, as the fallout from a cyberattack on Change Healthcare, a critical subsidiary of UnitedHealth Group, extends into its third week.
Change Healthcare, initially detecting the cyberattack on February 21, has left pharmacies, doctors’ offices, and patients in disarray due to widespread outages in systems integral for medical billing and insurance claims.
The impact is particularly pronounced in disruptions to copay assistance and coupon card processing at pharmacies, revealing critical vulnerabilities in a system upon which lives depend. Ronda Miller from Deadwood, South Dakota, emphasized the urgency of the situation, stating that her husband’s insulin, vital for his Type 2 diabetes and congestive heart failure, became unaffordable when the discount card could not be processed.
Change Healthcare’s extensive involvement in industry transactions, amounting to $1.5 trillion in health claims annually, has affected 21 parts of its business, disrupting payment processes, insurance reimbursements, and insurance eligibility checks.
Dr. Jesse Ehrenfeld, President of the American Medical Association, highlighted the far-reaching implications, affecting routine medications, rebate programs, and even elective surgeries.
UnitedHealth Group responded promptly by disconnecting Change Healthcare’s systems, emphasizing that services would remain offline until safety is ensured. The company aims to implement a new network connecting pharmacies to benefit managers, expected to come online shortly.
However, pharmacies, like Marion Family Pharmacy in Virginia, are witnessing patients unable to afford medications without copay assistance cards, leading to dire consequences for those relying on crucial treatments.
Even patients not using copay assistance face challenges. Donna Hamlet, a breast cancer patient in Florida, experienced difficulties getting her medication due to billing delays. The Florida Cancer Specialists & Research Institute estimates $350 million worth of charges affected by the cyberattack.
To mitigate the impact, the Centers for Medicare and Medicaid Services encouraged the removal or relaxation of prior authorizations during the outage, urging advance funding for healthcare providers.
UnitedHealth Group reported that around 90% of claims were flowing uninterrupted as of Tuesday, with temporary fixes in place. The company encourages healthcare providers to switch to the Optum system for expediting claims submission.
However, healthcare providers, including Dr. Christine Meyer in Pennsylvania, express concerns about the insufficiency of temporary loans offered by Optum, raising issues about expenses, staffing, and potential closure.
The cyberattack has underscored vulnerabilities in the healthcare sector, prompting calls for increased cybersecurity measures. Dr. Mayank Amin from Skippack Pharmacy questioned the delay in resolving a system leak affecting small pharmacies.
The cyberattack, attributed to the group ALPHV/Blackcat, has raised questions about ransom payments. While UnitedHealthcare did not confirm a ransom payment, experts point to a bitcoin wallet that received over $22 million, possibly linked to the attackers.
Cybersecurity experts stress the need for mandatory minimum cybersecurity standards for critical infrastructure sectors, including healthcare, to protect patient information and prevent future attacks. UnitedHealth Group is yet to confirm whether patients’ personal information has been compromised, stating only that investigations are ongoing.
