Cyberattack Pinches Providers.
* The Feb. 21 cyberattack limited cash flow to hospitals and prevented the collection of claims.* The attack led UAMS to borrow millions and liquidate about $25 million of its investments.
Six weeks after a cyberattack on health care billing and payment clearinghouse Change Healthcare, Arkansas hospitals and providers are still struggling with the fallout.
The Feb. 21 cyberattack squeezed cash flow to hospitals and prevented dozens of physicians and pharmacists from collecting millions of dollars' worth of claims. The full scale of the attack's damage may not be fully calculated for months.
The attack on Change Healthcare, which is part of UnitedHealth Group Inc. of Minnetonka, Minnesota, led the University of Arkansas for Medical Sciences to borrow millions and liquidate about $25 million of its investments to offset the cash flow crisis.
United Healthcare offered some providers loans while it straightened out its system but attached fees that prompted some blowback.
The attack "had a pretty significant impact on us," said Amanda George, UAMS' chief financial officer. Change Healthcare was UAMS' sole clearinghouse for processing medical claims for the hospital and some of its pharmacy accounts.
"We were immediately concerned about this problem, because clinical revenue is a huge part of our cash flow," George said.
UAMS isn't alone.
"Many hospitals have been impacted. Many physician practices have been impacted," George said. "Change is one of the largest, if not the largest, clearinghouse used in the health care industry."
Not all providers used Change Healthcare, but the attack left hospitals, doctors and pharmacists who do without an easy way to file insurance claims. They're now waiting for Change Healthcare to come fully back to life. Some say they are looking for another clearinghouse.
David Wroten, executive vice president of the Arkansas Medical Society, which represents physicians, said the cash flow crunch has become a serious worry for physicians, medical groups and clinics.
"We've had a couple of clinics call that were looking at possibly having to borrow money to make payroll," he said. "It's slowed everything down."
John Vinson, CEO of the Arkansas Pharmacists Association, said the attack has affected every single retail pharmacy in Arkansas. "Some pharmacies had 10% to 30% of their claims i mpacted a nd other pharmacies had 100% of their claims impacted initially," Vinson said.
Arkansas Attorney General Tim Griffin announced on March 21 that his office had started an investigation into Change Healthcare to determine if confidential medical information of Arkansans was compromised and whether any laws were violated as a result of the attack.
"Additionally, my office will look into whether Change Healthcare used reasonable security procedures and practices to protect this information as required by Arkansas law," Griffin said. "Protecting Arkansans' personal information and holding organizations accountable for data breaches are two of my responsibilities under Arkansas law."
The U.S. Department of Health & Human Services also said it is investigating the cyberattack, citing its "unprecedented magnitude."
United Health Group said on March 18 that it was making progress in reducing the impact of the hack on consumers and providers.
"We continue to make significant progress in restoring the services impacted by this cyber-attack," Andrew Witty, CEO of United Health Group, said in a news release. "We know this has been an enormous challenge for health care providers and we encourage any in need to contact us."
How It Worked
Providers who use Change Healthcare would submit their claims with the clearinghouse, which then would tailor the claims for each of the various insurance companies. Change Healthcare also would flag potential billing errors before they were submitted to payers.
But that all changed on Feb. 21, when UnitedHealth Group said it learned its Change Healthcare had been the victim of a cyberattack. UnitedHealth Group disconnected Change Healthcare's systems to prevent further impact.
The move caused migraines for those that used Change Healthcare.
"So when the attack happened, we had no ability to be able to submit any claims from Feb. 21 on through the traditional way that we submitted claims," said Jennifer Styron, CARTI's CFO.
Larry Shackelford, president and CEO of Washington Regional Medical System, said the attack "really should awaken us as to how fragile the system is."
United Healthcare said on Feb. 22 that it was working "diligently" to restore Change Healthcare and was working to "resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time."
CARTI's Styron said CARTI was initially told that Change would be back up quickly.
"And so we waited for seven days because we were hopeful that we could resume traditional submission of our claims," she said.
But when that didn't happen, CARTI couldn't trust Change's timeline.
So the cancer center started submitting Medicare claims, which comprise about 60% of its patients' use, by keying in claims by hand.
CARTI CEO Adam Head said that CARTI had "to manually type each one of these in. It became incredibly labor intensive for the majority of health care systems in a flash."
Cash Flow Issues Surface
Hospitals started feeling the cash flow impact from the Change hack about a week after the attack, as it usually takes 10 to 20 days to get paid on a claim, Styron said.
UnitedHealthcare offered loans to providers to "help bridge the gap in short-term cash flow needs."
It touted that it advanced more than $3.3 billion thus far through multiple initiatives, but not all providers were happy with UnitedHealthcare's offer.
CARTI qualified for $16 million, but it would have had to pay a $300,000 fee to Optum Financial, a part of UnitedHealthcare.
Styron said the only amount that the company offered without a fee was $129,000, "which wouldn't have covered an hour of our operations," she said.
After UnitedHealthcare received criticism from providers for charging a fee, it offered CARTI an interest-free loan of almost $300,000.
She said CARTI is in discussions with UnitedHealthcare for another loan, but Optum is requesting several years of financial statements. "They want all of this analysis in the midst of everything else that you're having to pull together," she said.
On March 9, the Centers for Medicare & Medicaid Services said it would offer advance payments for Medicare providers. CARTI received $9 million under that program, but within days, Medicare started recouping the money.
"We've already paid back about $5 million of the $9 million that we received, which is not time enough to be able to really submit any of those commercial claims," Styron said.
Styron said CARTI has about $8 million worth of claims waiting to be paid.
UAMS, which receives about $105 million a month in cash for clinical revenue, received about $16 million through the Medicare advance payment program.
And through the Change Healthcare's loan, UAMS received about $13 million, but George said that loan didn't have any interest tied to it.
More Concerns
Change Healthcare's electronic payments platform was restored in the middle of March, UnitedHealthcare said.
George said that Change Healthcare is only partially back up, as not all payers are connected to the system. Change Healthcare is "working down a list of payers and getting them ready to accept the claims from the clearinghouse," she said.
Meanwhile, UAMS is using a secondary clearinghouse. "We feel like we need some redundancy," she said.
UAMS also is evaluating its relationship with Change Healthcare.
CARTI said it has already hired another clearinghouse. "We're not willing to continue with Change Healthcare in the future," Styron said.
But switching clearinghouses isn't easy. "In most cases, switching over to a new clearinghouse is a time-consuming proposition," said Wroten, of the Arkansas Medical Society. "It's not something you can do overnight or in a week or two."
In the meantime, UAMS plans to monitor for an increase in denials from payers. "And obviously, we're going to work them like we always have," George said. "But it will put an additional burden on the revenue cycle team that we have here because it will be a volume that is higher than what they're used to."
Shackelford, of Washington Regional, said that as of late March, the health system had rerouted its claims.
"The piece that is unknown is how are payers going to handle this backlog," he said. "And what's the timeframe that it's going to take for the cash flow to really return to how it's been in the past."
He also fears what will happen when the claims that were delayed begin to be processed. "Are we going to have further claims denials, if we did not get appropriate preauthorizations, and are there technical reasons that the claims won't be paid in time?" Shackelford said. "So it's just an unknown right now as to what that cash flow impact is going to be."
BY MARK FRIEDMAN
[email protected]
Caption: The University of Arkansas for Medical Sciences is one of several hospitals in Arkansas and around the nation that were impacted by the cyberattack on Change Healthcare, a part of the UnitedHealth Group.
Caption: Amanda George
Caption: John Vinson
Caption: Jennifer Styron
Caption: Adam Head
Please Note: Illustration(s) are not available due to copyright restrictions.
 Printer friendly
 Cite/link
 Email
 Feedback
| |
| Author: | Friedman, Mark |
|---|---|
| Publication: | Arkansas Business |
| Geographic Code: | 1U7AR |
| Date: | Apr 8, 2024 |
| Words: | 1518 |
| Previous Article: | EXEC Q&A: Smiley Technologies Inc. employs almost 100 people, most of them in Arkansas. |
| Next Article: | 45 years of OZK milestones: Gleason Sizes Up His Top 10. |
| Topics: | |