Small private practices and health-care providers are facing mounting financial pressures as crucial reimbursement systems remain down for the ninth day, following the cyberattack on Change Healthcare.
Change Healthcare offers tools for payment and revenue cycle management that help facilitate transactions between providers and most major insurance firms. Its parent company UnitedHealth Group discovered that a cyber threat actor breached a part of the unit’s information technology network on Feb. 21, in response to a filing with the U.S. Securities and Exchange Commission.
Consequently, the corporate isolated and disconnected the impacted systems “immediately upon detection” of the threat, the filing said.
The fallout has caused a ripple of disruption across the U.S. health-care system.
Doctors told CNBC the outage has left them unable to envision patients’ eligibility for treatment or fill prescriptions electronically, which has created more administrative responsibility for employees which are already overwhelmed by clerical work. Perhaps more importantly, providers have been unable to receive reimbursements from insurers, effectively grinding many health systems’ revenue cycles to a halt.
Smaller and mid-sized practices that depend on reimbursement money flow to operate are making tough decisions about stay afloat. If the outage drags on for too long, experts say some practices can have to shut their doors for good.
Dr. Purvi Parikh, an allergist and immunologist with a personal practice in Recent York City, told CNBC that the breach has been a “mess” and a “big stressor.” Like many others, she said her practice hasn’t been capable of receive reimbursements from insurers for patient visits, which makes it difficult for the practice to pay for operational expenses like payroll and medical supplies.
Switching to a recent platform could take weeks, Parikh said, so there is no immediate workaround available. As of Thursday, Change Healthcare has not shared any updates about when it expects its systems to be back online.
“Essentially the most frustrating part is that no person has any answers or solutions,” Parikh said. “We’re form of just stuck.”
Change Healthcare on Thursday said that ransomware group Blackcat is behind the attack. Blackcat, also called Noberus and ALPHV, steals sensitive data from institutions and threatens to publish it unless a ransom is paid, in response to a December release from the U.S. Department of Justice.
The corporate said it’s working with law enforcement and third party consultants like Mandiant, which is owned by Google, and cybersecurity software vendor Palo Alto Networks to evaluate the breach.
“Patient care is our top priority and we have now multiple workarounds to make sure people have access to the medications and the care they need,” Change Healthcare said in an announcement to CNBC.
Dr. Kiranjit Khalsa, an allergist and immunologist who runs an independent practice in Scottsdale, Arizona, said her staff has been working longer hours to attempt to accommodate the additional work because of this of the breach, in addition to manually calling in prescriptions.
She said the issues around reimbursement have been the “biggest burden,” since she is nervous about how she will proceed to support her patients and employees. Khalsa is considering cutting back hours for employees and even closing the clinic for a number of days.
“I worry about providing for them,” Khalsa told CNBC in an interview. “I also worry about: Where am I going to get this money if it doesn’t come through? Do I want to take a loan out to maintain the clinic afloat?”
Even when Change Healthcare’s systems do come back online, there are a number of unanswered questions on what’s going to occur next, in response to Dr. Dan Inder Sraow, an interventional cardiologist who owns a personal practice around Phoenix, Arizona. He said it isn’t clear whether Change Healthcare will tackle the responsibility of processing all of the claims or if he’ll have to hire additional staff to assist.
“I do not think that folks are aware that the actual people providing the services will not be capable of extract revenue for those services,” Dr. Sraow told CNBC. “We do not understand how long that is going to be, and that is such a dangerous, dangerous thing.”
Dr. Jesse Ehrenfeld, president of the American Medical Association, said he has spent days fielding calls from concerned colleagues.
He said he spoke with one doctor who runs an oncology practice and only has as much as two weeks’ price of money available. If the outage drags out, the practice won’t have the opportunity to purchase the chemotherapy that its patients rely upon for treatment.
Since many providers are operating on razor-thin margins, Ehrenfeld said there’s a possibility that some will exit of business.
“Now we have so many practices which are on the perimeter, particularly smaller practices, where they are only scraping by,” Ehrenfeld told CNBC in an interview. “Any aberration within the system where, ‘Oh, you do not get checks for 2 weeks,’ obviously is a situation that does put practices in danger.”
In 2022, Change Healthcare merged with the provider Optum, which services greater than 100 million patients within the U.S. and is owned by UnitedHealth, the country’s biggest health-care company by market cap.
The American Medical Association vocally opposed the merger, writing in a letter to the DOJ that the union could stifle competition, give UnitedHealth access to large data stores and potentially disrupt patient care.
The merger ultimately went through, however the DOJ has recently launched an antitrust investigation into UnitedHealth, in response to a Wall Street Journal report Tuesday.
“It’s just form of like an ideal storm of regulatory issues [and] lack of competition — and unfortunately, the people who find themselves really going to suffer are patients and individuals who work within the healthcare system,” said Dr. Ravi Parikh, a retina specialist that owns and operates a practice in Recent York City.
The cyberattack has left Parikh’s clinic with no solution to receive reimbursements for the expensive medications it administers. He said he has been fascinated by contingency plans, akin to looking for out cheaper medications and asking some patients to pay upfront, but his focus is on providing the perfect care possible.
“The health care system could eventually come to a halt because a number of clinics and pharmacies won’t be viable,” Parikh said.