UnitedHealth makes doctors repay loans issued after Change cyberattack

Following the huge cyberattack on UnitedHealth Group’s Change Healthcare unit last yr, the corporate launched a brief funding assistance program to assist medical practices with their short-term money flow needs, offering no-interest loans with no added fees.

Just a little over a yr later, UnitedHealth is aggressively going after borrowers, demanding they “immediately repay” their outstanding balances, in line with documents viewed by CNBC and providers who received funding. Some groups have been asked to repay lots of of 1000’s of dollars in a matter of days. 

Optum, UnitedHealth’s financial, pharmacy and care services arm, is telling borrowers that it reserves the proper to “begin offsetting claims payable” to the practices, meaning the corporate will withhold separate funds until it recoups the loan.

It’s a big change in posture for the corporate, which suffered a cyberattack in February 2024 that compromised data from around 190 million Americans, the biggest reported health-care breach in U.S. history. The following disruption caused severe fallout across the health-care system, leaving many providers temporarily unable to receives a commission for his or her services. Some dipped into their personal savings to maintain their practices afloat.

During a Senate hearing concerning the attack in May, UnitedHealth CEO Andrew Witty said providers would only be required to repay the loans when “they, not me, but they confirm that their money flow is normalized.”

Several doctors who took advantage of the financing told CNBC that they can not meet the corporate’s recent demands. Dr. Christine Meyer, an internist who began a practice in Exton, Pennsylvania, received a letter from Optum earlier this month telling her to instantly submit her organization’s payment. 

“We should not in any position to start out repaying this loan,” Meyer, who began her practice about 20 years ago, told CNBC. She has been a vocal critic of UnitedHealth following the breach.

“I’m just taking a look at all my legal options at this point,” Meyer said. “But repaying them $750,000 in five days is clearly not going to occur.”

UnitedHealth didn’t comment on specific cases, but a spokesperson for Change Healthcare confirmed that the corporate has began recouping the loans.

“Now, a couple of yr post the event and with services restored, now we have begun the strategy of recouping the interest-free funding we provided to providers,” the spokesperson said in an announcement.

The corporate said the U.S. Department of Health and Human Services took the identical approach last yr “under its own cyber-attack lending program.” HHS launched a separate funding assistance program through the Centers for Medicare & Medicaid Services last March. CMS said it could mechanically recoup payments from Medicare claims, and providers could accrue interest, in line with a release.

“We proceed to work with providers on repayment and other options, and proceed to achieve out to those providers which have not been conscious of previous calls or email requests for more information,” the Change Healthcare spokesperson said.

Providers were told that UnitedHealth reserved the proper to withhold future payments once they signed up for the funding assistance program, the corporate added. CNBC independently reviewed a replica of a loan agreement for this system and confirmed this statement.

Change Healthcare, which offers payment and revenue cycle management tools, was acquired by Optum in 2022.

After discovering the breach last yr, UnitedHealth said it isolated and disconnected the impacted systems. The corporate paid out greater than $9 billion to providers in 2024, and greater than $4.5 billion has already been repaid, in line with the corporate’s fourth-quarter earnings report in January. UnitedHealth said providers would receive an invoice once standard payment operations resumed, and that they might be subject to a repayment period of 45 business days. 

“Change Healthcare will notify the recipient that the funding amount is due after claims processing or payment processing services have resumed and payments impacted in the course of the service disruption period are processed,” the web site says. 

While the overwhelming majority of Change Healthcare’s services have been restored over the course of the last yr, three products are still listed as “partial service available,” in line with UnitedHealth’s cyberattack response website.

And doctors are still reeling. 

Meyer said that when the breach took place, she watched her practice’s each day deposits shrivel from the range of $60,000 to $80,000 to about $150 “overnight.” She applied for Optum’s temporary funding assistance program, and after some difficulty and backwards and forwards with the corporate, she ultimately received a complete of $756,900 in financial assistance.

Former Senator Bob Casey Jr., D-Pa., shared Meyer’s story in the course of the congressional hearing in May. He asked Witty concerning the company’s approach to the repayment process. 

“I’d like to completely confirm to you and Dr. Meyer that now we have no intention of asking for loan repayment until after she determines that her business is back to normal,” Witty told lawmakers. “Even then, we might not search for repayment until 45 business days – 60 calendar days – after that and there could be no interest and no fee related to that loan.”

“So it could be a determination she makes?” Casey asked.

“That is absolutely right,” Witty said. 

Meyer said that is not what happened. 

She received a notice from Optum on Jan. 24, which was viewed by CNBC, that requested repayment since “the service disruption has ended for many clients.” Meyer said she called and told the corporate she was “not in any position to pay.” 

Meyer claims that her practice lost greater than $1 million in revenue resulting from the Change Healthcare cyberattack. She told CNBC the figure was based on a forensic financial evaluation her practice carried out by comparing its charges against payments over recent years. The $1.2 million figure accounts for losses across all its insurers, not only UnitedHealthcare, Meyer said.

On April 1, Meyer received one other notice requesting immediate repayment inside five business days. The letter was addressed to Meyer. However the name of the practice on the letter, Insight Counseling, in addition to the full amount due, $925,200, were incorrect. 

Meyer said she called Optum again and was told the corporate made a mistake, but that she had five days to repay her actual total of $750,000. At that time, the corporate would start withholding her UnitedHealthcare payments, which she described as a “shakedown.”

Meyer said her practice typically receives annual claims payments of about $150,000 to $200,000 from UnitedHealthcare.

“I assume I’ll just allow them to take those payments back for the subsequent three years until they get their a refund,” she told CNBC.

In a post on LinkedIn on Thursday, Meyer wrote that she and her team “made a plan to go away the least amount of cash within the account set as much as receive payments from UnitedHealthcare. If it’s not there, they can not get it.”

Dr. Purvi Parikh, an allergist and immunologist with a non-public practice in Recent York, shared an analogous story.

Parikh’s practice received about $440,000 in funding assistance after the breach. She said she began getting repayment notices late last yr, and that Optum was threatening to offset claims payable to the practice.

“We were already hit very hard by the Change Healthcare hack,” Parikh said in an interview. “Now on top of that, they’re asking for all of this a refund or they will hold future payments ransom. It’s just been a really frustrating experience coping with Optum.”

Parikh’s practice requested a one-month extension on its final payment of $101,650 in January to try to keep UnitedHealth from withholding other payments. In the e-mail request, Parikh’s colleague wrote that “it has been quite difficult to get better financially.”

Optum granted Parikh’s practice the extension.

“People don’t just have that amount of cash just sitting around,” Parikh said. “We have paid every thing back, however it wasn’t without hardship.” 

On Friday, the American Medical Association sent a letter to Optum urging the corporate not to make use of a “one-size-fits-all” approach to loan repayment. The AMA also asked Optum to honor its commitment to permit physicians to come to a decision when to start the repayment process.

“Each practice may have distinct levels of patient volumes, revenue generation, and value pressures and desires a repayment plan that doesn’t recreate the identical dire financial straits experienced in the course of the cyberattack when CHC’s systems were non-functional,” AMA CEO Dr. James Madara wrote.

A physician who runs a pediatric practice in Recent Jersey said UnitedHealth has already began withholding payments from the organization. The practice received greater than $500,000 in funding assistance following the Change Healthcare breach. 

The doctor, who asked to not be named resulting from the sensitive nature of the situation, said the practice began receiving phone calls and emails from Optum requesting repayment starting late last yr. The group indicated that it did not have the cash, but would arrange a payment plan and had begun the method.

However the doctor said its billing department noticed that UnitedHealth had already began holding back claims payments. In its explanation of advantages, which details what an insurer will cover, there is a line that reads: “The quantity payable on this statement has been used to repay amounts owed under your agreement with Change Healthcare Operations, LLC.”

WATCH: Health and Human Services Department opens probe into hack at UnitedHealth’s Change Healthcare