Editorial: Health care industry vulnerable to cyber attacks

OUR POSITION: Changes may be needed in how the health care industry handles its records to avoid crippling cyber attacks that can impact thousands of health facilities with a single hack.

On Feb. 21, ransomware hackers comprised one of the largest health care medical technology systems in the country.

Scores of hospitals across the country — including more than 100 in Florida — took their medical claims, billing, insurance verification and other technology systems offline because of the hack of UnitedHeath Group's Change Healthcare.

That outage has impacted Sarasota Memorial, DeSoto Memorial, Tampa General and other hospitals across the state.

UnitedHealth is the parent of UnitedHealthcare and Change has a huge footprint in the U.S. medical system. The company says it processes 15 billion medical and health care transactions annually and claims to touch one in every three patient records nationally.

Roughly a month later. UnitedHealth is still trying to get Change's systems back up and running even after a reported huge ransomware payment.

Many hospitals — especially smaller ones with fewer resources and financial reserves — have been hit hard by the outage. They can't submit or process claims. They can't paid.

UnitedHealth and the Center for Medicare and Medicaid have taken steps to try to mitigate the harm to hospitals and other providers.

But plenty of damage has been done.

Mary Mayhew, president and CEO of the Florida Hospital Association, said 45% of the hospital's beds statewide are at facilities dependent on Change Healthcare for their technology systems.

Many hospitals are completely dependent, she said.

Hospitals say the hack is not impacting patient care but a survey by the American Hospital Association found that the month-long episode is causing delays with insurance verifications.

Mayhew and others said there are two larger lessons to be learned from the cyber attack.

One is the consolidation of industries and technology. That has shown itself in the Change hack where hospitals across the state and country are dependent on one vendor — one huge multibillion-dollar vendor.

Vince Sica, CEO of DeSoto Memorial Hospital in Arcadia, said previously his 49-bed facility had a number of different technology, billing and other back office systems vendors.

That has changed culminating with UnitedHealth's $13 billion acquisition of Change Healthcare last year.

Mayhew said the AHA voiced objections to that merger and raised concerns about the consolidation.

But she said industry consolidations have been happening all around the economy with concerns about competition and over reliance on one supplier or vendor.

"Unfortunately, it's occurring on many fronts and not just health care," Mayhew said. "We saw this in our supply chains during the pandemic."

Mayhew said there is an even larger concern — cybersecurity.

She said the ransomware hack was not just a way to blackmail UnitedHealth. It was an attack on the U.S. and its medical system, she contends.

In Arcadia, Sica worries the unfortunate success of the Change cyber assault will encourage more hackers with ransomware aspirations to target more hospitals and health care companies.

He said even after the billing and claims systems come back online it could take months to get operations and cash flows back to normal.

That comes at a time when many rural and smaller hospitals are already struggling financially.

UnitedHealth had revenue of $372 billion last year and the U.S. spent more than $4.5 trillion on health care in 2022, according to CMS.

Health care makes up 17.3% of U.S. GDP making the industry a continued target for cyber attacks and ransoms.