Fallout grows from cyberattack at UnitedHealth Group subsidiary [Star Tribune]

Minnesota hospitals are struggling with the financial fallout from a cyberattack last month at a subsidiary of Minnetonka-based UnitedHealth Group.

For now, patient care and prescription availability is stable, but the ongoing systems outage means many hospitals can't get their claims for payment processed by health insurers, the Minnesota Hospital Association said in a statement to the Star Tribune.

Smaller mental health providers, meanwhile, say they can't access workarounds for submitting claims and worry they soon won't be able to make payroll.

"This places a significant burden on the financial stability of the health care system," the Minnesota Hospital Association said in a statement. "The health care community in Minnesota needs clear and immediate communications ... about the response to this attack, and, potentially, advanced payments and financial support and regulatory relief to keep this crisis from metastasizing through the health care system."

UnitedHealth Group disclosed the cyberattack at its Change Healthcare unit on Feb. 21.

Much of the concern since then has focused on delays for patients seeking medication at the pharmacy counter. But as the outage drags on, the financial risk is coming into focus for clinics and hospitals.

"We are sitting on approximately $200,000 worth of claims, and those are just from the last seven days," said Maggie Williams, co-owner of Flourish Business Solutions in Bloomington, which handles billing for a dozen independent mental health providers.

"Right now, all of our clients are racking up balances because claims can't be submitted," Williams said. "I am getting calls from practice owners who are worried about being able to pay their providers and administrative staff."

UnitedHealth Group runs UnitedHealthcare, one of the nation's largest health insurers, as well as a health services division called Optum, which in 2022 acquired Tennessee-based Change Healthcare.

On Friday, Change Healthcare said many of its systems still were down following the attack, which it said was "perpetrated by a cybcercrime threat actor who has represented itself to us as ALPHV/Blackcat."

ALPHV/Blackcat is a notorious ransomware gang, Reuters reported earlier this week, where cybercriminals encrypt data to hold it hostage with the aim of securing massive cryptocurrency payouts. The group previously struck major businesses including MGM Resorts International and Caesars Entertainment.

UnitedHealth Group said it was working closely with law enforcement and leading third-party consultants, Mandiant and Palo Alto Network, in response.

"Patient care is our top priority and we have multiple workarounds to ensure people have access to the medications and the care they need," the company said in a statement. "Based on our ongoing investigation, there's no indication that except for the Change Healthcare systems, Optum, UnitedHealthcare and UnitedHealth Group systems have been affected by this issue."

The outage impacts claims being submitted not just to UnitedHealthcare, but other health insurers as well.

"The Change issue has had an impact on what we're seeing in our overall claims volume," said Eagan-based Blue Cross and Blue Shield of Minnesota in a statement to the Star Tribune. Fewer claims have been submitted to Minneapolis-based UCare as well.

For any given health care provider, the magnitude of disruption depends on its reliance on Change Healthcare's electronic clearinghouse for exchanging payment data. So far, Williams said she has not found viable workarounds.

One problem, she said, is that many of her clients' electronic health record systems have business relationships where claims are required to be submitted through Change Healthcare. For record systems that allow use of an alternate clearinghouse, providers might have to pay "a ton of money," Williams said, or key in data to manually submit claims — a prospect that's time-prohibitive.

Another issue is that because Minnesota law requires electronic submission of claims, "we can't even print claims and mail them to the insurance companies to be processed," Williams said.

"Things are a hot mess," she said.

Earlier this week, UnitedHealth Group said health care providers should not be experiencing cash flow problems yet, because it typically takes a week or two for payment to arrive once a claim has been processed.

But a cash crunch already is on the horizon, said Sarah Anderson, the owner of Psych Recovery Inc., a mental health practice in St. Paul with more than 30 health care providers.

Even if her practice receives payment, Anderson said she's not getting information from insurers that let her link reimbursements to the particular independent contractor who provided the care in her groups. Without that data, can't accurately pay them.

Therapist, physicians and nurse practitioners at the clinic aren't letting the bililng problems get in the way of patient care, Anderson said, but they're taking on some financial risk in the process. Many patients have high deductibles, meaning they pay for care out of pocket early in the year, but right now Anderson's practice can't tell patients how much they owe.

At pharmacy counters, many mental health patients use coupon programs to make medications affordable, but those information systems aren't working, Anderson said.

"Half of my clinic is panicking that people aren't going to take their medications because they're not going to be able to afford them," she said. "Or, the cost is going to be so high that they're just going to say: 'You know what, I don't need it.'"

At hospitals, the cyberattack isn't affecting patient care, but medical centers can't bill for services and get paid in a timely manner, said Rachelle Schultz, the chief executive of Winona Health.

Hospitals already were struggling in Minnesota with disruptions caused by a cyberattack at a large radiology practice in Eden Prairie, the Minnesota Hospital Association said in its statement. The Change Healthcare outage means many hospitals can't verify benefits eligibility, which then limits their ability to bill patients and provide cost estimates.

"Even after the Change Healthcare systems come back on line, reconciling payment and reimbursement information post-resolution will add more financial burden, especially given the platform's interaction with multiple insurance payers beyond just UnitedHealth Group," the Minnesota Hospital Association said.

©2024 StarTribune. Visit startribune.com. Distributed by Tribune Content Agency, LLC.