Nationwide cyberattack causes prescription delays at pharmacies

Health care tech company Change Healthcare, a unit of UnitedHealth Group Inc., was hit with a cyberattack Wednesday that began disrupting people's access to their medications across the United States.

UnitedHealth Group said Thursday in a regulatory filing its Change Healthcare business, which processes prescriptions to insurance for tens of thousands of pharmacies nationwide, was compromised by a "suspected nation-state-associated cyber security threat actor" who gained access to some of its IT systems. Companies are required to report cyberattacks to investors via the U.S. Securities and Exchange Commission.

"Immediately upon detection of this outside threat, the company proactively isolated the impacted systems from other connecting systems in the interest of protecting our partners and patients, to contain, assess and remediate the incident," the filing read.

The company became aware of the cyberattack Wednesday and said in a separate statement it expected the attack to last at least throughout the day Friday.

"The company has retained leading security experts, is working with law enforcement and notified customers, clients and certain government agencies," UnitedHealth Group wrote in the filing. "At this time, the company believes the network interruption is specific to Change Healthcare systems, and all other systems across the company are operational."

The American Hospital Association recommended that medical facilities disconnect from UnitedHealth's network until the issue is resolved because they might have exposure to the same attackers that breached Change Healthcare, according to a Thursday press release.

UnitedHealth provides health insurance for more than 47 million people nationwide. It also provides care, pharmacy benefits management and technology services through its Optum segment. In 2022, UnitedHealth completed its merger of U.S. healthcare services company Optum and Change Healthcare. Optum provides services in technology, data, pharmacy care and direct health care, according to the release.

The cyberattack prevented some pharmacies from processing prescriptions to insurance companies to receive payment.

For instance, Canadian Lakes Pharmacy in Stanwood, Michigan, wrote on social media that it was unable to bill most insurance companies. By late Thursday morning, most insurance claims were going through.

"There is a nationwide outage from some of the largest prescription processors in North America," the pharmacy wrote in the Thursday post. "What does this mean for you? We can receive your RX but for most insurance plans we cannot bill your insurance company. If you can wait a day or so to pick up your RX, that would be great. If you need it today, we can do our best to accommodate individual needs. Thank you for your understanding, patience and continued support. Unfortunately, this is completely out of our control and, like I said, affecting most pharmacies."

GoodRx, which offers discounts on prescriptions, also said Thursday its services were disrupted.

"We apologize for any outages you have been experiencing while at the pharmacy," GoodRx wrote on X. "Unfortunately, the issue is an external one impacting both GoodRx and a multitude of providers."

The American Hospital Association directed questions to Riggi at jriggi@aha.org. Information on the latest cyber threat intelligence and resources is available online at aha.org/cybersecurity.