'Operating in the dark': NYC pharmacies fight to fill prescriptions after United Health attack

Some New York City pharmacies are still struggling to fill all of their customers’ prescriptions more than a week after a cyberattack crippled a technology used by health care providers and insurers.

Following the attack, some patients have faced difficult decisions about whether to pick up their medications as pharmacies struggle to confirm that their prescriptions will be covered by insurance, two pharmacy owners said. If the medications are not covered by insurance, pharmacies either have to cover the cost or bill their patients.

In recent days, many pharmacies have transitioned to alternatives to the affected technology platform, but some are still facing billing issues, according to the Pharmacists Society of the State of New York. In some cases, pharmacies are dispensing medications without knowing whether their businesses will get reimbursed.

It’s still unclear whether, and to what extent, patient data has been compromised. The state Department of Health is monitoring the situation and Medicaid does not appear to have been affected, spokesperson Erin Clary said.

Change Healthcare, the company that operates the system that was compromised, is a division of the firm Optum, which is owned by UnitedHealth Group. Doctors use Change’s platform to send patients’ prescriptions to their pharmacies, which in turn use it to check patients’ insurance information and bill their insurers. The platform is also used to process manufacturer coupons, which provide discounts on expensive drugs.

The platform is widely used throughout the industry and serves as “the internet for pharmacies,” according to Danny Dang, owner of Esco, a pharmacy in Hell’s Kitchen.

“Imagine that all of a sudden the internet was disconnected,” Dang said Friday. “So, we’re operating in the dark.”

Esco is one of the 70,000 pharmacies across the U.S. that have had to find alternative ways to process prescriptions since Optum first announced that Change Healthcare was having technical problems on Feb. 21. Change Healthcare processes about 15 billion transactions a year and handles as many as a third of patient medical records, the New York Times reported.

United said last week that most of the pharmacies that used the Change platform had either switched to different tech companies to process prescriptions or found ways to do so manually. On Friday, the company also announced it has launched a new “instance” of the ePrescribing system that had not been compromised.

That new option is “seeing volume and working,” United spokesperson Tyler Mason said Monday.

Dang and another local pharmacy owner who spoke to Gothamist said they have switched to a different company to process prescriptions, but the alternative took several days to put in place and isn’t perfect.

Mayank Parikh is the co-founder of Super Health Pharmacy, which has six locations in the tristate area, including one on Staten Island. He said after switching to a company called Relay, he is still hitting some snags. As of Friday, he said he still wasn’t able to bill Medicare for vaccines — which he said could cost as much as $300 out of pocket — or diabetic testing supplies.

He said he was also having trouble filling some prescriptions for patients in long-term care facilities and still couldn’t process the manufacturers’ coupons designed to help patients afford costly drugs.

Parikh said his company has “helped many patients already” by giving them their medication, despite not being able to bill their insurance. But he said his company operates on tight margins and is in a difficult position. In some cases, Parikh said, he has told patients they can take home their medications now but might get billed in the future if their insurance doesn’t ultimately cover the cost — and not everyone is comfortable with that.

Parikh hasn’t yet returned a message Monday seeking an update.

Dang also switched to Relay and said Monday he is generally able to fill patients’ prescriptions now, although not all of his billing issues have been resolved.

But in the first days following the outage, he said, he was frequently unable to confirm whether a medication was covered by a patient’s insurance. Like Parikh, he also told some patients they could pay part of the cost up front and hope that their insurance would cover the rest later. But he said some patients picking up expensive HIV or diabetes medications didn’t want to take that risk.

“They don’t have that cash flow,” he said.

Large pharmacy chains have also been impacted. But a CVS spokesperson said the company is not letting the attack impact patients’ access to their medications.

“We’re continuing to fill prescriptions but in a small number of cases we are not able to process insurance claims or copay coupons,” Shelly Bendit, a spokesperson for CVS, said in a statement. In those cases, she said, “our pharmacy staff will work with the patient to ensure they continue to have access to their medication.”

Clary, from the state health department, said the agency is working with all impacted pharmacies, insurers and other entities to “ensure continuity of care for all New Yorkers.”

Parikh said “words of encouragement are great,” but added that pharmacies haven’t received any concrete support from government officials so far to ensure that continuity of care.

Holding the health system for ransom

Optum has attributed the cyberattack to a group called Blackcat, also known as ALPHV, that is known for holding computer networks hostage for ransom. The group is among the most prolific ransomware operators in the world and has already gotten victims of attacks to pay out hundreds of millions of dollars to restore their systems, according to a December release from the U.S. Department of Justice.

It’s still unclear to what extent patient information has been compromised in the latest attack.

“Our experts are working to address the matter and we are working closely with law enforcement and leading third-party consultants, Mandiant and Palo Alto Network, on this attack against Change Healthcare's systems,” Optum said in an update Saturday. “We are actively working to understand the impact to members, patients and customers.”

Insurance plans on the New York State of Health exchange have disconnected from Change Healthcare as a precaution and in some cases are implementing manual workarounds and other contingency plans to cover prescriptions, according to Clary.. She added that the state’s Medicaid system does not appear to be compromised.

Meanwhile, these types of attacks are only becoming more common. The health care industry has been subject to a growing number of cyberattacks in recent years, putting patient information and trust at risk, according to the U.S. Department of Health and Human Services. An attack last year against a medical transcription company called Perry Johnson & Associates, which works with local hospitals and clinics, put about 4 million New Yorkers’ personal information at risk.

Gov. Kathy Hochul’s administration is working on finalizing new regulations for hospitals to follow to protect themselves from cyberattacks, and the governor has allocated $500 million to help them upgrade their cybersecurity.

The views expressed in content distributed by Newstex and its re-distributors (collectively, "Newstex Authoritative Content") are solely those of the respective author(s) and not necessarily the views of Newstex et al. It is provided as general information only on an "AS IS" basis, without warranties and conferring no rights, which should not be relied upon as professional advice. Newstex et al. make no claims, promises or guarantees regarding its accuracy or completeness, nor as to the quality of the opinions and commentary contained therein.