The American Medical Association and the American Hospital Association say that the U.S. government’s acceleration of Medicare and Medicaid payments does not go far enough to assist providers and other healthcare entities affected by the ransomware attack on UnitedHealth Group subsidiary Change Healthcare.

Change, a provider of revenue management systems, revealed on February 21 that hackers affiliated with the BlackCat ransomware group caused “enterprisewide” connectivity issues that are still being felt weeks later with providers unable to submit claims and process reimbursements to pay expenses and employees, and pharmacists in all 50 states having trouble confirming insurance coverage and copayments to fill prescriptions, reported Cyber Daily. The company has taken its information technology systems offline, and there is no timeline yet for when its systems will be back up.

Additionally, according to Wired, a partner of BlackCat says that Change recently paid $22 million (350 bitcoin) as a ransom to retrieve protected information but that the ransomware group, which has shut down its site, still has the sensitive information along with data on healthcare partners that it obtained when it breached Change’s network, including Medicare and a host of other major insurance and pharmacy networks, reported Wired. Change has not confirmed or denied this claim.
To help cushion the impact on healthcare entities, the government says facilities may submit accelerated payment requests to their respective Medicare Administrative Contractor (MAC). It is also urging and providing guidance to Medicare Advantage (MA) organizations and Part D sponsors for “removing or relaxing prior authorization, other utilization management, and timely filing requirements” while the systems are offline, and encouraging Medicaid and CHIP managed care plans to do the same.

Additionally, it is advising these programs to issue waivers, exceptions, or extensions, and to accept paper claims. But both the AMA and the AHA say these measures fail to protect individual physician practices and adequately address the effects of what the AHA is calling “the most significant and consequential incident of its kind against the U.S. healthcare system in history."

Business Affairs Homepage