Small private practices and healthcare providers are facing increasing financial pressure as critical reimbursement systems remain down for a ninth day, following the cyberattack on Change Healthcare.
Change Healthcare offers payment and revenue cycle management tools that help facilitate transactions between providers and most major insurance companies. main company UnitedHealth Group It discovered that a cyber threat actor compromised part of the unit's IT network on February 21, according to a filing with the U.S. Securities and Exchange Commission.
As a result, the company isolated and disconnected the affected systems “immediately upon discovery” of the threat, the filing said.
The repercussions caused a wave of turmoil in the US health care system.
The outage left them unable to verify patients' eligibility for treatment or fill prescriptions electronically, creating more administrative liability for workers already overworked by clerical work, doctors told CNBC. Perhaps most importantly, providers have been unable to obtain reimbursement from insurance companies, effectively halting the revenue cycles of many health systems.
Small and medium-sized practices that rely on cash flow to pay for their business are making difficult decisions about how to stay afloat. If the outage lasts too long, experts say some practices may have to close their doors for good.
Dr. Purvi Parikh, an allergist and immunologist in private practice in New York City, told CNBC that the hack was “chaos” and “a lot of stress.” Like many others, she said her clinic has not been able to obtain reimbursements from insurance companies for patient visits, making it difficult for the clinic to pay operational expenses such as salaries and medical supplies.
Parikh said switching to a new platform could take weeks, so there is no immediate solution available. As of Thursday, Change Healthcare had not shared any updates on when its systems are expected to come back online.
“The most frustrating part is that no one has any answers or solutions,” Parikh said. “We're kind of stuck.”
Change Healthcare said on Thursday that the Blackcat ransomware group was behind the attack. Blackcat, also known as Noberus and ALPHV, steals sensitive data from organizations and threatens to release it unless a ransom is paid, according to a statement issued by the US Department of Justice in December.
The company said it is working with law enforcement and third-party consultants such as Mandiant, which is owned by Google, and cybersecurity software company Palo Alto Networks to evaluate the breach.
“Patient care is our top priority and we have multiple solutions to ensure people get the medications and care they need,” Change Healthcare said in a statement to CNBC.
Dr. Kiranjit Khalsa, an allergist and immunologist who runs an independent practice in Scottsdale, Arizona, said her employees are working longer hours to try to accommodate overtime as a result of the breach, in addition to manually calling in prescriptions.
Problems with reimbursement have been the “biggest burden,” she said, because she's worried about how to continue to support her patients and staff. Khalsa is considering reducing staff hours and even closing the clinic for a few days.
“I'm worried about providing care for them,” Khalsa told CNBC in an interview. “I'm also worried about: Where will I get this money if it doesn't come to me? Do I need to take out a loan to keep the clinic afloat?”
Even when Change Healthcare's systems are back up and running, there are a lot of unanswered questions about what will happen next, according to Dr. Dan Ender Srau, an interventional cardiologist who has a private practice around Phoenix, Arizona. He said it's not clear whether Change Healthcare will take responsibility for processing all claims or whether he will need to hire additional staff to help.
“I don't think people realize that the actual people who are providing the services are not able to generate revenue for those services,” Dr. Sarao told CNBC. “We don't know how long this will take, and this is very dangerous.”
Dr. Jesse Ehrenfeld, president of the American Medical Association, said he spent days fielding calls from concerned colleagues.
He said he spoke with a doctor who runs an oncology clinic and only had up to two weeks of money on hand. If the outage continues, the clinic will not be able to purchase the chemotherapy that its patients rely on for treatment.
Since many providers operate on razor-thin profit margins, Ehrenfeld said there is a possibility that some will go out of business.
“We have a lot of practices that are on the margins, especially smaller practices, where they're just getting rid of them,” Ehrenfeld told CNBC in an interview. “Any deviation in the system, where you say, ‘Oh, you won't get checks for two weeks,’ is clearly a situation that puts practices at risk.”
In 2022, Change Healthcare merged with Optum, which serves more than 100 million patients in the U.S. and is owned by UnitedHealth, the nation's largest healthcare company by market capitalization.
The American Medical Association vocally opposed the merger, writing in a letter to the Justice Department that a union could stifle competition, give UnitedHealth access to large data stores and potentially disrupt patient care.
The merger eventually went through, but the Justice Department recently launched an antitrust investigation into UnitedHealth, according to a Wall Street Journal report on Tuesday.
“It's just a perfect storm of regulatory issues (and) lack of competition — and unfortunately, the people who are really going to suffer are patients and people who work in the health care system,” said Dr. Ravi Parikh, a retina specialist. Specialist owns and operates a practice in New York City.
The cyberattack left Barrick's clinic without a way to obtain compensation for the expensive medications it administered. He said he has been considering contingency plans, such as looking for cheaper drugs and asking some patients to pay up front, but his focus is on providing the best care possible.
“The health care system may eventually grind to a halt because a lot of clinics and pharmacies may no longer be viable,” Parikh said.
