Small private practices and healthcare providers are facing increasing financial pressures as crucial reimbursement systems remain down for a ninth day, following the cyberattack on Change Healthcare.
Change Healthcare offers payment and revenue cycle management tools that help facilitate transactions between providers and most major insurance companies. Your parent company UnitedHealth Group discovered that a cyber threat actor breached part of the unit's information technology network on Feb. 21, according to a filing with the U.S. Securities and Exchange Commission.
As a result, the company isolated and took the affected systems offline “immediately upon detection” of the threat, according to the document.
The fallout has caused a wave of disruption throughout the US healthcare system.
Doctors told CNBC that the outage has prevented them from checking patients' eligibility for treatment or filling prescriptions electronically, creating more administrative responsibility for workers already overwhelmed by administrative work. Perhaps most importantly, providers have been unable to receive reimbursements from insurers, effectively crippling the revenue cycles of many health systems.
Small and medium-sized businesses that rely on reimbursement cash flow to operate are making difficult decisions about how to stay afloat. If the shutdown lasts too long, experts say some clinics may have to close their doors forever.
Dr. Purvi Parikh, an allergist and immunologist in private practice in New York City, told CNBC that the breach has been a “disaster” and a “huge stressor.” Like many others, he said his practice has been unable to receive reimbursements from insurers for patient visits, making it difficult for the practice to pay operating expenses such as payroll and medical supplies.
Switching to a new platform could take weeks, Parikh said, so there is no immediate solution available. As of Thursday, Change Healthcare has not shared any updates on when it expects its systems to be back online.
“The most frustrating part is that no one has answers or solutions,” Parikh said. “We're kind of stuck.”
Change Healthcare said Thursday that the Blackcat ransomware group is behind the attack. Blackcat, also called Noberus and ALPHV, steals sensitive data from institutions and threatens to publish it unless a ransom is paid, according to a December statement from the US Department of Justice.
The company said it is working with outside and law enforcement consultants such as Google-owned Mandiant and cybersecurity software provider Palo Alto Networks to evaluate the breach.
“Patient care is our top priority and we have multiple solutions to ensure people have access to the medications and care they need,” Change Healthcare said in a statement to CNBC.
Dr. Kiranjit Khalsa, an allergist and immunologist who runs an independent practice in Scottsdale, Arizona, said her staff has been working longer hours to try to accommodate extra work as a result of the breach, in addition to manually ordering prescriptions.
He said reimbursement issues have been the “biggest burden” as he worries about how he will be able to continue supporting his patients and employees. Khalsa is considering reducing staff hours and even closing the clinic for a few days.
“I'm worried about supporting them,” Khalsa told CNBC in an interview. “I'm also worried: Where am I going to get this money if it doesn't come? Do I need to take out a loan to keep the clinic afloat?”
Even when Change Healthcare's systems come back online, there remain many unanswered questions about what happens next, according to Dr. Dan Inder Sraow, an interventional cardiologist who has a private practice in Phoenix, Arizona. He said it is unclear whether Change Healthcare will take responsibility for processing all claims or whether it will need to hire additional staff to help.
“I don't think people are aware that the people who provide the services cannot earn income from those services,” Dr. Sraow told CNBC. “We don't know how long it's going to last and it's very, very dangerous.”
Dr. Jesse Ehrenfeld, president of the American Medical Association, said he has spent days fielding calls from concerned colleagues.
He said he spoke to a doctor who runs an oncology practice and only has two weeks' worth of cash on hand. If the interruption is prolonged, the practice will not be able to purchase the chemotherapy its patients depend on for their treatment.
With many suppliers operating on razor-thin margins, Ehrenfeld said there is a chance some could go out of business.
“We have a lot of practices that are on the sidelines, particularly smaller practices, where they're barely scraping by,” Ehrenfeld told CNBC in an interview. “Any aberration in the system that says, 'Oh, you don't get checks for two weeks,' is obviously a situation that puts practices at risk.”
In 2022, Change Healthcare merged with provider Optum, which serves more than 100 million patients in the US and is owned by UnitedHealth, the country's largest healthcare company by market capitalization.
The American Medical Association openly opposed the merger, writing in a letter to the Justice Department that the union could stifle competition, give UnitedHealth access to large data stores and potentially disrupt patient care.
The merger ultimately went through, but the Justice Department recently launched an antitrust investigation into UnitedHealth, according to a Wall Street Journal report on Tuesday.
“It's like a perfect storm of regulatory issues [and] lack of competition and, unfortunately, the people who are really going to suffer are the patients and the people who work in the health care system,” said Dr. Ravi Parikh, a retina specialist who owns and operates a practice in the city of NY.
The cyberattack has left Parikh's clinic with no way to receive reimbursements for the expensive medications it administers. He said he has been thinking about contingency plans, such as finding cheaper medications and asking some patients to pay up front, but his focus is on providing the best care possible.
“The healthcare system could eventually come to a standstill because many clinics and pharmacies may not be viable,” Parikh said.
