Cybersecurity Policy Report, Health Care Leaders Urged to ‘Meet the Moment’ After Ransomware Attack, (Mar 11, 2024)

By Tom Leithauser

UnitedHealth Group, Inc. (UHG) should do more to help beleaguered health care providers operate in the degraded environment that resulted from a ransomware attack on UHG, according to Health and Human Services Secretary Xavier Becerra and acting Labor Secretary Julie Su.

Change Healthcare, a subsidiary of UHG, suffered a ransomware attack in late February that led it to disconnect systems used to provide and pay for health care. The company operates one of the world’s largest electronic clearinghouses for processing health care payments, and its disruption has curtailed cash flows to health care providers.

“In a situation such as this, the government and private sector must work together to help providers make payroll and deliver timely care to the American people. The Biden-Harris Administration has taken action by removing challenges for health care providers and addressing this cyberattack head on. Now, we are asking private sector leaders across the health care industry—especially other payers—to meet the moment,” Mr. Becerra and Ms. Su said yesterday in an open letter to health care sector leaders.

“The Biden-Harris Administration remains committed to ensuring that all Americans can access needed care in spite of this cyberattack. We urge the private sector to quickly identify and carry out solutions. Specifically, we call on UHG, other insurance companies, clearinghouses, and health care entities to take additional actions to mitigate the harms this attack places on patients and providers, particularly our safety net providers,” the letter said.

The letter notes steps taken by HHS and the Centers for Medicare & Medicaid Services (CMS) to ease the financial burden on health care providers, including making it easier for them to change to a different clearinghouse for claims processing (CPR, March 5).

But the letter urged UHG to do its part by taking “responsibility to ensure no provider is compromised by their cash flow challenges stemming from this cyberattack on Change Healthcare,” ensuring “expedited delivery of funds” and advanced payments to impacted providers, and communicating “more frequently and more transparently, both within the health care community and with state Medicaid agencies.”

Mr. Becerra and Ms. Su called on insurance companies, particularly those that are larger and well-resourced, to provide interim payments to struggling health care providers. “Larger payers in particular have the balance sheet stability to advance payments. Payers have the opportunity to stop-gap the cash flow concerns by stepping in with bridge payments,” they said.

The ransomware attack on UHG “has impacted payments to hospitals, physicians, pharmacists, and other health care providers across the country. Many of these providers are concerned about their ability to offer care in the absence of timely payments,” the letter noted. “Overall, this incident is a reminder of the interconnectedness of the domestic health care ecosystem and of the urgency of strengthening cybersecurity resiliency across the ecosystem.”

In an update on its status published Friday, UHG said it had made “substantial progress in mitigating the impact to consumers and care providers.”

“Our focus has been on ensuring access to care and medications by addressing challenges to pharmacy, medical claims and payment systems targeted by the attack,” it said.

It said it had restored systems for electronic prescriptions for pharmacy services and expected its electronic payment platform to be available by this Friday. “We expect to begin testing and reestablish connectivity to our claims network and software on March 18, restoring service through that week,” it added.

“We are committed to providing relief for people affected by this malicious attack on the U.S. health system,” said Andrew Witty, UHG’s chief executive officer. “All of us at UnitedHealth Group feel a deep sense of responsibility for recovery and are working tirelessly to ensure that providers can care for their patients and run their practices, and that patients can get their medications. We’re determined to make this right as fast as possible.”

News: FederalLegislation DataSecurity