Cybersecurity Policy Report, HEALTH CARE REIMBURSEMENT NEWS: CMS announces advance payments for Part B suppliers affected by Change Healthcare outage, (Mar 11, 2024)

By Sheila Lynch-Afryl, J.D., M.A.

In an open letter, HHS called on UnitedHealth Group to “take responsibility to ensure no provider is compromised” by cash flow challenges resulting from the cyberattack.

Medicare Part A providers that have experienced disruptions as a result of the Change Healthcare cyberattack may submit accelerated payment requests, and Part B suppliers may submit applications for advance payments. CMS’ March 9 announcement recognized the “significant cash flow problems” suffered by certain facilities because the Change outage has prevented them from submitting claims and receiving Medicare payments. Meanwhile, in an open letter to health care leaders, HHS urged UnitedHealth Group, which owns Change Healthcare, to “take responsibility to ensure no provider is compromised by their cash flow challenges” resulting from the cyberattack.

Providers/suppliers may receive Change Healthcare/Optum Payment Disruption (CHOPD) accelerated and advance payments in amounts representing up to 30 days of claims payments, which are based on the total claims paid to the provider/supplier between August 1, 2023, and October 31, 2023, divided by three. Providers and suppliers will repay through automatic recoupment from Medicare claims for 90 days, and a demand for any unpaid balance will be issued on day 91. CMS’ fact sheet specified eligibility requirements and required certifications, including that the provider/supplier has been unable to obtain sufficient funding from other sources.

CMS again encouraged Medicare Advantage organizations to offer advance funding to providers most affected by the cyberattack and stated that providers and suppliers should consult with their liability insurers to determine whether they have coverage for this disruption. In an accompanying press release CMS noted that many Medicaid providers are “deeply affected” by the cyberattack and urged Medicaid managed care plans to make prospective payments to affected providers. One issue CMS did not address, however, is the American Medical Association’s request that CMS automatically apply the extreme and uncontrollable circumstances hardship exception to all eligible clinicians for the 2023 Merit-based Incentive Payment System (MIPS) performance period or, alternatively, extend the 2023 MIPS data submission window until after the cyberattack has been resolved.

According to HHS, Change Healthcare processes 15 billion health care transactions annually and is involved in one in every three patient records. In its open letter, it called on other insurance companies and health care entities to take “additional actions to mitigate the harms this attack places on patients and providers, particularly our safety net providers.” HHS suggested making interim payments to affected providers, particularly for Medicaid plans; simplifying electronic data interchange requirements and timelines and accepting paper claims; pausing prior authorizations and other utilization management requirements; and using “all available leeway” on deadlines.

Companies: Change Healthcare; UnitedHealth Group; American Medical Association

MainStory: TopStory ReimbursementNews ComplianceNews BillingNews CMSNews DMENews DrugBiologicNews EHRNews IPPSNews ManagedCareNews MedicaidNews MedicaidPaymentNews PartANews PartBNews PartCNews PartDNews PhysicianNews PrescriptionDrugNews QualityNews CyberPrivacyFeed DataBreach DataPrivacy DataSecurity