Fallout grows from cyberattack at UnitedHealth Group subsidiary

Minnesota hospitals are struggling with the financial fallout from a cyberattack last month on a subsidiary of Minnetonka-based UnitedHealth Group.

For now, patient care and prescription availability is stable, but the ongoing systems outage means many hospitals can’t get their claims for payment processed by health insurers or estimate costs for patients, the Minnesota Hospital Association said in a statement to the Star Tribune.

Smaller mental health providers, meanwhile, say they can’t access workarounds for submitting claims and worry they soon won’t be able to make payroll.

“This places a significant burden on the financial stability of the health care system,” the Hospital Association said. “The health care community in Minnesota needs clear and immediate communications ... about the response to this attack, and, potentially, advanced payments and financial support and regulatory relief to keep this crisis from metastasizing through the health care system.”

UnitedHealth Group disclosed the cyberattack at its Change Healthcare unit on Feb. 21. On Friday afternoon, UnitedHealth Group announced a temporary funding assistance program to help health care providers with short-term cash flow needs.

Much of the concern since last week’s attack has focused on delays for patients seeking medication at the pharmacy counter. But as the outage drags on, the financial risk is coming into focus for clinics and hospitals.

“We are sitting on approximately $200,000 worth of claims, and those are just from the last seven days,” said Maggie Williams, co-owner of Flourish Business Solutions in Bloomington, which handles billing for a dozen independent mental health providers.

“Right now, all of our clients are racking up balances because claims can’t be submitted,” Williams said. “I am getting calls from practice owners who are worried about being able to pay their providers and administrative staff.”

UnitedHealth Group runs UnitedHealthcare, one of the nation’s largest health insurers, as well as a health services division called Optum, which in 2022 acquired Tennessee-based Change Healthcare.

On Friday, Change Healthcare said many of its systems still were down following the attack, which it said was “perpetrated by a cybercrime threat actor who has represented itself to us as ALPHV/Blackcat.”

ALPHV/Blackcat is a notorious Russian ransomware gang, Reuters reported earlier this week, with cybercriminals encrypting data to hold it hostage with the aim of securing massive cryptocurrency payouts. The group previously struck major businesses including MGM Resorts International and Caesars Entertainment.

UnitedHealth Group said it was working closely with law enforcement and leading third-party consultants, Mandiant and Palo Alto Network, in response. The company also said it was helping to create multiple workarounds to make sure patients can access medications and the care they need.

Even so, UnitedHealth Group said it recognized the disruption with payments meant that some health care providers might need more immediate access to funding.

“For provider organizations impacted by that payer system outage, we’ve established a temporary funding assistance support program to help with short-term cash flow needs,” the company said in a statement.

Also on Friday, UnitedHealth Group launched a website detailing its response to the cyberattack. It expressed “a high level of confidence” that Optum, UnitedHealthcare and UnitedHealth Group systems “have not been affected by this issue.”

“There is no evidence of compromise beyond the scope of the Change Healthcare applications,” the company said.

The outage affects claims being submitted not just to UnitedHealthcare, but other health insurers as well. Blue Cross and Blue Shield of Minnesota and UCare both told the Star Tribune they’ve seen lower overall claims volume in the past week.

For any given health care provider, the magnitude of disruption depends on its reliance on Change Healthcare’s electronic clearinghouse for exchanging payment data. So far, Williams of Flourish Business Solutions said she has not found viable workarounds.

One problem, she said, is that many of her clients’ electronic health records systems have business relationships where claims are required to be submitted through Change Healthcare. For record systems that allow use of an alternate clearinghouse, providers might have to pay “a ton of money,” Williams said, or key in data to manually submit claims — a prospect that’s time-prohibitive.

“Things are a hot mess,” she said.

Earlier this week, UnitedHealth Group said health care providers should not be experiencing cash flow problems yet, because it typically takes a week or two for payment to arrive once a claim has been processed.

But a cash crunch already is on the horizon, said Sarah Anderson, owner of Psych Recovery Inc., a mental health practice in St. Paul with more than 30 health care providers.

Therapists, physicians and nurse practitioners at the clinic aren’t letting the billing problems get in the way of patient care, Anderson said, but they’re taking on some financial risk in the process. Many patients have high deductibles, meaning they pay for care out of pocket early in the year, but right now Anderson’s practice can’t tell patients how much they owe.

At pharmacy counters, many mental health patients use coupon programs to make medications affordable, but those information systems aren’t working, Anderson said.

“Half of my clinic is panicking that people aren’t going to take their medications because they’re not going to be able to afford them,” she said. “Or, the cost is going to be so high that they’re just going to say: ‘You know what, I don’t need it.’”

The impact spans medical specialties, said Dr. Neil Shah of Clarus Dermatology in New Brighton. At his practice, no new claims have been submitted for eight days now, Shah said, and there’s no guidance on when systems will be running again.

Moving to paper claims would be impossible, Shah said, in part because he doubts health insurers have infrastructure to process them in a timely manner. And adopting technical workarounds, he said, takes time and is easier said than done.

At hospitals, the cyberattack isn’t affecting patient care, but medical centers can’t bill for services and get paid in a timely manner, said Rachelle Schultz, chief executive of Winona Health.

Hospitals already were struggling in Minnesota with disruptions caused by a cyberattack at a large radiology practice in Eden Prairie, the Minnesota Hospital Association said in its statement. The Change Healthcare outage means many hospitals can’t verify benefits eligibility, which then limits their ability to bill patients and provide cost estimates.

“Even after the Change Healthcare systems come back on line, reconciling payment and reimbursement information post-resolution will add more financial burden, especially given the platform’s interaction with multiple insurance payers beyond just UnitedHealth Group,” the Minnesota Hospital Association said.