Healthcare System Still Reeling From UnitedHealth Cyberattack, AHA Says

The American Hospital Association says the cyber breach prevents many members from processing claims and checking patient eligibility for insurance coverage.

picture of a hospital
(Image credit: Getty Images)

The American Hospital Association (AHA) says the February 21 cyberattack at Change Healthcare continues to be felt throughout the healthcare system. 

Change Healthcare, a part of UnitedHealth Group (UHG) that provides healthcare technology including payment processing systems, processes 15 billion healthcare transactions annually and touches one in three patient records, AHA says.

Those transactions include "a range of services that directly affect patient care, including eligibility verifications and pharmacy operations, as well as claims transmittals and payment," said AHA President Rick Pollack in a February 29 blog. "All of these have been disrupted to varying degrees over the past several days and the full impact is still not known."

Subscribe to Kiplinger’s Personal Finance

Be a smarter, better informed investor.

Save up to 74%
https://cdn.mos.cms.futurecdn.net/hwgJ7osrMtUWhk5koeVme7-200-80.png

Sign up for Kiplinger’s Free E-Newsletters

Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.

Profit and prosper with the best of expert advice - straight to your e-mail.

Sign up

In a February 26 letter to Health and Human Services (HHS) Secretary Xavier Becerra, AHA said that any prolonged disruption of Change Healthcare's systems will negatively affect the ability of many hospitals to offer healthcare services in full. 

In the letter, the group asks HHS for immediate support as the disruption persists. This includes help with facilitating communication and transparency between Change Healthcare and providers, as well as guidance on how providers can request Medicare advanced and accelerated payments.

Pollack said the hack is "the most serious incident of its kind leveled against a U.S. healthcare organization." AHA represents 5,000 member hospitals, health systems and other healthcare organizations as well as clinician partners including 270,000 doctors and 2 million nurses.

The hack against Change Healthcare is also causing pharmacies nationwide and military hospitals and clinics worldwide to use workarounds to cope with ongoing disruptions.

Pharmacy, military hospitals workarounds

“We’re filling prescriptions and using exception and workaround processes to handle the small number of cases in which we can’t process insurance claims due to the Change Healthcare outage,” a CVS spokesperson told Kiplinger in a February 29 email. The drugstore chain giant previously told Kiplinger that it has business continuity plans in place to minimize service disruptions.

The breach has also affected military clinics and hospitals worldwide, according to Tricare, a government healthcare program for the U.S. military. “Military clinics and hospitals will provide outpatient prescriptions through a manual procedure until this issue is resolved,” Tricare says on its website.

On its website, UHG’s Optum Solutions said that Change Healthcare's cybersecurity issue is ongoing. It also said — as it has every day since the cyberattack — that it expects the disruption to last at least through today. The hack was committed by cybercriminals ALPHV/BlackCat, Optum added.

The company has “multiple workarounds to ensure people have access to the medications and the care they need,” Optum said, adding that it along with UHG and UnitedHealthcare systems were not affected by the breach.

Working to provide access — UHG

In a February 26 emailed statement to Kiplinger, a UHG spokesperson said that more than 90% of the nation’s 70,000-plus pharmacies have modified electronic claim processing to mitigate impacts from the incident and that the remainder have offline processing workarounds.

"Hospitals, health systems and providers have connections to multiple clearinghouses and access manual workarounds," the spokesperson said, adding that UHG has worked with customers and clients to provide access to medications and care. The company is also working with law enforcement and third parties, including cybersecurity firms Mandiant and Palo Alto Networks regarding the cyberattack, the spokesperson said.

“Our pharmacy operations and the vast majority of prescriptions are not being impacted by this third-party issue,” a Walgreens spokesperson told Kiplinger in a February 26 email. “For the small percentage that may be affected, we have procedures in place so that we can continue to process and fill these prescriptions with minimal delay or interruption.”

Healthcare cyberattacks on the rise

The incident comes amid a growing list of cyberattacks in the healthcare industry, including mail order prescription firm Truepill's data breach last November as well as Medicare's data breach in July that exposed the personal information of more than 600,000 Medicare beneficiaries and millions of other healthcare consumers.

On its website, Tricare directs users to check its patient portal for outages for updates and information such as how to refill and check the status of your prescriptions at military pharmacies.

Related Content

Senior News Editor

Esther D’Amico is Kiplinger’s senior news editor. A long-time antitrust and congressional affairs journalist, Esther has covered a range of beats including infrastructure, climate change and the industrial chemicals sector. She previously served as chief correspondent for a financial news service where she chronicled debates in and out of Congress, the Department of Justice, the Federal Trade Commission and the Commerce Department with a particular focus on large mergers and acquisitions. She holds a bachelor’s degree in journalism and in English.

With contributions from