Change Healthcare cyberattack devastates independent practices nationwide

The February Change Healthcare cyberattack sent shockwaves through the healthcare industry, thrusting countless practices into financial distress. The results of a new American Medical Association (AMA) survey emphasize the widespread, severe, and long-lasting impact of the cyberattack on independent practices. In written comments, many respondents expressed fears about bankruptcy and financial ruin.

Out of 1,400 participants, 80% said they’ve lost revenue due to the attack, while 85% have had to direct extra staff time and resources to manage revenue cycles. The majority of survey respondents came from practices with fewer than 10 doctors. For practices of this size, revenue loss and resource reallocation can quickly compromise financial and operational health.

In addition to financial issues, the AMA survey covers various cyberattack-related topics, including service disruptions, workarounds, and funding assistance. 

On February 21, 2024, Change Healthcare, one of the nation's largest clearinghouses, experienced a cyber event causing companywide security issues. Parent company UnitedHealth Group (UHG) quickly disconnected all Change Healthcare systems, but the event caused severe service outages affecting electronic payments, e-prescribing, medical claims processing, and other functions. So far, 2 ransomware groups have threatened to expose the alleged 4TB of data unless UHG makes a large ransom payment.

The AMA survey offers insight into the financial and operational challenges of affected practices, shedding light on the day-to-day impact of the cyberattack on providers and patients.

Financially, the cyberattack has blindsided many practices. Affected businesses have felt the impact from multiple directions. The AMA survey found 32% of respondents have been unable to submit claims, 36% have experienced suspended claim payments, and 22% have not been able to verify eligibility for benefits. 

Of survey respondents, 78% have lost revenue because they couldn’t submit claims; the inability to collect patient co-pays or unpaid balances has caused revenue loss for 51% of respondents. Cash flow interruptions have left 31% unable to make payroll and 44% unable to purchase supplies. Meanwhile, 55% said they’d dipped into personal funds to cover practice expenses. 

Fees and penalties for late payments compound financial troubles. 

“Payroll taxes and gross receipts are not able to be paid, resulting in penalties,” one respondent commented. “Other overhead costs are not able to be paid, also resulting in late fees.”

A total of 15% of practices have had to reduce office hours. However, despite that resiliency, ongoing financial turmoil will likely force many independent practices out of business. 

“The disruption caused by this cyber-attack is causing tremendous financial strain,” AMA President Jesse M. Ehrenfeld, M.D., MPH said in a press release. “These survey data show, in stark terms, that practices will close because of this incident, and patients will lose access to their physicians. The one-two punch of compounding Medicare cuts and inability to process claims as a result of this attack is devastating to physician practices that are already struggling to keep their doors open.”

“This cyberattack is leading me to bankruptcy, and I am just about out of cash,” said a respondent.

“[This]…may bankrupt our practice of 50 years in this rural community…,” another shared.

Many practices have dedicated time and resources to manual and electronic workarounds to address claims service interruptions. 

Although 39% of respondents reported being unable to obtain help with electronic remittances, 25% have used both electronic and manual workarounds to obtain such advice. Both types of workarounds were used by 31% to submit and receive claims payments and 25% to check eligibility.

As mentioned above, many respondents (55%) are using personal funds to mitigate the harmful effects of the cyberattack. Other strategies include temporary funding assistance and working with alternative clearinghouses. 

Nearly 25% of respondents have received assistance from UHG. The company currently states it has distributed more than $6 billion in advance funding and interest-free loans. Respondents have also received support from CMS/Medicare (12%), State Medicaid Plans (0.7%), or other health plans (4.5%).

Nearly half of respondents (48%) have entered into new contracts with alternative clearinghouses. In comments, many say they have found this strategy frustrating and expensive.

“SOOOO much overtime dealing with this. Cost me additional $50,000 in payroll,” reads one comment. 

Others say contracting with another clearinghouse “...crippled our brand new practice,” and resulted in an “...estimated $100,000 in unexpected costs.”

Consumers also feel the ongoing impact of the cyberattack. Change Healthcare’s service disruptions have prevented countless patients from filling prescriptions and using drug-coupon cards. Medication interruptions, canceled appointments, and delayed procedures interfere with care continuity and can negatively impact overall health.

So far, it’s unknown how many patients experienced issues with filling or paying for prescriptions or care delays. But the AMA survey highlights providers' serious concerns about how the cyberattack affects their patients.

In comments, respondents expressed frustration and worry, saying they’ve been unable to access patient lab results, forced to cancel visits because they couldn’t verify patient eligibility, and seek workarounds that have increased their patient’s medical bills. 

For patients managing chronic disease and those with serious medical conditions, even a brief care interruption can significantly decrease quality of life and could potentially encourage disease progression.

The cyberattack “severely affected our ability to manage pain care with our cancer patients,” according to one respondent. 

“…I have one patient that was unable to get her biological for two months as she was unable to afford the cash cost and her disease flared significantly,” another reported.

The Change Healthcare cyberattack has proven that critical vulnerabilities and challenges within the healthcare industry, if exploited, can impact any organization — regardless of size. It has also demonstrated that the financial repercussions of a security breach can be disastrous for smaller businesses. 

However, the emerging picture isn’t entirely bleak. A practice with a robust cybersecurity profile is more likely to succeed at keeping sensitive data out of the wrong hands. 

Now is the time to improve your practice’s cybersecurity defense. Consider strategies that reduce vulnerabilities, such as upgrading security tools and implementing tighter cybersecurity protocols. 

For helpful tips on how to get started, read our post on physician cybersecurity.