A survey published by the American Hospital Association found that 94% of hospitals have experienced financial disruptions from the Change Healthcare cyberattack. Jackson Health System in Miami was one of the hospitals affected.
UnitedHealth disclosed nearly a month ago that a cyber threat actor breached part of Change Healthcare's information technology network. Change Healthcare offers e-prescription software and tools for payment management, and the interruptions left many providers temporarily unable to fill medications or get reimbursed for their services by insurers.
“When hospitals don't get paid for the services they provide, that affects their ability to pay their doctors, nurses and their other staff, to sustain 24/7 operations and timely access to healthcare,” said Mary Mayhew, the Florida Hospital Association’s president and CEO.
The FHA represents over 200 hospitals in Florida, providing service and support focused on advancing healthcare policy at the state and federal level. The association also serves as a convener to support best practices, quality improvement and response to emergencies like this cyberattack.
Get South Florida local news, weather forecasts and entertainment stories to your inbox. Sign up for NBC South Florida newsletters.
Jackson Health System and its IT department were notified of the attack on Feb. 20 and immediately cut all access to any Change Healthcare team and disconnected the software that was purchased from the organization.
“We were not sure what was happening on their end, and whomever had done this to them could very easily get access through their system into ours,” said Myriam Torres, the Chief Revenue Officer for Jackson Health System. “IT has a whole set of protocols, and immediately the one thing they do is remove access.”
As of now, patients are not being affected. The current impact lies on the payer’s side with their inability to process the hospital’s claims. As time goes on, weeks of insurance claims are building up, and according to Mayhew, it is expected that hospitals will be owed billions of dollars because of this attack.
However, according to Torres, “we should all be concerned.”
“Even though this is an issue that has heavily impacted healthcare across the country, everyone should be concerned over the financial impact this could potentially have," she said. "A situation like this cannot linger on for an undefined period of time because hospitals cannot function without payment.”
According to Mayhew, the cyber criminal's ability to hack the Change Healthcare system reveals the vulnerable state of the country’s healthcare infrastructure.
“One of the biggest concerns is the fact that these cyber criminals were able to successfully attack the country's largest health insurance company that has undoubtedly dedicated tens of millions of dollars to cybersecurity. So, they were vulnerable,” Mayhew said. “It means it's not whether it's going to happen again, it's when it's going to happen again.”
Although the FHA has so far continued to maintain access to healthcare, Mayhew points out that “as a country, and as a state, we've got to come together and look at ways in which to strengthen our various systems.”
The Jackson Health System does not know when this will come to an end. According to Torres, Change Healthcare is restarting its systems slowly.
“They're not just bringing up their entire system up at once, they're going tool by tool,” Torres said. “There's, billing tools, processing tools, payment tools, and not all of them are up yet.”
UnitedHealth, which provides care for 152 million people, hasn't disclosed what kind of data was compromised in the attack, or whether it cooperated with the cyber threat actor to restore systems. The company said it's been working closely with law enforcement and third parties like Palo Alto Networks and Google Cloud's Mandiant to assess the breach.
“We're waiting on a meeting between the executives from Change Healthcare IT and the executives from IT at Jackson to share more information,” Torres said.
UnitedHealth Group said Monday that it's paid out more than $2 billion to help healthcare providers who have been affected by the cyberattack on subsidiary Change Healthcare.
According to a survey by the AHA, more than 60% of the 1,000 hospitals surveyed estimated the revenue hit to be around $1 million per day. Responses were collected between March 9 and March 12.
"We continue to call on Congress and the Administration to take additional actions now to support providers as they deal with significant fallout from this historic attack," AHA CEO Rick Pollack said in the release.
The Biden administration announced Wednesday that it has launched an investigation into the company due to the "unprecedented magnitude of the cyberattack."
The U.S. Department of Health and Human Services' Office for Civil Rights is carrying out the inquiry. The OCR enforces the Health Insurance Portability and Accountability Act's security, privacy and breach notification rules, which most health plans, providers and clearinghouses are required to follow to protect health information.
