What’s Going on with the Change Healthcare Cyber Attack — And Why You Should Care

By Barbara Griswold, LMFT  (March 12, 2023, updated March 25, 2023, see end of article also)

As many of you are aware, on February 21, 2024, Change Healthcare (owned by United Health Group) reported they were the victim of an “unprecedented cyberattack on the U.S. health system and the Change Healthcare claims and payment infrastructure.”  When they became aware of the outside threat, Change took action to disconnect their systems to prevent further impact.

Why should you care?  This is BIG.  According to Healthcare Dive, “Change processes 15 billion healthcare transactions each year and touches one in every three patient records nationwide.”  Clinicians have reported problems “receiving payment from patients and insurers, verifying coverage, submitting prior authorization requests and exchanging clinical records.”

Practice management programs like SimplePractice and TherapyNotes process many insurance plan claims through the Change Healthcare clearinghouse, which acts as a kind of a middle man between their platform and the insurance plan. So with Change going offline, the bottom line is that claims aren’t getting submitted or paid. SimplePractice reports “processing delays can be expected for claims and ERAs, with resolutions occurring at different times depending on the payer.”

When will it be fixed? As of this writing, Change is reporting,“we expect to begin testing and reestablish connectivity to our claims network and software on March 18, restoring service through that week” (emphasis mine). Change Healthcare is posting status updates and details about this claims disruption and workarounds — click here

Read the press release about it from the U.S. Dept of Health and Human Services: click here. As you can read, this impacts Medicare claims, also.

What can you do in the meantime? See the Change Healthcare page for suggested workarounds, if you don’t want to wait (or can’t). Their website states, “while we work to restore these systems, we strongly recommend our provider and payer clients use the applicable workarounds we have established — in particular, using our new iEDI claim submission system …. You can also contact the online platform that you use to submit claims. TherapyNotes and other claims submission platforms that use Change Healthcare are continuing to come up with workaround solutions and connections to alternate clearinghouses, in case there are further delays and to be better prepared for the future.

If you are a SimplePractice user, click here for more information.

If you are a TherapyNotes user, click here for more information — their webpage is updated regularly.  In addition, they have created a video to show how to download claims from TherapyNotes and upload them to Office Ally, for those of you who have not yet tackled this and don’t want to wait until services are fully restored using Change Healthcare. — view that video here.

If you are a Aetna provider:  Here is the March 18, 2024 update from Aetna:  click here

If you are an Office Ally user: In an 3/25/24 email from OA in response to a question, they stated “within our Ally Central tool (located through the blue question mark at the bottom right of the application), we are keeping an active list of payer connections impacted by the Change Healthcare cyber-attack. Payer connections highlighted in green have successfully been rerouted through an alternative connection as of the effective date listed, at which point any held claims would have been released.” 

Was my client’s privacy compromised? This seems a bit unclear at the moment. In answer to this question on the Change Healthcare website, they respond, “our privacy office and security information teams are actively engaged and working to understand the impact to members, patients and customers.” However, SimplePractice on their website reassured their customers that “data security wasn’t impacted by this breach and your information remains secure.”

What if you are low on cash? Change also announced an expansion of their temporary funding program to providers who have been unable to submit claims, and whose payers are not offering advanced payment programs. Providers can apply for interest free funding that will be reviewed on a case-by-case basis. More information on these temporary funding programs can be found by clicking here.

3/17/24 Update:  According to HealthCare Dive, officials from the White House and the Dept. of Health and Human Services held a meeting on 3/12/24 with UnitedHealth and other industry groups to discuss the cyberattack at Change Healthcare, which has disrupted the healthcare sector for three weeks.  Read more here

3/25/24 UPDATE:  According to HealthCare Dive, Change Healthcare said its largest claims clearinghouses would come back online over the weekend, and more than $14 billion in charges have been prepared for processing. Change’s electronic payments platform has also been restored, and the company is working on payer implementations. Read More here