Change Healthcare Cyberattack Response Timeline

Payments

• April 19: The American Medical Association has developed a brief survey to inform policy discussions with UnitedHealth Group, the Biden administration, and Congress. The deadline for this survey is Wednesday, April 24. Thank you for your support.
• March 22: Once claims begin to flow next week, payments will be contingent on payer timing.
• March 15: Electronic payment functionality restored and proceeding with payer implementations. UHG is continuing to bring payers and providers online. Providers who used SmartPay for patient payments may convert to SmartPay Plus. 
• March 9:  The Centers for Medicare & Medicaid Services (CMS) made available Change Healthcare/Optum Payment Disruption (CHOPD) accelerated payments to Medicare Part A providers and advance payments to Medicare Part B suppliers experiencing claims disruptions as a result of the cybersecurity incident. Contact your Medicare Administrative Contractor for assistance. See links below for more information.
• March 7: ASCO sends letter to CMS addressing concern that physician practices may not be included in emergency funding programs proposed by CMS. 
• March 5: HHS proposes flexibilities and accelerated payments for providers.  
• March 1, 2024: Optum Financial Services offering a temporary funding assistance program to providers. 

Medical Claims

• May 22:
  • Assurance (claims preparation) is back online.  Reconnection will occur in phases, beginning as early as Monday for Assurance customers. UHG will send out communications regarding protocol and necessary information to support reconnection with engagement of all submitted by mid-next week.
  • Relay Exchange (clearinghouse) is expected to be reconnected this weekend with communications to go out to customers next week.
• March 18: UHG to begin testing and reestablish connectivity to the claims network and software, restoring service through the week. 
• March 8, 2024: UnitedHealth Group (UHG) is temporarily suspending prior authorizations for most outpatient services except for Durable Medical Equipment, cosmetic procedures and Part B step therapies for its Medicare Advantage plans, including Dual Special Needs plans. UHG is suspending drug formulary exception review processes and will remain in place until March 31.

Pharmacy

• March 22: Copay offset coupons should be online, however pharmacy claims and reimbursement are currently disrupted. Email instructions are going out today to clients with instructions as restoration is expected to begin next week. UHG verified that pharmacies are eligible for temporary funding assistance.
• March 14: Infusion services functions are still being disrupted; restoration is anticipated once the claims and reimbursement functions of Change Healthcare are back online. 
• March 7: Majority of pharmacy network services has been restored.
• March 1, 2024: UnitedHealth Group (UHG) launched an e-prescribing solution. 

Other Items

• March 26: AMA has prepared an informal, 11-question survey to assess the current level of workflow disruptions and financial impact on practices. Response is requested by Friday, March 29.
• March 25: HHS issued a letter to providers with compiled information from health plans for providers in need of assistance. Please see the documents in the "Compiled Resources" section below. 
• March 22:
  • Relay Exchange, which encompasses eligibility, claims status, and other real time exchanges, to return to operation next week. 
  • Clinical Exchange (e-prescribing, orders, and results) and Analytics functions are expected to be available the week of April 1.
  • Risk Management functions are expected to be restored the week of April 8.
• March 15, 2024: The Centers for  Medicare & Medicaid Service (CMS) extended the 2023 Merit-based Incentive Payment System (MIPS) data submission deadline to April 15 and reopened the MIPS Extreme and Uncontrollable Circumstances Exception Application. 

Compiled Resources for Practices Affected by the Change Healthcare Cyberattack

From the Department of Health and Human Services (HHS)/CMS

• HHS Resources for Providers in Response to Change Healthcare Cyberattack (March 25)
• HHS Letter to Healthcare providers (March 25)
• CMS Announces Reopening of 2023 MIPS EUC Application in Response to Change Healthcare Cyberattack (March 15)
• Centers for Medicaid and Chip Services’ Response and State Flexibilities Informational Bulletin (March 15)
• Frequently Asked Questions on the CHOPD (Change Healthcare/Optum Payment Disruption) Accelerated and Advance Payment for Part A Providers and Part B Suppliers (March 13)
• Letter to Healthcare Leaders on Change Healthcare Cyberattack (March 10)
• Fact Sheet for CHOPD (March 9)
• CMS Memo to all Medicare Advantage Organizations, Part D sponsors, and Medicare-Medicaid Plans on addressing impacts to the Change Healthcare Cyberattack (March)
• Healthcare and Public Safety Cybersecurity Resource website

UnitedHealth Group

• Information on the Change Healthcare Cyber Response (last update March 21)

ASCO

• Cancer Care in the Wake of a Cyberattack: How to Prepare and What to Expect | JCO Oncology Practice

Original post begins below: 

Change Healthcare, a healthcare technology company that is a business unit of Optum and owned by UnitedHealth Group, fell victim to a cyberattack on February 21, 2024. Its clearinghouse remains offline. Regular updates on the situation are available for impacted customers on Optum’s website. According to a recent update the platform's Rx ePrescribing service has been restored. 

The ransomware attack could have significant implications for hospitals, health systems, pharmacies and others that rely on Change Healthcare's tools for payment, revenue cycle management, medication fulfillment, and other functions. Change Healthcare is the largest payment exchange platform in the country, with more than 50% of U.S. medical claims passing through its electronic clearinghouse. 

Electronic claims submissions and benefits verifications—which in turn affects clinical decision support, good faith estimates, prior authorizations, electronic prescribing, revenue cycle operations, and pharmacy operations—have been significantly impacted. Reportedly, some patients have had to pay cash prices for prescriptions due to the outage. 

The American Society of Clinical Oncology (ASCO) is assessing the oncology-specific impact of the attack and will keep its members up to date. ASCO’s JCO Oncology Practice previously published Cancer Care in the Wake of a Cyberattack: How to Prepare and What to Expect to guide cancer care amid such an attack.

More information and resources are available from the following:

• Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Department of Health and Human Services (HHS): Joint Cybersecurity Advisory 
• American Hospital Association (AHA): AHA Letter to HHS on Implications of Change Healthcare Cyberattack 
• American Medical Association (AMA): Change Healthcare cyber outage
• Medical Group Management Association (MGMA): MGMA letter on Change Healthcare cybersecurity attack
• South Dakota Association of Healthcare Organizations: UnitedHealth Group’s Change Healthcare Experiencing Cyberattack that Could Impact Health Care Providers and Patients Across the U.S.  
• Illinois Healthcare and Family Services: Optum Rx

Bookmark ASCO in Action for updates as well as news, advocacy, and analysis on cancer policy.