After Cyberattack, Oncology Practices Respond, Adapt Amid Calls for Reform

The unprecedented cyberattack on claims processing giant Change Healthcare has thrown open a window on what independent providers have been saying for years: Consolidation and vertical integration—and Congress’ failure to stop both—threaten crucial parts of the health system and its ability to deliver patient care.

Even after Andrew Witty, CEO of parent company UnitedHealth Group (UHG), was summoned to the White House on March 12,¹ provider groups said the giant insurer was taking too long to forward payments and improve cash flow, threatening small business owners and safety net providers.

For many providers, claims processing came to a near halt following the cyberattack on February 21 by the Russian “BlackCat” group.² Change Healthcare is estimated to handle more than 50% of all claims, involving 900,000 physicians, 33,000 pharmacies, 5500 hospitals, and 600 laboratories.³ Much of the meltdown revolved around the inability to gain prior authorization for expensive drugs, and oncologists were among the providers to seek relief from the typical requirements until the Change Healthcare outage was fully resolved.

Patients also felt the sting, as the outage crippled the ability of pharmacies to process coupons, leaving some consumers on the hook for the full cost of drugs—even if they could recover costs later.

By March 13, HHS had opened an investigation, and there were calls for Congress to ask not only how and why the outage occurred but also whether the growth of UHG is part of the problem.⁴ CMS announced a program to help states pursue retroactive payments for Medicaid providers.⁵ Published reports say the Department of Justice (DOJ) has started an antitrust action less than 2 years after UHG acquired Change Healthcare—amid reports that UHG subsidiaries gobbled up cash-strapped practices as the outage unfolded.^6,7

Kathy Oubre, MS | Image credit: LinkedIn

In part because the drugs they use to treat patients are so expensive, community oncologists felt the outage’s effects quickly, and many took time to explain its devastating effects on their practices. Kathy Oubre, MS, CEO of Pontchartrain Cancer Center in Covington, Louisiana, appeared on MSNBC on March 14 to outline the fallout of the attack. Suddenly, Oubre said, her practice could not get prior authorization for therapies or verify a patient’s eligibility under their insurance plan. “All that stopped without warning,” she said in an interview with MSNBC’s Chris Jansing. “We were able to contact most of the payers by phone and work through those things. But…overnight, it completely stopped our ability to send out health care claims to our payers and then to, in turn, have those processed and those payments come back to us…. We were scrambling to find out work-arounds in order to care for our patients and keep our clinics open.”⁸

In an email to Evidence-Based Oncology™, Oubre explained how the financial impact of the outage grew worse with each passing week. With no new claims going into the system, by week 3, claims revenue was now 40% of the norm. The was the week the White House demanded that UHG forward funds to practices, and some monies did start to flow.1 However, there were also angry online debates about whether the government was moving too slowly; some asked why UHG, through its Optum subsidiary, had been allowed to grow to the point of controlling 10% of the nation’s physicians.⁹

Oubre, who in the fall was named cochair of the Community Oncology Alliance (COA) committee on Drug Policy and Regulatory Affairs, said in her email that the cyberattack needs to be a “wake-up call” about the risks of vertical integration. “I urge Congress, the DOJ, and the [Federal Trade Commission] to take a hard look at the perils of vertical integration, consolidation, and monopolistic behavior and break these companies apart.”

A recent report in MedCity News outlined the scope of UGH: Acquisitions, including Change Healthcare, have pushed the Minnesota company to $371.6 billion in revenue in 2023 and profits of $22.4 billion. Meanwhile, its Optum subsidiary is affiliated with 90,000 physicians, including Optum-owned practices, whereas Optum Rx is the third-largest pharmacy benefit manager (PBM) by total number of prescription claims.¹⁰

On the same day that UHG’s Witty was called to the White House, AHIP, the umbrella group for the nation’s insurers, issued this response to calls for relief on prior authorization, which was already a hot topic prior to the cyberattack. “Health insurance plans have taken immediate and comprehensive steps to support providers and ensure continuity in patient care in response to the cyberattack,” said Mike Tuffin, president and CEO of AHIP. “These efforts have enabled many providers to resume claim submissions, receive timely payments, and maintain their operations.” He also noted that “some providers are still experiencing operational challenges,” and thus plans created alternative payment processes.¹¹

“Given the very wide variability of impact across the system, individual plans and providers are in the best position to assess how to maintain appropriate payments in a timely manner—and to minimize the need for reconciliation processes,” the statement continued. “Further, broad exemptions in prior authorization at a time of advanced payments could expose patients and employers to fraud, waste, and unnecessary costs.”¹¹

Jesse Ehrenfeld, MD, MPH | Image credit: AMA

That statement was met with a blistering response from Jesse M. Ehrenfeld, MD, MPH, president of the American Medical Association (AMA). “It is dumbfounding that following weeks of silence and a lack of assistance to struggling practices in the wake of the Change Healthcare cyberattack, AHIP’s response is a ‘business-as-usual’ approach to prior authorization,” Ehrenfeld said in the emailed statement. “This approach is particularly galling [as] service outages have exacerbated the administrative burdens and care delays already associated with this process. Prioritizing profits over the stability and solvency of our care delivery system starkly contrasts with the Biden Administration’s appeal to health plans to ‘meet the moment.’”

Ted Okon, MBA, COA executive director, said the Change Healthcare event was a massive crisis for practices who were already experiencing ongoing reimbursement challenges. “We are witnessing a disaster unfold in real time. The cyberattack on Change Healthcare is not just an inconvenience, it’s a direct threat to the livelihood of community oncology practices and the well-being of patients with cancer,” he said.¹² “The government must step in immediately with concrete measures to mitigate this crisis impacting both practices and the patients they serve. This is the closest event to a public health emergency we have seen since COVID[-19].”

At the White House meeting, UHG and other payers were asked to account for why funds were not going out to providers when payers were collecting premiums but not paying claims, according to Reuters.¹ The next say, the HHS Office of Civil Rights (OCR) followed up by opening an investigation into whether Change Healthcare complied with the federal law protecting patient data, following reports that the company paid a $22-million ransom to recover lost data.¹³

Specifically, HHS will focus on whether Change Healthcare or UHG violated the Health Insurance Portability and Accountability Act. “Given the unprecedented magnitude of this cyberattack, and in the best interest of patients and health care providers, OCR is initiating an investigation into this incident,” the HHS said in a letter to the industry.¹⁴

Previously, HHS and the Department of Labor had issued an open letter on March 10, urging UHG and other insurers to ensure that providers are insulated from cash flow disruptions. “We urge the private sector to quickly identify and carry out solutions,” the letter stated.15 “Specifically, we call on UHG, other insurance companies, clearinghouses, and health care entities to take additional actions to mitigate the harms this attack places on patients and providers, particularly our safety net providers.”

CMS urged insurers and PBMs to ease prior authorization restrictions in both Medicare and Medicaid, and offered instructions to its Medicare Administrative Contractors to speed payments to Medicare Part A providers while advancing payments to Part B providers and suppliers.

The AMA statement noted that one function of the Change Healthcare clearinghouse is to administer prior authorization, which the group said “is used to deny necessary care.” COA said the incident has threatened “the fragile ecosystem” of reimbursement, which threatens not only patient care but also practice sustainability. “The inability to process claims is choking the cash flow that is the lifeblood of practices, threatening their ability to provide care, pay staff salaries, and maintain operations,” Okon said.¹²

Among other steps, Okon called on CMS to allow providers to switch to alternative clearinghouses without the normal 21-day approval period.12

Nathan H. Walcker, MBA | Image credit: FCS

Some practices handled the crisis by developing their own solutions. Florida Cancer Specialists & Research Institute (FCS), which operates 100 separate care sites, announced on March 8 that it had stood up a new system to process claims and prescriptions through its management services corporation, Core Ventures Group. There was no time to waste for a practice where medical oncology spending is estimated at $300 million each month.16

“The stakes are undeniably high,” Nathan H. Walcker, MBA, CEO of FCS, said in a statement. “A financial crisis is looming—one greater than we have ever encountered—and we cannot sit idle waiting for a resolution. For this reason, we have been forced to take matters into our own hands with no other working solution being presented.”16

FCS’ statement described how the practice and its Core Ventures subsidiary worked with partner Unlimited Systems, which provides its revenue cycle platform, to activate a new medical claims pathway, called Availity.

“As a result of swift, collaborative action, FCS and Core Ventures accelerated delivery of the full-scale Availity pathway for the benefit of specialty health care providers across the country who rely on our practice management application to drive reimbursement,” Brian Gockerman, president and CEO of Unlimited Systems, said in the statement.

Ron Southwick of Chief Healthcare Executive®, an MJH Life Sciences® brand, contributed to this report.

References

1. White House meets with UnitedHealth CEO over hack. Reuters. March 12, 2024. Accessed March 14, 2024. https://www.reuters.com/world/us/white-house-summons-unitedhealth-ceo-over-hack-washington-post-reports-2024-03-12/
2. Capoot A. Ransomware group BlackCat is behind cyberattack on UnitedHealth division, company says. CNBC. February 29, 2024. Accessed March 18, 2024. https://www.cnbc.com/2024/02/29/blackcat-claims-responsibility-for-cyberattack-at-unitedhealth.html
3. Robertson J, Tozzi J, Pashankar S. UnitedHealth blamed ‘nation-state’ threat in hack that disrupted pharmacy orders. Bloomberg. February 22, 2024. Accessed March 18, 2024. https://www.bloomberg.com/news/articles/2024-02-22/unitedhealth-cyberattack-disrupts-medical-data-exchange-network
4. Roy S, Wingrove P. US health department opens probe into UnitedHealth hack. Reuters. March 13, 2024. Accessed March 18, 2024. https://www.reuters.com/technology/cybersecurity/hhs-opens-probe-into-hack-unitedhealth-unit-2024-03-13/
5. Tsai D. Change Healthcare cybersecurity incident—CMS response and state flexibilities. CMS Special Bulletin. March 15, 2024. Accessed March 18, 2024. https://www.medicaid.gov/sites/default/files/2024-03/cib031524.pdf
6. Matthew AW, Michaels D. U.S. opens UnitedHealth antitrust probe. Wall Street Journal. February 27, 2024. Accessed March 13, 2024. https://www.wsj.com/health/healthcare/u-s-launches-antitrust-investigation-of-healthcare-giant-unitedhealth-ff5a00d2
7. Tkacik M. UnitedHealth exploits ‘emergency’ it created. American Prospect. March 10, 2024. Accessed March 14, 2024. https://prospect.org/health/2024-03-10-unitedhealth-exploits-emergency-change-ransomware-oregon/
8. Jansing C. Major cyberattacks ‘completely stopped’ system at health center: cancer center CEO. MSNBC. March 14, 2024. Accessed March 15, 2024. https://www.msnbc.com/chris-jansing-reports/watch/major-cyber-attacks-completely-stopped-system-at-health-center-cancer-center-ceo-206537285740
9. Herman B. UnitedHealth Group now employs or is affiliated with 10% of all physicians in the U.S. STAT. November 29, 2023. Accessed March 15, 2024. https://www.statnews.com/2023/11/29/unitedhealth-doctors-workforce/
10. Plescia M. Should the DOJ break up UnitedHealth Group? MedCity News. March 17, 2024. Accessed March 18, 2024. https://medcitynews.com/2024/03/doj-antitrust-investigation-unitedhealth/
11. AHIP statement on response to cyberattack. News release. AHIP. March 12, 2024. Accessed March 18, 2024. https://www.ahip.org/news/press-releases/ahip-statement-on-response-to-cyberattack
12. COA sounds alarm for community oncology practices impacted by Change Healthcare cyberattack. News release. Community Oncology Alliance. March 5, 2024. Accessed March 14, 2024. https://mycoa.communityoncology.org/news-updates/press-releases/coa-sounds-alarm-for-community-oncology-practices-impacted-by-change-healthcare-cyberattack
13. Lyngaas S. Feds investigating whether hacked health care giant complied with law protecting patient data. CNN. March 13, 2024. Accessed March 14, 2024. https://www.cnn.com/2024/03/13/politics/feds-investigating-whether-hacked-health-care-giant-complied-with-law-protecting-patient-data/index.html
14. Rainer MF. Cyberattack on Change Healthcare. HHS. March 13, 2024. Accessed March 14, 2024. www.hhs.gov/sites/default/files/cyberattack-change-healthcare.pdf
15. Letter to health care leaders on cyberattack on Change Healthcare. HHS. March 10, 2024. Accessed March 18, 2024. https://www.hhs.gov/about/news/2024/03/10/letter-to-health-care-leaders-on-cyberattack-on-change-healthcare.html
16. No solution in sight, Florida Cancer Specialists & Research Institute, Core Ventures forge ahead in race to recover from Change Healthcare shutdown. News release. Florida Cancer Specialists & Research Institute. March 8, 2024. Accessed March 14, 2024. https://flcancer.com/articles/chresponse/