State AGs, Industry Groups Urge Action in Change Health Saga

Twenty-two state attorneys general and some industry groups are urging Change Healthcare’s parent company and regulators to be transparent and give more financial aid to cash-strapped providers as the firm recovers from a highly disruptive cyberattack and the healthcare industry braces for massive breach notifications.

See Also: Take Inventory of Your Medical Device Security Risks

On Monday, UnitedHealth Group said it fears that the protected health information and personal identifiable information for a “substantial portion” of the U.S. population was affected by the cyberattack (see: Change Health Attack: Details Emerge; Breach Will Top Record).

The data breach could affect tens of millions of individuals in what many are describing as a record-setting hack. The February attack forced Change Healthcare to shut down more than 100 applications, many of which are used for insurance verification and reimbursements by a large number of hospitals, pharmacies and practices.

In a letter Thursday to UnitedHealth Group CEO Andrew Witty, the attorneys general from nearly half of U.S. states vented their frustration over Change Healthcare’s response so far “to the lengthy disconnection and subsequent limited restoration of its platform services” as a result of a cyberattack.

“Healthcare entities and pharmacies within our jurisdictions have indicated that they are in jeopardy of collapse. Patients describe disruptions to their care and delayed or denied access to prescription drugs as a consequence of Change Healthcare’s failures,” said Minnesota Attorney General Keith Ellison in the letter signed by his peers in 21 other states.

“You must do more than you are currently to avoid imposing further harm to our states’ healthcare infrastructure and the patients who rely upon it.”

Though providers who directly contract with Change Healthcare reported the most substantial impacts on their ability to continue providing care and remain solvent, they were not the only parties affected by the outage, the AGs said.

“Even parties who do not wittingly use Change Healthcare have endured the effects of Change’s failures as insurers have seen their systems hobbled by the disruption of Change. As a consequence, care providers and facilities initially had to choose whether to provide care or prescriptions to patients without completing the requisite approvals and preapprovals – thus risking that they would later not be reimbursed by insurers – or refusing to provide those services and jeopardizing the health of patients.”

The AGs ask that UHG take several actions, including:

• Expanding and enhancing financial assistance to all affected providers, facilities and pharmacies;
• Revising terms for longer pay-back periods and permit repayment through offsets of claims paid;
• Suspending prior authorizations and certain other documentation requirements;
• Ensuring that providers, facilities, pharmacies, regulators, affected patients and the public are informed of what data was compromised and what steps need to be taken to mitigate future identity theft or systems risks.

As of Friday, UHG said it has so far offered $6 billion in financial assistance to affected providers.

UHG in a statement to Information Security Media Group said it is aware of the letter from the state attorneys general.

“Since day one, we have prioritized patient access to care and providing resources and support to concerned individuals, providers and customers. We continue to offer financial assistance to those providers who need it and encourage them to contact us,” the statement says.

Major Impact

The Change Healthcare attack has caused major disruptions for U.S. healthcare providers and patients, in part because it has disrupted medical care reimbursements, the ability to verify patient eligibility for services, and for some, the ability to obtain pharmacy prescriptions. Change Healthcare handles about 6% of all U.S healthcare system payments.

UHG this week also confirmed that it paid a ransom in the attack, but it did not specify how much or to whom. A western affiliate of the BlackCat, aka Alphv, ransomware group who claimed to behind the February attack said UnitedHealth Group paid BlackCat a $22 million ransom. That affiliate also claimed BlackCat kept the entirety of that massive ransom payment, rather than sharing the affiliate’s cut, and a second group, RansomHub, briefly posted samples of the stolen data on a leak site and reportedly hit UHG with another ransom demand. Meanwhile, the company is still working to restore certain IT systems and services, but others like prescription services and payment processing are operating respectively at levels 99% and 86% as normal.

The American Medical Association in a statement on Wednesday chastised UHG for the “havoc” the disruption has caused to physicians and especially to small practices.

AMA members also are deeply concerned that “the vast amounts of sensitive medical data might have been stolen from Change Healthcare’s system are in the hands of malicious ransomware groups,” the association said.

The AMA is urging the company to keep the medical community informed of developments in the cyber incident and breach and to provide “financial assistance and administrative flexibilities needed for practices to stay open and provide patient care.”

“Nearly two months after Change Healthcare turned off its systems, large portions of physicians reported suspended claim payments, and the inability to submit claims or verify benefits,” the AMA said. “UHG must solve many of these issues one practice or situation at a time, so it is not a shock that small practices are last in line and really struggling.”

Breach Reporting Burden

The Medical Group Management Association, which represents 15,000 medical group practices and 350,000 physicians, on Thursday in a letter to U.S. Department of Health and Human Services’ Office for Civil Rights Director Melanie Fontes Rainer urged the agency to take certain actions involving the Change Healthcare breach.

Those actions include clarifying that UHG, and not medical groups, will bear the full brunt of breach notification and regulatory scrutiny for breaches involving the Change Healthcare cyberattack.

Specifically, the MGMA wants HHS OCR to state that responsibility for breach notifications rests solely with Change and UHG, ensure that providers “that are completely innocent in this unique situation” will be spared any regulatory scrutiny, and require Change and UHG to “fulfill the promises they have made in a prompt and transparent manner.”

UHG in its statement Monday said that to help ease reporting obligations on other stakeholders whose data may have been compromised in the cyberattack, it is offering to make breach notifications “and undertake related administrative requirements on behalf of any provider or customer.”

HHS OCR in HIPAA guidance issued last week said covered entities affected by the Change Healthcare attack also must file breach reports to HHS and notifications to affected individuals “without unreasonable delay.” Business associates affected by the incident also must notify affected covered entities after the discovery of the breach (see: Feds Issue Guide for Change Health Breach Reporting Duties).

HHS OCR also said, “HIPAA-regulated entities affected by this incident should contact Change Healthcare and UHG with any questions on how HIPAA breach notification will occur.”

HHS OCR did not immediately respond to ISMG’s request for comment on the MGMA’s requests.

In addition to Minnesota’s Ellison, the others signers of the letter sent to UHG are the attorneys generals of Arizona, California, Connecticut, Hawaii, Maine, Michigan, Massachusetts, Mississippi, Nevada, Nebraska, New Hampshire, New York, North Carolina, Oregon, Pennsylvania, Rhode Island, South Dakota, Vermont, Utah, Washington and the District of Columbia.