Cybersecurity bill would add caveat to provider payments

Photo: Michael Duva/Getty Images

Sen. Mark R. Warner (D-VA) on Friday introduced legislation to allow the Department of Health and Human Services to speed up provider reimbursement called advance and accelerated payments when hospitals and physicians are affected by cyberattacks.

The bill comes with a caveat: Providers and their vendors need to meet minimum cybersecurity standards to qualify. 

The Health Care Cybersecurity Improvement Act of 2024 is the first piece of legislation to follow the Feb. 21 cybersecurity attack that affected Change Healthcare and providers that have used its claims processing program.

WHY THIS MATTERS

The disruption in billing services from the Change cyberattack has threatened provider financial solvency. Hospital and physician groups have been continually asking for greater financial assistance from the federal government and more flexibility from payers.

Warner's bill applies to Medicare Part A providers (such as acute care hospitals, skilled nursing facilities and other inpatient care facilities) and Part B suppliers (including physicians, nonphysician practitioners, durable medical equipment suppliers and others who furnish outpatient services) that face cash flow challenges due to specified circumstances beyond their control.

This included the COVID-19 pandemic. 

Since the 1980s, the Centers for Medicare and Medicaid Services has provided temporary financial relief to participants in these programs through Accelerated and Advance Payment programs, during which these providers and suppliers receive advance payments from the federal government that are later recovered by withholding payment for subsequent claims.

The Health Care Cybersecurity Improvement Act of 2024 would modify the existing Medicare Hospital Accelerated Payment Program and the Medicare Part B Advance Payment Program by:

• Requiring the secretary to determine if the need for payments results from a cyber incident;
• If it does, requiring the healthcare provider receiving the payment to meet minimum cybersecurity standards, as determined by the secretary, to be eligible; and
• If a provider's intermediary was the target of the incident, the intermediary must also meet minimum cybersecurity standards, as determined by the secretary, for the provider to receive the payments.

These provisions would go into effect two years from the date of enactment. 

THE LARGER TREND

UnitedHealth Group, the parent company of Optum, which owns Change, has advanced more than $2.5 billion to providers through its Temporary Funding Assistance Program.

This week, Change should have the ability to process real-time transactions, have clearance for benefits verification and estimation related services, have pharmacy electronic claims for medical, claim pricing and coverage discovery, it said on its Optum status website.

ON THE RECORD

Warner, a member of the Senate Finance Committee and co-chair of the Senate Cybersecurity Caucus, said: "The recent hack of Change Healthcare is a reminder that the entire healthcare industry is vulnerable and needs to step up its game. This legislation would provide some important financial incentives for providers and vendors to do so." 

Email the writer: SMorse@himss.org