HHS seeks input from payers on Change cyberattack response

Photo: Weiquan Lin/Getty Images

U.S. Department of Health and Human Services Secretary Xavier Becerra and Deputy Secretary Andrea Palm convened a meeting of payers on Monday to discuss actions they could take to mitigate the harm caused by the Change Healthcare cyberattack.

In the follow-up to another meeting last week, White House Domestic Policy Advisor Neera Tanden and White House Deputy National Security Advisor (DNSA) for Cyber and Emerging Technologies Anne Neuberger, and others from the federal government, also participated.

Since the last meeting, HHS surveyed payers for data and information relating to actions they were taking to help providers resolve issues stemming from the cyberattack. The teams then worked over the weekend to review the responses.

During the meeting, Becerra and Tanden discussed the adjustments made to improve claims processing, but urged more support to providers who remain in need, particularly those serving vulnerable populations, rural hospitals and smaller institutions. They made clear the government and private sector must continue to work together to help providers make payroll and deliver timely care.

Palm acknowledged steady progress in reestablishing claims processing, and urged insurers to target advanced payments to small, rural and safety net healthcare providers who are still voicing concerns over cash flow.

Neuberger noted the interconnectedness of the domestic healthcare ecosystem and the urgency of strengthening cybersecurity resilience across the sector, and urged insurers to implement HHS' voluntary HPH Cyber Performance Goals (CPGs). Saying many payers and providers will require third party certification of the cybersecurity of Change Healthcare's system before reconnecting, she encouraged UnitedHealth Group (UHG) to communicate to providers about efforts to safely secure claims systems and the time frame for those third-party assessments.

Becerra and Palm also urged UHG to connect providers to needed supports. Tanden urged insurers to assess their own data to determine which providers are in need of additional support, and to directly engage them.

Representatives from the participating insurers offered updates on their efforts to date and outlined specific actions they will be taking to resolve outstanding issues. HHS and White House leadership pressed insurers to be targeted and specific in carrying out solutions, including increasing advanced payments where needed to the providers and communities still most in need.

WHAT'S THE IMPACT?

Late last week, Dr. Jesse Ehrenfeld, president of the American Medical Association criticized insurer group AHIP's lack of response to the cyberattack.

"It is dumbfounding that following weeks of silence and a lack of assistance to struggling practices in the wake of the Change Healthcare cyberattack, AHIP's response is a 'business as usual' approach to prior authorization," said Ehrenfeld. This approach is particularly galling since service outages have exacerbated the administrative burdens and care delays already associated with this process. Prioritizing profits over the stability and solvency of our care delivery system starkly contrasts with the Biden Administration's appeal to health plans to 'meet the moment.'"

HHS was notified of the cyberattack on Change Healthcare systems on February 21. HHS and other federal agencies have taken a number of actions since:

• On March 13, the Centers for Medicare and Medicaid Services released a set of answers to Frequently Asked Questions regarding the availability of accelerated and advance payments for Part A and Part B providers and suppliers, respectively. 
• On March 13, HHS sent a survey to payers that participated in a March 12 convening on the Change Healthcare cybersecurity incident. 
• On March 13, HHS' Office of Civil Rights (OCR) issued a "Dear Colleague" letter addressing the cybersecurity incident impacting Change Healthcare, a unit of UHG, and other healthcare entities. Given the unprecedented size of the attack and public interest, OCR announced in the letter that it opened an investigation of the cyberattack on Change Healthcare and United Health. The letter also made clear to the thousands of other covered entities affected by the breach that they are not OCR's target. OCR enforces the HIPAA Security Rule, which is the department's law enforcement tool to safeguard protected health information from cyberattacks.
• On March 15, CMS reopened the 2023 Merit-based Incentive Payment System (MIPS) Extreme and Uncontrollable Circumstances (EUC) Exception Application to provide relief to clinicians impacted by the cybersecurity incident on reporting requirement time frames.  
• On March 15, CMS announced flexibilities to help state Medicaid agencies provide needed relief to Medicaid providers and protect access to healthcare coverage. In particular, CMS announced flexibilities to ensure that states can start making interim payments to providers affected by the Change Healthcare cybersecurity incident.

THE LARGER TREND

Minnesota Hospital Association and Minnesota Attorney General Keith Ellison said this week that scammers are taking advantage of the Change Healthcare cyberattack to steal credit card information. People claiming to be representatives from various healthcare providers are telling patients they will receive refunds if they provide their credit card number, said the notice from the Minnesota AG's office.

Some of the scam reports involve alleged payments, rebates or refunds related to drugs or other health services, the MHA said.

In its latest update, Change, owned by Optum, a subsidiary of UnitedHealth Group said, "We are working to restore access for providers that lost claims and ERA connectivity during the Change Healthcare cybersecurity issue. Over the next several weeks, Optum is working with government payers and intermediaries to transition providers enrolled in Change Healthcare connections to the Optum iEDI Clearinghouse (Exchange claims and ERAs, Change Healthcare OKC Clearinghouse claims and ERAs, Assurance Reimbursement Management, Revenue Performance Advisor). This transition includes both claims and ERA transactions. Our payers will maintain dual enrollment for claims to ensure an easy transition as our platforms come online."

Change said it was enabling for customers the Rx CardFinder Service.

"We have completed standing up a new instance of Change Healthcare's Rx CardFinder Service in a new environment," Change said. "Testing was successful with Surescripts and Relay Health on both commercial and TROOP queries. As a result, we are enabling this service for all customers effective 6 p.m. CT, Friday, March 15."

It has launched a new instance of the Rx Connect (Switch) service and is actively working to restore full service and connectivity claim traffic. Rx Connect, Rx Edit, and Rx Assist are now expected to be enabled and available for customers who have configured direct internet access connectivity.
 

Jeff Lagasse is editor of Healthcare Finance News.
Email: jlagasse@himss.org
Healthcare Finance News is a HIMSS Media publication.