Hospitals affected by Change cyberattack advised to disconnect from Optum

Photo: Courtesy of UnitedHealth Group

All healthcare organizations that were disrupted or potentially exposed to Change Healthcare's cybersecurity incident have been advised to disconnect from Optum.

The American Hospital Association sent out the cybersecurity advisory on Thursday.

"Due to the sector wide presence and the concentration of mission critical services provided by Optum, the reported interruption could have significant cascading and disruptive effects on revenue cycle, certain healthcare technologies and clinical authorizations provided by Optum across the healthcare sector," the AHA said in a cybersecurity advisory issued Thursday.

"Based upon the statements from Change Healthcare that they became aware of an 'outside threat' and disconnected 'in the interest of protecting our partners and patients,' we recommend that all healthcare organizations that were disrupted or are potentially exposed by this incident consider disconnection from Optum until it is independently deemed safe to reconnect to Optum. It also is recommended that organizations which utilize Optum's services prepare related downtime procedures and contingency plans should Optum's services remain unavailable for an extended period."

The AHA said it has been in communication with the FBI, Department of Health and Human Services, and the Cybersecurity and Infrastructure Security Agency regarding this incident.

The cyberattack began disrupting a number of Change Healthcare's systems and services on Wednesday.

The latest update, posted on the Optum status page on Friday, said "Change Healthcare is experiencing a cybersecurity issue, and our experts are working to address the matter. Once we became aware of the outside threat, in the interest of protecting our partners and patients, we took immediate action to disconnect our systems to prevent further impact. At this time, we believe the issue is specific to Change Healthcare and all other systems across UnitedHealth Group are operational. The disruption is expected to last at least through the day. We will provide updates as more information becomes available."

UnitedHealth Group disclosed Thursday one of its subsidiaries was hit this week by a cyberattack from an actor with a suspected nation-state association, according to the Star Tribune. After detecting the incident, UnitedHealth isolated the impacted information technology systems from other connecting systems to contain, assess and remediate the problem, the report said.

Pharmacies reportedly experienced delays in filling prescriptions due to Change's incident. CVS Health said some of its business operations were impacted by the network interruption, according to the Star Tribune report. CVS Health said there was no indication that its systems had been compromised. It was continuing to fill prescriptions but in some cases is not able to process insurance claims.

AHIP did not immediately comment on the cybersecurity incident or whether it has the potential to disrupt payer operations. Many insurers use Optum's services. Four out of five health plans use Optum Insights, according to information posted by UnitedHealth Group.

WHY THIS MATTERS

In 2022, UnitedHealth Group, parent company of Optum, completed its merger of Change, a company that provides services in technology, data, pharmacy care and direct healthcare.

The cybersecurity breach reveals the interconnectedness of healthcare systems using the services of Optum and Change Healthcare.

In a 2017 interview, when an Optum executive was asked how many insurers used Optum, the answer, he said, was virtually all of them. At the time Optum worked with about 300 health plans and had over 5,000 hospitals in its portfolio. 

THE LARGER TREND

The AHA advised organizations to test the security, redundancy and resiliency of their network and data backups, while ensuring they remain offline. AHA recommended backup technology which renders the backups "immutable" – unable to be deleted, altered or encrypted.

The AHA is asking hospitals to send any technical, financial and/or clinical impact or related technical threat intelligence on a confidential basis to jriggi@aha.org.

Other recommendations:

• Ensure that all high criticality, known and exploited vulnerabilities have been patched, especially any which are internet facing.
• Review and test cyber incident response plans, and ensure they are well coordinated and integrated with emergency management plans. Test callout for activation of incident command structure and backup communications plans should email and VoIP communications fail.
• Review business and clinical continuity downtime procedures to ensure mission-critical and life-critical functions could sustain a loss of information, operational and medical technology for up to 30 days.
• Consider designating clinical downtime "coaches" and "safety officers" for each shift. These would be individuals who are experienced and adept at working with downtime, manual procedures, should there be a loss of access to the EMR, and other medical technology. They should be able to guide and lead other less experienced staff in the implementation of downtime procedures to ensure continuation of safe and quality care.
• Increase threat-hunting and monitoring tools and techniques. Although no specific threat actor has been identified, the joint government agency advisory regarding "living off the land" cyber technique serves as a good general guide.

For further information on ransomware preparedness see the Stop Ransomware guide or visit www.aha.org/cybersecurity.

Email the writer: SMorse@himss.org