Scammers take advantage of Change cyberattack 

Photo: HIMSS Media

Scammers are taking advantage of the Change Healthcare cyberattack to steal credit card information, according to the Minnesota Hospital Association and Minnesota Attorney General Keith Ellison.

State hospital associations have received reports from patients who have been targeted by scammers seeking to steal their credit card information, Ellison said. People claiming to be representatives from various healthcare providers are telling patients they will receive refunds if they provide their credit card number, said the notice from the Minnesota AG's office.

Patients should be aware of reports of scammers contacting people around the country, posing as hospital, clinic or pharmacy employees, and asking for credit card information to resolve issues from the Change Healthcare cyberattack, according to the Minnesota Hospital Association. 

Some of the scam reports involve alleged payments, rebates or refunds related to drugs or other health services, the MHA said.

Hospitals will not call patients asking for credit card information, offering or demanding gift cards, or seeking bank account information, MHA said. The best course of action is to reach out directly to their provider to address any doubts or questions about billing or other financial information. 

WHY THIS MATTERS

The Blackcat ransomware gang was reportedly behind the cyberattack. UnitedHealth Group paid $22 million to recover access to data and systems encrypted by Blackcat, according to Reuters.

Neither the Minnesota AG's office nor MHA has linked the scams to personal information the group said it obtained in the reported ransomware attack. Blackcat claims to have stolen the data of millions of patients, including medical records, insurance records, dental records, payment information, claims information and patients' PHI, including health data, contact information and Social Security numbers, according to The HIPAA Journal.

"The Change system also holds potentially private data and other information for millions of patients," said Lou Ann Olson, MHA Associate vice president of Communications and Public Relations. 

The cyberattack has disrupted payments to healthcare providers. Seventy-four percent of hospitals report a direct impact to patient care due to delays in processing health plan utilization requirements such as prior authorization, according to the American Hospital Association.

Ninety-four percent of hospitals report a financial impact, with more than half saying it has a significant or serious impact. This includes cash flow issues and, from more than half of hospitals, an impact to revenue of $1 million per day or greater, the AHA said.

UnitedHealth Group subsidiary Change Healthcare is the largest healthcare payment system in the United States, Ellison said.

"I am urging all Minnesotans to be on the lookout for calls from scammers pretending to be your healthcare provider and asking for your credit card number," said Attorney General Ellison. "If you receive a call like this, do not provide any information. Instead, you should hang up, then dial your medical provider yourself to determine whether they actually need your payment information."

Consumers are encouraged to file a complaint with the Office of Attorney General Keith Ellison.

THE LARGER TREND

In its latest update, Change, owned by Optum, a subsidiary of UnitedHealth Group said, "We are working to restore access for providers that lost claims and ERA connectivity during the Change Healthcare cybersecurity issue. Over the next several weeks, Optum is working with government payers and intermediaries to transition providers enrolled in Change Healthcare connections to the Optum iEDI Clearinghouse (Exchange claims and ERAs, Change Healthcare OKC Clearinghouse claims and ERAs, Assurance Reimbursement Management, Revenue Performance Advisor). This transition includes both claims and ERA transactions. Our payers will maintain dual enrollment for claims to ensure an easy transition as our platforms come online."

Change said it was enabling for customers the Rx CardFinder Service.

"We have completed standing up a new instance of Change Healthcare's Rx CardFinder Service in a new environment," Change said. "Testing was successful with Surescripts and Relay Health on both commercial and TROOP queries. As a result, we are enabling this service for all customers effective 6 p.m. CT, Friday, March 15."

It has launched a new instance of the Rx Connect (Switch) service and is actively working to restore full service and connectivity claim traffic. Rx Connect, Rx Edit, and Rx Assist are now expected to be enabled and available for customers who have configured direct internet access connectivity.

Email the writer: SMorse@himss.org