UnitedHealth Group's Q3 earnings show impact of Change cyberattack
Earnings from operations of $8.7B include $0.3B in unfavorable cyberattack effects, company says.
Photo: HIMSSMedia
UnitedHealth Group's third quarter earnings reflect the fallout of the Change ransomware attack from February, according to the Q3 earnings released Tuesday.
Earnings from operations of $8.7 billion for the three months ending Sept. 30 include $0.3 billion in unfavorable cyberattack effects, UnitedHealth Group said. Adjusted earnings of $9 billion include impacts from the Change business disruption but exclude cyberattack direct response costs.
This compares to Q3 2023 earnings from operations of $8.5 billion.
Adjusted earnings of $7.15 per share include $0.12 in business disruption impacts and excludes $0.28 in direct response costs.
UnitedHealth Group's stock price fell more than 9% at one point Tuesday morning after the earnings report, according to Seeking Alpha.
WHY THIS MATTERS
UnitedHealth Group said its adjusted net earnings outlook of $27.50 to $27.75 continues within the $27.50 to $28 range established nearly a year ago, even as it absorbs an estimated $0.75 per share of business disruption impacts for the affected Change Healthcare services, which have increased about $0.10 per share from the estimate provided last quarter.
The company's full-year 2024 net earnings outlook of $15.50 to $15.75 per share reflects the South America operations disposition activities reported in the first half of 2024 and Change Healthcare cyberattack impacts.
The medical cost ratio increased from 82.3% last year during the third quarter to 85.2% this year. Among the reasons for the increase is the Medicare funding reductions from the Centers for Medicare and Medicaid Services. Days claims payable increased to 47.4 this year compared with 45.2 in 2023 due to more normal claims submission patterns from providers, UnitedHealth said.
CFO John Rex called attention to the continued "pronounced upshift in coding intensity by hospitals." Rex said, "In some cases, the coding actions are extreme. Certain entities have been notably and persistently aggressive, having up shifted their coding intensity factors by more than 20%. We are actively addressing this unnecessary additional cost burden to the health system."
A second factor is a timing mismatch within Medicaid, in which state customer rate actions do not yet reflect the higher acuity of members who remain in Medicaid following the redetermination process.
Another factor, Rex said, is the rather rapid acceleration in the prescribing of certain high cost specialty medications, primarily those used to treat cardiovascular disease, autoimmune disorders and cancer. "We believe a contributing factor to the acceleration was the Inflation Reduction Act, which eliminated the individual coinsurance requirement during the catastrophic coverage phase," Rex said.
The Q3 2024 results also reflect broad-based growth in the number of people served by Optum and UnitedHealthcare.
The number of consumers in commercial offerings grew by 2.4 million.
Revenues of $100.8 billion grew $8.5 billion year-over-year.
"Our people have done all this and more in a challenging period, navigating the first year of the CMS Medicare rate cuts and its impact on member mix, the effects of the state-driven Medicaid member redeterminations, certain novel care patterns and the Change Healthcare cyberattack," CEO Andrew Witty said during the earnings call. "While many of those factors could not have been anticipated, thanks to our people's efforts, we can affirm a full year 2024 earnings outlook still within the range, we first offered back in November 2023."
THE LARGER TREND
Change Healthcare, which Optum bought two years ago, was hit by a ransomware attack on Feb. 21 that disrupted claims payments for numerous hospitals and physician practices nationwide.
As of April, UnitedHealth estimated Change expenses would exceed $1 billion this year.
In May, speaking before a House Committee, Witty confirmed that he made the decision to pay $22 million in bitcoin ransom to protect patient information.
The HIMSS Healthcare Cybersecurity Forum is scheduled to take place Oct. 31-Nov. 1 in Washington, D.C. Learn more and register.
Email the writer: SMorse@himss.org
