CNN
—
For more than two weeks, cyberattacks have disrupted operations at medical institutions across the United States, forcing small clinics to remain open and exposing vulnerabilities in the billing system that supports American healthcare.
“We're bleeding a lot,” said Katherine Reinheimer, practice manager at a foot and ankle specialty center in suburban Philadelphia. “This is probably the last week we can have everyone working full time without doing anything,” she told CNN. The center is considering taking out a loan to keep the lights on.
The cyberattack disrupted Change Healthcare's computer network, which serves thousands of hospitals, insurance companies and pharmacies across the country. This left some insurance payments for prescription drugs unprocessed, effectively leaving many healthcare providers to cover their bills without receiving reimbursement.
Change Healthcare, part of UnitedHealth, is one of the few companies that make up the central nervous system of the U.S. healthcare market. Its services allow doctors to check patients' insurance, pharmacies to process prescriptions, and clinics to submit claims for payment.
Medical groups have petitioned the Department of Health and Human Services (HHS) to provide medical practices with a financial lifeline. The department said Tuesday it was taking extraordinary steps to help process claims, but some health care providers say it's not enough.
Mel Davis, chief financial officer of Oregon Oncology Specialists, told CNN that if financial relief is not received soon, the private practice, which treats 16,000 cancer patients a year, will be forced to close. He said he was concerned that this could happen.
He said cash flow has fallen by 50% in the two weeks since the cyberattack. “The magnitude of this is unfathomable to us.”
On Thursday night, half a month after the unrest began, Change Healthcare announced plans to bring its electronic payment platform back online by March 15 and to restore its network for submitting claims the following week. Announced.
But health care providers and analysts say it will take much longer to wipe out the economic damage caused by the cyberattack.
Jesse Ehrenfeld, president of the American Medical Association, said in a statement on Friday: “The prospect of the Change Health Care Claims System remaining unreinstated for more than a month means that doctors will not be able to receive much needed funding, including funding for financially stressed medical practices. “This highlights the critical need for economic support.” .
Reinheimer, who works at a podiatry center, said Change Healthcare's plan to bring the system back online is “a ray of light at the end of the tunnel…but it's also a sign of the looming lack of funding today, tomorrow, and tomorrow.” It doesn't solve the problem.” next week. ”
The disruption caused by cyberattacks is prompting U.S. cybersecurity officials to consider the vulnerabilities of critical companies supporting the health care system.
The Change Healthcare hack “is an evolution beyond other ransomware attacks on individual hospitals and shows that the entire system is a house in the sand,” a senior US cybersecurity official told CNN.
Healthcare industry executives have been warning for several days that cyberattacks are placing a severe financial burden on the healthcare sector.
The Medical Group Management Association, which represents 15,000 medical institutions, warned of “catastrophic” financial losses due to the hack and “significant funding challenges” faced by doctors. The nonprofit Community Oncology Alliance said this week that ransomware attacks are having a “severe and continuing impact on cancer care and its patients.”
A week ago, Change Healthcare announced plans for a temporary loan program to provide funding to health care providers affected by power outages.
But Richard Pollack, president of the American Hospital Association, which represents thousands of hospitals across the country, called the proposal “not even a quick fix for payment problems.”
Carter Groom, CEO of cybersecurity firm First Health Advisory, said the cyber attack could ultimately cost Change Healthcare billions of dollars in lost revenue and customers. He said there is.
“This is a huge, huge moneymaker that is essentially an intermediary, an intermediary, between insurance companies,” Groom told CNN.
Change Healthcare blames the hack on a multinational ransomware gang called ALPHV or BlackCat, which the Department of Justice claims is responsible for ransomware attacks on victims around the world.
Hackers affiliated with ALPHV claimed this week that the company paid a $22 million ransom to recover data stolen in the hack. Change Healthcare spokesman Tyler Mason declined to comment when asked whether the company had paid off the hackers.
Private experts who track cryptocurrency payments said the hacking group received a $22 million payment, but it was unclear who made the payment. “Cryptocurrency accounts associated with ALPHV received $22 million in payments [on March 1]” Ari Redboard, global policy director at blockchain tracking firm TRM Labs, told CNN.
For Joshua Corman, a cybersecurity expert who has focused on the healthcare sector for years, the Change Healthcare cyberattack shows that the U.S. healthcare sector is not as resilient as it needs to be in the face of a crisis. That's clear evidence.
Corman, who led the federal task force to protect coronavirus research from hacking, said mergers and acquisitions of multibillion-dollar health care companies highlighted the problem, saying “single points of failure are huge and cascading.'' It can have an impact.”
He told CNN that if federal authorities “don't proactively identify systemically important entities, our adversaries will continue to do so on our behalf while we burn.”
