AHA Letter to HHS on Implications of Change Healthcare Cyberattack

February 26, 2024

The Honorable Xavier Becerra
Secretary
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Washington, DC 20201

RE: Implications of Cyberattack on Change Healthcare for Patient Care and Next Steps

Dear Secretary Becerra:

On behalf of our nearly 5,000 member hospitals, health systems and other health care organizations, our clinician partners — including more than 270,000 affiliated physicians, 2 million nurses and other caregivers — and the 43,000 health care leaders who belong to our professional membership groups, the American Hospital Association (AHA) thanks you for your leadership in responding to the recent cyberattack on Change Healthcare. We are grateful for your partnership and the Department of Health and Human Services’ (HHS) efforts to help minimize the fallout from this attack, and we ask for your continued support until the situation is fully resolved.

This unprecedented attack against one of America’s largest health care companies has already imposed significant consequences on hospitals and the communities they serve. Although the full scope of the impact is still unclear, Change Healthcare’s vast nationwide reach suggests that it could be massive. According to Change Healthcare, the company processes 15 billion health care transactions annually and touches 1 in every 3 patient records. These transactions include a range of services that directly affect patient care, including clinical decision support, eligibility verifications and pharmacy operations. All of these have been disrupted over the past several days. Thankfully, Change Healthcare has informed our members that its prior authorization portals are active, but our members are reporting that a substantial portion of their claims still cannot be processed, nor can they complete eligibility checks necessary to determine whether a patient’s insurance covers a prospective treatment.

Change Healthcare’s downed systems also will have an immediate adverse impact on hospitals’ finances and the work they do every day to care for patients and communities. Their interrupted technology controls providers’ ability to process claims for payment, patient billing and patient cost estimation services. Any prolonged disruption of Change Healthcare’s systems will negatively impact many hospitals’ ability to offer the full set of health care services to their communities. After all, without this critical revenue source, hospitals and health systems may be unable to pay salaries for clinicians and other members of the care team, acquire necessary medicines and supplies, and pay for mission critical contract work in areas such as physical security, dietary and environmental services. In addition, replacing previously electronic processes with manual processes will add considerable administrative costs on providers, as well as divert team members from other tasks. It is particularly concerning that while Change Healthcare’s systems remain disconnected, it and its parent entities benefit financially, including by accruing interest on potentially billions of dollars that belong to health care providers.

We appreciate that the resolution to this attack ultimately lies with Change Healthcare and its parent company UnitedHealth Group. We are in communication with their leadership and have asked for certain support, including greater transparency about the nature and scope of the attack, an anticipated timeline for resolution, and temporary access to advanced payments to help providers weather the period while normal claims processing functions are down.

However, we believe there are several areas where hospitals and health systems may need immediate federal support as the disruption persists. Because the situation is still fluid and many facts have not been shared with AHA or its members, these represent our best understanding of some of the steps that would help hospitals and health systems at this time. Specifically, we ask that HHS:

• Continue efforts to facilitate communication and transparency from Change Healthcare to the provider community.
• Offer guidance to providers about how they may request Medicare advanced and accelerated payments and including by directing the Medicare Administrative Contractors to prioritize processing applications by hospitals for advanced payments.
• Alert surveyors to the likelihood that some hospitals’ systems are not functional, which may cause longer than normal waits for care, upsetting patients and their families, but are out of the control of hospitals and should not result in additional citations or complaint surveys being conducted.
• Provide enforcement discretion related to good faith estimates and educate the public that these estimates may temporarily be unavailable.
• Provide an extension to the timely filing requirements under federally regulated health plans.
• Provide flexibility with respect to e-prescribing regulations.
• Evaluate whether this attack may impact value-based purchasing programs given that hospitals and health systems may not be able to receive remittances, as well as any other policies and programs.

We thank the Administration for its ongoing support and stand ready to work with you, Change Healthcare and its corporate ownership to minimize any further disruption to patient care as a result of this attack. Please contact me if you have questions, or feel free to have a member of your team contact AHA Executive Vice President Stacey Hughes at shughes@aha.org.

Sincerely,

/s/

Richard J. Pollack
President and Chief Executive Officer

CC: The Honorable Chiquita Brooks-LaSure, Administrator, Centers for Medicare & Medicaid Services