AHA Urges Congress to Provide Support to Help Minimize Further Fallout from Change Healthcare Attack

March 4, 2024

Dear Leader Schumer, Leader McConnell, Speaker Johnson and Leader Jeffries:

On behalf of our nearly 5,000 member hospitals, health systems and other health care organizations, our clinician partners — including more than 270,000 affiliated physicians, 2 million nurses and other caregivers — and the 43,000 health care leaders who belong to our professional membership groups, the American Hospital Association (AHA) writes to update you on the recent cyberattack on Change Healthcare and its impacts on hospitals, health systems and patients around the country. We are now on day 13 of this crisis and urgently need your support to help minimize further fallout from this attack.

Background on the Cyberattack

On Feb. 21, Change Healthcare, a subsidiary of UnitedHealth Group, was the victim of the most significant cyberattack on the U.S. health care system in American history. Change Healthcare is the predominant source of more than 100 critical functions that keep the health care system operating. Among them, Change Healthcare manages the clinical criteria used to authorize a substantial portion of patient care and coverage, processes billions of claims, supports clinical information exchange, and processes drug prescriptions. Significant portions of Change Healthcare’s functionality have been crippled. As a result, patients have struggled to get timely access to care and billions of dollars have stopped flowing to providers, thereby threatening the financial viability of hospitals, health systems, physician offices and other providers.

Impact to Hospitals, Health Systems, Communities and Patients

This unprecedented attack against one of America’s largest health care companies has already imposed significant consequences on patients and the hospitals, health systems and other providers who care for them. In some communities, patients have struggled to obtain prescriptions or have faced delays in scheduling care or receiving and paying bills. Hospitals, health systems and other providers are experiencing extraordinary reductions in cash flow, threatening their ability to make payroll and to acquire the medical supplies needed to provide care. The urgency of this matter grows by the day.

While the impact varies by hospital, Change Healthcare’s downed systems are hampering providers’ ability to verify patients’ health insurance coverage, process claims and receive payment from many payers, exchange clinical records with other providers, provide cost estimates and bill patients, and, in some instances, access the clinical guidelines used in clinical decision support tools and as part of the prior authorization process. The staggering loss of revenue means that some hospitals and health systems may be unable to pay salaries for clinicians and other members of the care team, acquire necessary medicines and supplies, and pay for mission critical contract work in areas such as physical security, dietary and environmental services. In addition, replacing previously electronic processes with manual processes has often proved ineffective and is adding considerable administrative costs on providers, as well as diverting team members from other tasks.

Action by UnitedHealth Group/Optum/Change Healthcare

Since we first learned of the attack, we have been in communication with UnitedHealth Group leadership to lend our support and share our members’ challenges because of the Change Healthcare outage. Over the past week, we also have asked for support, including greater transparency about the nature and scope of the attack, an anticipated timeline for resolution, and temporary access to advanced payments to help providers weather the period while normal claims processing functions are down.

Unfortunately, UnitedHealth Group’s efforts to date have not been able to meaningfully mitigate the impact to our field. Workarounds to address prior authorization, as well as claims processing and payment are not universally available and, when they are, can be expensive, time consuming and inefficient to implement. For example, manually typing claims into unique payer portals or sending by fax machine requires additional hours and labor costs, and switching revenue cycle vendors requires hospitals and health systems to pay new vendor fees and can take months to implement properly.

In addition, UnitedHealth Group’s “Temporary Funding Assistance Program” that it stood up as part of its response on March 1 will not come close to meeting the needs of our members as they struggle to meet the financial demands of payroll, supplies and bond covenant requirements, among others. We will continue to work with UnitedHealth Group as this situation evolves to communicate the state of the field and ensure support for our members and the patients they serve.

Hospitals Need Assistance from the Department of Health and Human Services

On Feb. 26 AHA sent a letter to Health and Human Services (HHS) Secretary Xavier Becerra detailing several areas where hospitals and health systems may need immediate federal support as the disruption persists. As of the writing of this letter, HHS has yet to provide a formal response or issue mitigating solutions. We urge Congress to press upon the department the importance of the need for immediate action with a particular focus on:

• Directing the Medicare Administrative Contractors to prioritize and expedite review and approval of hospital requests for Medicare advanced payments.
• Issuing guidance to all payers that outlines expectations that payers will implement periodic interim payments or advanced payments to providers; waive timely filing requirements for claims; extend timelines for appeals; and not deny claims due to lack of authorization, failure to give notice of admission, failure to check eligibility electronically, failure to receive medical records or failure to timely appeal denials; among other considerations given the widespread disruption in routine operating procedures.
• Using all power at the Secretary’s disposal to ensure that UnitedHealth Group takes all necessary steps to remedy the situation, including implementing a meaningful financial assistance program and engaging in frequent and forthright communication with providers.

Congressional Request

This incident demands a whole of government response. We therefore urge Congress to consider any statutory limitations that may exist for any federal agencies that can assist hospitals at this critical moment. If such limitations exist, the Executive Branch may be unable to provide solutions to ensure our nation’s provider network remains solvent and serves patients.

We must resolve the crisis resulting from the cyberattack on Change Healthcare for the wellbeing of our patients and broader communities. We stand ready to work with you, Change Healthcare and its corporate ownership to minimize any further disruption to patient care as a result of this attack and to ensure hospitals and health systems have the resources they need to continue serving their patients and communities. We urge you to press the Executive Branch for bold, swift action to prevent further fallout and to ensure a complete and fulsome response from UnitedHealth Group. Please contact me if you have questions, or feel free to have a member of your team contact AHA Executive Vice President Stacey Hughes at mailto:shughes@aha.org.

Sincerely,

/s/

Richard J. Pollack
President and Chief Executive Officer

CC.

The Honorable Xavier Becerra, Health and Human Services Secretary
The Honorable Alejandro Mayorkas, Department of Homeland Security Secretary
The Honorable Jake Sullivan, National Security Advisor