Congress should consider any statutory limitations that exist for an adequate response from the Centers for Medicare & Medicaid Services and Department of Health and Human Services to help hospitals and other providers minimize further fallout from the Change Healthcare cyberattack, AHA wrote March 13 in a letter to Senate Finance Committee leaders.

“The Administration has limited tools available, particularly because, unlike with COVID-19, the government is not operating under a declared Public Health Emergency and National Emergency,” AHA said. “While CMS has offered payments under the AAP [accelerated and advance payments], the agency only has authority to do so for limited time periods and amounts and with very high interest rates after repayments are due.”

AHA shared new data from a survey of hospitals and health systems describing the significant impact the cyberattack has had on direct patient care impact, including delays in authorizations for medically necessary care, as well as the significant and serious financial impact on their organizations.

“The staggering loss of revenue means that some hospitals and health systems may be unable to pay salaries for clinicians and other members of the care team, acquire necessary medicines and supplies, and pay for mission critical contract work in areas such as physical security, dietary and environmental services,” AHA wrote.

In the letter, which was sent ahead of a March 14 Senate Finance Committee hearing on HHS’ fiscal year 2025 budget proposal, AHA also commented on new penalties HHS proposes to implement on hospitals beginning in FY 2029 for not meeting what the Administration defines as essential cybersecurity practices.

“The AHA cannot support proposals for mandatory cybersecurity requirements being levied on hospitals as if they were at fault for the success of hackers in perpetrating a crime,” AHA wrote. “Many recent cyberattacks against hospitals and the health care system, including the current Change Healthcare cyberattack, have originated from third-party technology and other vendors. No organization, including federal agencies, is or can be immune from cyberattacks. Imposing fines or cutting Medicare payments would diminish hospital resources needed to combat cybercrime and would be counterproductive to our shared goal of preventing cyberattacks.”

Related News Articles

Headline
The AHA is advising hospitals and health systems to be alert for potential scam calls where actors are impersonating Drug Enforcement Agency agents. An AHA…
Headline
The Cybersecurity and Infrastructure Security Agency and Food and Drug Administration Jan. 30 released notices warning of vulnerabilities found in the Contec…
Headline
The AHA yesterday released an advisory alerting members that the association and the Health Information Sharing and Analysis Center have identified attempted…
Headline
The ransomware attack last year against UnitedHealth Group subsidiary Change Healthcare exposed data of more than 190 million people — up from previous reports…
Headline
The Cybersecurity and Infrastructure Security Agency and FBI Jan. 22 released an advisory explaining how cyberthreat actors “chained” vulnerabilities —…
Headline
A guide published Jan. 13 by the Cybersecurity and Infrastructure Security Agency, National Security Agency, FBI, Environmental Protection Agency,…