State insurance regulators say last month’s cyberattack on a major billing platform continues to affect New Hampshire’s health care system, putting medical practices under financial strain and disrupting patient care.
The attack shut down services at Change Healthcare, a subsidiary of UnitedHealth that many insurers use to process claims.
D.J. Bettencourt, commissioner of the New Hampshire Insurance Department, said many health care providers in New Hampshire have seen a drop in revenue, as payments have slowed or stopped.
UnitedHealth says it’s made more than $2.5 billion in advance payments available to struggling providers. But at a news conference Tuesday, Bettencourt said it’s not clear that figure matches the scale of the need, and the assistance isn’t reaching all providers. He said he’s especially worried about smaller providers with little financial cushion.
“I have heard from some providers that they're really assessing their options as to whether or not they can continue to stay open, at least temporarily close or potentially permanently close,” he said.
Change Healthcare says it took its systems offline after detecting the breach on Feb. 21. The company later said it was carried out by a cybercrime network that has targeted other organizations with ransomware attacks, which involve holding an organization’s data hostage, or threatening to release it, unless it pays a large sum.
Bettencourt said the attack also disrupted the process of getting prior authorization, which insurance companies require before moving ahead with some medical care.
While changes have been made for public insurers like Medicare, Bettencourt expressed concern that some patients with private insurance are facing delays getting care.
Bettencourt called on UnitedHealth to immediately address the issues with prior authorizations, and change its criteria for financial relief to make sure that assistance is benefitting the smallest health providers.
Eric Hausman, a spokesperson for UnitedHealth, said the company has “a number of resources available for those needing relief” and encouraged providers to reach out directly for help, through an online form or by calling 877-702-3252.
Hausman said UnitedHealth has temporarily suspended many prior authorization requirements for Medicare. He did not respond to a followup question about what the company’s done to address prior authorizations for those with private insurance.
UnitedHealth says it’s working to restore the affected systems and assess whether the hackers accessed sensitive patient information.
Bettencourt encouraged health care providers who are having trouble getting paid, or patients who are experiencing delays in prior authorization due to the attack, to contact the New Hampshire Insurance Department for help resolving those issues.
“If you are a provider in New Hampshire that is significantly struggling financially or is unable to provide care to patients in a timely manner, do not wait or hesitate to reach out to the department,” he said.
