Cyberattack Costing Hospitals $2 Billion a Week in Cash Flow, Report Shows

While the U.S. Department of Health and Human Services (HSS) Office for Civil Rights has opened an investigation into the Change Healthcare cyberattack, the magnitude of the attack's impact is only starting to become evident.

Data collected by Indianapolis-based Kodiak Solutions “show that payer claims have dropped by more than a third since the Feb. 21 breach at Change Healthcare,” per a press release published through Businesswire. “Through March 9, the cash flow impact of the halting of claims processing through Change totals an estimated $6.3 billion for the more than 1,850 hospitals and 250,000 physicians in Kodiak's data set.”

Healthcare Innovation spoke with Colleen Hall, senior vice president and revenue cycle leader at Kodiak Solutions, a data-driven company focused on the healthcare industry. In addition to the revenue cycle line, the company has two other lines of business: finance and reimbursement and the risk and compliance group. The company’s technology product, Revenue Cycle Analytics (RCA), receives daily transactional data from over 1800 hospitals and over 250,000 physicians. From the data, Kodiak can estimate the hospitals' net revenue on a monthly basis.

What are you hearing from organizations about the outfall of the Change Healthcare cyberattack?

The providers that were utilizing Change Healthcare are seeing the inability to get the claims out the door, so they're not able to effectively get the account claims to the payers. There are significant cash declines. Ultimately, they’re not getting rectified solutions. They are hearing they can do paper claims. The problem with paper claims is that they don’t have the manpower to employ them. Also, a lot of people work remotely.

They don't have the cash on hand available to wait and see what happens with Change Healthcare and how long it'll take for them to get everything back online. They have to shift gears to get those claims out the door because they're not financially stable enough to make it. The longer-term effects of the inability to get these claims out the door have yet to be felt more broadly. We expect that there will be an increase in medical necessity denials from the payers. We expect an increase in prior authorization denials and timely filing denials because we don't know how long it will be before all of these claims can finally get released and billed to the payers.

Could you speak more about the long-term effects?

We don't know the true timeline for when Change Healthcare will be up and running again. If the impacts that we're seeing now continue, they could have very far-reaching implications for months and potentially a year into the future. The catch-up period will be really challenging for the providers to manage because they just don't have the manpower to deal with that type of influx and volume.

HHS has announced steps to address the financial stress that healthcare systems experience. What are your thoughts on that?

They encouraged Medicare Advantage plans to be lenient. Our clients have received very minimal response from the plans. HHS also issued another letter to the healthcare industry, basically asking for more broad-scale leniency in the commercial industry and in more of the private sector. And once again, payers have been deafeningly silent about helping providers navigate this crisis.

It has been really disappointing to know that the payers could single-handedly help these providers navigate and lessen the impacts of this attack, for which they had absolutely no fault whatsoever. I’m appalled at the lack of action on the part of payers.

What can hospitals and health plans do right now?

They need to continue to fight and demand concessions where they can. They can let payers know that they can't make it through this without the support of their communities.

They need to navigate through and continue to focus on what matters most to them, which ultimately is the patient’s care and experience. I believe that the providers are doing what they can to try to make this more of an insular feeling for them and not have the patients be impacted by it. There will be some facilities out there that are really going to struggle because of a lack of cash flow.

What are some of the lessons learned?

One of the biggest lessons we should take away from this is that it is dangerous for one company to have such control over such a large part of our healthcare industry. Secondly, the guard can never be down regarding cybersecurity threats. It’s a reminder to all of us in the healthcare industry that we have to remain vigilant in protecting our patient information.

If there's any place that we need to put additional effort and expense into, it is to ensure that our processes are as firmed up as they possibly can be. It has to be in this area. This one event has been so catastrophic for the industry, and I have to believe that it certainly could have been prevented.

They are conducting extensive investigations into what really happened. You have to believe that somehow, something fell short of the level it needed to be from a protection perspective. We’ve got to do better.

If you compare and contrast this to the pandemic and how support for the providers was mobilized in that scenario, there’s a lack of support being provided here.

The Centers for Medicare & Medicaid Services (CMS) does not have the authority to mandate that Medicare Advantage plans comply with their requests. They can mandate how traditional Medicare is handling things and they can advocate how to handle traditional Medicaid. In reality, they're doing what they can by just asking nicely. If the advantage plans in the commercial plans decide not to want to help, there are no repercussions.