Nearly three weeks after a cyberattack paralyzed the largest billing and payment clearinghouse for the U.S. health care system, some Oregon medical providers are canceling appointments and taking out loans to keep their practices afloat.
Change Healthcare, a subsidiary of insurance giant UnitedHealth Group, little known outside the healthcare industry, announced on February 21 that it was the victim of a cyber attack. The company plays a critical role in the healthcare system, acting as an intermediary between insurance companies, healthcare providers, clinics and pharmacies.
The resulting disruption has vendors scrambling. Andrew Willius, a mental health nurse practitioner and owner of Lifespan Psychiatric Consulting, a private practice in Gresham that specializes in mental health care for people with autism and intellectual disabilities, said roughly 65 percent of his patients are covered by Medicaid through CareOregon , which uses Change Healthcare as its clearinghouse and has been unable to receive electronic claims since the cyber attack.
He said he has spent much of the past two and a half weeks trying to navigate the problem, finding workarounds to submit medical claims to insurers so his clinic can be reimbursed for services. As a result of administrative work, he had to cancel some meetings last week.
“If I’m into it, then it’s time to be able to see patients,” he said. Villius said he, along with his small staff of three nurses and a therapist, provides care for approximately 400 patients.
And with no payments coming in, the practice is burning through cash. If the billing problems continue, Willius said he plans to borrow money against his house to pay his six employees and cover other expenses.
Change Healthcare processes about 15 billion medical claims a year and handles about one in three patient records in the U.S., said Sean Hoare, a partner at Portland labor and employment law firm Constangy, Brooks, Smith & Prophete. Its problems have left health care providers in Oregon and across the U.S. unable to process bills and receive the payments they need to operate. And until last week, providers couldn’t send prescriptions to pharmacies electronically.
“When insurance eligibility and coverage cannot be determined and payment for health care services cannot be made, the delivery of health care services stops,” Hoare, who also serves as chairman of his cybersecurity firm, said in an email. “In addition to the real-time disruption to healthcare services, the attackers claim to have stolen eight terabytes of data, including millions of sensitive patient records.”
Brad Larsen, a psychologist and co-founder of Portland Mental Health & Wellness, said his practice averaged about $400,000 in reimbursements every two weeks before the Change Healthcare hack. In the two weeks since the outage, his clinic has received only $35,000 in insurance payments.
Not only does his practice receive little or no money from payers, but the small amounts of payments that do come in are impossible to assign to individual patient accounts. In other words, Larsen can’t say how much to charge patients after what insurance companies have covered.
“I see a big problem if this continues. Oregon already has a mental health crisis,” he said. “If this continues and we can’t pay suppliers, it’s only going to get worse.”
Larsen said his practice had to take out $300,000 in loans just to pay his staff of 50 therapists and nurse practitioners through the end of the month. He said if payments don’t come before April, he and the practice’s four other co-owners are prepared to pool all their savings to keep the doors open. He then said the practice would have to make staff redundant if the situation did not improve.
“We’re willing to do everything we can to stay open,” he said. “Our margins are already quite low. For example, we never get to a point where we have a lot of cash on hand.
Mel Davis, chief financial officer of Oregon Oncology Specialists in Salem, said revenue has dropped 50 percent since Change Healthcare went dark. The independent practice serves more than 16,000 patients with oncological and blood diseases. Davis said staff have been working overtime for the past three weeks to prevent any interruptions in patient care. They had to manually check patients’ insurance coverage and file claims on paper.
“It’s a million times worse than when COVID hit, because then at least we got federal help,” she said. “But there are no guarantees this time and we don’t know when things will start working again.”
Davis said the practice spends up to $1 million a day on chemotherapy and other cancer drugs, and to keep up with the drugs, she has had to borrow money from a bank and ask drug manufacturers and distributors if the clinic can delay payments.
“If this continues, we will have to cut services by a lot,” she said. “I can make paychecks maybe two more times while going into debt. … If we max out our line of credit, we’re going to have to transfer patients.”
Davis said she was relieved when the Centers for Medicare and Medicaid Services announced Saturday that they would provide some emergency funds for providers affected by the Change Healthcare outage. Davis said she has applied for aid on behalf of the clinic, but doesn’t know how much money she will receive or when.
Last week, UnitedHealth Group said it had restored electronic prescribing and that other parts of the system, such as payment processing, would be back online by mid-March. The company said it expects electronic payments to be back up and running by Friday and that it hopes to restore medical claims processing services on Monday.
Kristy Siedlecki, CEO of Grants Pass Clinic, said the update from UnitedHealth gives her some hope, but she wishes the insurance giant would provide more details on when operations will fully resume. She said that despite UnitedHealth’s assurances, her staff still can’t use e-prescribing and must issue paper prescriptions.
“Right now, our biggest impact is still prescriptions, and we can’t match accounts with insurance coverage yet,” she said. “Not being able to send prescriptions electronically really affects seniors and others who can’t afford to drive to pick up paper prescriptions.”
Siedlecki said the outage made it impossible to get prescriptions for controlled substances to patients who lived far away, and patients who couldn’t pick up paper prescriptions in person simply weren’t getting the drugs they needed.
Siedlecki said that although her clinic has started receiving more payments from insurers, the amounts are less than expected and billed. Like other providers, she said she can’t assign the payments she receives to patients who were covered, meaning she can’t say how much patients owe.
“This is a serious situation. … Independent practices like us were already struggling before the Change Healthcare hack,” she said. “If this isn’t fully fixed by the end of March, then I’m going to have some really unhappy doctors in April.”
In addition to the inability to get paid by insurers, health care providers are worried about new problems.
Megan Geary, a mental health provider and CEO of Cascade Counseling and Consulting in Portland, worries about compromised patient and provider data.
“I feel like it’s like the tiny, tiny frozen corner of the tip of the iceberg, and that it’s going to be Titanic-sized,” she said. “In doing so, it will potentially bring down health care as we know it.”
Like other small business owners of healthcare practices, Geary worries about the financial stability of his clinic, which serves more than 500 patients in the Portland metro area — roughly 60 percent of whom are covered by Oregon Health Plan.
“The silence from insurance companies and the government for weeks has been deafening,” she said. “We were forced to work around the issue and resolve this catastrophic situation.”
Geary wonders how and why the government allowed one company to handle so many aspects of the health care system.
“If you want to catastrophically cripple our health infrastructure and medical system, this is one way to do it,” she said. “We can’t let this happen again.”
The fallout from the Change Healthcare cyberattack has drawn renewed attention to the growing consolidation in the healthcare industry. Change was acquired by UnitedHealth Group in 2022 for $13 billion after the federal government unsuccessfully tried to block the merger.
Meanwhile, UnitedHealth is buying medical practices across the country, including in Oregon. Optum, a UnitedHealth affiliate, bought the Oregon Medical Group system in Lane County in 2020, then Portland-based GreenField Health in 2021.
Optum also recently announced plans to purchase the Corvallis clinic, which will require approval from the Oregon Health Authority. Last Friday, Optum and the Corvallis clinic filed for an emergency waiver to bypass the review process, according to Erica Joy Hartquist, a spokeswoman for the health authority.
In the filing, the parties said “the transaction is urgently needed to maintain The Corvallis Clinic’s solvency” because its “financial condition has significantly deteriorated” since the deal was proposed in early December. It is unclear whether the request is related to the fallout from the Change Healthcare system outage.
Heartquist said the state agency has suspended its review of the deal and is considering whether the proposed acquisition of Optum should be exempt from review because of the risk of the clinic failing completely, but she did not offer a time frame for the decision.
–Christine de Leon covers retail and business trends. Contact her at [email protected].
Our journalism needs your support. Please subscribe today to OregonLive.com/subscribe.
