The Cyber Attack On Change Healthcare

UnitedHealth Group's Optum claims processing platform, Change Healthcare, experienced a cyber attack on Feb. 21, 2024, understood to be at the hands of ransomware group ALPHV Blackcat. The event forced Change Healthcare to take its systems offline; consequently, many of our rated acute health care providers, that use its services directly, had to disconnect from Change Healthcare to mitigate the risk of a data breach or another cyber event. Some entities were also exposed indirectly via their third-party vendors that use Change Healthcare. This follows the intensified attacks S&P Global Ratings has seen in the U.S. health care sector, given providers process and retain vast amounts of personal and private data and the increased reliance on wireless connectivity, among other factors (see "Cyber Risk In Health Care: High Stakes, Valuable Data, And Increasing Connectivity Attract Bad Actors," published Dec. 6, 2022, on RatingsDirect).

Change Healthcare has many aspects to its business, but of particular importance, it serves as a billing clearinghouse for many providers and pharmacies to different insurance companies. It also provides other services that support billing, including insurance verification and prior authorizations.

Although we don't know when Change Healthcare will resume full business operations, acute-care providers hit by cyber attacks typically have been offline for several weeks or longer. That said, we understand that Change Healthcare is working to bring certain systems back online (per its website) and UnitedHealthcare has helped to put certain workarounds in place. S&P Global Ratings understands that United/Optum is working with law enforcement agencies and security firms on its response, which could expedite the resolution. The attack highlights our view of third-party risk related to cyber events and risks related to the systems that other vendors use (see "Cyber Risk In A New Era: Are Third-Party Vendors Unwitting Cyber Trojan Horses For U.S. Public Finance?," Oct. 25, 2021).

To Date, The Impact On Providers Varies, With Timing Of Full Resolution Unknown

The cyber attack has caused significant delays in processing claims for insurance payments (including certain governmental managed-care plans), a key revenue source for providers. While we expect providers will eventually be paid for services and pharmaceuticals, we believe the biggest near-term impact will be to cash flow and liquidity and expect some operational disruption and potential delays in authorizing care. There could be a risk of increased denials by insurers in the future, given some of the manual workarounds. This comes when many providers are still recovering from operating difficulties related to labor pressures in the past couple of years.

Although no provider seems immune from exposure to the cyber event, certain ones are less affected.   Based on initial conversations with several providers that we rate, some hospitals and health systems, particularly the larger ones, have relationships with multiple organizations providing similar services to Change Healthcare. This might help to minimize the full effect of Change Healthcare's suspension of services. These larger providers may more easily transfer claims to other businesses they already work with. Typically, larger hospitals and systems also have access to other forms of liquidity and business lines to help support cash needs in the short term. However, some single-site and smaller providers work only with Change Healthcare and, thus, might have only a single point of business and could be more materially affected, depending on how quickly they can transition needed billing-related services to other organizations or find other temporary fixes. Also, certain smaller or lower-rated providers usually have less access to liquidity and cash to support them under stressed conditions, further amplifying the effects of this situation. Some rated providers (large and small) may use a different clearinghouse almost entirely and have very limited exposure to Change Healthcare.

Workarounds are in use for most providers.   Providers that we have spoken to indicate that they're implementing various fixes to get claims paid and increase cash flow; however, some of these fixes can be labor-intensive and manual, taking much longer to process, and could add administrative costs. Certain providers have discussed transferring key services provided by Change Healthcare to another platform, but this could take time. Furthermore, while certain larger acute-care systems have multiple billing clearinghouses, others are evaluating whether this strategy makes sense, given monitoring and costs of an additional third-party vendor and the need to enter into a long-term contract. Many providers are also contacting insurance companies to see if there's an option to directly submit claims. Lastly, on March 5, the U.S. Department of Health and Human Services (HHS) announced steps that the Centers for Medicare and Medicaid Services (CMS) are taking to support providers, including guidance on how to change clearinghouses for claims processing, relaxing prior authorizations and timely filing requirements for Medicare Advantage, and various exceptions, waivers, and extensions.

External liquidity could provide interim support.   UnitedHealth Group has indicated that it might offer advances to providers in certain cases, and we're monitoring updates on this as additional details unfold. While we don't know what this means for each provider, it could help offset some of the near-term stress. Although HHS did not confirm advance payments for all providers affected, it has encouraged providers to request advance payments from CMS on a case-by-case basis, helping to support liquidity. Finally, some providers are requesting, and some state hospital associations are lobbying for, bridge payments from insurance companies and for insurance companies to relax filing deadlines.

Credit Implications Are Still Emerging

To date, there has been no impact to ratings on not-for-profit acute-care providers; we'll monitor the situation as it evolves and depending on its duration. Most rated providers, in particular those with good reserves and access to liquidity, could manage for a period of time with less cash flow; however, smaller or lower-rated providers with lighter liquidity or less access to lines of credit and other cash support could be at greater risk of credit quality deterioration.

While it's still too early to know final outcomes, we'll monitor any broader implications for providers depending on the resolution, from both a cyber security perspective and a vendor management standpoint and will provide updates to the market for our rated providers as additional details become available.