CHANGE HEALTHCARE CYBERSECURITY INCIDENT RECENT UPDATES
6/24/2024 Updates: The last updates to these websites were made on 6/20/2024, the sites contain the same information, but have different URLs: https://www.unitedhealthgroup.com/changehealthcarecyberresponse https://www.unitedhealthgroup.com/ns/changehealthcare.html This is the CHC website with information related to the breach and was last updated 6/20/2024: https://www.unitedhealthgroup.com/ns/health-data-breach.html
6/21/2024 Updates:
The last updates to these websites:
https://www.unitedhealthgroup.com/changehealthcarecyberresponse
https://www.unitedhealthgroup.com/ns/changehealthcare.html
The UHCProvider.com website also includes a link to the updated information on the Change Healthcare
cyber response at these websites.
Latest update
June 20, 2024 4:00 p.m. CT
Change Healthcare provided an update on the customer notifications related to the cyberattack.
View Substitute Notice here:
https://www.changehealthcare.com/hipaa-substitute-notice
The http://changecybersupport.com/ website has been updated and provides a link to the substitute
notice of the breach, as well as offering 2 years of free credit monitoring through IDX. The FAQs have
been updated on the types of data affected; when notifications will happen; what support is being
offered by the company; what steps consumers can take to protect themselves; how to obtain a copy of
their credit report; and how to place a fraud alert or security freeze with contact information for the
three credit reporting agencies toll-free fraud numbers.
Change Healthcare Cyberattack
Change Healthcare is providing support for people concerned about their personal data due to the
criminal cyberattack on Change Healthcare systems.
Review the substitute notice here.
What happened?
On February 21, 2024, Change Healthcare became aware of deployment of ransomware in its computer
system. Once discovered, Change Healthcare quickly took steps to stop the activity, disconnected and
turned off systems to prevent further impact, began an investigation and contacted law enforcement.
Change Healthcare’s security team worked around the clock with several top security experts to address
the matter and understand what happened. Change Healthcare has not identified evidence this incident
spread beyond Change Healthcare.
Change Healthcare retained leading cybersecurity and data analysis experts to assist in the investigation,
which began on February 21, 2024. On March 7, 2024, Change Healthcare was able to confirm that a
substantial quantity of data had been exfiltrated from its environment between February 17, 2024, and
February 20, 2024. On March 13, 2024, Change Healthcare obtained a dataset of exfiltrated files that
was safe to investigate and began preliminary targeted analysis. On April 22, 2024, following analysis,
Change Healthcare publicly confirmed the impacted data could cover a substantial proportion of people
in America.
What can you do now?
Get free credit monitoring with IDX
If you believe that your information may have been impacted by this incident, you can enroll in two
years of complimentary credit monitoring and identity protection services. Change Healthcare is paying
for the cost of these services for two years. You can sign up by clicking "Enroll now" or by calling 1-888-
846-4705.
Enroll now
Check on your health care information
Be on the lookout and regularly monitor your explanation of benefits statements from your
health plan and health care providers, as well as financial documents to check for any unfamiliar
activity.
If you notice any health care services you did not receive listed on an explanation of benefits
statement, contact your health plan or doctor.
If you notice any suspicious activity on bank, credit card statements or tax returns, contact
your financial institution.
If you believe you are the victim of a crime, contact local law enforcement authorities and
file a police report.
Frequently asked questions
What types of data were affected?
While Change Healthcare cannot confirm exactly what data has been affected for each impacted
individual, information that may have been impacted for affected patients and members may have
included contact information (such as first and last name, address, date of birth, phone number, and
email) and one or more of the following:
Health insurance information (such as primary, secondary or other health
plans/policies, insurance companies, member/group ID numbers, and Medicaid-
Medicare-government payor ID numbers);
Health information (such as medical record numbers, providers, diagnoses,
medicines, test results, images, care, and treatment);
Billing, claims and payment information (such as claim numbers, account numbers,
billing codes, payment cards, financial and banking information, payments made and
balance due) ;
and/or
Other personal information such as Social Security numbers, driver’s licenses or
state ID numbers, or passport numbers.
The information that may have been involved will not be the same for everyone.
How will the notifications happen if my data was impacted?
The data review is in its late stages. Change Healthcare plans to send direct notice (written letters), at
the conclusion of the data review, as required to affected individuals identified for whom Change
Healthcare has a sufficient address. Please note, Change Healthcare may not have sufficient addresses
for all affected individuals. The mailing process is expected to begin in late July after Change Healthcare
completes quality assurance procedures.
I believe I am personally affected. What support are you offering?
A dedicated call center has been set up to offer free credit monitoring and identity theft protections for
two years to anyone who believes they're impacted. The call center will also include trained clinicians to
provide emotional support services. Given the ongoing nature and complexity of the data review, the
call center will not be able to provide any details on people’s impacted data at this time.
The call center can be reached at 1-866-262-5342.
What steps can I take to protect myself?
While Change Healthcare is still investigating whether your personal information may have been
affected, there are some things you can do to protect yourself:
Be on the lookout and regularly monitor the explanation of benefits statements you
receive from your health plan and statements from your health care providers, as well
as your bank and credit card statements, credit reports and tax returns, to check for any
unfamiliar activity.
If you notice any health care services you did not receive listed on an explanation of
benefits statement, please contact your health plan or doctor.
If you notice any suspicious activity on either your bank or credit card statements or
on your tax returns, please immediately contact your financial institution and/or credit
card company or relevant agency.
If you believe you are the victim of a crime, you can contact your local law
enforcement authorities and file a police report.
How do I get a copy of my credit report?
To order your free annual credit report, visit www.annualcreditreport.com, call toll-free at 877-322-
8228, complete the Annual Credit Report Request Form on the U.S. Federal Trade Commission’s (“FTC”)
website at www.ftc.gov and mail it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta,
GA 30348-5281. The three credit bureaus provide free annual credit reports only through their website,
toll-free number or request form.
How do I place a fraud alert?
A fraud alert helps protect against the possibility of an identity thief opening new credit accounts in your
name. You can place a fraud alert on your credit report by calling any one of the three credit
reporting agencies' toll-free fraud numbers. The contact information for the credit reporting agencies
can be found at:
Equifax
800-525-6285
Experian
888-397-3742
TransUnion
800-680-7289
How do I place a security freeze?
A security freeze needs to be placed on your credit file at each credit bureau. To place a security freeze
on your credit report, contact the credit reporting agency by phone, mail or secure electronic means and
provide proper identification of your identity.
Equifax
800-525-6285
Experian
888-397-3742
TransUnion
800-680-7289
What is the difference between a fraud alert and a security freeze?
A fraud alert helps protect against the possibility of an identity thief opening new credit accounts in your
name. A security freeze helps prevent potential credit grantors from accessing your credit report
without your consent.
Contact us
For additional support related to the cyberattack call the number below. Given the ongoing nature and
complexity of the data review, agents will not be able to provide any specifics on individual data
impacted at this time.
+1-866-262-5342
NAIC UPDATES ON CHANGE HEALTHCARE CYBERATTACK – JUNE 20, 2024
UPDATE – JUNE 20, 2024
CHANGE HEALTHCARE UPDATES
Change Healthcare announces that notices will be going to those whose personal
information could be impacted by the data breach.
Change Healthcare posted the following Substitute Notice as required by HIPAA:
NOTICE OF DATA BREACH
This notice is from Change Healthcare (CHC) about a recent security incident.
Change Healthcare provides services to health care providers, health insurance
plans and other companies, from which individuals may have received health
services or health insurance. Because Change Healthcare works as a vendor to
health care providers or health insurance plans, personal information, including
health information, has been impacted in this incident.
CHC is posting this substitute notice to provide customers and individuals with
information about the criminal cyberattack on CHC systems and to share
resources available to people who believe their personal data potentially being
impacted.
The review of personal information potentially involved in this incident is in its
late stages. CHC is providing this notice now to help individuals understand what
happened, let them know that their information may have been impacted, and
give them information on steps they can take to protect their privacy, including
enrolling in two years of complimentary credit monitoring and identity theft
protection services if they believe that their information may have been
impacted.
This substitute notice contains the information CHC can provide at this time while
CHC continues working through data review to identify affected individuals. CHC
plans to mail written letters at the conclusion of data review to affected
individuals for whom CHC has a sufficient address. Please note, we may not have
sufficient addresses for all affected individuals. The mailing process is expected to
begin in late July as CHC completes quality assurance procedures.
Full HIPAA Substitute Notice: https://www.changehealthcare.com/hipaa-
substitute-notice
Update from Change Healthcare – FAQ: Change Healthcare Consumer
support page - UnitedHealth Group
Article
Change Healthcare breach notifications begin
Politico
BY CHELSEA CIRRUZZO | 06/20/2024 05:00 PM EDT
Change Healthcare began telling its customers, including providers and insurers, on
Thursday whether a February cyberattack compromised their patients or members’
data.
Cybercriminals targeted Change, the largest medical bill clearinghouse which is owned
by UnitedHealth Group, disrupting provider payments across the country. UnitedHealth
CEO Andrew Witty told Congress in May that about a third of Americans were impacted
by the breach and said the company paid hackers a $22 million ransom to get access to
their data.
Change said Thursday it has reviewed more than 90 percent of impacted files and found
no evidence that doctors’ charts or full medical histories were taken, but said
information taken likely includes individuals’ contact and health insurance information,
billing claims and potentially Social Security numbers.
The breach notifications come after HHS’ Office for Civil Rights clarified last month that
providers could delegate the burdensome requirement of notifying impacted patients to
Change. Change said Thursday it would provide its impacted customers with a website
URL to help them with any questions.
“CHC is assuming responsibility for making individual notifications on behalf of those
impacted customers which do not opt out of CHC’s notifications process, as outlined in
the customer notice,” Change said in a press release.
FEDERAL AGENCY UPDATES
CMS Preparing to Close Program that Addressed Medicare Funding Issues
Resulting from Change Healthcare Cyber-Attack
Link: https://www.cms.gov/newsroom/press-releases/cms-preparing-close-program-addressed-
medicare-funding-issues-resulting-change-healthcare-cyber
The last updates to these websites were made on 6/19/2024: https://www.unitedhealthgroup.com/changehealthcarecyberresponse https://www.unitedhealthgroup.com/ns/changehealthcare.html June 19, 2024 5:00 p.m. CT An updated Claims Payer List for legacy Emdeon customers now on iEDI: https://www.unitedhealthgroup.com/content/dam/UHG/xls/iedi_claims_payer_list_for_emdeon_change_healthcare_customers_06192024_01.xlsx
6/12/2024 Updates:
The last updates:
https://www.unitedhealthgroup.com/changehealthcarecyberresponse
https://www.unitedhealthgroup.com/ns/changehealthcare.html
Latest update
June 11, 2024 3:00 p.m. CT
An updated Claims Payer List for legacy Emdeon customers now on iEDI and an updated ERA Payer List for Emdeon/Change Healthcare customers are now available.
5/31/2024 Updates:
The last updates to these websites:
https://www.unitedhealthgroup.com/changehealthcarecyberresponse
https://www.unitedhealthgroup.com/ns/changehealthcare.html
Latest update
May 30, 2024 9:00 a.m. CT
A new webinar is available for listening: Enterprise Imaging Operational Update
5/30/2024 Updates:
The last updates to these websites:
https://www.unitedhealthgroup.com/changehealthcarecyberresponse
https://www.unitedhealthgroup.com/ns/changehealthcare.html
Latest updates
May 29, 2024 4:00 p.m. CT
An updated Claims Payer List for legacy Emdeon customers now on iEDI is now available.
UHCProvider.com website has an updated banner with the following as of 5/30/2024.
May 30, 2024 at 8:00 AM CT
For information on the Change Healthcare cyber response, find updated information on the Provider Portal. You can also learn more about the Temporary Funding Assistance Program on the Optum websiteopen_in_new.
5/22/2024 Updates:
The last updates to these websites were made on 5/22/2024:
https://www.unitedhealthgroup.com/changehealthcarecyberresponse
https://www.unitedhealthgroup.com/ns/changehealthcare.html
Latest Updates
May 22, 2024 6:00 a.m. CT
An updated Claims Payer List for legacy Emdeon customers now on iEDI is now available.
Funding support
We've advanced more than $6.5B to providers in need, and we will continue to financially support providers through full system recovery.
For information about the temporary funding process, please call
1-877-702-3253 or complete the inquiry form.
UHCProvider.com website banner has been updated to show the following:
May 22, 2024 at 8:00 AM CT
For information on the Change Healthcare cyber response, find updated information on the Provider Portal. You can also learn more about the Temporary Funding Assistance Program on the Optum websiteopen_in_new.
PROVIDER GROUP UPDATES
More than 50 provider groups send letter to HHS requesting clarification on the application of HIPAA privacy rules on United Health Group following the Change Healthcare cyberattack and data breach.
ARTICLES
Fast Company
“The Change Healthcare and Ascension cyberattacks were disastrous. Can $50 million stop the next breach?”
5/17/2024 Updates:
https://www.unitedhealthgroup.com/changehealthcarecyberresponse
https://www.unitedhealthgroup.com/ns/changehealthcare.html
Latest Update
May 16, 2024 11:00 a.m. CT
A new webinar is available for listening: Enterprise Imaging Operational Update.
UHCProvider.com update as of 5/15/2024:
May 15, 2024
May monthly overview
Review the latest UnitedHealthcare prior authorization, medical policy, pharmacy, reimbursement, laboratory and policy and protocol updates.
Includes reminder to update sign-in and recovery updates to the UHC Provider Portal:
UHC Provider Portal security reminder
Provider portal authentication
To enhance data security, UnitedHealthcare Provider Portal and specialty portal users will be required to make One Healthcare ID sign-in and recovery updates by summer 2024.
5/6/2024 Updates:
https://www.unitedhealthgroup.com/changehealthcarecyberresponse
https://www.unitedhealthgroup.com/ns/changehealthcare.html
Latest Update
May 3, 2024 1:00 p.m. CT
An updated Claims Payer List for legacy Emdeon customers now on iEDI is now available.
OTHER UPDATES
CONGRESSIONAL HEARINGS
Committee Summary of Energy & Commerce Subcommittee’s hearing: https://energycommerce.house.gov/posts/what-we-learned-change-healthcare-cyber-attack
AMA Provider Update
https://www.ama-assn.org/practice-management/sustainability/change-healthcare-cyberattack
Life after Change Healthcare cyberattack: Without payment for claims, physicians struggle to keep practices afloat
5/2/2024 Updates:
The last updates to these websites were made on 5/1/2024, the sites contain the same information, but have different URLs:
https://www.unitedhealthgroup.com/changehealthcarecyberresponse
https://www.unitedhealthgroup.com/ns/changehealthcare.html
LATEST UPDATES
May 1, 2024 3:00 p.m. CT
A new Change Healthcare Enterprise Imaging Customer Support webinar recording is now available for listening.
OTHER UPDATES:
CONGRESSIONAL HEARINGS
United Health Group CEO Witty testified before the Senate Finance Committee and the House Energy and Commerce Subcommittee on Oversight Wednesday May 1, 2024 regarding the Change Healthcare cyberattack.
OPENING STATEMENTS
Senate Finance:
House Energy & Commerce Subcommittee on Oversight:
Articles:
5 takeaways from UnitedHealth Group’s big day on the Hill (May 1, 2024)
Politico
HEARING HIGHLIGHTS — Lawmakers on the Senate Finance Committee today blasted UnitedHealth Group for not doing more to prevent one of the largest cyberattacks in the country’s history, POLITICO’s Robert King reports.
UnitedHealth Group CEO Andrew Witty explained to senators how hackers orchestrated the Feb. 21 cyberattack that crippled the company’s subsidiary, Change Healthcare, which processes insurance payments for doctors and hospitals. Witty is also testifying this afternoon at the House Energy and Commerce Oversight and Investigations Subcommittee hearing on the cyberattack.
Here are some takeaways from the Senate hearing:
UnitedHealth apologizes, but blames Change transition
Witty explained that a Change server lacked a cybersecurity protection average Americans know well, multi-factor authentication, that typically requires a user to enter a code received on another device before gaining access to a password-protected computer application. He acknowledged the security gap was a violation of company policy and said he was “deeply, deeply sorry.”
He explained that UnitedHealth had failed to fully update security procedures at Change after acquiring it in October 2022.
Senators say UnitedHealth should compensate providers
Committee members said that the no-interest loans the insurer has offered hospitals and doctors while they awaited direct payment haven’t been enough to plug the financial hole providers faced.
“We have hospitals that are pulling on a line of credit, are you going to pay that interest? Are you going to reimburse that?” asked Sen. Marsha Blackburn (R-Tenn.).
Witty insisted things are “broadly back to normal,” but Blackburn said her constituents are still complaining.
Other Articles
https://www.medpagetoday.com/washington-watch/washington-watch/109918
https://healthitsecurity.com/news/change-healthcare-disconnects-system-amid-cyberattack
4/26/2024 Updates:
- https://www.unitedhealthgroup.com/changehealthcarecyberresponse
- https://www.unitedhealthgroup.com/ns/changehealthcare.html
LATEST UPDATE
April 26, 2024 8:30 a.m. CT
An updated Claims Payer List for legacy Emdeon customers now on iEDI is now available.
4/25/2024 Updates:
- https://www.unitedhealthgroup.com/changehealthcarecyberresponse
- https://www.unitedhealthgroup.com/ns/changehealthcare.html
ADDITIONAL INFORMATION
Pharmacy Portal - For Optum Rx network pharmacies, visit the Optum Rx Pharmacy Portal.
Resources to come for Change Healthcare pharmacies.
Optum Rx Pharmacy claims
We are seeing the majority of Optum Rx network pharmacies back online and processing claims. As pharmacy services are restored, Optum Rx Pharmacy Network Audit has taken the following actions to address the concerns of our network pharmacy providers:
· Impacted pharmacies will not be audited through early April 2024.
· Claims that were filled but could not be submitted online during the Change Healthcare outage will not be audited or reviewed.
o Upon notification by Pharmacies of inadvertent audits of such claims, Optum Rx will remove the claims from audits and clear any findings for the claims from the audits if applicable.
o Upon notification by Pharmacies of Prescription Validation Reviews of such claims, Optum Rx will remove the claims from the reviews and clear any findings for the claims from the reviews if applicable.
· For Centers for Medicare & Medicaid Services (CMS)-directed audits, if more time is needed to gather the required documents, please notify us and we will work on obtaining an extension.
· Requests for extensions from Pharmacies with open audits will be reviewed on a case-by-case basis.
If you have any questions, please reach out to our Provider Relations team via the intake form located on our website: https://professionals.optumrx.com/resources/forms/pharmacyproviderrelationsform.html.
4/23/2024 Updates:
The last updates to these websites were made on 4/22/2024, the sites contain the same information, but have different URLs:
- https://www.unitedhealthgroup.com/changehealthcarecyberrespons
- https://www.unitedhealthgroup.com/ns/changehealthcare.htm
LATEST UPDATE - April 22, 2024 4 p.m. CT
UnitedHealth Group is announcing support http://changecybersupport.com/ for people who may be concerned about their personal data potentially being impacted based on preliminary findings from our investigation and review of the data involved in the malicious criminal cyberattack on Change Healthcare’s systems. The company is also providing an update on progress in restoring Change Healthcare’s products and services. See the full update here.
- This investigation remains ongoing due to the complexity of data review and requires a comprehensive analysis.
- UHG is providing support for people who are concerned about their personal data due to the criminal cyberattack on Change Healthcare systems, and launched a new website that went live as of 5:30 PM EST 4/22/2024 http://changecybersupport.com/, as well as a call center phone number 1-866-262-5342.
- The website includes answers to Frequently Asked Questions, as well as information about how to obtain a copy of the consumer’s credit report and place a fraud alert or security freeze.
- The website indicates this is not an official breach notification. When enough information is available from its ongoing and methodical data review, it will do appropriate notifications in the most efficient way possible, as required by law.
- The call center includes trained clinicians who will provide emotional support services as well as free credit monitoring and identity theft protections for two years to anyone impacted.
OTHER UPDATES:
FEDERAL AGENCY UPDATES
HHS Office of Civil Rights: The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) posted a new webpage to share answers to frequently asked questions (FAQs) concerning HIPAA and the cybersecurity incident impacting Change Healthcare.
ARTICLES:
- Wall Street Journal: “Hackers Broke Into Change Healthcare’s Systems Days Before Cyberattack”
- CNBC: “UnitedHealth paid ransom to bad actors, says patient data was compromised in Change Healthcare cyberattack”
- Wired: “Change Healthcare Finally Admits It Paid Ransomware Hackers—and Still Faces a Patient Data Leak”
- Wall Street Journal: “Lawmakers Address Cyber Risks in Wake of Change Healthcare Hack”
4/18/2024 Updates:
https://www.unitedhealthgroup.com/changehealthcarecyberresponse
https://www.unitedhealthgroup.com/ns/changehealthcare.html
April 17, 2024 4:00 p.m. CT
- A new webinar is available for listening: Enterprise Imaging Operational Update.
- There are several updates on the UHCProvider.com website:
April 17, 2024 - Arizona: Required health care workforce survey opened April 16 : Complete the 2024 AZ Healthcare Workforce Goals and Metrics Assessment online starting April 16.
April 18, 2024 - May 1: Electronic reconsideration and appeal submissions require : Health care professionals must submit Medicaid medical reconsiderations and appeal submissions electronically in Massachusetts and Mississippi.
April 18, 2024 - Your Community Plan medical claim letters are going paperless soon : Starting May 3, 2024, Medicaid claim letters won’t be mailed in Florida and Massachusetts.
April 18, 2024 - CommunityCare Portal can help save you time: The CommunityCare Portal allows you to get an overview of a patient’s total health, complete redeterminations and more.
April 18, 2024 - Important AHCCCS Medical Policy Manual 510 revisions: We’re notifying you of policy updates that’ll help you better coordinate primary and mental health care for UnitedHealthcare Community Plan of Arizona members.
April 18, 2024 - April monthly overview: Review the latest UnitedHealthcare prior authorization, medical policy, pharmacy, reimbursement, laboratory and policy and protocol updates.
OTHER UPDATES:
April 16 & 17 - Healthcare Financial Management Association: Cyberattack on Change Healthcare brings turmoil to healthcare operations nationwide
UPDATE – TUESDAY, APRIL 16, 2024
NAIC ACTION
The NAIC submitted a letter to the House Energy & Commerce Subcommittee on Health for an April 16th hearing on Change Healthcare. (Details of hearing below.)
CONGRESSIONAL HEARING
House Energy and Commerce Subcommittee on Health
"Examining Health Sector Cybersecurity in the Wake of the Change Healthcare Attack"
TUESDAY, April 16
10:00am EDT
Witnesses/Testimony:
Mr. Greg Garcia, Executive Director for Cybersecurity, Healthcare Sector Coordinating Council
Mr. Robert Sheldon, Senior Director of Public Policy and Strategy, CrowdStrike
Mr. John Riggi, National Advisor for Cybersecurity and Risk, American Hospital Association
Mr. Scott MacLean, Board Chair, College of Healthcare Information Management Executives (CHIME)
Articles
- Change Healthcare cyberattack fallout continues - (April 18, 2024)
- UnitedHealth to take up to $1.6 billion hit this year from Change hack - (April 16, 2024)
-
Change Healthcare stolen patient data leaked by ransomware gang - (April 15, 2024)
4/11/2024 Review/Updates:
Updates were made to these websites as of 4/10/2024, which contain the same information, but have different URLs:
https://www.unitedhealthgroup.com/changehealthcarecyberresponse
https://www.unitedhealthgroup.com/ns/changehealthcare.html
April 10, 2024 4:30 p.m. CT
A new Claims Payer List for legacy Emdeon (OKC) customers on Intelligent EDi is now available.
There was an update to the uhcprovider.com website, the update is in reference to the Surest out-of-network, which was last modified 4/5/2024 and states that beginning 4/1/2024 they are updating the out-of-network service area for Surest benefit plans with out-of-network (OON) benefits.
4/4/2024 Review/Updates:
Updates were made as of 3/27/2024 to these websites:
- https://www.unitedhealthgroup.com/changehealthcarecyberresponse
- https://www.unitedhealthgroup.com/ns/changehealthcare.html
Product Capabilities Week of 3/25:
Eligibility Processing - Processes real-time transactions
Clearance - Benefits verification and estimation related services
MedRX - Pharmacy electronic claims for medical
Reimbursement Manager - Claim pricing
Coverage Insight - Coverage discovery
Hosted Payer Services (HPS) - Payer hosting service for eligibility responses to providers
Week of 4/1: Acuity / Pulse - Acuity provides revenue cycle analytics for users of Clearance and Assurance; Pulse provides RCM KPI benchmarks for institutional claims utilizing Assurance client data
Week of 4/8: Risk Manager - Supports clients in managing value-based payment contracts
Health QX - Retrospective episode-based payment models
Week of 4/15: Clinical Exchange - Provider workflow enabling electronic prescribing, ordering and resulting integrated into EHRs
Week of 4/29: Payer Connectivity Services (PCS) - EDI validation and editing
If a product is not listed in this schedule, that does not mean that product is more than three weeks away. It means that we do not yet have line of sight to the week that we expect it to be restored and will provide updated information as those timelines become clear.
There have been updates to the following sections as of 4/4/2024:
Funding Relief For Providers - nearly $4.7B to providers in need.
March 27, 2024 Updates:
Provider website includes changes coming to the UnitedHealthcare Provider Portal access. https://www.uhcprovider.com/en/access/provider-portal-authentication.html .
Including:
- Soon, UnitedHealthcare Provider Portal users will be required to update their One Healthcare ID authentication* sign-in and recovery options to retain their portal access. These updates include:
- April 1: Users will be required to have a verified phone number on file (mobile or direct landline)
- Expected in May 2024: Email will no longer be an option as a sign-in/recovery option
- What is authentication? For our purposes, authentication is the process of securely verifying your identity when accessing the portal. Now, you’ll use Authenticator to generate a time sensitive code to enter with your One Healthcare ID instead of a password or security questions that could be shared or compromised.
- Website: https://www.unitedhealthgroup.com/ns/changehealthcare.html includes additional information:
Timeline – Product Capabilities
- Week of 3/25:
- Eligibility Processing - Processes real-time transactions
- Clearance - Benefits verification and estimation related services
- MedRX - Pharmacy electronic claims for medical Reimbursement Manager - Claim pricing
- Coverage Insight - Coverage discovery
- Week of 4/1:
- Clinical Exchange - Provider workflow enabling electronic prescribing, ordering and resulting integrated into EHRs
- Payer Connectivity Services (PCS) - EDI validation and editing
- Hosted Payer Services (HPS) - Payer hosting service for eligibility responses to providers
- Acuity / Pulse - Acuity provides revenue cycle analytics for users of Clearance and Assurance; Pulse provides RCM KPI benchmarks for institutional claims utilizing Assurance client data
- Week of 4/8:
- Risk Manager - Supports clients in managing value-based payment contracts.
- Health QX - Retrospective episode-based payment models
Change Healthcare updates as of 3/20/2024 include:
- Technology – updated 3/20/2024
- Amazon cloud services for Assurance and Relay Exchange were restored from backups, scanned, and cleared by four partners: AWS, Trend Micro, Mandiant and Palo Alto Networks; penetration testing was also completed by Bishop Fox.
- Authentication services were completely rebuilt on a new network and security controls for the new domains were instituted with all services being monitored by at least two scanning services.
- Third party documentation and assurances are available either through the client executive or at [email protected].
Other updates were made on 3/18/2024 regarding Pharmacy, Claims, Payments and Relief Programs - in summary:
- Pharmacy – updated 3/18/2024
- On 3/7/2024, 99% of pharmacy network services were restored; however, there is still a small subset of pharmacies still offline; CHC is still working on the disruption for infusion pharmacies; and challenges for some Medicaid fee-for-service customers.
- Claims – updated 3/18/2024
- Assurance, the medical claims preparation software is back online and began testing on 3/18/2024 with its first providers; reconnection with thousands of providers will occur in phases and by the end of the week they expect all Assurance users, including thousands of hospitals, to have complete functionality enabled so they can begin preparing the backlog of claims.
- Relay Exchange, its largest clearinghouse for third-party documentation is expected to be back online and reconnection will begin with providers, including Assurance customers, channel partners and other clearinghouses to enable claims submissions. Claims prepared in Assurance will not be released until this happens.
- Reconnection testing will continue into the week of 3/25/2024 as operations ramp up; there will be a small subset of claims submitters, mainly channel partners who do not directly connect with Relay Exchange - until that happens they encourage providers to participate in the temporary funding initiatives.
- Payment – updated 3/18/2024
- CHC’s electronic payments platform was restored 3/15/2024 and is now proceeding with payer implementations; it will take time to fully bring all payers and providers back online.
- Relief Programs – updated 3/18/2024
- UHG has advanced over $2 billion through multiple initiatives; enhancements have been made to the process for providers who receive payments from payers processed by CHC; UHC medical, dental & vision providers; providers who have exhausted all available connection options, or are in the process of implementing workarounds, and other payers who opted not to advance funds while CHC systems are down.
- Providers must determine eligibility; however, to accept funds, an Optum Pay account is required. The repayment period has been extended to 45 business days to return funds; CHC will send notice after claims processing or payment processing services resume; there are no fees or interest/additional costs associated.
4/2/2024 Review/Updates:
- Updates were made as of 3/27/2024 to these websites, that each contain the same information, but have different URLs: - see pdf dated 4/2/2024 https://www.unitedhealthgroup.com/changehealthcarecyberresponse & https://www.unitedhealthgroup.com/ns/changehealthcare.html
- Relay Exchange Payer Status List shows an update as of 3/27/2024 for up-to-date reconnection status information: https://support.changehealthcare.com/customer-resources/payer-lists
3/28/2024 Updates:
Revised URLs:
- https://www.unitedhealthgroup.com/changehealthcarecyberresponse
- https://www.unitedhealthgroup.com/ns/changehealthcare.html
- Relay Exchange Payer Status List for up-to-date reconnection status information. https://support.changehealthcare.com/customer-resources/payer-lists.
The timeline for product restoration has been updated for the next three weeks with the following:
Additional restoration webinars are also available, with the most recent as of 3/26/2024:
The following updates were made to certain areas of the Latest Updates Section as of 3/27/2024:
- Claims Network: “Medical claims have begun to flow through Change Healthcare’s network. Assurance was back online the week of March 18 and Relay Exchange, our largest clearinghouse, was back online the weekend of March 23. When the clearinghouse came back online, we began taking steps with both commercial payers and government payers to reconnect the claims network. The next stage is to facilitate increased connectivity with payers, trading partners and submitters.”
- Payment: “On March 15, Change Healthcare’s electronic payments platform was restored and is now proceeding with payer implementations. As claims begin to flow to payers, the actual cash flow timing is dependent on individual payers. You can expect us to process payments immediately upon receipt and processing of claims, and we encourage other payers to do the same. Until claims are flowing at pre-incident levels, we remain focused on ensuring continued access to care and supporting providers impacted.”
- Relief Programs: “UnitedHealth Group has advanced more than $3.3 billion so far, with more than 40% of those funds going to safety net hospitals and federally qualified health centers serving many of the patients and communities at the highest risk.
- Since this effort launched, there have been significant enhancements, which are available to:
- Providers who receive payments from payers processed by Change Healthcare.
- UnitedHealthcare medical, dental and vision providers.
- Providers who have exhausted all available connection options — or are in the process of implementing workaround solutions — and work with other payers who have opted not to advance funds while the Change systems are down.
- Additional Actions to Support Providers and Consumers: “For pharmacy, the Optum Rx PBM notified network pharmacy partners and pharmacy associations that we would reimburse all appropriate pharmacy claims filled with the good faith understanding that a medication would be covered.”
- Reconnection of Additional Products: The Company indicates that it remains on track with the schedule of other restoration activities and provides details on the products coming back online during the week of March 25.
- Clearance, Emdeon Eligibility Network (aka IMN) and Coverage Insight, all of which remain on track to come back online the week of March 25 and begin reconnection and testing in a phased approach.
- The Company has scheduled customer calls for Clearance and IMN for March 28 to talk through information security and the reconnection process. Coverage Insight customers will receive direct outreach regarding the restart process.
- On March 26, MedRx, its pharmacy-to-medical claim processing software was re-enabled for all existing customers. Regulatory, compliance and coverage edits will be in place and patient eligibility checks will follow soon after.
- Reimbursement Manager, the claims pricing software, is on track to be back online by the end of the week. Once online, they expect customers will be able to reset credentials and access the software.
- The Company is planning a call the week of April 1 with customers of OKC, its legacy Emdeon clearinghouse, to discuss solutions for claims submissions and electronic remittance advice (ERA) processing.
Technology:
The Company remains confident in what its telemetry and controls demonstrated – that the Optum UnitedHealthcare and UnitedHealth Group systems are safe and were not affected by this issue. Forensic analysis continues with Mandiant, but they are confident in the safe restore date that was established. This work continues to validate the attack stopped at the Change firewall. There has never been, nor is there now, any evidence of traversal to Optum, UHG, UHC or any other endpoint. Palo Alto Networks’ Attack Surface Monitoring (ASM) is scanning all company domains and will remain in place indefinitely.
- They are still determining the content of the data that was taken by the threat actor, including any PHI/PII. This is taking time because CHC’s own systems were impacted by the event and difficult to access, so it was not safe to immediately pull data directly from the Change systems. They recently obtained a dataset that is safe to access and analyze and have recently been able to begin analyzing the data. To date they have not seen evidence of any data having been published on the web. They will provide updates as they progress through the data and will be offering to do notification work for customers where permitted if they have notification obligations.
Is patient health information compromised?
Investigations continue into the extent of impacted data. Investigations are being done as quickly as possible and prioritizing the review of data that would likely contain personal health information (PHI), personally identifiable information (PII), claims and eligibility or financial information. A leading vendor is tasked with analyzing that data to determine the content, including any PHI/PII.
3/20/2024 Updates:
- Technology – updated 3/20/2024
- Amazon cloud services for Assurance and Relay Exchange were restored from backups, scanned, and cleared by four partners: AWS, Trend Micro, Mandiant and Palo Alto Networks; penetration testing was also completed by Bishop Fox.
- Authentication services were completely rebuilt on a new network and security controls for the new domains were instituted with all services being monitored by at least two scanning services.
- Third party documentation and assurances are available either through the client executive or at mailto:[email protected].
Other updates were made on 3/18/2024 regarding Pharmacy, Claims, Payments and Relief Programs - in summary:
- Pharmacy – updated 3/18/2024
- On 3/7/2024, 99% of pharmacy network services were restored; however, there is a small subset of pharmacies still offline; CHC is still working on the disruption for infusion pharmacies; and challenges for some Medicaid fee-for-service customers.
- Claims – updated 3/18/2024
- Assurance, the medical claims preparation software, is back online and began testing on 3/18/2024 with its first providers; reconnection with thousands of providers will occur in phases and by the end of the week they expect all Assurance users, including thousands of hospitals, to have complete functionality enabled so they can begin preparing the backlog of claims.
- Relay Exchange, its largest clearinghouse for third-party documentation, is expected to be back online and reconnection will begin with providers, including Assurance customers, channel partners and other clearinghouses to enable claims submissions. Claims prepared in Assurance will not be released until this happens.
- Reconnection testing will continue into the week of 3/25/2024 as operations ramp up; there will be a small subset of claims submitters, mainly channel partners who do not directly connect with Relay Exchange, until that happens they encourage providers to participate in the temporary funding initiatives.
- Payment – updated 3/18/2024
- CHC’s electronic payments platform was restored 3/15/2024 and is now proceeding with payer implementations; it will take time to fully bring all payers and providers back online.
- Relief Programs – updated 3/18/2024
- UHG has advanced over $2 billion through multiple initiatives; enhancements have been made to the process for providers who receive payments from payers processed by CHC; UHC medical, dental & vision providers; providers who have exhausted all available connection options, or are in the process of implementing workarounds, and other payers who opted not to advance funds while CHC systems are down.
- Providers must determine eligibility; however, to accept funds, an Optum Pay account is required. The repayment period has been extended to 45 business days to return funds; CHC will send notice after claims processing or payment processing services resume; there are no fees or interest/additional costs associated.