Medicare Compliance & Reimbursement

Cybersecurity:

CMS Offers Support Amidst Change Healthcare Attack

Crucial: Connect with your MAC and other payers for additional advice.

If you’re scrambling financially due to the ransomware attack on UnitedHealth Group’s Change Healthcare division, you’re not alone. The feds are stepping in to help.

Take a Look at This Timeline of Events

On Feb. 21, Nashville-based Change Healthcare, which is owned and operated by UnitedHealth Group (UHG), reported it had been targeted in a ransomware attack. As the cyber incident evolved and disruptions to the healthcare industry multiplied, the feds got involved in the response.

Here’s a brief breakdown of how the cyber incident was identified, how the situation evolved, and what the feds initially did to help providers:

On Feb. 21, UHG issues an alert that Change Healthcare — a billing and data provider that handles billions of healthcare transactions annually — has been the victim of a ransomware attack. The Department of Health and Human Services (HHS) is also alerted. Concerns arise that Optum, a healthcare provider that works with more than 125 million patients and more than 65,000 pharmacies, may also have been impacted.

On Feb. 22, UHG files a report with the Securities and Exchange Commission (SEC) that it thinks it was an attack from a “nation-state.”

On Feb. 27, the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and HHS release a joint cybersecurity advisory on the Russian hacking group Blackcat. They don’t mention Change Healthcare, but a Blackcat operative admits to the attack on social media.

On March 1, Change Healthcare/Optum offer a “Temporary Funding Assistance Program [that] is designed to help bridge the gap in short-term cash flow needs for providers impacted by the disruption of Change Healthcare’s services,” Optum lists on its website. UHG still hasn’t named the hacking culprits, but it continues to offer guidance and help.

On March 2, Change Healthcare acknowledges its continued monitoring of the cyberattack, admitting finally that Blackcat is behind it.

On March 5, the feds finally issue a statement on the cyberattack. “HHS recognizes the impact this attack has had on health care operations across the country,” the agency says. “HHS’ first priority is to help coordinate efforts to avoid disruptions to care throughout the health care system.”

HHS also announces how the Centers for Medicare & Medicaid Services (CMS) will help providers impacted by the incident with numerous flexibilities. HHS also mentions the possibilities of accelerated or advanced payments similar to those instituted during the COVID-19 public health emergency (PHE) — but doesn’t give details on how this type of expansion would work.

Additionally, around this time, there are reports that UnitedHealth has paid a $22 million bitcoin ransom; however, it still has not resolved the problem, according to press reports.

On March 6, CMS leadership offers insight into what they will do to help. “We recognize the impact that the cyberattack on UnitedHealth Group’s subsidiary Change Healthcare has had on physicians and other providers — and we are particularly concerned about small practices and community-based providers,” they note in a release. “We are actively examining our authority to help support these critical providers at this time and working with states to do the same.”

On March 7, UHG affirms that its electronic prescription program as well as its payment systems are back up and running.

See the Latest on the Feds’ Input

On March 9, CMS put a relief plan into action for providers impacted by claims disruptions and struggling with cash flow issues due to the ransomware attack. The agency offered a Part A provider option, the Change Healthcare/Optum Payment Disruption (CHOPD) accelerated payments, as well as the opportunity to request advance payment for Part B providers and suppliers, CMS says in a release.

“Accelerated and Advance Payments are intended to provide necessary funds to Part A and B providers, respectively, when there is a disruption in Medicare claims submission and/or claims processing,” explains Part B Medicare Administrative Contractor (MAC) National Government Services on its website. “The expansion of the AAP is only for the duration of the claims processing disruptions associated with this incident.”

“As a result of the Change Healthcare/Optum Payment Disruption, most providers supported by this vendor are eligible to request up to 100% of the Medicare payment amount for a 30-day period,” NGS continues.

With Change Healthcare/Optum suggesting systems will be tested starting the week of March 18, you may want to act quickly on the AAPs to alleviate cash flow issues, say attorneys Anna Grizzle, Angela Humphreys, and Elaine Naughton with law firm Bass, Berry & Sims. “While there is no specified deadline, CMS will not issue accelerated and advance payments once the disruption to claims servicing is remediated, regardless of when a request is received,” they advise.

“Further, CMS reserves the right to conduct post-payment audits related to any accelerated or advance payments issued under this program,” Grizzle, Humphreys, and Naughton note in online legal analysis.

The request process for the CHOPD accelerated and advance payments for Part A and Part B providers is similar and includes the following:

  • Make a request in writing using a form on your specific MAC’s website. Part B providers will need a separate form for each Provider Transaction Access Number (PTAN).
  • Ensure forms are signed by an official involved in financial decision-making and understanding of repayment requirements.
  • Submit your request in an email to the MAC address that matches your jurisdiction and specific Part of Medicare.
  • Expect a decision soon after. “Once our review is complete, we will send a decision letter to the provider requesting accelerated payment using the most expeditious method (e.g., email, facsimile, telephone). As a last resort, we may have to mail a copy of the decision letter,” NGS says.
  • Receive your payment via standard financial methods after your MAC approves your request. Payment will be issued within five days after approval.

Recoupment: The CHOPD accelerated and advance payments come with parameters similar to other AAP programs, including written acknowledgement by providers and suppliers that they agree to the terms and conditions of the program. “Applicants should be aware that these payments represent an advance on claims, are not loans, cannot be forgiven, and do not have flexible repayment timelines,” Grizzle, Humphreys, and Naughton caution.

Following the date the payment is granted, “repayment will start immediately through 100 percent recoupment of Medicare claims payments owed to the provider, as claims are submitted and processed,” NGS explains. “Recoupment will continue for a period of 90 days. A demand will be issued for any remaining balance on day 91 following the issuance of the accelerated and advance payment,” the MAC continues.

Know that interest will accrue starting “30 days after a demand is issued consistent with the interest rate established under applicable interest authorities,” CMS says.

Resources: Review CMS’ fact sheet on the CHOPD accelerated and advance payments at www.cms.gov/newsroom/ fact-sheets/change-healthcare/optum-payment-disruption-chopd-accelerated-payments-part-providers-and-advance and peruse UHG’s ongoing updates and calendar at www.unitedhealthgroup.com/ns/changehealthcare.html.