Emergency Funds for Providers Impacted by Change Healthcare/Optum Cyberattack

The effects of Change Healthcare’s late February cyberattack have been felt by healthcare providers across the nation.  As the nation’s largest processor of medical claims, Change Healthcare, a unit of UnitedHealth Group, many providers were left with no avenue to submit claims and receive payment for care provided.  Consequently, the cyberattack resulted in massive financial consequences to healthcare providers from hospital systems to small physician groups.

In response to the cyberattack, the U.S. Department of Health and Human Services (HHS) and Centers for Medicare & Medicaid Services (CMS)  have stepped up to the plate to offer some relief in the meantime to providers that have been affected by the cyberattack through a program that offers accelerated payments to Part A providers and advance payments to Part B suppliers experiencing disruption or delays in payment.  CMS has reserved the right to terminate the program and its available payments at any time. 

To be eligible to participate, providers must request the payments for individual providers/suppliers by unique National Provider Identifier (NPI) and Medicare ID (PTAN) combinations and make the following certifications: 

(i)             The provider/supplier is unable to submit claims to receive Medicare claims payments;

(ii)            The provider/supplier has experienced a disruption in claims payment or submission due to its or its third party payer’s relationship with Change Healthcare or another entity using Change Healthcare;

(iii)          The provider/supplier has been unable to obtain sufficient funding from other available sources to cover the disruption attributable to the cyberattack;

(iv)          The provider/supplier does not intend to cease business operations and is not presently insolvent;

(v)           If currently in bankruptcy, the provider/supplier will alert CMS as to this status and include case information;

(vi)          Based on its best information, knowledge, and belief, the provider/supplier is not aware that it or its related entities is under investigation for a False Claims Act violation, a defendant in a state or federal civil or criminal action, or has been notified by a state or federal agency that it is subject of a civil or criminal investigation or Medicare program integrity administrative action; or notified that it is subject of a program integrity investigation by a licensed health insurance issuer’s special investigative unit;

(vii)         The provider/supplier is enrolled in the Medicare program and has not been revoked, deactivated, precluded, or excluded by CMS or the HHS Office of the Inspector General;

(viii)       The provider/supplier does not have any delinquent Medicare debts;

(ix)          The provider/supplier is not on a Medicare payment hold or suspension; and

(x)           The provider/supplier will use the funds for its operations.

Additionally, the provider/supplier must sign a written agreement, acknowledging and agreeing to the terms of the accelerated and advanced payment, including the following:

·       The amounts extended are an advance on claims payment

·       The amounts extended are not a loan and cannot be forgiven or reduced and there is no flexibility in repayment timelines

·       Repayment will begin immediately with 100% recoupment over a period of 90 days from the payment

·       A demand will be made for any outstanding balance on day 91

·       Interest will accrue 30 days after a demand is issued consistent with the interest rate established under applicable interest authorities

·       If any of the certifications or acknowledgments are falsified, CMS will proceed directly to demand the payments

·       A grant of payments is not guaranteed and will not be issued once the disruption to claims is remediated and CMS may terminate the program at any time

·       CMS may conduct post payment audits related to these payments

The available accelerated or advanced payment amounts are based on the average claims the provider has typically submitted in prior 30-day periods (specifically, total claims paid between 8/1/23-10/31/23, divided by 3) or the provider can request a specific amount not to exceed this maximum allowable amount.  The amounts provided are to be repaid by automatic recoupment from Medicare claims for a period of 90 days, with a demand issuing for any unpaid balance on day 91. 

CMS and HHS have also encouraged other private health plans that have not been impacted by the cyberattack to expedite the processing of claims in an effort to alleviate the financial hardships providers are currently facing. More information regarding CMS’ relief can be accessed here.

Progress is underway, UnitedHealth Group is working to restore Change Healthcare’s platform and plans to release medical claims preparation software over the next few days as the next step in resuming services.  As of March 15th, Change Healthcare’s electronic payments platform has been restored and is proceeding with payer implementations.  On March 7th, 99% of Change Healthcare’s pharmacy network services has been restored.  Recognizing the effects this attack has had on the provider community, UnitedHealth Group has advanced more than $2 billion to help providers in need and has suspended prior authorizations for most outpatient services and utilization review of inpatient admissions for Medicare Advantage plans. 

Bradley’s Healthcare Practice Group will continue to monitor the cyberattack, the CMS program, and implications for providers.