WHAT HAPPENED?

Most are aware of the massive cyberattack on United Healthcare (UHC) revealed over the past few weeks.  The breach has been traced to an employee download that allowed cybercriminals access to huge amounts of the database.  The impact of this breach is simply massive.  Specific to our world, there are two impacts on business.

1. If your EMR utilizes OPTUM for prescription ordering and processing, patients are having a huge issue getting their medications. According to UHC, most of the pharmacy programs are being reconnected and everyone will get their medication.  For immediate or emergency prescription needs, you may have to go outside the patient’s pharmacy provider and have patients pay themselves using coupons, generic substitutions or other options.  As of today, UHC has not given a timeline for total resolution of this issue.
2. If your EMR, your remote billing company or your clearinghouse routes claims through Change Healthcare, many claims are being held until the portal to Change Healthcare is secured. This impacts hundreds of payers (email us for the full list).  For optometry, the biggest impact has been on certain Medicare Advantage programs, practices utilizing APEX as their clearinghouse, Amerigroup/Wellpoint plans (mostly Medicaid), many state Medicaid programs, many BCBS plans, Molina Healthcare, and most all United Healthcare plans.  As of March 5, UHC states that claims processing has been restored to 90% of all payers.  The backlog of unprocessed claims and isolated security issues are expected to continue for some time.

WHAT DOES ALL THIS MEAN?

1. HIPAA Breach Compliance. We have many clients asking what PCS is doing about this.  The bottom line is there is nothing to do right now.  UHC is still investigating the breach and has not released any information on what patient information was impacted.  They do not feel PHI has been compromised but a complete forensic audit is underway.  We cannot make any recommendations or support to your systems (if needed) until UHC does its due diligence and releases the appropriate information.  Once UHC provides clarity on exactly what was compromised, we can appropriately recommend steps for PCS clients.
2. Claims Processing. As stated, a large portion of claims processing has already been restored.  Payments are starting to go out but this is going to be a process that takes time and will place a significant burden on your in-house or remote claims processing.  Some are recommending changing your clearinghouse away from any program involved with Change Healthcare but a review of the attached list shows the futility of this complex move.  Some are recommending switching to paper claims.  While you can, we do not believe this is going to significantly solve the issue.  HHS current recommendation is to continue to file claims as usual.  Any unprocessed claim will be processed once the Change Healthcare portal is reopened.
3. Claims Payment. Obviously, unprocessed claims cannot be paid.  There will definitely be some delay in receiving payments for claims until UHC completely resolves its internal issues.  Although only a small number, any practice significantly impacted by the delay in payments can investigate temporary loan programs being discussed at UHC.  You can investigate these options at https://www.unitedhealthgroup.com/changehealthcarecyberresponse .

DO YOU HAVE LIABILITY IN ALL THIS?

This very unfortunate situation only emphasizes the importance of following HIPAA protocols and properly training staff on cybersecurity issues. Remember, possibly the largest insurance claims processing system in the world was taken down by one employee mistake.  If you have a complete, updated HIPAA program in place, documented staff training and current business associate agreements with your EMR, clearinghouse and other entities involved in revenue cycle management, your liability is very low.  Without those noted issues in place, you could be in a precarious situation if the breach turns out to involve significant patient information.

WHAT DO I DO NOW?

1. Pay attention to any correspondence you receive from Practice Compliance Solutions, United Healthcare, Change Healthcare, your EHR provider or Health and Human Services. Updates and directions should be forthcoming.
2. If you are a PCS HIPAA client, we will send information regarding what PCS will be doing and what you may need to do once UHC completes its investigation.
3. Unless you are significantly impacted by this unfortunate situation, we recommend you follow HHS advice and continue to file claims as usual. These will be processed once the Change Healthcare portal is reopened.

UHC is updating the situation every few days and you can see their updates here: https://www.unitedhealthgroup.com/changehealthcarecyberresponse.  Once PCS has more direction on the next best steps to take, we will provide additional direction.