Local hospitals scramble to deal with disruptions after cyberattack on vendor
Subscriber Benefit
As a subscriber you can listen to articles at work, in the car, or while you work out. Subscribe Now
It’s been an exasperating week or so at Riverview Health, the small hospital system owned by Hamilton County, following a cyberattack on a large outside company that helps it process insurance claims.
The cyberattack 13 days ago shut down Riverview’s electronic filing process—essentially its billing and claims system for its surgeries, emergency rooms, therapy clinics and all other medical functions.
That meant that Riverview, like thousands of hospitals and doctors’ offices across the country, could see huge delays in getting paid by insurers for thousands of procedures worth millions of dollars.
“The first question I asked is, are we good to make payroll?” CEO David Hyatt told IBJ. “And we are, that’s our most important thing.”
But Riverview could have to dip into cash reserves to meet payroll and pay some other bills while waiting for things to come back to normal, he added.
“That’s why hospitals have to keep those large reserves that many people can be critical of,” Hyatt said. “It’s for times like this.”
The Feb. 21 cyberattack on Change Healthcare, a claims-processing business owned by insurance giant UnitedHealth Group, has hospitals and doctors’ offices around the country scrambling to find other ways to submit claims and get reimbursed by insurance companies.
The hospitals say it hasn’t affected any of their electronic medical records or ability to provide care. But it has cut off many health-care organizations from the systems they rely on to transmit patients’ health-care claims and get paid.
In response, some hospitals and clinics are resorting to filling out and submitting paper statements to insurers, a much slower process for getting paid and dealing with payment denials.
Indiana University Health, the largest health system in the state, with 15 hospitals, said in a brief statement it is working to rectify the situation.
“Like many national providers, IU Health is working with Change Healthcare to fully restore claims service,” the statement said. “The outage has no impact on patient care.”
The Indiana Hospital Association said the cyberattack is “causing major disruptions in patient care and claims payments” to hospitals, pharmacies and other health care providers.
“In many cases, hospitals are not being reimbursed for care and are taking great hits to their revenue,” IHA spokeswoman Laura Kracher wrote in an email.
On Monday, the American Hospital Association sent a letter to Congressional leaders, saying they “urgently need your support to help minimize further fallout from the attack.” It called the incident “the most significant cyberattack on the U.S. health care system in American history.”
In addition to slowing the billing process, the cyberattack has interrupted many pharmacies from filling prescriptions and billing insurers. It said that workarounds to address prior authorization, claims processing and payment are expensive, time consuming and inefficient.
“For example, manually typing claims into unique payer portals or sending by fax machine requires additional hours and labor costs, and switching revenue cycle vendors requires hospitals and health systems to pay new vendor fees and can take months to implement properly,” the AHA letter said.
Riverview Health said it has started investigating alternatives to Change Healthcare and is using its cyber insurance to try to mitigate losses. It is also exploring the idea of adding temporary staff to process the claims manually, because the chore would overwhelm the current staff.
“It’s going to take us some time to get cash back in the door,” Hyatt said. “And it’s going to increase our costs over the short run.”