The name Change Healthcare does not appear on anyone’s health insurance, explanation of benefits or doctors’ bills. Yet the company is vital to the business of health care — and a cyberattack against the company a month ago has sent the industry in search of cash.
Health care providers across the country, including the largest hospitals in Florida, have been impacted by what appears to be a massive cybersecurity break-in at one of the industry's biggest and least publicly known companies.
"We could be easily talking over $1 billion in payments for health care services that have not been made by these insurance companies," said Florida Hospital Association CEO Mary Mayhew. Her estimate is only for the state of Florida.
Change Healthcare is a company that matches health insurance coverage with medical claims, allowing providers to get paid.
On Feb. 21, sophisticated and organized computer hackers stole what they claimed was eight terabytes of data from Change Healthcare. One terabyte can store about 85 million documents.
As part of the ransomware attack, the hackers blocked access to the company's payment processing system. Hospitals, health care providers and pharmacies using the software were initially impacted.
Change Healthcare's payment processing system is operating again though it has not yet fully returned. The federal government is investigating if any private health information was violated.
At Jackson, the Miami-Dade taxpayer-backed hospital, the worst-case scenario is $30 million a month in missing revenue.
"That is very significant," said Jackson's Chief Revenue Officer Myriam Torres.
Jackson normally collects $125 million to $130 million each month in patient revenue. Missing $30 million for a month would mean 20% to 25% of the organization's usual revenue isn't collected.
"Obviously, that's very difficult for us," said Torres. "Thirty million is a big chunk of change. And again, it's the worst-case scenario."
It has been difficult to estimate the widespread missing revenue for the health care industry. One firm, First Health Advisory, pegged the lost revenue at $100 million a day. Operators across Florida have not been spared.
Baptist Health South Florida sent WLRN a statement saying it is "revisiting our cash forecasts" and that it was "making decisions to be able to cover shortfalls." However, Baptist did not say how much revenue it was missing due to the cyberattack at Change Healthcare.
Broward Memorial Healthcare runs a half-dozen hospitals and other facilities. It did not respond to a request for comment.
Here’s how hospitals and health care providers usually get paid by a health insurer. A patient with health insurance goes to the doctor or hospital. The doctor or hospital bills the insurer. Half of those claims nationwide are sent to Change Healthcare to match up insurance coverage with the health care service. Without Change Healthcare able to process the claims, providers have not gotten paid.
Change Healthcare is owned by United Healthcare, which is the largest insurance payer at Jackson.
Insurance denials and Medicaid applications affected
Jackson also uses Change Healthcare to manage half of the insurance denials its patients receive. Those are usually appealed in hopes of collecting some revenue. Plus, Change Healthcare screens Jackson’s Medicaid applications.
"We treat (an) overwhelming percentage of uninsured patients. It's very important to qualify these patients," Torres said.
Often, these patients apply for Medicaid, and Change Healthcare works to make sure patients qualify.
Torres has been responsible for managing revenue at Jackson for almost a decade.
"It feels like this is only something that the finance world is aware of. Not even everyone in the health care world is aware that this is happening," she said.
Navigating through this cyberattack is more difficult for her than managing through the COVID-19 pandemic.
"For me, this is worse. Back then the anxiety was on the delivery of care. The caregivers. They took the brunt of the issues during the pandemic," she said during an interview over Zoom.
This crisis is not impacting the ability of patients to get health care. And it’s not dominating the headlines each day. Yet, it is a massive disruption in the flow of money.
Mayhew from the Florida Hospital Association calls the hack almost an act of war.
"If this was against the country's electrical grid, we would immediately understand it. If we were talking about aviation control towers, we would immediately understand the magnitude, the implications. That is what this is, the country's largest cyberattack on our health care delivery system," she said.
Copyright 2024 WLRN 91.3 FM. To see more, visit WLRN 91.3 FM.
