CHANGE HEALTHCARE CYBERSECURITY INCIDENT RECENT UPDATES

4/26/2024 Updates:

LATEST UPDATE

April 26, 2024 8:30 a.m. CT

An updated Claims Payer List for legacy Emdeon customers now on iEDI is now available.

4/25/2024 Updates:

ADDITIONAL INFORMATION

Pharmacy Portal - For Optum Rx network pharmacies, visit the Optum Rx Pharmacy Portal.

Resources to come for Change Healthcare pharmacies.

Optum Rx Pharmacy claims

We are seeing the majority of Optum Rx network pharmacies back online and processing claims. As pharmacy services are restored, Optum Rx Pharmacy Network Audit has taken the following actions to address the concerns of our network pharmacy providers:

·       Impacted pharmacies will not be audited through early April 2024.

·       Claims that were filled but could not be submitted online during the Change Healthcare outage will not be audited or reviewed.

o   Upon notification by Pharmacies of inadvertent audits of such claims, Optum Rx will remove the claims from audits and clear any findings for the claims from the audits if applicable.

o   Upon notification by Pharmacies of Prescription Validation Reviews of such claims, Optum Rx will remove the claims from the reviews and clear any findings for the claims from the reviews if applicable.

·       For Centers for Medicare & Medicaid Services (CMS)-directed audits, if more time is needed to gather the required documents, please notify us and we will work on obtaining an extension.

·       Requests for extensions from Pharmacies with open audits will be reviewed on a case-by-case basis.

 

If you have any questions, please reach out to our Provider Relations team via the intake form located on our website: https://professionals.optumrx.com/resources/forms/pharmacyproviderrelationsform.html.

 

4/23/2024 Updates:

The last updates to these websites were made on 4/22/2024, the sites contain the same information, but have different URLs:

 

LATEST UPDATE - April 22, 2024 4 p.m. CT

UnitedHealth Group is announcing support http://changecybersupport.com/ for people who may be concerned about their personal data potentially being impacted based on preliminary findings from our investigation and review of the data involved in the malicious criminal cyberattack on Change Healthcare’s systems. The company is also providing an update on progress in restoring Change Healthcare’s products and services. See the full update here.

  • This investigation remains ongoing due to the complexity of data review and requires a comprehensive analysis.
  • UHG is providing support for people who are concerned about their personal data due to the criminal cyberattack on Change Healthcare systems, and launched a new website that went live as of 5:30 PM EST 4/22/2024 http://changecybersupport.com/, as well as a call center phone number 1-866-262-5342.
  • The website includes answers to Frequently Asked Questions, as well as information about how to obtain a copy of the consumer’s credit report and place a fraud alert or security freeze.
  • The website indicates this is not an official breach notification. When enough information is available from its ongoing and methodical data review, it will do appropriate notifications in the most efficient way possible, as required by law.
  • The call center includes trained clinicians who will provide emotional support services as well as free credit monitoring and identity theft protections for two years to anyone impacted.

OTHER UPDATES:

FEDERAL AGENCY UPDATES

HHS Office of Civil Rights: The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) posted a new webpage to share answers to frequently asked questions (FAQs) concerning HIPAA and the cybersecurity incident impacting Change Healthcare.

ARTICLES:

4/18/2024 Updates:

https://www.unitedhealthgroup.com/changehealthcarecyberresponse

https://www.unitedhealthgroup.com/ns/changehealthcare.html

April 17, 2024 4:00 p.m. CT

April 17, 2024 - Arizona: Required health care workforce survey opened April 16 : Complete the 2024 AZ Healthcare Workforce Goals and Metrics Assessment online starting April 16.

April 18, 2024 - May 1: Electronic reconsideration and appeal submissions require : Health care professionals must submit Medicaid medical reconsiderations and appeal submissions electronically in Massachusetts and Mississippi.

April 18, 2024 - Your Community Plan medical claim letters are going paperless soon : Starting May 3, 2024, Medicaid claim letters won’t be mailed in Florida and Massachusetts.

April 18, 2024 - CommunityCare Portal can help save you time: The CommunityCare Portal allows you to get an overview of a patient’s total health, complete redeterminations and more.

April 18, 2024 - Important AHCCCS Medical Policy Manual 510 revisions: We’re notifying you of policy updates that’ll help you better coordinate primary and mental health care for UnitedHealthcare Community Plan of Arizona members.

April 18, 2024 - April monthly overview: Review the latest UnitedHealthcare prior authorization, medical policy, pharmacy, reimbursement, laboratory and policy and protocol updates.

OTHER UPDATES:

April 16 & 17 - Healthcare Financial Management Association: Cyberattack on Change Healthcare brings turmoil to healthcare operations nationwide 

UPDATE – TUESDAY, APRIL 16, 2024

 NAIC ACTION

 The NAIC submitted a letter to the House Energy & Commerce Subcommittee on Health for an April 16th hearing on Change Healthcare.   (Details of hearing below.)

 CONGRESSIONAL HEARING

 House Energy and Commerce Subcommittee on Health

"Examining Health Sector Cybersecurity in the Wake of the Change Healthcare Attack"

TUESDAY, April 16

10:00am EDT

Witnesses/Testimony:

Mr. Greg Garcia, Executive Director for Cybersecurity, Healthcare Sector Coordinating Council

Mr. Robert Sheldon, Senior Director of Public Policy and Strategy, CrowdStrike

Mr. John Riggi, National Advisor for Cybersecurity and Risk, American Hospital Association

Mr. Scott MacLean, Board Chair, College of Healthcare Information Management Executives (CHIME)

Articles

 

4/11/2024 Review/Updates:

 

Updates were made to these websites as of 4/10/2024, which contain the same information, but have different URLs:

https://www.unitedhealthgroup.com/changehealthcarecyberresponse

https://www.unitedhealthgroup.com/ns/changehealthcare.html

 

April 10, 2024 4:30 p.m. CT

A new Claims Payer List for legacy Emdeon (OKC) customers on Intelligent EDi is now available. 

There was an update to the uhcprovider.com website, the update is in reference to the Surest out-of-network, which was last modified 4/5/2024 and states that beginning 4/1/2024 they are updating the out-of-network service area for Surest benefit plans with out-of-network (OON) benefits.

4/4/2024 Review/Updates:

Updates were made as of 3/27/2024 to these websites:

Product Capabilities Week of 3/25:

Eligibility Processing - Processes real-time transactions

Clearance - Benefits verification and estimation related services

MedRX - Pharmacy electronic claims for medical

Reimbursement Manager - Claim pricing

Coverage Insight - Coverage discovery

Hosted Payer Services (HPS) - Payer hosting service for eligibility responses to providers

Week of 4/1: Acuity / Pulse - Acuity provides revenue cycle analytics for users of Clearance and Assurance; Pulse provides RCM KPI benchmarks for institutional claims utilizing Assurance client data

Week of 4/8: Risk Manager - Supports clients in managing value-based payment contracts

Health QX - Retrospective episode-based payment models

Week of 4/15: Clinical Exchange - Provider workflow enabling electronic prescribing, ordering and resulting integrated into EHRs

Week of 4/29: Payer Connectivity Services (PCS) - EDI validation and editing

If a product is not listed in this schedule, that does not mean that product is more than three weeks away. It means that we do not yet have line of sight to the week that we expect it to be restored and will provide updated information as those timelines become clear.

There have been updates to the following sections as of 4/4/2024:

Funding Relief For Providers - nearly $4.7B to providers in need.

 

March 27, 2024 Updates:

Provider website includes changes coming to the UnitedHealthcare Provider Portal access. https://www.uhcprovider.com/en/access/provider-portal-authentication.html .

Including:

  • Soon, UnitedHealthcare Provider Portal users will be required to update their One Healthcare ID authentication* sign-in and recovery options to retain their portal access. These updates include:
    • April 1: Users will be required to have a verified phone number on file (mobile or direct landline)
    • Expected in May 2024: Email will no longer be an option as a sign-in/recovery option
  • What is authentication? For our purposes, authentication is the process of securely verifying your identity when accessing the portal. Now, you’ll use Authenticator to generate a time sensitive code to enter with your One Healthcare ID instead of a password or security questions that could be shared or compromised.

Timeline – Product Capabilities

  • Week of 3/25:
    • Eligibility Processing - Processes real-time transactions
    • Clearance - Benefits verification and estimation related services
    • MedRX - Pharmacy electronic claims for medical Reimbursement Manager - Claim pricing
    • Coverage Insight - Coverage discovery
  • Week of 4/1:
    • Clinical Exchange - Provider workflow enabling electronic prescribing, ordering and resulting integrated into EHRs
    • Payer Connectivity Services (PCS) - EDI validation and editing
    • Hosted Payer Services (HPS) - Payer hosting service for eligibility responses to providers
    • Acuity / Pulse - Acuity provides revenue cycle analytics for users of Clearance and Assurance; Pulse provides RCM KPI benchmarks for institutional claims utilizing Assurance client data
  • Week of 4/8:
    • Risk Manager - Supports clients in managing value-based payment contracts.
    • Health QX - Retrospective episode-based payment models

 

Change Healthcare updates as of 3/20/2024 include:

  • Technology – updated 3/20/2024
    • Amazon cloud services for Assurance and Relay Exchange were restored from backups, scanned, and cleared by four partners: AWS, Trend Micro, Mandiant and Palo Alto Networks; penetration testing was also completed by Bishop Fox. 
    • Authentication services were completely rebuilt on a new network and security controls for the new domains were instituted with all services being monitored by at least two scanning services.
    • Third party documentation and assurances are available either through the client executive or at [email protected].

Other updates were made on 3/18/2024 regarding Pharmacy, Claims, Payments and Relief Programs - in summary:

  • Pharmacy – updated 3/18/2024
    •  On 3/7/2024, 99% of pharmacy network services were restored; however, there is still a small subset of pharmacies still offline; CHC is still working on the disruption for infusion pharmacies; and challenges for some Medicaid fee-for-service customers.
  • Claims – updated 3/18/2024
    • Assurance, the medical claims preparation software is back online and began testing on 3/18/2024 with its first providers; reconnection with thousands of providers will occur in phases and by the end of the week they expect all Assurance users, including thousands of hospitals, to have complete functionality enabled so they can begin preparing the backlog of claims.
    • Relay Exchange, its largest clearinghouse for third-party documentation is expected to be back online and reconnection will begin with providers, including Assurance customers, channel partners and other clearinghouses to enable claims submissions. Claims prepared in Assurance will not be released until this happens.
    • Reconnection testing will continue into the week of 3/25/2024 as operations ramp up; there will be a small subset of claims submitters, mainly channel partners who do not directly connect with Relay Exchange - until that happens they encourage providers to participate in the temporary funding initiatives.
  • Payment – updated 3/18/2024 
    • CHC’s electronic payments platform was restored 3/15/2024 and is now proceeding with payer implementations; it will take time to fully bring all payers and providers back online.
  • Relief Programs – updated 3/18/2024 
    • UHG has advanced over $2 billion through multiple initiatives; enhancements have been made to the process for providers who receive payments from payers processed by CHC; UHC medical, dental & vision providers; providers who have exhausted all available connection options, or are in the process of implementing workarounds, and other payers who opted not to advance funds while CHC systems are down.
    • Providers must determine eligibility; however, to accept funds, an Optum Pay account is required. The repayment period has been extended to 45 business days to return funds; CHC will send notice after claims processing or payment processing services resume; there are no fees or interest/additional costs associated.

 

4/2/2024 Review/Updates:

 

 

3/28/2024 Updates:

 

Revised URLs:

The timeline for product restoration has been updated for the next three weeks with the following:

Additional restoration webinars are also available, with the most recent as of 3/26/2024:

 

The following updates were made to certain areas of the Latest Updates Section as of 3/27/2024:

  • Claims Network: “Medical claims have begun to flow through Change Healthcare’s network. Assurance was back online the week of March 18 and Relay Exchange, our largest clearinghouse, was back online the weekend of March 23. When the clearinghouse came back online, we began taking steps with both commercial payers and government payers to reconnect the claims network. The next stage is to facilitate increased connectivity with payers, trading partners and submitters.”
  • Payment: “On March 15, Change Healthcare’s electronic payments platform was restored and is now proceeding with payer implementations. As claims begin to flow to payers, the actual cash flow timing is dependent on individual payers. You can expect us to process payments immediately upon receipt and processing of claims, and we encourage other payers to do the same. Until claims are flowing at pre-incident levels, we remain focused on ensuring continued access to care and supporting providers impacted.”
  • Relief Programs: “UnitedHealth Group has advanced more than $3.3 billion so far, with more than 40% of those funds going to safety net hospitals and federally qualified health centers serving many of the patients and communities at the highest risk.
  • Since this effort launched, there have been significant enhancements, which are available to:
    • Providers who receive payments from payers processed by Change Healthcare.
    • UnitedHealthcare medical, dental and vision providers.
    • Providers who have exhausted all available connection options — or are in the process of implementing workaround solutions — and work with other payers who have opted not to advance funds while the Change systems are down.
  • Additional Actions to Support Providers and Consumers: “For pharmacy, the Optum Rx PBM notified network pharmacy partners and pharmacy associations that we would reimburse all appropriate pharmacy claims filled with the good faith understanding that a medication would be covered.”
  • Reconnection of Additional Products: The Company indicates that it remains on track with the schedule of other restoration activities and provides details on the products coming back online during the week of March 25.
  • Clearance, Emdeon Eligibility Network (aka IMN) and Coverage Insight, all of which remain on track to come back online the week of March 25 and begin reconnection and testing in a phased approach.
  • The Company has scheduled customer calls for Clearance and IMN for March 28 to talk through information security and the reconnection process. Coverage Insight customers will receive direct outreach regarding the restart process.
  • On March 26, MedRx, its pharmacy-to-medical claim processing software was re-enabled for all existing customers. Regulatory, compliance and coverage edits will be in place and patient eligibility checks will follow soon after.
  • Reimbursement Manager, the claims pricing software, is on track to be back online by the end of the week. Once online, they expect customers will be able to reset credentials and access the software.
  • The Company is planning a call the week of April 1 with customers of OKC, its legacy Emdeon clearinghouse, to discuss solutions for claims submissions and electronic remittance advice (ERA) processing.

 

Technology:

The Company remains confident in what its telemetry and controls demonstrated – that the Optum UnitedHealthcare and UnitedHealth Group systems are safe and were not affected by this issue. Forensic analysis continues with Mandiant, but they are confident in the safe restore date that was established. This work continues to validate the attack stopped at the Change firewall. There has never been, nor is there now, any evidence of traversal to Optum, UHG, UHC or any other endpoint. Palo Alto Networks’ Attack Surface Monitoring (ASM) is scanning all company domains and will remain in place indefinitely.

  • They are still determining the content of the data that was taken by the threat actor, including any PHI/PII. This is taking time because CHC’s own systems were impacted by the event and difficult to access, so it was not safe to immediately pull data directly from the Change systems. They recently obtained a dataset that is safe to access and analyze and have recently been able to begin analyzing the data. To date they have not seen evidence of any data having been published on the web. They will provide updates as they progress through the data and will be offering to do notification work for customers where permitted if they have notification obligations.

 

Is patient health information compromised?

Investigations continue into the extent of impacted data. Investigations are being done  as quickly as possible and prioritizing the review of data that would likely contain personal health information (PHI), personally identifiable information (PII), claims and eligibility or financial information. A leading vendor is tasked with analyzing that data to determine the content, including any PHI/PII.

 

3/20/2024 Updates:

 

  • Technology – updated 3/20/2024
    • Amazon cloud services for Assurance and Relay Exchange were restored from backups, scanned, and cleared by four partners: AWS, Trend Micro, Mandiant and Palo Alto Networks; penetration testing was also completed by Bishop Fox.
    • Authentication services were completely rebuilt on a new network and security controls for the new domains were instituted with all services being monitored by at least two scanning services.
    • Third party documentation and assurances are available either through the client executive or at mailto:[email protected].
Other updates were made on 3/18/2024 regarding Pharmacy, Claims, Payments and Relief Programs - in summary:
  • Pharmacy – updated 3/18/2024
    • On 3/7/2024, 99% of pharmacy network services were restored; however, there is a small subset of pharmacies still offline; CHC is still working on the disruption for infusion pharmacies; and challenges for some Medicaid fee-for-service customers.
  • Claims – updated 3/18/2024
    • Assurance, the medical claims preparation software, is back online and began testing on 3/18/2024 with its first providers; reconnection with thousands of providers will occur in phases and by the end of the week they expect all Assurance users, including thousands of hospitals, to have complete functionality enabled so they can begin preparing the backlog of claims.
    • Relay Exchange, its largest clearinghouse for third-party documentation, is expected to be back online and reconnection will begin with providers, including Assurance customers, channel partners and other clearinghouses to enable claims submissions. Claims prepared in Assurance will not be released until this happens.
    • Reconnection testing will continue into the week of 3/25/2024 as operations ramp up; there will be a small subset of claims submitters, mainly channel partners who do not directly connect with Relay Exchange, until that happens they encourage providers to participate in the temporary funding initiatives.
  • Payment – updated 3/18/2024
    • CHC’s electronic payments platform was restored 3/15/2024 and is now proceeding with payer implementations; it will take time to fully bring all payers and providers back online.
  • Relief Programs – updated 3/18/2024
    • UHG has advanced over $2 billion through multiple initiatives; enhancements have been made to the process for providers who receive payments from payers processed by CHC; UHC medical, dental & vision providers; providers who have exhausted all available connection options, or are in the process of implementing workarounds, and other payers who opted not to advance funds while CHC systems are down.
    • Providers must determine eligibility; however, to accept funds, an Optum Pay account is required. The repayment period has been extended to 45 business days to return funds; CHC will send notice after claims processing or payment processing services resume; there are no fees or interest/additional costs associated.

Change Healthcare Updates