IHA Comment Letter on Members' Concerns Regarding Cyberattack on Change Healthcare

March 21, 2024


Honorable Mike Quigley
2083 Rayburn Building
Washington, DC 20510

Dear Congressman Quigley,

On behalf of more than 200 member hospitals and nearly 40 health systems, the Illinois Health and Hospital Association (IHA), would like to express our members’ concerns about the recent cyberattack on Change Healthcare, a subsidiary of UnitedHealth Group. Change Healthcare is the leading source of more than 100 critical healthcare functions across the healthcare industry, including processing of drug prescriptions and processing claims for services. As a result, this cyberattack and the subsequent outage of many of Change Healthcare’s functions continues to have a ripple effect across the entire nation’s hospital community, including here in Illinois.

IHA has actively monitored the impacts of the Change Healthcare cyberattack since it was announced on February 21. As this disruption continues into its fifth week, we are concerned about potential impediments to patient care. For example, in a recent survey of our hospital members, we learned that our hospitals are experiencing difficulty prescribing medications for their patients. Call centers have seen increased volume as patients experience medication access issues. We also know that the challenges associated with the cyberattack have resulted in increased administrative burden on staff at hospitals and health systems already experiencing a critical workforce shortage. One of our hospitals that typically submits approximately 2000 claims per day is now submitting only 500 per day and all on paper. Ultimately, these additional burdens impact the patient experience.

In addition to the outage’s impact on patient healthcare access, serious consequences to our hospitals’ financial stability are beginning to materialize. We now know that many affected hospitals are beginning to experience cash flow issues with some Illinois hospitals estimating that as much as 75 to 100% of their revenue may be impacted. Our safety net and critical access hospitals in particular cannot withstand this level of financial pressure caused by their ongoing inability to submit claims for payment, receive payments from payers who use Change Healthcare for payment and remittance processes, or check patients’ eligibility for coverage. Compounding the strain on hospitals is the fact that the financial assistance offered by Change Healthcare is inadequate, with Illinois hospitals reporting that the assistance only covers 25- 50% of revenue lost due to the cyberattack.

The cyberattack has also resulted in major disruptions in prior authorization processes. Illinois hospitals report patient difficulty in accessing care due to delays in prior authorization approvals and other care utilization decisions, as well as interruptions in care. One hospital is also reporting issues sharing patient information between organizations using electronic medical record interoperability.

As a result of the duration of this outage, Illinois hospitals have now had to implement their own workarounds, including submitting paper claims, calling payers to check eligibility and even contracting with new clearinghouses. In fact, some Illinois hospitals have expressed interest in using two claims clearinghouse vendors moving forward to mitigate future risk. However, we have learned that some payers require hospitals to contract with only one vendor, complicating this strategy. Considering many hospitals believe it will take two to four months or more before the impact of this cyberattack is no longer affecting their daily cash flow, payers should not be allowed to have such limiting requirements for claims submission purposes.

We ask you to urge the Centers for Medicare & Medicaid Services (CMS) to actively engage in solutions that protect patients, hospitals, and physician practices. On March 4, the American Hospital Association sent a letter to congressional leaders asking for support and, if necessary, facilitations of executive action to ensure patients can access the care they need and that our state’s hospitals remain solvent. We echo this request, and specifically ask that you urge the administration for:

  • Direction for Medicare Administrative Contractors to prioritize and expedite review and approval of hospital requests for sufficient Medicare advanced payments;

  • Guidance to all payers, including commercial payers, outlining expectations that they implement interim payments or advanced payments to providers;

  • Guidance to all payers, including commercial payers, to waive timely filing requirements for claims; extend timelines for appeals; and prevent denial of claims due to lack of authorization, failure to give notice of admission, failure to check eligibility electronically, failure to receive medical records, or failure to timely appeal denials; among other considerations given the widespread disruption in routine operating procedures;

  • Use of all power at the Secretary of Health and Human Services’ disposal to ensure that UnitedHealth Group takes all necessary steps to remedy the situation, including implementing a more meaningful financial assistance program and engaging in frequent and forthright communication with providers; and

  • Direction for CMS to extend Medicaid state plan flexibilities past June 30, 2024, and instead through the end of the calendar year.

Thank you for your consideration.

A.J. Wilhelmi

President and CEO
Illinois Health and Hospital Association