Update as of March 27, 2024
The Unites States Department of Health and Human Services (HHS) hosted a briefing Tuesday, March 19 on the Change Healthcare cybersecurity incident. You can find a recording of the webinar on HHS’ YouTube page and other relevant information below.
Department of Health and Human Services
- Open Letter to Health Care Leaders on Cyberattack on Change Healthcare
- Healthcare Sector Cybersecurity Concept Paper
- HPH Cybersecurity Performance Goals (CPGs)
Centers for Medicare & Medicaid Services (CMS)
- Memo to All Medicare Advantage Organizations, Part D Sponsors, and Medicare-Medicaid Plans Addressing Impacts Related to the Cyberattack on Change Healthcare
- Change Healthcare/Optum Payment Disruption (CHOPD) Accelerated Payments to Medicare Part A Providers and Advance Payments to Part B Suppliers Fact Sheet
- CHOPD Accelerated and Advance Payments for Medicare Part A Providers and Part B Suppliers Frequently Asked Questions
- Change Healthcare Cybersecurity Incident – CMS Response and State Flexibilities Centers for Medicaid & CHIP Services (CMCS) Informational Bulletin
Administration for Strategic Preparedness and Response (ASPR)
- HPH Cybersecurity Resources
Finally, health care organizations with general questions for HHS regarding the Change Healthcare cyber incident or seeking access to HHS resources and support to help them enhance their cybersecurity posture should contact hhscyber@hhs.gov or go to the department’s new website—https://hphcyber.hhs.gov/ —which serves as a centralized platform connecting healthcare organizations to a wealth of cybersecurity resources provided by HHS and other federal agencies. This new website is designed to be a consistently evolving, comprehensive, and accessible hub improving access to information, programs, and resources to enhance cybersecurity practices across the industry.
Update as of March 25, 2024
Complete an informal, 11-question survey, created by the American Medical Association by Friday, March 29. Survey results will inform ongoing advocacy efforts to help support physician practices negatively impacted by the Change Healthcare cyberattack in February.
Update as of March 18, 2024
This is a compilation of communications that MSMS has received regarding the Change Healthcare cyberattack on February 21, 2024. You may have received some of this information directly from health plans or the Centers for Medicare & Medicaid Services (CMS).
CMS has met with health plans, physicians/providers, and suppliers to hear about their most pressing concerns. CMS has directed Medicare Administrative Contractors (MACs) to expedite actions needed for physicians/providers and suppliers to change the clearinghouse they use and to accept paper claims if physicians/providers need to use that method. CMS will continue to respond to physicians/providers and suppliers’ inquiries regarding MAC processes.
CMS also recognizes that many Medicaid physicians/providers are deeply affected by the impact of the cyberattack. CMS continues to work closely with States and are urging Medicaid managed care plans to make prospective payments to impacted physicians/providers, as well.
CMS has created a fact sheet that outlines eligibility requirements for accelerated and advanced payments. Wisconsin Physician Services (WPS) issued a Medicare eNews on March 4, 2024, providing options to physicians/providers for submitting Medicare claims to WPS.
CMS also has created an FAQ relating to the payment disruption.
The American Medical Association (AMA) sent a letter to Secretary Becerra and Acting Secretary Su urging HHS and the Department of Labor (DOL) to use all regulatory flexibilities to continue supporting physicians and tackle the enormous interruption in day-to-day physician practice operations that has impeded physicians’ ability to care for patients. The AMA also created a dedicated webpage on this issue, which you are encouraged to visit as it is being regularly updated as information becomes available.
Health Alliance Plan (HAP) is using Availity to accept claims as a temporary clearinghouse during the Change Healthcare outage, for HAP Commercial and Medicare Advantage claims. If you are interested in establishing a connection with Availity, you can find more information here.
Physicians can submit claims to Physicians Health Plan (PHP) through the Trizetto Provider Solutions (TTPS) clearinghouse.
United Health Group (UHG) has created a website to provide updates on the cyberattack.
Change Healthcare is posting updates on the status of the cyberattack.
Just recently, the U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) announced it has opened an investigation into the Change Healthcare cyberattack.
OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that HIPAA covered entities and their business associates must follow to protect the privacy and security of protected health information and the required notifications to HHS and affected individuals following a breach.
The CMS is continuing to monitor and assess the impact that the cyberattack on UnitedHealth Group’s subsidiary Change Healthcare has had on all physician/provider and supplier types.
MSMS will continue to update the membership as new information becomes available.
Update as of March 15, 2024
The Centers for Medicare and Medicaid Services (CMS) announced a new opportunity for physicians impacted by the cyber-attack and resulting disruptions with Change Healthcare to request advance Medicare payments to help with cash flow disruptions. The details of the program, terms and the steps needed to apply can be found in the links below.
Please contact your respective MAC for assistance. A list of MACs can be found at our CMS.gov website at: https://www.cms.gov/mac-info.
Update as of March 8, 2024
There has been much activity since the February 21, 2024, cyberattack on Change Healthcare, a data analytics, technology, and clearinghouse subsidiary of UnitedHealth Group (UHG). As we have learned over the days following the incident, many medical practices, hospitals, pharmacies, long term care facilities, payers, etc. have been impacted by the stoppage of claims and payment processing. UHG and others have developed resources to assist.
If your medical practice is experiencing delays and the majority of your claims go through the Change Healthcare platform you may be eligible for temporary financial assistance and/or access to a work around. You are advised to visit the UHG response website for updates on the cyber-attack, their response, and potential temporary financial assistance and/or access to work arounds for which you may be eligible. Optum Financial Services is providing temporary financial assistance to those medical practices and other providers who receive payments from payers that were processed by Change Healthcare to help with short-term cash flow needs. To learn more about the program and whether you may be eligible, visit their webpage. Below is information from that webpage about an alternative work around for claims submissions:
“Our strong recommendation is for providers and revenue cycle vendors to connect to our EDI option. This will work for the vast majority of providers who cannot submit today. There are some cases where other approaches need to be designed due to connection incompatibility. We regard EDI to be the most expeditious way to help solve this problem. We fully acknowledge that not all functionality will be in place and will create some rework burden, but we are recommending this approach to get claims flowing.
To support these efforts, as of March 5, 2024, we began hosting an ongoing series of webinars on EDI. Our teams are ready to engage and help those payers and providers get claims connections built quickly through this secure and verified platform.
Please connect with your account team if you want to receive support regarding moving to Optum’s EDI claims connections. Click on the client assistance email link in the Quick Links section on the right. Our team will respond regarding your specific situation to connect you to the resources and webinars to learn more about the solution.
As we continue to navigate this issue, we encourage you to execute your continuity plans with clearinghouses and continue to use payer portals for claims submission, status and eligibility.”
Practices are also encouraged to regularly check the American Medical Association’s dedicated webpage on this issue, which will be regularly updated as more information becomes available.
Most recently, the US Department of Health and Human Services (HHS) and the Centers for Medicare and Medicaid Services (CMS) announced several steps they have authorized to help. You can read the full text on their webpage, as well as the following steps:
Affected parties should be aware of the following flexibilities in place:
- Medicare providers needing to change clearinghouses that they use for claims processing during these outages should contact their Medicare Administrative Contractor (MAC) to request a new electronic data interchange (EDI) enrollment for the switch. The MAC will provide instructions based on the specific request to expedite the new EDI enrollment. CMS has instructed the MACs to expedite this process and move all provider and facility requests into production and ready to bill claims quickly. CMS is strongly encouraging other payers, including state Medicaid and Children’s Health Insurance Program (CHIP) agencies and Medicaid and CHIP managed care plans, to waive or expedite solutions for this requirement.
- CMS will issue guidance to Medicare Advantage (MA) organizations and Part D sponsors encouraging them to remove or relax prior authorization, other utilization management, and timely filing requirements during these system outages. CMS is also encouraging MA plans to offer advance funding to providers most affected by this cyberattack.
- CMS strongly encourages Medicaid and CHIP managed care plans to adopt the same strategies of removing or relaxing prior authorization and utilization management requirements, and consider offering advance funding to providers, on behalf of Medicaid and CHIP managed care enrollees to the extent permitted by the State.
- If Medicare providers are having trouble filing claims or other necessary notices or other submissions, they should contact their MAC for details on exceptions, waivers, or extensions, or contact CMS regarding quality reporting programs.
- CMS has contacted all of the MACs to make sure they are prepared to accept paper claims from providers who need to file them. While we recognize that electronic billing is preferable for everyone, the MACs must accept paper submissions if a provider needs to file claims in that method.
