UnitedHealth calls for repayment of loans issued to docs during Change Healthcare cyberattack

UnitedHealth Group CEO Andrew Witty gestures as he testifies before the Senate Finance Committee on May 1, 2024. Witty apologized for the effects of the massive cyberattack against the company's entity Change Healthcare starting in February 2024.

A health insurance giant is seeking money back from physicians who suffered the financial consequences of a massive cyberattack last year.

The Feb.21, 2024, computer breach of Change Healthcare, a subsidiary of UnitedHealth Group, caused huge disruption in payments to physicians and other clinicians across health care. Within weeks it was apparent smaller practices and hospitals were struggling due to the financial implications of delayed claims payments. UnitedHealth Group loaned money through a Temporary Funding Assistance Program to keep medical practices afloat while the company determined the scope and scale of the attack.

Now UnitedHealth is seeking repayment, amounting to tens of thousands or even hundreds of thousands of dollars, according to the American Medical Association (AMA), along with reports from The Wall Street Journal and MedPageToday.

This month, AMA CEO and Executive Vice President James L. Madara, MD, described the situation in a letter to Roger Connor, CEO of OptumInsight Inc., a one of UnitedHealth’s tech subsidiaries. A full 14 months after the cyberattack, payment remains problematic for doctors who had nothing to do with the hacking incident in the first place.

“We are hearing from many practices about Optum’s strict measures related to repayment/recoupment of loans to practices after the cyberattack and the resulting outage,” Madara wrote. “In addition, many practices are still grappling with claims from the period associated with CHC’s outage and receiving rejections for not meeting UnitedHealthcare’s (UHC) timely filing deadlines.”

What would help

If physicians don’t pay within five business days, Optum has threatened to withhold current claims payments until the balance is repaid, Madara’s letter said. He suggested two remedies that could be implemented immediately:

• Use an individualized, practice-by-practice approach to recoup the loans issued in response to the CHC cyberattack.
• Work with UHC to suspend all claim filing deadlines for the time when CHC’s systems were not functioning and practices were unable to file claims appropriately.

Millions affected

At the time of the cyberattack, Change Healthcare’s systems touched an estimated one in three patient records in the United States. It processed an estimated 15 billion transactions a year, involving an estimated 900,000 physicians, 118,000 dentists, 33,000 pharmacies and 5,500 hospitals around the nation. The attack affected an estimated 100 million patients across the country — and UnitedHealth Group paid $22 million to recover stolen data.

The size of the situation prompted public examination, and Madara recalled the U.S. Senate Finance Committee hearing of May 1, 2024. Then, UnitedHealth Group CEO Andrew Witty “confirmed that UnitedHealth Group had no intention of asking for loan repayment until the physician determines that their business is back to normal.” Even then, doctors wold have 45 business days or 60 calendar days to begin repayment, with no interest or fees.

“Given that the recovery from the cyberattack for physician practices is still very much in process, business is not back to normal, from any perspective,” Madara said. Optum should honor that commitment and drop its “one-size-fits-all” approach to loan repayment, he added.

As for physicians’ claims, UHC should suspect deadlines for timely filings for claims associated with the cyberattack, and encourage other payers to do so, Madara said.

Paying back UHC

Physicians, other clinicians and health systems have not disregarded UnitedHealth Group’s Temporary Funding Assistance Program. As of Oct. 15, 2024, recipients had repaid $3.2 billion, according to the company’s website. One physician affected, Christine Meyer, MD, who has been cited by The Wall Street Journal and MedPageToday, said UnitedHealth Group “could afford to write off $5 billion.”

For 2024, UnitedHealth Group reported revenues of $400.3 billion, up 8% from 2023, even with the Change Healthcare cyberattack. The company projected to bring in revenues of $450 billion to $455 billion in 2025, according to its 2024 results posted Jan. 16 this year.