Health care providers losing up to $1B a day from cyberattack
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Aïda Amer/Axios
Disruptions from the Change Healthcare cyberattack are costing health providers as much as $1 billion a day and creating enough of a drag to depress first-quarter earnings, analysts and industry officials say.
Why it matters: Even though Change's parent, UnitedHealth Group, has a timeline for restoring the third-party payment systems that roughly half of U.S. health care relies on, it's not as simple as throwing a switch.
- Hospitals, pharmacies, doctors, medical equipment vendors and others could spend weeks or months sorting out patient eligibility, filing claims and paying additional staff to handle the extra administrative burden.
What they're saying: "I know some systems that bill $40 or $50 million a day. They're up to about $800 million so far," Chip Kahn, CEO of the Federation of American Hospitals, told Axios about lost cash flow.
The big picture: Providers that use Change systems have seen portions — and in some cases nearly all — of their revenue vanish since systems for filing claims or having them paid went offline Feb. 21.
- Assuming that between 5% and 10% of U.S. health care claims are affected by the attack, providers are losing between $500 million and $1 billion in daily revenue compared with 2023, Compass Point analyst Max Reale estimated.
- "Cash-constrained operators will begin to feel the full brunt of the slowdown in payments for services between late March and early April, assuming it takes about 30 to 45 days to process a claim and receive payment," Reale wrote in a note.
- Federal officials over the weekend announced a plan to distribute emergency funds to providers and suppliers facing cash flow problems and called for other payers, particularly UnitedHealth, to do the same.
Between the lines: It's not just a matter of waiting for the money owed to show up.
- Health providers have already incurred massive expenses coming up with workarounds that have been largely manual and paper-based, said Judson Ivy, CEO of revenue cycle management company Ensemble Health Partners.
- Once the funds start flowing again, it's likely that a significant amount of money due won't actually be paid out because of paperwork errors and lack of prior authorizations.
Threat level: Though the largest health systems can likely weather the storm, Moody's Ratings warned "even large providers with thin margins and weak liquidity are not immune to challenges and will eventually face liquidity hurdles if the disruption lingers."
- Plenty of smaller providers, particularly physician groups and federally qualified health centers, are experiencing existential concerns.
- Safety net providers may be struggling to make payroll right now and could be at risk of closing their doors, potentially endangering care for millions of the most vulnerable patients, Kate McEvoy, executive director of the National Association of Medicaid Directors, told Axios.
- UnitedHealth and other insurers may actually see a bump in investment income in the first quarter from interest on all the cash it's sitting on.
What to watch: UnitedHealth estimates electronic payment functions will be reconnected starting next Friday. Testing and other checks on the Change network and software will begin the following week.
The bottom line: Provider groups critical of the federal response say it's time for the federal government to declare a state of emergency to free up more government resources in the same way as for natural disasters.
- "It's sort of invisible because, you know, there's not a fire or a hurricane here, but it has the same kind of effect," Kahn said.
Editor's note: This story was updated to reflect that Moody's Investors Service was recently rebranded as Moody's Ratings.
