Update on Change Healthcare Cybersecurity Incident

Update on Change Healthcare Cybersecurity Incident

On Wednesday, Feb. 21, Change Healthcare began experiencing a cyber security issue and isolated its systems to prevent further impact. Optum, UnitedHealthcare, and UnitedHealth Group (UHG) systems were not affected by the issue, according to information provided by UHG. UHG has indicated they have taken appropriate action to contain the incident so that customers and partners do not need to sever network connections and disrupt vital services. Cybersecurity experts and the HHS Administration for Strategic Preparedness and Response (ASPR) suggest taking these steps to protect your networks:

        ·  With consideration of the written attestation from UHG that the Optum network is safe, organizations should evaluate their risk of using Optum, UnitedHealthcare and UHG systems.

        ·  While UHG asserts that any system that is currently live and available is safe to use, organizations should evaluate their risks and make determinations if connections to Change Healthcare are appropriate at this time.

As part of your risk evaluation, health care organizations should consider the impacts of severing connectivity to Optum, which includes but is not limited to loss of prior procedure authorizations, electronic prescribing and other patient care functions. Ultimately, your organization should make its own determination on whether or not to block Optum specifically while considering all the risks and consequences of doing so. Change Healthcare is posting updates on the status of the cyberattack.

Updates as of Feb. 29

Actionable next steps for impacted medical practices include (but are not limited to) the following:

           ·  Communicate with your payors regarding payment workarounds to bypass disrupted Change Healthcare applications.

           ·  Monitor the Change Healthcare Incident update website for relevant updates.

           ·  Develop a set of security- and Incident-related questions or criteria for Change Healthcare to reestablish connectivity with Change Healthcare systems (e.g., what assurances can be provided that the risk has been contained and remediated? What security improvements have been implemented to help ensure similar incidents do not occur again? What personal information about our patients and/or clinicians has been compromised? What actions are Change Healthcare taking to protect those patients and/or clinicians?).

            · Review HIPAA compliance programs, including (among others) written policies and procedures and security risk analyses.

Change Healthcare has stated they intend to establish an interim payment portal for impacted medical practices on March 1. While the details are not clear, the AMA has reached out to UnitedHealth Group (UHG) requesting more detailed information. Once the payment portal is live, the AMA will post updates on this site and through our normal communication channels.

Cybersecurity updates

In response to active exploitation of a cybersecurity vulnerability, the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Health and Human Services (HHS) have released a joint announcement on what is believed to be the cyber-attack that impacted Change Healthcare. The advisory details the attack and provides information for medical practices and information technology staff to help strengthen your organization’s cybersecurity.    

Additional resources

AMA has curated resources and has tips for physicians and health care staff to protect patient health records and other data from cyberattacks.