Medical Providers Still Grappling With UnitedHealth Cyberattack: ‘More Devastating Than Covid’

Two months after a cyberattack on a UnitedHealth Group subsidiary halted payments to some doctors, medical providers say they’re still grappling with the fallout, even though UnitedHealth told shareholders on Tuesday that business is largely back to normal.

“We are still desperately struggling,” said Emily Benson, a therapist in Edina, Minnesota, who runs her own practice, Beginnings & Beyond. “This was way more devastating than covid ever was.”

Change Healthcare, a business unit of the Minnesota-based insurance giant UnitedHealth Group, controls a digital network so vast it processes nearly 1 in 3 U.S. patient records each year. The network is a critical conduit for shuttling information between most of the nation’s insurance companies and medical providers, who submit claims through it to get paid for treating patients.

For Benson, the cyberattack continues to significantly disrupt her business and her ability to pay her seven other clinicians.

Before the hack brought down the system, an insurance company would process a provider’s claim, then send a type of receipt known as an “electronic remittance,” which details the amount the provider was paid and whether the claim was denied. Without it, providers don’t know if they were paid correctly or how much to bill patients. 

Now, instead of automatically handling those receipts digitally, some insurers must send forms in the mail. The forms require manual entry, which Benson said is a time-consuming process because it requires her to match up service dates and details to divvy up pay among her clinicians. And from at least one insurer, she said, she has yet to receive any remittances.  

“I’m holding on to my sanity by a thread,” Benson said.

The situation is so dire, Alex Shteynshlyuger, a urologist who owns a practice in New York City, said he had to transfer money from his personal accounts to pay his office bills.  

“Look, I am freaking out,” Shteynshlyuger said. “Everyone is freaking out. We are like monkeys in a cage. We can’t really do anything about it.”

Roughly 30% of his claims were routed through Change’s platform. Except for Medicare and certain Blue Cross plans, he said, he has been unable to submit claims or receive payment from any insurers.

The company is encouraging struggling providers to reach out to the company directly via its website, said Tyler Mason, vice president of communications for UnitedHealth Group.

“I don’t think we’ve had a single provider that hasn’t been helped that’s contacted us.” As part of that help, Mason said, UnitedHealth has sent providers $7 billion so far.

Ever since the February cyberattack forced UnitedHealth to disconnect its Change platform, the company has been working “day and night to restore services” and has made “substantial progress,” UnitedHealth CEO Andrew Witty told shareholders April 16. 

“We see a fairly normal claims receipts and payments flow going on at this point,” Chief Financial Officer John Rex said during the shareholder call. “But we’ll really want to be careful on that because we know there are certain care providers out there that may have been left out of it.”

Rex said the company expects full operations to resume next year.

The company reported that the hacking has already cost it $870 million and that leaders expect the final tally to total at least $1 billion this year. To put that in perspective, the company reported $99.8 billion in revenue for the first quarter of 2024, an 8.6% increase over that period last year.

Meanwhile, the House Energy and Commerce Health Subcommittee held a hearing April 16 seeking answers on the severity and damage the cyberattack caused to the nation’s health system.

Subcommittee chair Brett Guthrie (R-Ky.) said a provider in his hometown is still grappling with the fallout from the attack and losing staff because they can’t make payroll. Providers “still haven’t been made whole,” Guthrie said.

Rep. Frank Pallone Jr. (D-N.J.) voiced concern that a “single point of failure” reverberated around the country, disrupting patients’ access and providers’ financial stability.

Lawmakers expressed frustration that UnitedHealth failed to send a representative to the Capitol to answer their questions. The committee had sent Witty a list of detailed questions ahead of the hearing but was still awaiting answers.

As providers wait, too, they are trying to cover the gaps. To pay her practice’s bills, Benson said, she had to take out a nearly $40,000 loan — from a division of UnitedHealth.