The Journal. - The Cyberattack That’s Roiling Healthcare

Episode Date: March 14, 2024

Hospitals, pharmacies and medical groups have been reeling in the wake of last month’s ransomware attack on a company widely used for insurance billing and payments. WSJ's James Rundle unpacks how the cyberattack on Change Healthcare has left thousands of providers scrambling to pay their bills and some wondering if they can keep their doors open. Further Reading: - Change Healthcare Rival Onboards Hundreds of Thousands of Customers During Hack Crisis  - U.S. Health Department Intervenes in Change Healthcare Hack Crisis  - UnitedHealth Aims to Restore Change Healthcare Systems Within Two Weeks  Further Listening: - The Ruthless Group Behind Ransomware Attacks on Hospitals  - Ransomware, a Pipeline and a Gas Shortage  - Why Crypto is Key to Stopping Ransomware  Learn more about your ad choices. Visit megaphone.fm/adchoices

Christine Meyer is a doctor in Chester County, Pennsylvania, about an hour outside of Philadelphia. She owns and operates a primary care practice. This is our 20th anniversary year, which I'm so, so proud of. We have 84 employees, two buildings, 30,000 active patients. 30,000? Yeah. I went from, I'm never going to have my own practice to, you know, really taking care of a big swath of our community. And do you have patients who have been with you that whole time? Yes, I have many.

A few weeks ago, Christine's day was going along as normal when something went wrong. It had to do with a payment processing company called Change Healthcare. I'm a little embarrassed to say, but it's the honest to God truth. Until February 21st, if someone had said to me, hey, what's Change Healthcare? I would have been like, oh, that's a thing. It's something we need to do. I didn't realize it was a noun, but apparently it is. But then February 21st, my billing manager slacked everyone and said, change healthcare's down.

Hopefully it'll be back up in a few hours. Like, I have, you know, 20 patients to see today. So I just blew right past it. Christine thought this was a run-of-the-mill tech snafu. But then, a few hours later, her billing manager circled back. She stood in the doorway of my office and she said, I'll never forget these words now as long as I live, Christine, this is really bad.

And I was like, what? What's really bad? She's like, change healthcare being down is really bad. She's like, patients can't pay their bills. And I was like, well, okay, that's okay. Like, we'll be fine. And she said, no, we cannot submit any claims to any insurance company at all.

We've not been able to submit bills all day. And let me just say that what we thought would happen was not what happened. What did you think would happen? We just thought it would come right back up. We're like, tomorrow will be fine, right? Like, that's what we thought. It turns out Change Healthcare was hacked. And after three weeks, it still hasn't come back online, leaving Christine and thousands of other medical providers

struggling to stay afloat. Welcome to The Journal, our show about money, business, and power. I'm Kate Leinbaugh. It's Thursday, March 14th. Coming up on the show, the hack that's roiling healthcare. We'll see you next time. Extraordinary hydration, so you can live a more extraordinary life. Live more with Liquid IV Hydration Multiplier. Available in refreshing lemon-lime, passion fruit, and strawberry flavors. Buy a stick in-store at Costco, Walmart, Amazon, and other Canadian retailers.

Three weeks ago, there was a major hack. A cyber attack on the health care provider Change Healthcare is wreaking havoc nationwide. Hundreds of millions of dollars of payments not being made. This isn't just pharmacy. This is all health care. This is hospitals. This is medical clinics. This is a lot. Hospitals and pharmacies can't get paid and patients can't get prescriptions. How would you rank this hack in the annals of hacks? It's huge, frankly. It is definitely the worst ones ever hit the health care sector in the U.S. I would probably go further and say it's one of the worst I've ever seen in my 15 plus years covering technology. That's our colleague James Rundle.

It's one that has an immediate and deleterious impact on patient care. People have had to pay full price for their prescriptions. It's been challenging for physicians to keep their practices afloat. And it's one that has really highlighted, again, how fragile our system really is. If one company can be taken down like this, it affects so many people, then that's a huge systemic problem. Why is change so important to the healthcare industry as a whole? change so important to the healthcare industry as a whole? It handles insurance claims that are submitted by medical practitioners, such as doctors, through to the insurance companies and how the insurance companies then pay those doctors back. Change has a significant presence within the U.S. healthcare sector. It processes around 15 billion transactions annually. It touches one in three patient records in the U.S.,

and that's according to the U.S. Health Department. It's a massive, massive entity that has grown over the years, has been acquired, has acquired other companies to the point where it's operating a pretty systemically vital function within healthcare. So I might fill my prescription with Walgreens, but there's a transaction happening that I don't see between my insurer and my pharmacy and change is processing that transaction. Basically, yeah, that's the platform for doing that. It basically underpins a lot of what goes on. What do we know about how Change realized it was hacked? I think Change realized pretty quickly. So when the ransomware attack happens, Change's parent company, Optum,

whose ultimate parent company is United Health Group, made the very sensible decision to disconnect all their systems, just in case it didn't spread, to stop the damage from increasing and everything else. That unfortunately had an immediate and fairly catastrophic effect on the healthcare sector. The hackers behind this attack immediately claimed responsibility. It was a notorious Eastern European group called Alpha. Members of this group have been linked to another big cyber attack in 2021 on Colonial Pipeline, which supplies oil and gas up the East Coast.

Alpha has emerged as really one of the most prolific, and they've been on a rampage over the last few months. In December, the FBI seized their website only for them to seemingly take it back hours later, very briefly. The Justice Department says they've caused damage in the hundreds of millions across healthcare, manufacturing, education, everywhere across the public and private sectors. Have they said anything, the hackers? They have.

They said they'd stolen terabytes worth of data from change of systems, which includes very sensitive health information on millions and millions of people. And so, yeah, the amount of information out there could be really quite significant. And what did they want in this attack? The same thing that they always want, which is money, frankly. We don't know exactly how much. UnitedHealth has declined to answer questions about whether it's paid a ransom or how much it was or anything like that.

There was a report in Wired two weeks ago which strongly suggested that a $22 million amount of Bitcoin landed in one of the wallets controlled by the group. Again, UnitedHealth has confirmed that, despite being asked directly. So how has this hack trickled out to the broader healthcare industry? What has happened? I wouldn't say it trickled out as much as it exploded out, to be honest. The second it went down, it started causing problems. People sort of woke up on the following morning after the 21st and opened their practices as usual saw patients

tried to file their claims and found that they couldn't and that was it immediately after that a lot of places since that moment haven't taken in a single cent of revenue because they haven't been able to send their claims through it's had a very very immediate and extremely troubling effect on a lot of smaller practices many of whom operate with pretty high margins for costs and salaries and everything else. You know, doctors aren't cheap to employ. And they rely on that revenue coming in regularly in order to meet those obligations. And having that cut off suddenly and now for an extended three-week period has meant many are very, very concerned about their ability to stay open.

With the hack forcing change healthcare to go offline, tens of thousands of providers have been affected, from big hospital systems to small pharmacies. And it's worse for the smaller ones as well, because the larger ones tend to have multiple providers they can use or fall back on. The smaller ones will often have one primary technology provider for this, and that tends to be changed. We've spoken to a lot of people across the country since this started who many of whom

have written in because they are desperate. They're worried about meeting their payroll. They've had to furlough some staff. We spoke to one gentleman who had to sell $100,000 worth of his own stock portfolio to meet his payroll because he had nothing else coming in that week and he had to pay his staff. It's extremely, extremely challenging for a lot of people out there who rely on the money coming in and have just seen it dry up. One of those people is Dr. Christine Meyer,

who you heard from earlier. Coming up, what she's doing to keep her clinic going. DQ presents... Picture this. Picture the DQ freezer, home to all the Blizzard flavors of the past. Picture it opening to bring back the salted caramel truffle Blizzard for a limited time. Picture that salted caramel truffle Blizzard in your hands. It's all yours. No, really, it's all yours.

This treat is too good to share. Everyone will have to get one for themselves. Hurry in to get this flavor before the DQ Freezer closes. DQ. Happy tastes good. Summer is like a cocktail. It has to be mixed just right. Start with a handful of great friends. Now add your favorite music. And then finally add Bacardi rum.

Shake it together. And there you have it. The perfect summer mix. Bacardi. Do what moves you. Live passionately. Drink responsibly. Copyright 2024. Bacardi. It's trade dress and the bat device are trademarks of Bacardi and Company Limited. Rum 40% alcohol by volume.

After the cyber attack caused changed healthcare to go offline, Dr. Christine Meyer was in a bind. She needed to figure out how to submit claim information to insurance companies. So we started creating this hodgepodge of systems to just push claims out the door. None of it was easy. All of it was tremendously time consuming. I think my billing manager, Sue, told me that it was taking them 10 times as long to submit claims as it was before Change Healthcare went down. 10 times as long. Some insurances would only accept paper claims. So everybody started to take work home. My mom actually works in my billing department.

She was the one employee I had when I started. She's 79 years old. And, you know, she has my back. She has our back. Nobody does like your mom, right? Right. So here's a 79-year-old dragging like boxes of paper home to try to just get these claims out as fast as possible. But Christine had a bigger problem facing her. She had bills to pay. I think I misunderstood the impact of money literally not coming in, you know, because we had some money in the bank. But I was like, wait a minute, I have payroll next week. So I had payroll, $175,000. I have an $80,000 vaccine bill and a $50,000 medical supply bill. And those three things were essentially due on the same day.

And none of those three things could I hold off on paying. And so if I had made those three payments, I would pretty much be out of my cash reserves. That would be it. Right. The end. So we started looking at where do we get more money? I called my bank and they were like, yeah, we could extend you a line of credit, but it's going to

take time to do all of the things they have to do. We don't have that kind of time. I have one week, basically, and then we're going to be down to zero. And we're going to have to talk about the unthinkable. What's the unthinkable? Closing. Closing the doors, sending people home. I mean, again, I could cry just talking about it because, you know, in the worst times, which I would say was COVID, right? Yeah. We still worked. We still took care of our patients and people continued to be paid. So, you know, this was so different.

This was, we just can't, we're not liquid. We cannot operate the business like this. So I wanted that to be the absolute last resort. So my husband and I started looking at our personal finances and what cash we could immediately free up to cover our expenses. You know, we're talking about $500,000 to $600,000 a month of expenses. And, you know, I don't know about you, but I don't know too many people that are just hanging on to half a million dollars in cash in their bank account. You're talking to a journalist here. Yeah, no, people aren't hanging on to that.

Right. Yeah, no, people aren't hanging on to that. Right. So, you know, we decided that probably the first thing we would do is take out a home equity line of credit because we've been in our home for 20 years. It's paid off. And, you know, a home equity line of credit is easy to get and just sits there. You know, if you need it, you need it. If you don't, you don't. So, but that was such a hard thing too, because we've basically like saying, due to something completely out of our control,

we're about to put our house on the line. Around that time, Optum, the parent company of Change Healthcare, offered help to providers like Christine. Optum, which is owned by healthcare giant United Health Group, proposed a loan program. Christine took that loan. So we were expecting, you know, 80% of our charges in the form of this loan. And then we got the statement and it was, they were going to give me $4,000 a month against half a million dollars of charges every month. And, you know, first of all, that is, don't get me wrong, $4,000 is a lot of money. But in respect to what we have to do to operate my practice, it could have been pennies, right? So during this time, are you still treating patients? Yeah. yeah. Christine still needed to pay hundreds of thousands of dollars for things like payroll and medical supplies,

and the Optum loan was nowhere near enough. Ultimately, she got help from somewhere else. A health care group she works with offered to front her some money. It was enough to cover those bills and keep her practice running. And she didn't have to put her house on the line. How are things now? So Change Health Care said they expect to be up March 18th, Change Healthcare said they expect to be up March 18th, which is a full month from when they went down. So that's terrible. That means we have to continue this very difficult workflow for several more weeks, another, what is it, six days from now at least, assuming it comes back up and works perfectly.

But at least we have a date, right? So that's something we're very hopeful about. And I'm kind of, you know, there's stages of grief, right? I'm at that stage of grief now where I'm like, just mad. I'm so mad. I... Who are you mad at? I am mad at UnitedHealth Group. I'm mad at, listen, I'm not an antitrust expert. That's not what I do. But I'm angry at the powers that be that allowed one entity to become so huge and have their tentacles in so many aspects of healthcare that something happening to them could directly impact not just my livelihood and the livelihood of my team, but patients' lives.

How did we allow that to happen? So, you know, my anger is directed absolutely at UnitedHealth Group. They got hacked. They didn't have the proper systems in place. And then they did not make good. They are 100% responsible and have done zero, zero percent to help us. In a statement, UnitedHealth's CEO said the company is determined to, quote, make this right as fast as possible. Last week, the company said that pharmacy transactions were

running again. Yesterday, the U.S. Department of Health and Human Services announced an investigation into the attack. UnitedHealth said it's cooperating. The government is also offering some programs to financially assist providers. James says that even though change will come back online soon, it might take time for providers to get paid. back online soon, it might take time for providers to get paid.

They expect to start testing their claims platform on March the 18th, and then from there, restore connectivity through the week. So hopefully an end in sight to the outage. And, you know, even when the systems are back up, there is an enormous amount of backlog that has to be entered into the system, a lot of which was recorded by hand, because obviously systems were down, so people were using pen and paper. So it could be weeks until it's restored, weeks more until they're paid. What does this say about the power of hackers? It says an enormous amount, quite frankly. You know, the fact that an unknown group of people can break into a confused system at one company in the United States and cause this level of national disruption speaks volumes to the resilience of the, not just the healthcare sector, but I think the private sector in general. And the impossibility in some ways of defending against hackers.

And the fact of the matter is, you know, they're encouraged because people pay, especially in the healthcare sector. That's one of the reasons why they go after hospitals, because they know that if they attack hospitals, if they attack healthcare, it becomes an immediate threat to patient care, to life or death, and people more likely to pay.

And so they go away with it. And that really does speak to the level of ferocity, the level of ruthlessness, and as you said, the level of power these groups have. That's all for today, Thursday, March 14th. The Journal is a co-production of Spotify and The Wall Street Journal. Additional reporting in this episode by Kim Nash and Katherine Stump. Thanks for listening. See you tomorrow.