UnitedHealth Group estimates 90% of the 70,000-plus pharmacies in the U.S. using Change Healthcare's platform have modified electronic claims processing to mitigate effects of the cybersecurity incident that hit the company last week.
The remaining 10% have offline processing workarounds, according to a Feb. 26 statement from UnitedHealth Group, which owns Change Healthcare. The cybersecurity issue, believed to be the work of a foreign nation-state-associated cybersecurity threat actor, caused enterprisewide connectivity issues.
A Feb. 26 cybersecurity advisory from the American Hospital Association said Change is a victim of the ConnectWise ScreenConnect vulnerabilities, but the organization was unable to confirm attack details amid the ongoing investigation.
UnitedHealth Group reported Optum Rx and UnitedHealthcare have seen few reports of issues, and fewer than 100 out of the 65 million pharmacy benefit manager members have not been able to get their prescriptions. The company has immediately escalated patients that haven't been able to access prescriptions to preserve continuity of care.
Since identifying the issue on Feb. 21, Change has worked closely with customers and clients to secure access to medications during the network disruption. The company is also working with law enforcement, Mandiant, Palo Alto Networks, and other third parties to investigate and resolve the issues.
"We appreciate the partnership and hard work of all of our relevant stakeholders to ensure providers and pharmacists have effective workarounds to serve their patients as systems are restored to normal," said the statement. "As we remediate, the most impacted partners are those who have disconnected from our systems and/or have not chosen to execute workarounds."
The company also noted hospitals and health systems have connections with multiple clearinghouses and manual workarounds to continue providing care.
"We understand the impact this issue has had on claims for payers and providers. Any delays to claims processing have yet to impact provider cash flows as payers typically pay one to two weeks after processing. As we work on bringing systems back online, we are also developing solutions to that challenge if needed," the company said in its statement.
The AHA's advisory recommends organizations "reevaluate their risk of keeping any network services shut down to Optum, Change Healthcare, UnitedHealthcare and/or UnitedHealth Group, which has been deemed safe by them."
So far the network disruption has been contained within Change Healthcare, and Optum, UnitedHealthcare, and other UnitedHealth Group companies have not been affected.