UPDATED April 24, 2024 - United Health Group Releases New Statement, AMA Launches New Survey

UnitedHealth Group (UHG) issued a press release on Monday, April 22, with more information about the Change Healthcare cyberattack and the impact of the breach on personal data. UnitedHealth Group officials have agreed to address any additional questions we may have. We would like to get input from the Federation. Please review the press release and send any questions you may have to ama.advocacy@ama-assn.org, we will try to get answers from UHG. 

UHG also posted about the “strong progress” that Change Healthcare is making to restore services, but we know that many practices are still facing major financial and administrative challenges due to the cyberattack. The AMA has developed another brief survey to gather up-to-date information on the impact of the breach on physicians and practices to inform our policy discussions with UnitedHealth Group, the Biden administration, and Congress. Survey responses are due Wednesday, April 24.

As UHG’s investigation proceeds to determine the scope and extent of the compromised information and the impacted customers and individuals, it created a dedicated website (changecybersupport.com) and call center (866.262.5342) to provide more information and resources, including free credit monitoring and identity theft protections for two years to anyone impacted. UHG expects more information and announcements to be forthcoming as its investigation continues, including an official notification of a breach. 

For more information on UHG’s funding assistance program, please visit Temporary Funding Assistance for Providers. The CMS Change Healthcare/Optum Payment Disruption (CHOPD) program is available online. The AMA will continue to raise issues of concern to UHG, CMS, state regulators, and other payers. Additional information from the AMA is also available on our Change Healthcare cyber outage webpage.

UPDATED March 18, 2024 - HHS Provider Briefing on Response to Cyberattack on Change Healthcare

Please join Department of Health and Human Services (HHS) Deputy Secretary Andrea Palm, along with leadership from the Immediate Office of the Secretary and the Centers for Medicare & Medicaid Services (CMS), to learn how HHS is responding to the cyberattack on Change Healthcare on Tuesday, March 19, 2024 at 4:00 pm ET. CMS will provide an overview of how to apply for Medicare advance and accelerated payments, and leaders from UnitedHealth Group will demonstrate how to apply for funding the company has made available to providers. You can register for the briefing using this link. 

UPDATED March 18, 2024 - CMS Announces Reopening of 2023 MIPS EUC Application in Response to Change Healthcare Cyberattack

In response to the Change Healthcare cyberattack in late February, the Centers for Medicare & Medicaid Services (CMS) extended the data submission deadline and is now reopening the 2023 Merit-based Incentive Payment System (MIPS) Extreme and Uncontrollable Circumstances (EUC) Exception Application to provide relief to MIPS eligible clinicians impacted by this cybersecurity incident. The application will be open for the remainder of the extended data submission period, which closes April 15, 2024, at 8 p.m. ET.

IMPORTANT: Because CMS is reopening the 2023 MIPS EUC Exception Application window in response to the Change Healthcare cyberattack, CMS will only approve applications citing this cyberattack as the basis for requesting reweighting under the MIPS EUC Exception. Any applications submitted for reasons outside of the Change Healthcare cyberattack will be denied. Additionally, any data submitted to CMS will override your application for those performance categories.

March 15, 2024

The Tennessee Medical Association (TMA) wants to ensure that its members have access to resources regarding the cyber-attack on Change Healthcare that has significantly disrupted health care services across the country. 

The Centers for Medicare and Medicaid Services (CMS) announced an opportunity for physicians impacted by the cyber-attack and resulting disruptions with Change Healthcare to request advanced Medicare payments to help with cash flow disruptions. Physicians should carefully review the terms of these payments. 

On March 13, 2024, CMS posted a set of Frequently Asked Questions regarding the agency’s recent announcement that Medicare Parts A and B providers would be eligible for Accelerated and Advance Payments as a result of the Change Healthcare cyberattack. CMS clarified that the process for “Change Healthcare/ Optum Payment Disruption (CHOPD) Accelerated and Advance Payments (AAPs)” differs from traditional accelerated and advance payments in several ways, including:  (1) CHOPD AAPs will be available “for a limited time period to help alleviate financial strain attributed to the disruption in the claims submission to and payments from Medicare Administrative Contractors[MACs];” (2) the “CHOPD program operates under different terms such as the establishment of certifications and acknowledgments, for all impacted providers and suppliers; and (3) “the CHOPD payment is intended to cover up to 30 days of Medicare claims and providers/suppliers have 90 days to repay the payment.”

The details of the program, terms, and the steps needed to apply can be found in the links below.

Fact Sheet - Click Here

CMS Statement - Click Here

Recently, CMS updated its FAQs to add the following information:

Question: What is a Change Healthcare/ Optum Payment Disruption (CHOPD) Accelerated and Advance Payment (AAP)?

• CMS Response: “A CHOPD accelerated or advance payment refers specifically to accelerated/advance payments issued to providers and advance payments issued to suppliers who are experiencing delays in the submission or processing of Medicare claims payments as a result of the Change Healthcare/ Optum cyber incident, which began on February 21, 2024.  The name of these payments are intended to distinguish the CHOPD payments from other accelerated and advance payments that CMS has issued after federally-declared disasters or emergencies in specific areas of the country, such as hurricanes or wild fires.”

Question: How long will accelerated or advance payments due to the Incident be available?

• CMS Response: “At this time, CMS does not have a projected end date for the CHOPD accelerated and advance payment program. CMS expects these payments will no longer be available upon resolution of the disruptions to Change Healthcare/ Optum’s Electronic Data Interchange (EDI).”

Question: How long will it take the MAC to make the payment after the paperwork has been submitted?

• CMS Response: “MACs are aiming to review requests and will notify most providers/suppliers of the outcome of their request within 5 business days of receipt.”

Question: How long will it take the MAC to make the payment after the paperwork has been submitted?

• CMS Response: Yes, CMS requires providers and suppliers to attest that they are experiencing a delay in claims submission and processing which has resulted in a disruption of their Medicare Part A or Part B claims payments related to the Change Healthcare/ Optum cyber incident.  CMS is not requiring providers to quantify the level or percentage of impact to their Medicare claims.

Additional information, including regarding application processes, eligibility, and repayment requirements, can be found in the attached CMS FAQs. TMA will continue to monitor this incident.