UnitedHealth Aims to Restore Change Healthcare Systems Within Two Weeks

Testing of medical claims systems will begin on March 18, parent company says‍

‍UnitedHealth Group said it plans to test connections to its Change Healthcare’s medical claims software and network starting Monday, March 18, and restore service through the week.

Change Healthcare, which UnitedHealth owns through its Optum subsidiary, was forced to disconnect more than 100 services after a ransomware attack that began Feb. 21. Change Healthcare operates the largest clearinghouse for insurance billing and payments in the U.S., and the outage has wreaked havoc among hospitals, pharmacies and medical groups, many of which have gone without revenue since the attack.

The insurance giant said pharmacy claims and payment systems are back up and running as of Thursday and its electronic payments platform will be available from March 15.

“We’re strongly recommending that all of our provider and payer clients continue to work on the workarounds,” Dirk McMahon, president and chief operating officer of UnitedHealth, said in his first interview since the attack. 

“They’re good to have in place,” said McMahon, who is leading the company’s response to the attack. “We want to get the system moving faster, number one, and number two, they’re important in the interest of redundancy in the current environment.” 

UnitedHealth said it would expand stopgap funding for its providers. This additional program, which is separate from an Optum loan program launched on Feb. 29, will apply to United Healthcare’s medical, dental and vision providers.

“We’re urging other payers to do the same thing. The payers have the best view of the providers that have been impacted,” McMahon said.

The loan program has received a mixed reception from smaller medical groups. Some have said the amounts offered fell far short of what they needed to stay in business.

Optum will also provide funding through loans to providers who can’t connect to workaround solutions for submitting insurance claims, and whose payers haven’t advanced funds.

The loans, which are interest- and fee-free, will become repayable 30 days after an invoice is issued, the company said.

McMahon said the loan program is a “funding mechanism of last resort” and will be evaluated on a case-by-case basis.

With systems down for around two-and-a-half-weeks, McMahon said restoration has been a lengthy process.

“It’s a combination of doing some development and what I would call rebuilding from safe environments, and some situations where we are remediating and decontaminating the infected code,” he said.

McMahon declined to comment on whether UnitedHealth paid a ransom to the hackers. The company identified them as the ALPHV gang in an update last week, after first attributing the attack in a regulatory filing to a nation-state.

A report in Wired magazine on Monday suggested the company paid a ransom of $22 million in bitcoin, citing darknet forum posts and analysis of activity in wallets known to be controlled by the gang.

“We’re not going to talk about that,” McMahon said. “What I would tell you is, across the board on the investigation, we’re working closely with law enforcement, and this is an ongoing investigation.”

Write to James Rundle at james.rundle@wsj.com

Source: The Wall Street Journal‍