Medicare Compliance & Reimbursement

Recap: Cyberthreat actors deployed a ransomware attack on Change Healthcare’s systems on Feb. 21, 2024, which forced the clearinghouse to suspend operations. ALPHV/Blackcat claimed credit for the ransomware-as-a-service (RaaS) attack, and Change Healthcare reportedly paid a $22 million ransom.

On April 10, 2024, the AMA released its findings from an informal survey of more than 1,400 individuals of the Federation of Medicine “on the impact of the Change Healthcare cyberattack on physician practices.”

According to the survey, more than one-third of respondents have experienced a pause in payments for medical claims, and 32 percent haven’t been able to even submit claims. As a result, 80 percent of respondents attest to missing revenue from the unpaid claims.

What Was the Effect on Your Providers?

In the days and weeks following the ransomware attack, revenue cycle teams started to recognize the effects of the Change Healthcare outage.

“It became very clear, real fast when the claims could not be sent from the clearinghouse, secondary claims are not getting processed, manual checks are not being processed as far back as February, and it is taking longer to get manual claims sent to carriers processed,” says Lisa Makela-Walters, CPC, CDC, business office manager at Southwest Michigan Dermatology, a division of Paragon Health PC, in Portgage, Michigan.

Without reimbursement for submitted claims, practices have had trouble covering expenses for materials, payroll, and monthly operating bills. Some payers used alternative means to pay for claims, but processing those methods carried additional expenses.

“Some of the carriers sent virtual credit cards for payments, and that hurts. We had to take reductions on their payments on already delayed payments because of the credit card fees,” Makela-Walters says.

Communication has also been crucial for revenue cycle teams since the outage has been a major hardship on medical practices.

“We have been in touch with other providers in our area, ones that rely on that consistent timely payment from the carriers. The biggest question on most providers minds is how much longer we should have to wait for claims to be processed and reimbursement to come?” Makela-Walters says.

Remember the Roots of Claim Submissions

While connections to other payers and clearinghouses have remained active during the outage, healthcare providers and organizations that submit a majority of their claims through Change Healthcare have had to use different operating procedures to request reimbursement.

One procedure is to return to paper claim submissions. “We are really at the mercy of the carriers, like many, waiting for them to get the process fixed. In the meantime, we have identified any manual claims that we have had to print and mail to carriers, are checking on remittance and manual payments weekly and keeping a spreadsheet of all outstanding claims that we have had to wait on,” Makela-Walters says.

She adds that this process has added significant work for the staff and the annual financials look “horrible.”

Patricia Swain, CPC, CPPM, CPCO, revenue cycle manager for AMA Labs at American Medical Missouri in Oklahoma City, explained to Medicare Compliance & Reimbursement that her office has entered all UnitedHealthcare claims directly into the provider portal, while other claims are filed on paper.

However, you shouldn’t expect timely reimbursement if you’re filing claims on paper. “Response time for the paper claims is taking 35 or more days, but we’ve been able to maintain,” Swain says.

While using paper claims and the mail to submit claims for reimbursement takes longer than the electronic claim submissions teams are used to, being able to fall back on traditional methods is beneficial for all practices regardless of whether they’re submitting claims to private payers or Medicare.

Receive Valuable Training

While the ransomware attack has been incredibly detrimental for many healthcare practices and organizations, revenue cycle teams have had an opportunity to get back to basics.

“This is the first time my team has seen the ‘old manual’ paper way to submit claims. I was thrilled for the teaching opportunity, my team not so much because it has affected productivity,” Swain says.

The pen-and-paper medical coding method may seem archaic in the age of electronic health records (EHRs), provider portals, and electronic claims; but knowing how to perform this rudimentary task can be helpful when, not if, the next ransomware attack occurs.

“Never allow yourself the opportunity to forget the basics. Always be eager to learn the basics, the knowledge at some point will come in handy,” Swain advises.

Michael Shaughnessy, BA, CPC, Development Editor I