Samaritan, River Hospital say Change Healthcare hack hasn't caused major disruptions

Mar. 10—As the U.S. healthcare system continues to work to recover from a cyberattack at a major clearinghouse for insurance transactions, local hospitals in Jefferson County say the impact to them has been minimal, and New York's junior U.S. Senator is calling for more federal action.

Change Healthcare, a subsidiary of UnitedHealth Group, was attacked by a network of hackers in late February, hit with a ransomware virus that locked access to most of its computer systems. The group demanded a $22 million ransom to unlock the computers, which was paid by Change Healthcare last week.

But the rolling impact of the weekslong outage — at a company its owners privately admitted was integral to the financial health of the U.S. healthcare system — has been widespread. Hospitals and pharmacies submit their claims to Change Healthcare, which then works as a clearinghouse to connect those claims with the insurance companies meant to pay the claims. The company also processes prior authorization requests and other information exchanges required for medical care and payment.

With Change's computers down, claims couldn't be communicated to the insurance companies, and payments could not be sent back. Providers across the country have warned that an extended outage could lead to major operating deficits and potentially disruptions to medical services from providers who rely on Change Healthcare exclusively.

Earlier this week, the Centers for Medicare and Medicaid Services in the U.S. Department of Health and Human Services announced it would be providing interest-free bridge loans to impacted hospitals, and offering assistance for healthcare providers to switch away from Change Healthcare if it is their main processor.

According to Change Healthcare documents available on its website, New York-based insurance companies working with Change include Aetna Better Health of New York and New York Empire Blue Cross Blue Shield.

In Jefferson County, it appears the impact was minimal. Leslie M. Distefano, spokesperson for Samaritan Medical Center in Watertown, said in a statement Tuesday that the hospital did not maintain a direct partnership with Change Healthcare, but does use the company as a third-party clearinghouse for medical billing.

"When the service disruption first occurred due to the unfortunate cyberattack, there was a significant workflow impact on our team and the various vendors who also work with Change Healthcare," she said. "We quickly put many alternative billing solutions in place to minimize any impact on Samaritan Medical Center. There has been minimal disruption to direct patient care, and once again our amazing team of caregivers have risen to the challenges often presented in healthcare."

She said the hospital is anticipating a delay in payments, but said the impact is manageable with the hospital's current financial position.

"We do not anticipate having to need any government support to help offset the delay in financial payments," Distefano said.

Mia Ramseier, spokesperson for River Hospital in Alexandria Bay, said in a brief statement Friday that the hospital had been minimally impacted.

"We are currently working through all of our options; however, the hospital remains stable and our internal systems have not been affected by the Change Healthcare ransomware attack," she said.

Spokespeople for Carthage Area Hospital, Claxton-Hepburn Medical Center in Ogdensburg, and the University of Vermont Medical Center, which owns the Alice Hyde Medical Center in Malone, did not return requests for comment by deadline Friday.

Friday morning, U.S. Sen. Kirsten E. Gillibrand, D-N.Y., called on the Department of Health and Human Services and the Cybersecurity and Infrastructure Security Agency to collaborate and develop a plan to help healthcare providers navigate the service disruption, and prevent further cyberattacks.

"Key federal agencies — the Department of Health and Human Services and the Cybersecurity and Infrastructure Security Agency — are working hard to address this problem, but the American people and the health care sector need more support and information," Gillibrand said in a statement. "That is why I'm calling on these agencies to share their plan to address this crisis and provide hospitals in need with technical assistance to securely resume operations. I'm also asking HHS and CISA to explain what they are doing to proactively help the health care sector defend against cyber threats."

Gillibrand was joined in a letter to the leaders of the two agencies by 10 other Democratic senators, as well as 11 House Democrats.