Florida Hospital Association CEO describes 'massive' impact of Change Healthcare cyberattack

Florida hospitals are seeing serious problems from the cyberattack that has hit Change Healthcare.

Mary Mayhew, president and CEO of the Florida Hospital Association, talked with Chief Healthcare Executive® Monday about some of the impact on Florida hospitals and health systems. UnitedHealth Group, Change Healthcare’s parent company, said the attack was discovered Feb. 21, so hospitals and other providers have been dealing with the implications for nearly two weeks.

“I've been working with the hospitals in Florida for quite some time, including when I was a regulator at the beginning of the pandemic,” Mayhew says. “So I know signs of panic and concern. And they are incredibly concerned.”

• Read more: Change Healthcare cyberattack called 'most significant' in healthcare in U.S. history

Some large hospitals and health systems rely heavily on Change Healthcare for billing services, prescriptions, checking insurance eligibility and authorizations, among other services. Hospitals and other providers aren’t getting paid by insurers due to the disruptions in processing claims.

“You're talking hundreds of millions of dollars per week that hospitals are not getting paid,” Mayhew says. “That is going to quickly add up to over a billion dollars.” (See part of our conversation with Mary Mayhew in this video. The story continues below.)

Mayhew says she’s stressing that the fallout doesn’t just include administrative hassles. With payments from insurers being delayed, patient care could be hampered.

“I have to keep emphasizing, if you don't get paid for the care that's been provided, you cannot pay your doctors, your nurses, your staff, to support the operations to continue to provide care,” Mayhew says.

“Hospitals are going to do everything they can to preserve access to care,” she says. “In Florida during hurricanes, they will swiftly move to deal with what it takes to get care provided with or without the authorizations. But obviously, they're concerned about what may happen down the road, when claims for that care are submitted and they get denied.”

Smaller hospitals are getting very concerned, she says.

“You've got small hospitals with razor thin margins,” Mayhew says. “They don't have significant reserves to lean into during a crisis. They're going to get challenged increasingly with cash flow and their ability to meet payroll. That could begin to affect access to care.”

Mayhew says she understands the enormous challenge UnitedHealth Group is facing with the cyberattack. But hospitals would like to get more information from the company about the scope of the attack and projections for the restoration of services, she says.

“We're not getting a lot of meaningful information from United about when they will stand these systems back up,” she says. “And we've had concerns about the extent to which they've been minimizing the complexity of doing what they've referred to as work-arounds. It is not easy to take sophisticated automated claims processing systems and revert back to manual submissions. You don't just flip a switch and change from one claims clearinghouse to another. It's not practical.”

Cyberattack recovery is a complex and arduous process, and hospital leaders understand that reality, but they need more communication from Change Healthcare so they can plan appropriately. “I am talking about an honest evaluation of how long it's going to take,” Mayhew says.

The Florida Hospital Association has been in regular contact with the members of Florida’s congressional delegation to explain the impact of the event. Hospital leaders are pushing Congress and the federal government to take steps to help hospitals, including expedited Medicare payments.

“Nobody wants to cry wolf or scream that the sky is falling, but as it has continued on, it's imperative that we highlight and increase the awareness about the magnitude, the severity, of the impact and seek appropriate response and action,” Mayhew says. “I think, in some ways, we may all broadly be getting a little too desensitized when it comes to cyberattacks and, and data breaches. And this is really exposing the vulnerability.”

While Mayhew is aiming to give voice to the impact on hospitals, she notes the ongoing disruption of payments could threaten the viability of physician practices.

“We already have a problem getting timely access to primary care in the state,’ she says. “There are areas of the state where if you are new to the region, and you need to get a primary care physician, even with health insurance coverage, you are waiting seven to nine months to get in. So we cannot afford to lose more providers.”

• Read more: Hospitals say UnitedHealth Group aid program for cyberattack is 'not even a band-aid'