The Change HealthCare hack
This post uses material that a Facebook friend posted. I re-post it here with her permission.
Any provider that uses a Billing Software (that has Change HealthCare integrated in their system as the main clearinghouse) can’t get claims to insurance companies once they medically bill for something/services in their software. Change Healthcare is the ‘bridge’. The claim goes from the provider, over the bridge, to the insurance company. Then once the claim and payment process, it comes back over the bridge and dumps into the software.
The bridge has been blown up.
Aside from not being able to get stuff over, there is a lot of money and explanation of payment/benefits that aren’t coming into the Billing Software from previous cut-off/adjudication cycles.. Without the bridge, providers are scrambling to make their own bridges, called “Work Arounds”. Depending on what branch of healthcare, these generally are extremely time consuming and there isn’t enough meticulous manpower to keep up with everything. Meantime money is being pumped out for cost of overhead, without money coming in to meet profit margins. This can ultimately lead to the Provider closing its doors. That means hospitals aren’t getting paid for office visits, labs, radiological services, surgeries, literally everything they are capable of doing. Physical Therapist aren’t getting paid for Therapy. Optometrist can’t get paid for eye visits or glasses/lenses. DME can’t get paid for oxygen/wound care/beds/Wheelchairs/Power Wheelchairs. The list goes on and on.”
In addition to this, Change Healthcare spent years acquiring and consolidating smaller clearinghouses and other administrative entities, such as RelayHealth, meaning that this one company now has its tentacles in a staggering amount of transactions throughout the healthcare industry. Change itself is now owned by Optum/United Health Group, which has in turn been consolidating even more aggressively through essentially simultaneous vertical and horizontal integration.
There are other clearinghouse vendors that perform the same functions, but many provider-facing software systems lock themselves into integration partnerships with a single clearinghouse, leaving very few options when that single bridge gets blown up. And even if the provider uses a different clearinghouse, as stated above, Change may be involved somewhere else down the chain that the provider is not even aware of.
The automated functions that the clearinghouse performs have replaced a lot of transaction-based human labor in the industry over the last 15-20 years, so when the automations break….there is no redundancy or surge capacity on either side of the bridge to make up for it. Many current employees don’t even know how to do some of these tasks manually, and certainly not with any sort of efficiency/scale.
As we learned with many things during COVID (ex. supply chain), maximizing for profit and efficiency makes for very fragile systems. I would hope that we will learn from this as a society and crack down on this kind of monopolization for critical infrastructure, but I fear that we won’t learn a damn thing. It’s tough to watch.”
Too big to fail.. should be too big to exist.. the Government failed us..
Any provider that uses a Billing Software (that has Change HealthCare integrated in their system as the main clearinghouse) can’t get claims to insurance companies once they medically bill for something/services in their software. Change Healthcare is the ‘bridge’. The claim goes from the provider, over the bridge, to the insurance company. Then once the claim and payment process, it comes back over the bridge and dumps into the software.
The bridge has been blown up.
Aside from not being able to get stuff over, there is a lot of money and explanation of payment/benefits that aren’t coming into the Billing Software from previous cut-off/adjudication cycles.. Without the bridge, providers are scrambling to make their own bridges, called “Work Arounds”. Depending on what branch of healthcare, these generally are extremely time consuming and there isn’t enough meticulous manpower to keep up with everything. Meantime money is being pumped out for cost of overhead, without money coming in to meet profit margins. This can ultimately lead to the Provider closing its doors. That means hospitals aren’t getting paid for office visits, labs, radiological services, surgeries, literally everything they are capable of doing. Physical Therapist aren’t getting paid for Therapy. Optometrist can’t get paid for eye visits or glasses/lenses. DME can’t get paid for oxygen/wound care/beds/Wheelchairs/Power Wheelchairs. The list goes on and on.”
In addition to this, Change Healthcare spent years acquiring and consolidating smaller clearinghouses and other administrative entities, such as RelayHealth, meaning that this one company now has its tentacles in a staggering amount of transactions throughout the healthcare industry. Change itself is now owned by Optum/United Health Group, which has in turn been consolidating even more aggressively through essentially simultaneous vertical and horizontal integration.
There are other clearinghouse vendors that perform the same functions, but many provider-facing software systems lock themselves into integration partnerships with a single clearinghouse, leaving very few options when that single bridge gets blown up. And even if the provider uses a different clearinghouse, as stated above, Change may be involved somewhere else down the chain that the provider is not even aware of.
The automated functions that the clearinghouse performs have replaced a lot of transaction-based human labor in the industry over the last 15-20 years, so when the automations break….there is no redundancy or surge capacity on either side of the bridge to make up for it. Many current employees don’t even know how to do some of these tasks manually, and certainly not with any sort of efficiency/scale.
As we learned with many things during COVID (ex. supply chain), maximizing for profit and efficiency makes for very fragile systems. I would hope that we will learn from this as a society and crack down on this kind of monopolization for critical infrastructure, but I fear that we won’t learn a damn thing. It’s tough to watch.”
Too big to fail.. should be too big to exist.. the Government failed us..
Joel:
Mid February, I wrote about this: Computerized Systems can be compromised by Cyberattacks, as occurring at Lurie Hospital.
Lurie hospital in all of their trust in a computer system appears to lack an in-place fail-safe system. Hence they are being held captive until they pay up or the “perp” is caught. In the business industry, “fail-safe” is a term referring to a system that can automatically reroute in case of failure. A fail-safe system is one that will continue functioning even if one or more parts of the system fail.
So what is the fail-safe system to back up a criminally invaded computer system?
Early-on in manufacturing, companies used Kardex files. Each component had a part number, description, an inventory location, supplier, etc. This covered hundreds of parts and it was dependent upon people to keep the system accurate by logging inventory transactions. It was tedious work for a couple of people. Computerization replaced it and was far more efficient as long as people used the system and did not “steal” inventory from a location and not record it. The other issue was power outages. This could be handled with a weekly run of inventory by location.
At U of M. Things were computerized too. I would barely get out the door and a bill would arrive on my computer. However, my primary care, heart, etc. doctor had my records on file on a 8.5 x 11 manila card. I had my own records also and brought them with me to AZ.
The fail safe to this is similar to what I did, maintain your own healthcare records too. My health is kind of complicated so have them, makes sense for me. For others it may not matter. However, it appears the profit motive may have played a part with the United Healthcare system. Somebody is liable in addition to the hacker.
“Somebody is liable beside the hacker.”
Perhaps *in addition to* the hacker. Don’t let the hacker off the hook.
Joel:
A good expansion of hacking Medical Records.