Change Healthcare hack by 'nation-state' disrupts pharmacies, patients
Pharmacist Nidhin Mohan, at the New Island Pharmacy in Deer Park in 2023. Mohan said about 10% to 20% of his customers are affected by the hacking incident. Credit: Kendall Rodriguez
A cyberattack blamed on a “nation-state” is wreaking havoc with prescriptions on Long Island and nationwide, leading to some insurance authorizations not going through and some customers being told to wait for refills until the problem is resolved.
Pharmacies that rely exclusively on Change Healthcare to process insurance claims are reeling, said Heather Ferrarese, board chair of the Pharmacists Society of the State of New York.
“For some pharmacies, it’s been completely devastating to their business the past few days,” said Ferrarese, co-owner of Bartle's Pharmacy in upstate Oxford.
Change, a subsidiary of the giant Minnesota-based UnitedHealth Group, first publicized the problem early Wednesday morning, and since Thursday has been periodically posting messages through fellow UnitedHealth subsidiary Optum that described a “cyber security issue” that “our experts are working to address.”
UnitedHealth said in a filing Thursday with the Securities and Exchange Commission that it “cannot estimate the duration or extent of the disruption at this time.”
Optum, with which Change merged in 2022, declined Friday to comment on a timeline.
It's unclear how many prescriptions are impacted by the outage.
At New Island Pharmacy in Deer Park, about 10% to 20% of customers are affected by the breach, said owner and pharmacist Nidhin Mohan.
Mohan said his pharmacy has two servers that connect insurance companies with his computer system, and with the Change server down, he is using one run by competitor RelayHealth. The problems are with customers whose insurance companies or plans don’t work with Relay, he said.
When he cannot connect with the insurance companies of long-term customers, Mohan asks the customer to wait until the problem is resolved. But for those who can’t wait, he accepts the patient’s copay, which he determines from previous transactions. After Change’s systems are back online, he will seek reimbursement for the rest of the drug cost from insurance companies.
“I'm hoping that once everything is settled, I can run it through and get my money back,” he said.
“If you are using a private pharmacy, if you’re using a small mom-and-pop, this works, but if you’re with a chain, you’re at their mercy,” he said.
Mohan is asking newer customers to wait until the problem is resolved, because he does not know their copay.
Ferrarese said there is some risk to pharmacists, because health plans sometimes change, and pharmacists may not have updated deductible and copay information.
“By doing the right thing, and advancing and caring for their patients, they're taking a huge financial risk by putting their neck on the line,” said Ferrarese.
CVS, Rite Aid and Walgreens issued statements acknowledging the outage's effect on some claims. CVS said that it implemented a plan to “ensure patients continue to have access to their prescriptions,” Rite Aid said it has “successfully processed many of those claims through another billing mechanism,” and Walgreens said it has “procedures in place” to fill prescriptions.
But asked whether customers would have to pay the insurance company’s share of the medication costs — which can run into the hundreds or even thousands of dollars for some drugs — until Change is back online, all three either declined to comment or did not respond.
Military clinics and hospitals are providing outpatient prescriptions manually and “will give priority to urgent prescriptions followed by routine prescriptions,” according to a statement by Tricare, a health care program for nearly 10 million service members, retirees, their families and others.
Some pharmacists use Change to connect with prescribers, and they are not receiving electronic prescriptions, so some are accepting paper scripts, Ferrarese said.
New York law requires electronic prescriptions, but there is an exception for technology-related emergencies, state health department spokeswoman Cadence Acquaviva said in an email.
Change also provides discounts for some medications — including the popular weight-loss drugs Zepbound and Mounjaro, which can be much cheaper with the discounts, Mohan said.
“Everybody who is on that medication who is trying to refill it is having issues with it,” he said.
Those discounts are not available during the outage, so Mohan has covered them for long-term customers.
In its Securities and Exchange Commission filing, UnitedHealth said it had “identified a suspected nation-state associated cyber security threat actor [that] had gained access to some of the Change Healthcare information technology systems. Immediately upon detection of this outside threat, the Company proactively isolated the impacted systems.”
UnitedHealth “has retained leading security experts, is working with law enforcement and notified customers, clients and certain government agencies,” the filing said. “At this time, the Company believes the network interruption is specific to Change Healthcare systems, and all other systems across the Company are operational.”
A cyberattack blamed on a “nation-state” is wreaking havoc with prescriptions on Long Island and nationwide, leading to some insurance authorizations not going through and some customers being told to wait for refills until the problem is resolved.
Pharmacies that rely exclusively on Change Healthcare to process insurance claims are reeling, said Heather Ferrarese, board chair of the Pharmacists Society of the State of New York.
“For some pharmacies, it’s been completely devastating to their business the past few days,” said Ferrarese, co-owner of Bartle's Pharmacy in upstate Oxford.
Change, a subsidiary of the giant Minnesota-based UnitedHealth Group, first publicized the problem early Wednesday morning, and since Thursday has been periodically posting messages through fellow UnitedHealth subsidiary Optum that described a “cyber security issue” that “our experts are working to address.”
WHAT TO KNOW
- A cyberattack is leading to some insurance authorizations for prescriptions not going through and Long Islanders having to wait for refills.
- UnitedHealth Group, whose subsidiary Change Healthcare was the victim of the attack, blamed a “nation-state” and said it is unclear when the problem will be resolved.
- Some independent pharmacies are temporarily covering insurance costs until the outage ends.
UnitedHealth said in a filing Thursday with the Securities and Exchange Commission that it “cannot estimate the duration or extent of the disruption at this time.”
Optum, with which Change merged in 2022, declined Friday to comment on a timeline.
It's unclear how many prescriptions are impacted by the outage.
At New Island Pharmacy in Deer Park, about 10% to 20% of customers are affected by the breach, said owner and pharmacist Nidhin Mohan.
Mohan said his pharmacy has two servers that connect insurance companies with his computer system, and with the Change server down, he is using one run by competitor RelayHealth. The problems are with customers whose insurance companies or plans don’t work with Relay, he said.
When he cannot connect with the insurance companies of long-term customers, Mohan asks the customer to wait until the problem is resolved. But for those who can’t wait, he accepts the patient’s copay, which he determines from previous transactions. After Change’s systems are back online, he will seek reimbursement for the rest of the drug cost from insurance companies.
“I'm hoping that once everything is settled, I can run it through and get my money back,” he said.
“If you are using a private pharmacy, if you’re using a small mom-and-pop, this works, but if you’re with a chain, you’re at their mercy,” he said.
Mohan is asking newer customers to wait until the problem is resolved, because he does not know their copay.
Ferrarese said there is some risk to pharmacists, because health plans sometimes change, and pharmacists may not have updated deductible and copay information.
“By doing the right thing, and advancing and caring for their patients, they're taking a huge financial risk by putting their neck on the line,” said Ferrarese.
CVS, Rite Aid and Walgreens issued statements acknowledging the outage's effect on some claims. CVS said that it implemented a plan to “ensure patients continue to have access to their prescriptions,” Rite Aid said it has “successfully processed many of those claims through another billing mechanism,” and Walgreens said it has “procedures in place” to fill prescriptions.
But asked whether customers would have to pay the insurance company’s share of the medication costs — which can run into the hundreds or even thousands of dollars for some drugs — until Change is back online, all three either declined to comment or did not respond.
Military clinics and hospitals are providing outpatient prescriptions manually and “will give priority to urgent prescriptions followed by routine prescriptions,” according to a statement by Tricare, a health care program for nearly 10 million service members, retirees, their families and others.
Some pharmacists use Change to connect with prescribers, and they are not receiving electronic prescriptions, so some are accepting paper scripts, Ferrarese said.
New York law requires electronic prescriptions, but there is an exception for technology-related emergencies, state health department spokeswoman Cadence Acquaviva said in an email.
Change also provides discounts for some medications — including the popular weight-loss drugs Zepbound and Mounjaro, which can be much cheaper with the discounts, Mohan said.
“Everybody who is on that medication who is trying to refill it is having issues with it,” he said.
Those discounts are not available during the outage, so Mohan has covered them for long-term customers.
In its Securities and Exchange Commission filing, UnitedHealth said it had “identified a suspected nation-state associated cyber security threat actor [that] had gained access to some of the Change Healthcare information technology systems. Immediately upon detection of this outside threat, the Company proactively isolated the impacted systems.”
UnitedHealth “has retained leading security experts, is working with law enforcement and notified customers, clients and certain government agencies,” the filing said. “At this time, the Company believes the network interruption is specific to Change Healthcare systems, and all other systems across the Company are operational.”
David Olson covers health care. He has worked at Newsday since 2015 and previously covered immigration, multicultural issues and religion at The Press-Enterprise in Southern California.
