50 Facts About Change Healthcare

Change Healthcare: A Brief History

Change Healthcare has a fascinating journey from its inception to becoming a key player in the healthcare industry.

1. Company Name and History: Founded in 2007, Change Healthcare initially focused on healthcare consumer engagement and health plan cost transparency tools. Emdeon acquired it in 2014, rebranding it to Change Healthcare in 2015.
2. Headquarters: The company is based in Nashville, Tennessee, with 89 additional locations across the globe, including the U.S., Canada, New Zealand, Israel, Taiwan, the UK, and the Philippines.
3. Revenue Cycle Management: Change Healthcare specializes in revenue cycle management solutions, connecting payers, providers, and patients by managing financial and administrative information exchanges.
4. Services Offered: They provide a variety of services such as claims clearinghouse, electronic health records (EHRs), and patient engagement platforms.
5. Acquisition by Emdeon: In 2014, Emdeon acquired Change Healthcare for $135 million, leading to the rebranding in 2015.

Leadership and Funding

Leadership and financial backing have played significant roles in shaping Change Healthcare's path.

6. Leadership: Notable leaders include Howard McLure, chairman and CEO from 2011 to 2012, and Doug Ghertner, who became president and CEO in 2012.
7. Funding Rounds: The company secured significant funding, including a $15 million Series D funding round in 2013 led by HLM Venture Partners.
8. Awards and Recognition: Recognized as one of Modern Healthcare’s “100 Best Places to Work in Healthcare” in 2013, highlighting its positive work environment.

Cybersecurity Challenges

Change Healthcare faced a major cybersecurity challenge that impacted its operations and the broader healthcare system.

9. Cybersecurity Challenges: In February 2024, a cyberattack crippled its financial operations, affecting hospitals, insurers, pharmacies, and medical groups nationwide.
10. Ransomware Attack: The ransomware group ALPHV/BlackCat claimed responsibility, stealing 6 terabytes of data, including medical records and patient Social Security numbers.
11. Impact on Healthcare Providers: The attack caused a backlog of unpaid claims, leading to serious cash flow problems for healthcare providers and threatening patients’ access to care.
12. Government Response: The U.S. Department of Health and Human Services (HHS) announced financial flexibilities for hospitals impacted by the attack, though the American Hospital Association (AHA) criticized these measures as inadequate.

UnitedHealth Group’s Response

UnitedHealth Group, Change Healthcare's parent company, took several steps to mitigate the impact of the cyberattack.

13. UnitedHealth Group’s Response: UnitedHealth advanced over $2 billion to providers and launched software for medical claims preparation, restoring 99% of pharmacy network services.
14. Optum’s Temporary Funding Assistance Program: On March 1, 2024, Optum introduced a temporary funding assistance program to help bridge short-term cash flow needs for affected providers.
15. AHA’s Criticism: The AHA criticized the program's onerous terms and conditions, including Optum’s ability to recoup funds immediately and without prior notification.

Congressional and Regulatory Actions

The cyberattack prompted significant government and regulatory responses.

16. Congressional Involvement: Nearly 100 federal lawmakers urged HHS to ensure payments to hospitals, physicians, and Medicare Advantage plans, as well as state Medicaid programs.
17. Regulatory Updates: Rep. Jamie Raskin expressed concern that UnitedHealth was restricting federal agencies' ability to assist Change Healthcare, requesting a briefing for oversight committee staff.
18. Senate Finance Committee Hearing: The Senate Finance Committee sought a hearing with UnitedHealth CEO Andrew Witty to discuss the cyberattack and its aftermath.

Restoring Operations

Efforts to restore Change Healthcare's operations and address the data breach were extensive.

19. Claims Processing: By March 22, 2024, Change Healthcare began restoring its biggest clearinghouse platforms, processing $14 billion in claims.
20. Data Breach Notification: The AHA urged HHS to clarify whether hospitals should notify patients about compromised protected health information, with state hospital associations advising members on data breach notification laws.
21. Lawsuits Filed: Providers began filing lawsuits against UnitedHealth over the cyberattack, with at least six federal lawsuits filed between March 14 and 20, 2024.
22. Financial Assistance: UnitedHealth advanced more than $6 billion in assistance to healthcare providers affected by the cybersecurity attack as of April 16, 2024.

Cybersecurity Measures and Risks

The cyberattack underscored the importance of robust cybersecurity measures.

23. Cybersecurity Measures: The attack highlighted the need for multifactor authentication (MFA) in securing critical systems. UnitedHealth acknowledged that MFA was not used on the affected server.
24. Data Leak Estimates: It is estimated that a third of Americans had their sensitive health information leaked to the dark web due to the attack.
25. Ongoing Risks: Despite UnitedHealth paying a ransom, there remains a risk of further sensitive information leaks.
26. Communication with Hackers: UnitedHealth CEO Andrew Witty confirmed he did not directly communicate with the hackers during the attack.
27. Ransom Payment Details: The exact ransom amount and payment method were not disclosed by UnitedHealth.

Industry Standards and Impact

The cyberattack revealed critical vulnerabilities and prompted discussions on industry standards.

28. Industry Standards: The lack of MFA on the affected server was identified as a critical failure in adhering to industry standards for cybersecurity.
29. Change Healthcare’s Role: Change Healthcare acts as a clearinghouse for nearly 40% of all medical claims in the U.S., processing 15 billion claims annually.
30. Impact on Healthcare Access: The cyberattack created a backlog of unpaid claims, threatening patients’ access to care, especially for smaller and rural healthcare practices.

Government Briefings and Bipartisan Efforts

The government took steps to address the cyberattack's impact and prevent future incidents.

31. Government Briefings: Energy and Commerce Republicans were briefed by the Administration for Strategic Preparedness and Response, the Centers for Medicare and Medicaid Services, and Change Healthcare.
32. Bipartisan Efforts: Bipartisan Energy and Commerce leaders wrote to UnitedHealth seeking answers about the attack. The Subcommittee on Health convened a hearing to explore cybersecurity vulnerabilities in the healthcare sector.

Oversight and Healthcare Professionals’ Views

Oversight actions and healthcare professionals' perspectives on changes were crucial in addressing the cyberattack's aftermath.

33. Oversight Subcommittee Actions: The Oversight Subcommittee called UnitedHealth CEO Andrew Witty to explain the situation to the American people, discussing the company's response and future prevention plans.
34. Healthcare Professionals’ Views: Professionals emphasized the importance of clear communication and preparation when implementing changes, stressing that changes should be communicated well in advance.
35. Subjective Experience vs. Objective Measures: Understanding healthcare professionals’ views on changes is crucial for assessing the success of organizational changes.
36. Individual Experiences of Change: Experiences of change can vary significantly among healthcare professionals, with some finding changes beneficial and others experiencing stress and disadvantages.
37. Successful Organizational Changes: Successful changes are often those that are clearly communicated and allow for preparation, ensuring everyone is part of the process.

Communication Challenges and Powerlessness

Communication challenges and feelings of powerlessness were significant issues during the cyberattack's aftermath.

38. Communication Challenges: Healthcare professionals highlighted the challenges of receiving too much information too quickly, emphasizing the need for clear and timely communication.
39. Powerlessness and Uninformed Changes: Changes implemented without prior communication or adequate preparation can lead to feelings of powerlessness and being uninformed, resulting in significant consequences.
40. Quick Meetings and Lack of Preparation Time: Professionals often face situations where they must solve problems quickly without adequate preparation time, leading to stress and difficulties in implementing changes effectively.

Early Focus and Shift to B2B Market

Change Healthcare's early focus and shift to the business-to-business market were pivotal in its growth.

41. Healthcare Consumer Engagement Tools: Initially, Change Healthcare focused on providing healthcare consumer engagement and health plan cost transparency tools to health plans and large self-insured employers.
42. Shift to B2B Market: In January 2010, the company shifted its focus to the business-to-business market and launched the Change Healthcare Engagement Platform.

Leadership Changes and Further Funding

Leadership changes and further funding rounds were crucial in Change Healthcare's development.

43. Leadership Changes: In April 2011, Howard McLure, former president of CVS Caremark, came out of retirement to lead Change Healthcare as chairman and CEO. Doug Ghertner joined as president in July 2011.
44. Funding Rounds and Recognition: The company received significant funding rounds, including a $15 million Series D funding round in 2013, and was recognized as one of Modern Healthcare’s “100 Best Places to Work in Healthcare” in 2013.
45. Acquisition by Emdeon: In November 2014, Change Healthcare was acquired by Emdeon for $135 million, leading to the rebranding in 2015.

Temporary Funding Assistance and Financial Flexibilities

Temporary funding assistance and financial flexibilities were introduced to support affected providers.

46. Temporary Funding Assistance Program: On March 1, 2024, UnitedHealth Group’s Optum division launched a temporary funding assistance program to help bridge short-term cash flow needs for providers.
47. Government Financial Flexibilities: The U.S. Department of Health and Human Services announced financial flexibilities for hospitals impacted by the attack, though the AHA criticized these measures as inadequate.
48. UnitedHealth’s Financial Assistance: UnitedHealth advanced over $6 billion in assistance to healthcare providers affected by the cybersecurity attack as of April 16, 2024.

Ongoing Investigations and Improvements

Ongoing investigations and improvements aim to prevent future cybersecurity breaches.

49. Ongoing Investigations and Improvements: The cyberattack led to ongoing investigations into cybersecurity vulnerabilities and improvements in the company’s security measures.
50. Cybersecurity Upgrades: UnitedHealth is working to upgrade its technologies and implement industry-standard practices like multifactor authentication to prevent future breaches.

The Impact and Future of Change Healthcare

Change Healthcare has been a major player in the U.S. healthcare system, connecting payers, providers, and patients through its revenue cycle management solutions. Founded in 2007, the company has grown significantly, offering a range of services like claims clearinghouse and electronic health records. However, the recent cyberattack in February 2024 exposed vulnerabilities, causing a backlog of unpaid claims and affecting healthcare access nationwide. UnitedHealth Group, Change Healthcare's parent company, has taken steps to mitigate the damage, including advancing over $6 billion to affected providers. The attack has sparked government involvement and highlighted the need for robust cybersecurity measures. Moving forward, Change Healthcare must focus on strengthening its security protocols and ensuring clear communication with stakeholders to prevent future disruptions. The company's role in the healthcare system remains crucial, but it must adapt to new challenges to maintain trust and efficiency.