This audio is automatically generated. Please let us know if you have any comments.
Diving brief:
- CMS overpaid many hospitals as part of a relief package during last year’s Change Healthcare cyberattack, while missing hundreds of hospitals that also faced significant financial disruption, according to a study published last week in Health Affairs.
- The federal government distributed $3.3 billion to Medicare providers in early 2024 as payments were disrupted by the attack on the UnitedHealth-owned processing and payment technology company, according to the study.
- But most hospitals received payments greater than their lost Medicare revenue during the first six weeks of the cyberattack, the study found. Additionally, more than 300 hospitals did not participate in the relief program, even though they experienced similar losses – and were more likely to be small and rural facilities.
Dive overview:
The cyberattack on Change caused major disruption to the healthcare industry, already a major target for cybercriminals. The attack ultimately exposed the data of more than 192 million people – the largest health data breach ever reported to federal regulators.
The attack shook the healthcare industry for weeks in early 2024, upending usual administrative work, such as claims processing, eligibility checks, prior authorization requests and prescription filling.
Many providers have been unable to submit claims and receive reimbursement for their services. Change, which was acquired by healthcare giant UnitedHealth’s Optum unit in 2022, processes billions of transactions each year.
In an effort to alleviate some of the financial pressure that occurred as a result of the cyberattack, CMS established a relief program that allowed Medicare providers to request cash advances.
Providers would receive a one-time payment equal to 30 days of their average Medicare reimbursement, or less upon request. Payments were not adjusted based on the severity of the disruption, and CMS ultimately recovered payments without charging interest.
Overall, hospitals received more than two-thirds of total CMS payments. under the relief program, followed by doctors who received nearly 19% of the payments, according to the Health Affairs study.
However, most hospitals received more funds than necessary to offset their losses. The median hospital had a surplus of $314,302, according to the study. However, about a third saw their income loss exceed their relief payment, while another third received a payment $1 million or more greater than their income loss.
Additionally, some hospitals did not participate in the program, even though they likely faced financial disruption during the cyberattack.
The median hospital in the program received approximately 66% less Medicare revenue during the attack compared to the same period in 2023. In comparison, the median hospital that did not participate had very similar Medicare revenue during the two periods.
However, the study found that 312 hospitals did not receive financial assistance but experienced a revenue loss equal to or greater than the median participating facility. These hospitals were more likely to be smaller, less likely to be owned by a nonprofit or part of a health system, and much more likely to be located in a rural area.
The study suggests that CMS could improve future provider relief programs, the researchers wrote. For example, the agency could reduce payments given that many hospitals were overpaid, but add additional support for providers facing particularly severe disruptions.
“Our results also indicate the importance of provider outreach if CMS continues with a voluntary approach to relief payments,” the researchers wrote. “This approach is attractive because of its ability to target relief payments to providers demonstrating need, but we found strong evidence that many hospitals facing revenue disruptions during the Change Healthcare cyberattack did not receive. [Change Healthcare/Optum Payment Disruption] program relief payments.
