Change Healthcare Cyberattack Information

On February 21st, Change Healthcare began to experience a cyberattack that has subsequently impacted the payment of claims for patients around the country, including for clinicians treating patients with addiction.

Below are a list of key dates and actions that the Biden Administration has taken in the days and weeks following this cyberattack.

March 5: The US Department of Health and Human Services (HHS) issued a statement that acknowledge the cyberattack and made impacted parties aware of a number of actions HHS was taking to mitigate the attack, including:

• Enhanced flexibilities to change payment clearinghouses;
• Notification of forthcoming guidance to Medicare Advantage (MA) organizations and Part D sponsors encouraging them to remove or relax utilization management controls;
• Encouragement to Medicaid and CHIP managed care plans to adopt the same strategies of removing or relaxing utilization management requirements and provide advance funding for impacted providers; and
• Preparing Medicare Administrative Contractors to accept paper claims.

March 10: HHS Secretary Xavier Becerra penned a letter to health care industry leaders encouraging them to take a number of steps, including:

• Providing interim payments to impacted providers;
• Simplifying electronic data interchange requirements and timelines and by accepting paper claims; and
• Pausing prior authorizations and other utilization management requirements.

March 12: Biden Administration convened leaders of the health care industry to discuss the cyberattack and ways to mitigate harms to patient and providers.

March 13: The Centers for Medicare and Medicaid Services issued a list of frequently asked questions regarding accelerated and advance payments for Part A providers and Part B suppliers.

March 18: CMS reopened the 2023 MIPS Extreme and Uncontrollable Circumstances (EUC) hardship application. The deadline to apply for an exemption is April 15, 2024. If a physician or practice has already submitted data and would like to take advantage of this flexibility, it requires logging into the CMS portal and updating the submission.

March 19: A bipartisan group of US House of Representatives members sent a letter to HHS asking the agency to go further in its response to the cyberattack.

Additional information:

• CMS FAQs on Accelerated and Advance Payments for Impacted Clinicians
• Information from United Health Group on the Change Healthcare Cyber Response
• Physician cybersecurity resources from the American Medical Association

If you have additional questions or concerns, please contact ASAM at advocacy@asam.org.

__________________________________________________________________________________________________________________________________________________________________________