24-03 - Change Healthcare Cyberattack, March 18, 2024

DEPARTMENT OF COMMERCE AND INSURANCE P.O. Box 690, Jefferson City, Mo. 65102-0690

INSURANCE BULLETIN 24-03 Change Healthcare Cyberattack – February 21, 2024

Issued: March 18, 2024

The following Bulletin is issued by the Missouri Department of Commerce and Insurance (“Department”) to inform and educate the reader on the specified issue. It does not have the force and effect of law, is not an evaluation of any specific facts or circumstances, shall not be considered a statement of general applicability and is not binding on the Department. See § 374.015, RSMo (2016).

To: Health carriers writing health insurance or health benefit plan coverage in Missouri and other interested parties

From: Director Chlora Lindley-Myers

Re: Change Healthcare Cyberattack – February 21, 2024

The purpose of this bulletin is to provide information to health carriers (“insurers”) and other interested parties regarding the Change Healthcare cyberattack that occurred on February 21, 2024, and whose impact remains ongoing. The Missouri Department of Commerce and Insurance (“Department”) appreciates the efforts insurers have already taken to address this situation and is committed to working with all insurers for the benefit of Missourians.

The Department understands that the Change Healthcare cyberattack has created significant operational challenges for insurers and healthcare providers including hospitals, individual 1 practitioners, practice groups, outpatient facilities, diagnostic centers, laboratories, and pharmacies (“providers”) in Missouri.

Change Healthcare is owned by Optum, a subsidiary of United Healthcare Group. Change Healthcare performs a variety of business solutions for insurance companies and providers including facilitating the electronic transfer of medical documentation and insurance claims as a clearinghouse. The company is working diligently to address the cyberattack including establishing workarounds and providing new software to its customers. However, operational challenges continue for some providers and insurers. The most up-to-date information on Change Healthcare’s efforts to address the cyberattack can be found at: https://www.unitedhealthgroup.com/ns/changehealthcare.html.

Consumers Insurers are strongly encouraged to make the necessary accommodations to minimize the impact on enrollees and their ability to access care. This may include updates to websites and the development of public-facing materials that communicate how consumers can obtain assistance accessing their benefits affected by the incident. Such information may include, but not be limited to:

• Information about how enrollees can confirm their eligibility for coverage, including requesting duplicate insurance cards if needed; • Information about how enrollees can submit for reimbursement any covered services for which the enrollee pays out of pocket; and • Information about how enrollees can contact the insurer with concerns or issues related to the cyberattack and resulting system outages.

Providers Due to the variety of contracts Change Healthcare has with insurers and providers, the Department recognizes the need for a variety of responses to the cyberattack and resulting system outages. To the extent an insurer has not yet implemented assistance for providers, we strongly encourage each insurer operating in Missouri to make every effort to provide prompt assistance to providers as they navigate the situation over the coming weeks. This assistance should take into consideration the importance of providers being able to treat patients and to be reimbursed for health care services provided with as little interruption as possible, given the circumstances.

While each insurer may tailor its guidance, the Department strongly encourages insurers to consider the following actions:

• Updating its website and other public-facing materials that communicate how providers can contact the insurer for assistance to resolve operational or financial concerns so that providers can deliver the health care services the insurer has promised to cover for its policyholders in a timely manner. This will likely include a point of contact or a monitored account for questions or concerns and information on how providers may access any alternative clearinghouses or insurer-specific workarounds to seek reimbursement and submit prior authorizations, claims, and appeals.

2 • Providing flexibility concerning operational processes, including eligibility verification, prior authorization for services, claims submissions, and appeal processes if impacted by the Change Healthcare outage. Flexibility offered should include consideration of relaxing prior authorization, timely claims submission requirements, and other operational requirements in situations where the insurer and provider cannot electronically share information or would need to use workarounds in the absence of a Change Healthcare system.

• Recognizing that insurers continue to receive premium payments, providing opportunities for network providers to obtain financial advances from the insurer during periods where billing and reimbursement processes are unavailable or delayed because of a Change Healthcare outage.

Affected providers with payment distribution interruptions, may be eligible for financial assistance from Optum. Information about the Change Healthcare’s Temporary Funding Assistance Program is available at https://www.optum.com/en/business/providers/health- systems/payments-lending-solutions/optum-pay/temporary-funding-assistance.html.

The Department continues to work with state regulators across the country as well as the National Association of Insurance Commissioners to assess broader impacts related to this event. Further guidance and requests may be forthcoming as the Department continues to assess consumer and provider impacts.

INSURERS who have additional questions about the contents of this bulletin may contact the Department’s Market Conduct Section at marketconduct@insurance.mo.gov or 573-751-2430.

CONSUMERS and PROVIDERS experiencing concerns related to the Change Healthcare cyberattack should first attempt to resolve those issues with their insurer or health care provider directly. If a resolution cannot be reached, please contact the Department’s Consumer Affairs Division at consumeraffairs@insurance.mo.gov or 800-726-7390.

###

3