AHA Claims Almost All of US Hospitals Suffered Financial Hit from Change’s Cyberattack

The survey indicates that 94% of American hospitals experienced disruptions in cash flow, and over half of them reported substantial financial damage as a result of Change’s failure to handle claims.

The cyberattack that shocked the global healthcare ecosystem last month, has impacted more than what was reported before. A recent survey conducted by American Hospital Association (AHA) revealed that the cyberattack had impacted most of the US hospitals, financially.

The survey indicates that 94% of American hospitals experienced disruptions in cash flow, and over half of them reported substantial financial damage as a result of Change’s failure to handle claims.

The association, which represents almost 5,000 hospitals and healthcare systems in the US, sent a letter ahead of its Congressional hearings on cybersecurity vulnerabilities in the healthcare sector.

"While this event had disparate impacts on providers, all communities felt the effects in some way," the AHA wrote in a letter to the US Senate Finance and House Energy and Commerce committees.

The AHA highlighted that, despite receiving financial support from the healthcare behemoth, some providers were compelled to resort to high-interest loans.

"UnitedHealth Group and other insurers have held on to premium dollars, collecting as-yet unknown amounts of interest on what they have not paid out to providers," the AHA wrote to Congress.

Important Survey Findings

The survey collected responses from nearly 1,000 hospitals between March 9 to March 12, 2024. Here are some key findings from the survey:

74% of hospitals reported a direct impact on patient care.

Nearly 40% reported patients having difficulty accessing care due to delays in health plan utilization requirements (e.g., prior authorization).

A staggering 94% of hospitals reported a financial impact, with more than half reporting a “significant or serious” impact.

82% of hospitals reported impacts on their cash flow. Of these:

More than 33% reported an impact on more than half of their revenue.

Nearly 60% reported that the impacts on revenue were $1 million per day or greater.

44% expected the negative impact on revenue to continue for 2-4 more months.

More than 20% were currently uncertain of the magnitude of the impacts.

Developments from the Congressional Hearing

When questioned by the Senators, UnitedHealth CEO Andrew Witty said that UnitedHealth's problems are not a threat to the broader economy.

On the Congressional hearing, Senators grilled Witty during the first of two scheduled testimonies in front of Congressional panels.

Subsequently, Witty apologized to patients and doctors, admitting that hackers broke into the subsidiary through a poorly protected computer server. He also confirmed authorization of a $22 million ransom payment to the hackers.

UnitedHealth has blamed its hack on the well-known criminal organization known as ALPHV, or BlackCat, which the Justice Department says has been responsible for ransomware attacks on victims around the world.

Talking about the ransom, UnitedHealth said it did so “as part of the company’s commitment to do all it could to protect patient data from disclosure.”

But lawmakers on Wednesday said they would keep pressurizing the company to get to the bottom of what personal health information was accessed.

Moreover, the FBI discourages victims from paying a ransom because it can fuel more ransomware attacks.

“Americans are still in the dark about how much of their sensitive information was stolen,” Sen Ron Wyden, an Oregon democrat and chairperson, finance committee, noted.

The hearings follow a security probe by the US government into Change Healthcare, which operates the country's largest payment management system for healthcare providers.

In February, USA’s healthtech giant, Change Healthcare experienced a major cyberattack by hackers. This attack led to the disruption of the healthcare giant’s services.

Due to this, recently, leading health insurance and healthcare services provider disclosed that the cyberattack, potentially compromised the personal information of a significant number of individuals across America.

During the hearing, Senators emphasized the seriousness of the situation and how inadequate security protocols can have nationwide implications.

UnitedHealth, with a market value of $445 billion and an annual revenue of $372 billion, is one of the largest corporations in the United States. As stated by the Senators in the hearing, it ranks as the 11th largest company globally.