The name Change Healthcare does not appear on anyone’s health insurance, explanation of benefits or doctors’ bills. Yet the company is vital to the business of healthcare — and a cyberattack against the company a month ago has sent the industry in search of cash.
Healthcare providers across the country, including the largest hospitals in South Florida, have been impacted by what appears to be a massive cybersecurity break-in at one of the industry's biggest and least publicly-known companies.
"We could be easily talking over $1 billion in payments for healthcare services that have not been made by these insurance companies," said Florida Hospital Association CEO Mary Mayhew. Her estimate is only for the state of Florida.
Change Healthcare is a company that matches health insurance coverage with medical claims, allowing providers to get paid.
On Feb. 21, sophisticated and organized computer hackers stole what they claimed was eight terabytes of data from Change Healthcare. One terabyte can store about 85 million documents.
As part of the ransomeware attack, the hackers blocked access to the company's payment processing system. Hospitals, healthcare providers and pharmacies using the software were initially impacted.
Change Healthcare's payment processing system is operating again though it has not yet fully returned. The federal government is investigating if any private health information was violated.
READ MORE: Change Healthcare's cyberattack casts a light into how cybercriminal groups work
At Jackson, the Miami-Dade taxpayer-backed hospital, the worst-case scenario is $30 million a month in missing revenue.
"That is very significant," said Jackson's Chief Revenue Officer Myriam Torres.
Jackson normally collects $125-$130 million each month in patient revenue. Missing $30 million for a month would mean 20% to 25% of the organization's usual revenue isn't collected.
"Obviously, that's very difficult for us," said Torres. "Thirty million is a big chunk of change. And again, it's the worst-case scenario."
"Thirty million is a big chunk of change."Jackson Health System Chief Revenue Officer Myriam Torres
It has been difficult to estimate the widespread missing revenue for the healthcare industry. One firm, First Health Advisory, pegged the lost revenue at $100 million a day. Operators across South Florida have not been spared.
Baptist Health South Florida sent WLRN a statement saying it is "revisiting our cash forecasts" and that it was "making decisions to be able to cover shortfalls." However, Baptist did not say how much revenue it was missing due to the cyberattack at Change Healthcare.
Broward Memorial Healthcare runs a half dozen hospitals and other facilities. It did not respond to a request for comment.
Here’s how it hospitals and healthcare providers usually get paid by a health insurer. A patient with health insurance goes to the doctor or hospital. The doctor or hospital bills the health insurer. Half of those claims nationwide are sent to Change Healthcare to match up insurance coverage with the healthcare service. Without Change Healthcare able to process the claims, healthcare providers have not gotten paid.
Change Healthcare is owned by United Healthcare, which is the largest insurance payer at Jackson.
Insurance denials and Medicaid applications also affected
Jackson also uses Change Healthcare to manage half of the insurance denials its patients receive. Those are usually appealed in hopes of collecting some revenue. Plus, Change Healthcare screens Jackson’s Medicaid applications.
"We treat (an) overwhelming percentage of uninsured patients. It's very important to qualify these patients," Torres said.
Often, these patients apply for Medicaid and Change Healthcare works to make sure patients qualify.
Torres has been responsible for managing revenue at Jackson for almost a decade.
"It feels like this is only something that the finance world is aware of. Not even everyone in the healthcare world is aware that this is happening," she said.
Navigating through this cyberattack is more difficult for her than managing through the COVID-19 pandemic.
"For me, this is worse. Back then the anxiety was on the delivery of care. The caregivers. They took the brunt of the issues during the pandemic," she said during an interview over Zoom.
This crisis is not impacting the ability of patients to get health care. And it’s not dominating the headlines each day. Yet, it is a massive disruption in the flow of money.
Mayhew from the Florida Hospital Association calls the hack almost an act of war.
"If this was against the country's electrical grid, we would immediately understand it. If we were talking about aviation control towers, we would immediately understand the magnitude, the implications. That is what this is, the country's largest cyber attack on our healthcare delivery system," she said.
