Skip to content

Why are medical providers still struggling to get paid seven months after the Change Healthcare’s cyberattack?

Close-up of a person's hands typing on a keyboard in a dimly lit room.
Medical providers are still waiting to get paid after a cyberattack on Change Healthcare in February. Getty Images

Medical providers are still waiting on tens of thousands of dollars in claims payments nearly seven months after hackers infiltrated one of the country’s largest medical payment processing providers.

That provider is Change Healthcare, which in February shared that it had been subjected to a cyberattack.

New reporting from The Wall Street Journal highlights how some health care providers are still picking up the pieces, with many owed payments for claims issued as far back as the month of the attack.  

Kevin Fu, a Northeastern College of Engineering professor, isn’t surprised that the fallout continues, and highlighted the need for more government scrutiny.  

Headshot of Kevin Fu.
Northeastern professor Kevin Fu says companies need to do a much better job in building resilience to cyberattacks. Photo by Matthew Modoono/Northeastern University

“These are the kinds of stories the public is going to hear again and again until the industry begins to think about how we remain resilient to cybersecurity threats, rather than just ‘You know, trust us. We’re reliable.’”  

Northeastern Global News talked to Fu about the situation. 

This interview has been edited and condensed for clarity.

Why are medical providers still feeling the impact of an attack that happened almost seven months ago? 

We don’t know. Change Healthcare has been fairly quiet on the details. They used to update the website on a daily basis, and they stopped doing that. But my guess is that they probably had a system that depended on some insecure method of communication, and they likely turned that off as a remediation, and now they are scrambling to find a new way to do it. … It’s the sort of dirty business of plumbing for health care. It’s sort of out of sight and out of mind. Sometimes, your septic overflows, and that is pretty much what is happening here.

In the wake of the attack, providers sent in claims through the mail and used specific insurance website portals, but that proved to be insufficient in helping them keep track of claims, according to the Wall Street Journal. Why aren’t alternative methods to process claims as good or not better than ChangeHealthcare’s systems? 

Well I suspect there are a couple of things at play. There are light touch regulatory elements. What are the market factors here? There aren’t any because Change Healthcare is so big. They’re effectively a monopoly. There is not much choice, and part of that is because the federal government approved mergers and acquisitions. Change Healthcare is a large amalgam of what used to be smaller companies. So, these physicians groups don’t have a lot of choice because the government approved all these ‘too big to fail’ companies. Once they exist, the government doesn’t have a lot they can do once a company exists in that manner.

Change Healthcare began processing claims again months ago, but there is a backlog. Do you believe this will continue to be a problem for the foreseeable future or could there be a light at the end of the tunnel? 

I would love for there to be a light at the end of the tunnel, and I think it’s just really disappointing to see that there’s no way for a physician group or even a patient to know how much things are getting better. We are all at the whim of these untrustworthy companies just telling us to trust them. 

How does this situation hurt patients? 

Imagine having a roommate and they say, ‘Don’t worry, we’re going to pay you the rent,’ and then they never do for a year. You can imagine that will put a lot of pressure on those individuals. In this case, doctors have to make choices in terms of spending. I’m sure the physicians are trying as hard as possible to shield the patients from these disruptions, but at the end of day, there are fewer resources to do the same amount of work. And so, what cuts are they going to make? Are they going to be cutting care?