In early March, Marla Vannucci, PhD, a clinical psychologist and owner of a small group practice based in Chicago, frequently awoke in the middle of the night because she was worried about running out of money to pay her staff. The six psychologists in the group had not received payments from insurance companies for 3 weeks because of the debilitating cyberattack on Change Healthcare, the largest clearinghouse for medical claims in the United States.
To preserve money for payroll, Vannucci had started putting monthly expenses such as malpractice insurance, rent, and her Zoom account on a credit card. She was nervous about the high interest rate on her credit card debt, especially because it was unclear how long Change would remain shut down. She temporarily switched to other clearinghouses to submit bills, but the process was onerous and complicated.
By mid-March, Vannucci was relieved to see payments start trickling in from insurance companies, and by early April she was receiving reimbursements for about 70% of the claims submitted. Though the sense of panic subsided, the data breach exposed vulnerabilities in the health care system that needed to be addressed, said Marnie Shanbhag, PhD, senior director of APA’s Office of Independent Practice. “Not only were hospitals and doctors affected, but so was the entire mental health care system,” she said. “Many of us did not realize Change Healthcare was involved in the billing process.”
Many psychologists provide mental health care services in small practices that often lack the cash reserves and administrative staff to endure weeks without pay. “Psychologists worked very hard to minimize the impact on patients, so what happened in reality is that many providers did not take their paychecks in order to keep their practices running,” said Shanbhag.
Psychologists frequently use electronic health record (EHR) systems, such as SimplePractice, Valant, and TherapyNotes, to schedule appointments, document notes, and submit bills, and Change is a “middleman between the provider’s EHR and the health insurance plan,” said Leanna Fortunato, PhD, director of quality and health care innovation in APA’s Office of Health Care Innovation. Change processes billions of claims submissions, provider payments, eligibility confirmations, and prior authorization requests each year. Hackers can use medical records to submit false claims, and unlike a credit card, medical information cannot be quickly canceled or changed.
The Change incident was a ransomware attack (PDF, 2.43MB), a type of malware (malicious software) that attempts to deny access to a user’s data. Ransomware usually encrypts the data with a key known only to the attacker who deployed the malware until a ransom is paid. Seven weeks after the attack, there were also reports that the stolen data may be changing hands to a new ransomware group.
On March 11, APA Services sent a letter to the U.S. Department of Health and Human Services (HHS) emphasizing that Change Healthcare bore the responsibility for its cybersecurity failures, and that small group practices and individual psychologists have little capacity to navigate the disruptions those failures caused. Mental health care providers are motivated to increase public awareness about the risks the current billing system poses to the country’s mental health and to explore new strategies to protect themselves and their patients from data breaches in the future.
“This is a systemic issue,” said Shanbhag. In 2022, UnitedHealth, one of the largest health insurance providers in the country, acquired Change after fending off a U.S. Department of Justice lawsuit that alleged that the deal would harm competition in the insurance market. “We have had national conversations about the risks when banks are too big to fail, and we need to have those conversations about health insurance organizations,” she said.
This article was made by www.apa.org by
Source link
