.png)
Death by cyber-attack? Yes, it's possible. And with the steady increase of cyber-attacks against the healthcare community, including the recent operational collapse of Change Healthcare following a ransomware event, a fatality (at least in part) caused by a cyber-attack is likely imminent.
On February 21, 2024, the financial platform used by thousands of hospitals and providers across the country suffered a significant cyber-attack by Russian-based group, ALPHV a/k/a BlackCat. The platform, referred to as Change Healthcare, part of United Healthcare, processes insurance information and reimbursements for patients and providers across the United States, as well as timely approves patients for needed pharmaceuticals and procedures.
Before the attack, Change Healthcare boasted the processing of more the 14 billion medical claims and reimbursement payments per year, creating an average of more than 1.6 billion claims per month. Currently, those estimated 1.16 billion claims are in limbo, causing the U.S. Government, patients, and providers to panic as they are unable to fund daily operations or provide the necessary medical care to patients given the inability to verify insurance.
The matter is so grave that the American Hospital Association wrote a public letter to the U.S. Department of Health and Human Services on February 26, 2024, exclaiming:
“… our members are reporting that a substantial portion of their claims still cannot be processed, nor can they complete eligibility checks necessary to determine whether a patient’s insurance covers a prospective treatment.
Change Healthcare’s downed systems also will have an immediate adverse impact on hospitals’ finances … Their interrupted technology controls providers’ ability to process claims for payment, patient billing and patient cost estimation services. … without this critical revenue source, hospitals and health systems may be unable to pay salaries for clinicians and other members of the care team, acquire necessary medicines and supplies, and pay for mission critical contract work in areas such as physical security, dietary and environmental services.”
On February 28, 2024, the Medical Group Management Association penned a similar letter to DHHS, detailing similar impacts from the cyber-attack, which included patients paying out of pocket for medications or go without. The Biden Administration and DHHS responded to the industry’s cries for help by attempting to relax impediments to Medicare and Medicaid reimbursement, while also urging Change’s parent, United Healthcare to issue interim reimbursement payments.
Reports are slowing emerging that Change Healthcare paid ALPHV’s $22 million ransom demand, as evidence by visible bitcoin transactions. However, Change does not anticipate restoring all services until approximately March 18, 2024. Until restored, patients and providers should expect further billing issues, with Patients being referred to pharmacies that did/do not use Change Healthcare to process insurance claims for prescriptions.
Unfortunately, delays in prescriptions and procedure approvals are not mere inconveniences. In October 2023, researchers studied the mortality rates associated with hospitals impacted by cyber-attacks. To no surprise, mortality rates rise in hospitals battling cyber-attacks.
The University of Minnesota based authors of “Hacked to Pieces? The Effects of Ransomware Attacks on Hospitals and Patients,” found that in the initial week of a ransomware attack, hospital volume falls by 17-25 percent, Medicare revenue declines 19-41 percent, and that “[r]ansomware attacks increase the in-hospital mortality rate for patients already admitted to the ransomware-attacked hospitals on the date of the attack discovery.”
In 2020, Germany experienced its first cyber-attack death after an ambulance carrying a gravely ill patient was diverted from one emergency room (which was suffering a cyber-attack) to another, much further away and the patient died in transit. The U.S. may see similar incidents linked to the recent cyber-attack on Change Healthcare. Although the German authorities investigated the 2020 cyber-attack death as a “negligent homicide,” no charges were ultimately brought.
However, in the U.S., the concern is less about criminal charges in the event, but more about civil liability if a patient loses his/her/their life due to operational issues stemming from a cyber-attack.