Georgia hospitals find some workarounds after billing systems cyberattack

According to the American Hospital Association, some patients have struggled to get access to care and billions in payments to providers have been halted, threatening the financial viability of hospitals, health systems, physician offices and other providers.

The association and its members have pleaded with the federal government for help, with some saying they are nearing the bottom of their cash reserves and could soon be unable to maintain staffing and services.

But Anna Adams, a spokeswoman for the Georgia Hospital Association said the impact of the hack varies significantly among providers. Larger hospital systems with significant cash reserves are better positioned to weather the problems than smaller or rural hospitals, which operate with slimmer margins.

Adams said the hack has already resulted in $10 million in lost cash flow at a major hospital system in Georgia and even more than that at another one and at least one smaller hospital has lost $1 million in cash flow. She declined to name the hospitals without their permission.

In Georgia, Emory Healthcare and Northside Hospital report they have set up alternative pathways to file claims and verify insurance with insurance companies.

A spokesperson for Northside Hospital said they quickly disconnected from Change Healthcare functions after the hack and have implemented alternate programs “for the time being.” For now, the billing and payment processes are “working well and not disrupted.”

Credit: courtesy

Credit: courtesy

Emory Healthcare CEO Dr. Joon Lee called the situation a crisis for the U.S health care system and acknowledged the hack is having a “profound” impact on work to verify insurance and process claims.

In an interview with The Atlanta Journal-Constitution, Lee said “it’s fair to say organizations of our size will easily have millions of dollars of cash flow that are delayed or interrupted.” While Emory Healthcare has not shared the dollar value in lost cash flow from the hacking, Lee said Emory is expected to have a net revenue of $6.2 billion for the 2024 fiscal year based on activity during the first six months of the fiscal year that started in September of last year.

Lee said Emory has already developed many workarounds and is creating new systems going forward.

One thing he stressed has not changed: patient care.

“Some of the patients unfortunately have been inconvenienced in terms of scheduling and insurance verification, which is taking somewhat longer, but we have done everything we can to minimize any type of impact in terms of scheduling or actual delivery of care and so far we’re fortunate that we haven’t seen any impact in terms of actual care delivery,” he said.

A Piedmont Hospital spokesperson said contingency plans have minimized the impact to their operations.

At Northeast Georgia Medical Center, a spokesperson said the hack has hampered their ability to process some claims and as of Wednesday the hospital was experiencing about $2 million “and growing” in unbilled medical claims. Layne Saliba, a spokesman for the hospital system said they are working with vendors on a workaround and “we’re optimistic we’ll have something in place soon.”

Hospital systems not reliant on Change Healthcare appear unscathed by the massive ransomware attack on the giant technology company.

Phoebe Putney Hospital System in Albany switched vendors in order to to file claims years ago. A spokesman said only about 2% to 3% of claims have been affected and administrators have figured out a workaround to bill those claims.

Meanwhile, Change Healthcare also set up a new electronic prescription service for drugstores, hospitals and nursing homes, pharmacies, and other providers impacted by the ransomware attack.

Dawn Randolph, chief executive officer of the Georgia Pharmacy Association said the new temporary version of its “Rx ePrescribing service” was launched on Friday and pharmacies across Georgia are now using this temporary system. She said some pharmacists will have “an accounting nightmare” to work through their backlogs, but pharmacy claims are flowing at near-normal levels.

Pharmacists have continued to make sure patients had access to their medications, relying on workarounds or the assumption they would be reimbursed by insurance companies, Randolph said.

Change Healthcare announced Thursday that ransomware group ALPHV, or Blackcat, had claimed responsibility for the attack. According to a report by the tech blog Wired, hackers behind the cyberattack received a $22 million payment that is believed to be a ransom paid by Change Healthcare. But despite the payment, the system was still not back online Thursday.

The outage is reported to be widespread nationally. According to the Washington Post, the Justice Department in a 2022 lawsuit cited United as stating that 50% of U.S. medical claims go through Change’s “electronic data interchange clearinghouse.”

Adams said the Georgia Hospital Association is encouraging insurance companies to waive or extend timely claim filing requirements as well as urging them to make interim payments to hospitals that can show a hardship due to their reduced cash flow.

Emory’s Lee said he doesn’t expect an immediate fix.

“I think it’s fair to say none of us believe it will go back the way it was two weeks ago any time soon. And from our standpoint, we’re already planning on markedly different workarounds, some of which will be permanent,” he said.

Note: A correction was made to an earlier version of this story about the $6.2 billion in net revenue for Emory Healthcare. This is the expected net revenue for the 2024 fiscal year that began in September 2023, based on the activity of the first six months of the fiscal year.