Insurer Responsibilities in Response to Change Healthcare Cyber Attack

Bulletin B 24-04 TO: ALL INSURERS AUTHORIZED TO TRANSACT HEALTH INSURANCE BUSINESS IN THE STATE OF ALASKA AND OTHER INTERESTED PARTIES RE: INSURER RESPONSIBILITIES IN RESPONSE TO CHANGE HEALTHCARE CYBER ATTACK The Alaska Division of Insurance understands that the cybersecurity attack on Change Healthcare on February 21, 2024, has created significant operational challenges for insurers and health care providers including hospitals, individual practitioners and groups, outpatient facilities, and pharmacies in Alaska. Change Healthcare performs a variety of business solutions for insurance companies including facilitating the electronic transfer of medical documentation and insurance claims as a clearinghouse. Due to the varying contracts that Change Healthcare has with different insurers, the Division recognizes the differing response to the cyber attack and resulting system outage. We direct each health insurer operating in Alaska to provide prompt assistance to consumers and healthcare providers as they navigate the situation over the coming weeks. This assistance should take into consideration the importance of healthcare providers being able to treat and to be reimbursed for provided health care services with as little interruption as possible, given the circumstances. For consumers, we direct that each affected insurer will update its website and develop public-facing materials that communicate how consumers can get help accessing their benefits. This should include: • How consumers can confirm their eligibility for coverage, including the ability to get a duplicate insurance card if needed. • How consumers can submit for reimbursement any claims for which the consumer pays out of pocket. Because consumers may encounter barriers to obtaining prescription drugs from a network pharmacy, the Division directs insurers to waive penalties on pharmaceutical claims when a consumer obtains their prescription from a non-network pharmacy from February 21 to April 21, 2024. This flexibility may be extended if warranted by the Division to ensure continued consumer access and care. We also direct each affected insurer to update its website and develop public-facing materials that communicate how healthcare providers can deliver the healthcare services the insurer has promised to cover for its policyholders. This should include information on how healthcare providers may access an alternative clearinghouse or insurer-specific workarounds to submit claims and seek reimbursement. Department of Commerce, Community, and Economic Development DIVISION OF INSURANCE P.O. Box 110805 Juneau, AK 99811-0805 Main: 907.465.2515 Fax: 907.465.3422 B 24-04 Insurer Responsibilities in Response to Change Healthcare Cyber Attack Page 2 of 2 Insurers should also provide flexibility for timely claims submissions, appeal processes, and prior authorizations if impacted by the Change Healthcare outage. The Division reminds insurers and their vendors of Alaska’s breach of security disclosure requirements under AS 45.48.010 and AS 45.48.090. Alaska law requires that if a breach of an information system occurs, the information collector will disclose the breach to each state resident whose personal information was breached. This disclosure must be made in the most expeditious time possible. Refer to the statutes for additional requirements. Consumers are encouraged to continue personal cybersecurity best practices such as using complex passwords, avoiding suspicious links in emails, or ending a phone call and calling back an unknown medical provider or hospital seeking personal information. Questions regarding this bulletin should be directed to Sarah Bailey via email sarah.bailey@alaska.gov. Dated: March 6, 2024 __________________ Lori Wing-Heier Director