Change Healthcare Cybersecurity Attack

State of Idaho DEPARTMENT OF INSURANCE BRAD LITTLE Governor 700 West State Street, 3rd Floor P.O. Box 83720 Boise, Idaho 83720-0043 Phone 208-334-4250 Fax 208-334-4398 Website: https://doi.idaho.gov DEAN L. CAMERON Director Equal Opportunity Employer BULLETIN NO. 24-01 DATE: March 15, 2024 TO: All Affected Insurance Companies FROM: Dean L. Cameron, Director SUBJECT: Change Healthcare Cybersecurity Attack The Idaho Department of Insurance (DOI) is monitoring the effects of the recent cybersecurity attack on Change Healthcare that occurred on February 21, 2024. Change Healthcare is a part of UnitedHealth Group and also operates as Optum. Change Healthcare’s services are used by a substantial number of hospitals, health care providers, health care facilities, and pharmacies in Idaho. As a result of the cyber incident, some providers are unable to request prior authorization; engage in concurrent or retrospective reviews; request reconsiderations; submit internal appeals, external appeals, or claims within the standard timeframes; verify an insured’s eligibility for coverage; or obtain timely payment for health care services. The DOI is asking every health insurance company in Idaho to actively work to mitigate any impacts to their members and healthcare providers who have been impacted from Change Healthcare’s system issues. This should include either effective alternatives for healthcare providers to obtain the information needed for prior authorizations, appeals, claims submissions, as well as temporarily waiving or deferring such requirements if they are delaying needed health care services or prescriptions. The cyber incident has also impacted cash flows for some providers. Issuers should work with any affected network providers to provide assistance if financially feasible and prudent, after considering the liquidity and solvency of the issuer. Where assistance is needed to avoid any disruption of services provided by a provider, the state strongly urges the issuer and the provider to work together to develop a mutually acceptable plan to provide assistance to the provider, which may include periodic interim payments during the cyber incident. Further, DOI also requests these insurance companies to update their websites and create materials that explain how affected members can get help during this time. Insurers should post clear contact information for this issue, so providers, members, and the DOI can reach out if needed, as everyone works to recover from the cyberattack. You can find updates on Change Healthcare's efforts to deal with the cyber-attack at https://www.unitedhealthgroup.com/ns/changehealthcare.html 2 This Bulletin is not new law but is an agency interpretation of existing law, except as authorized by law or as incorporated into a contract. Requests for additional information or other inquiries regarding this Bulletin can be directed to Deputy Director Wes Trexler at 208-334-4214 or weston.trexler@doi.idaho.gov.