Notice Regarding the Change Healthcare Cyberattack

STATE OF MAINE DEPARTMENT OF PROFESSIONAL & FINANCIAL REGULATION BUREAU OF INSURANCE Office Location: 76 Northern Avenue, Gardiner, Maine 04345 Mailing Address: 34 State House Station, Augusta, Maine 04333 www.maine.gov/insurance Phone: (207) 624-8475 TTY: Please Call Maine Relay 711 Consumer Assistance: 1-800-300-5000 Fax: (207) 624-8599 Janet T. Mills Governor Anne L. Head DPFR Commissioner Robert L. Carey Superintendent Bulletin 470 Notice Regarding the Change Healthcare Cyberattack Change Healthcare experienced a cyberattack on February 21, 2024. Change Healthcare provides a range of services for issuers of healthcare plans, including pharmacy benefits management, acting as a clearinghouse for claims data, acting as a third-party administrator for submission of claims and enrollment data, and completing medical records review, among others. Change Healthcare supports tens of thousands of physicians, dentists, pharmacies, and hospitals, handling 50 percent of all medical claims in the United States. These services experienced a severe disruption until service was restored, and the disruption may lead to difficulties beyond the point of restored service. Consumers The Bureau urges consumers to be on the lookout for scams that seek to capitalize on the uncertainty caused by the Change Healthcare cyberattack. National news has reported scammers contacting consumers purporting to be representatives of hospitals, telling them that they are entitled to a refund because of the cyberattack if they provide a credit card number. Consumers who receive unsolicited phone calls purporting to be from either their health insurer or a healthcare provider relating to the Change Healthcare cyberattack should hang up. Neither health insurers nor healthcare providers will ask for a credit card number over the phone to initiate a refund of payment. Providers Affected providers with payment distribution interruptions may be eligible for financial assistance from Optum, the parent organization of Change Healthcare. Information about Change Healthcare’s Temporary Funding Assistance Program is available at: https://www.optum.com/en/business/providers/healthsystems/payments-lendingsolutions/optum-pay/temporary-funding-assistance.html Page 2 of 3 Insurers • Claims Timely claim filing requirements. Given the difficulty or, in some cases, impossibility of submitting claims during this time, some providers may not be able to submit claims within the normally required claims filing timelines. Accordingly, insurers should temporarily remove or relax timely filing deadlines for impacted providers. Insurers should not deny such claims as untimely based on the fact that a provider was unable to file the claim in the customary manner because of the Change Healthcare disruption. Timely payment responsibilities. Insurers that are unable to process payments due to the cyberattack should establish workarounds to ensure the insurer or its delegates continue to pay claims within the statutory timeframes of 30 days from receipt of a clean claim, or if the clean claim is overdue because of the Change Healthcare disruption, from the date of service. Delegates and vendors. Insurers should investigate whether the claims systems of their delegates or vendors are impacted and whether that impact is disrupting timely claims submissions by and payments to providers who deliver care to the insurer’s enrollees. It is imperative that insurers thoroughly investigate the impact on their ability to process and issue payments to ensure continued cash flow to providers. Pharmacy claims. Due to the disruption, many consumers may have needed to travel to different pharmacies to find a provider who is equipped to dispense their prescription. The Bureau encourages health insurers and PBMs to waive out-of-network cost sharing on pharmaceutical claims for prescriptions obtained between February 21 and April 21, 2024, when the consumer used an out-of-network pharmacy due to the Change Healthcare cyberattack. • Notification The Bureau reminds insurers that they may have an obligation to notify the Bureau of this event, to the extent they have not already done so, including notice of impacts in a system maintained by a third-party service provider. Impacted insurers should review Maine’s data security requirements for the notification requirements and process. The Bureau expects that all potentially impacted insurers are promptly and thoroughly investigating whether nonpublic information was accessed and the potential impact of the event on their company and insureds. Page 3 of 3 • Communication If insurers have not already done so, they should post information on their websites and provider portals to ensure providers have up-to-date information about the extent to which the insurers’ systems are impacted by the Change Healthcare cyberattack. That information should include insurer contact information for providers experiencing difficulties submitting claims or obtaining prior authorizations. If an insurer’s operations have not been disrupted by the cyberattack, the insurer should note that on its website. All posted information should also be sent to the Bureau through the established compliance contact. March 26, 2024 Robert L. Carey Superintendent of Insurance NOTE: This Bulletin is intended solely for informational purposes. It is not intended to set forth legal rights, duties, or privileges, nor is it intended to provide legal advice. Readers should consult applicable statutes and rules and contact the Bureau of Insurance if additional information is needed.