Cyberattack on Change Healthcare

BULLETIN 2024-4 4315 South 2700 West, Suite 2300, Taylorsville, Utah 84129 ● Office (801) 957-9200 ● Facsimile (385) 465-6047 ● insurance.utah.gov State of Utah SPENCER J. COX Governor DEIDRE M. HENDERSON Lieutenant Governor Insurance Department JONATHAN T. PIKE Insurance Commissioner To: All Insurers Offering Healthcare Coverage From: Jonathan T. Pike, Insurance Commissioner Date: March 11, 2024 Subject: Cyberattack on Change Healthcare The Utah Insurance Department issues this Bulletin regarding the cyberattack on Change Healthcare on February 21, 2024. The Department acknowledges that the cyberattack has created significant operational challenges for insurers and healthcare providers, including individual practitioners, practice groups, laboratories, facilities, and pharmacies. The Department requests an insurer to assist consumers and healthcare providers in navigating these challenges; and reminds insurers of the laws regarding the timely filing of claims, Utah Code § 31A-21-312(1)(b), as clarified in Bulletin 87-6, rev. 10/96, and Utah Admin. Code R590-192-6. The Department requests the following from each insurer offering health care benefits. • Provide prompt assistance to consumers and healthcare providers as system failures due to the cyberattack are being resolved in the coming weeks. • Update its website in a prominent location to include instructions and materials on how: o consumers can get help accessing their benefits; and o healthcare providers can verify eligibility and get assistance submitting preauthorizations, claims, and supporting documents. • Provide flexibility for appeal processes, prior authorizations, and other situations where the insurer and healthcare provider cannot electronically share information. • As insurers continue to receive premium payments without interruption from the cyberattack, they should consider the importance of healthcare providers being able to treat and be reimbursed for healthcare services with as little interruption as possible. The Department strongly encourages each insurer to make every effort to provide prompt assistance to resolve operational or financial concerns so that healthcare providers can deliver timely healthcare services insurers have promised for their policyholders, including the possibility for pre-payment of anticipated claims. Utah laws provide that failure to file a proof of loss within the time period specified in a policy does not bar recovery under a policy unless an insurer shows it was prejudiced by the failure. Pursuant to § 31A-21-312, as clarified in Bulletin 87-6 rev. 10/96, and Utah Admin. Code R590- 192-6(2), an insurer shall consider the extenuating circumstances due to the cyberattack when processing claims that may have not been timely filed. The Department requests insurers to automatically extend filing deadlines to all healthcare providers affected by the cyberattack for healthcare claims with dates of service starting on February 1, 2024, and continuing through the date providers' systems are fully restored. The Department greatly appreciates the efforts of many insurers who are already taking steps to address the complex issues resulting from the cyberattack. If you have any questions related to this Bulletin, please contact the Health and Life Division at health.uid@utah.gov or (801) 357-9280. DATED this 11th day of March 2024. _______________________________________________ Jonathan T. Pike Insurance Commissioner