Podcast
Market Implications of the Change Healthcare Breach
Ben Reigle & Trish Rivard
On this episode of Healthcare Market Matrix, host John Farkas is joined by Trish Rivard, CEO of Eliciting Insights, a healthcare technology market research and strategy company, and Ben Reigle, CEO of Tarpon Health, a community of providers that are building their own internal automation.
Trish is an accomplished ROI-driven leader and consultant specializing in healthcare technology companies, and boasts an impressive fifteen year record of success. Her expertise lies in steering EBIDTA improvement and fostering market share growth within the healthcare and payment industries. Trish is widely trusted for her exceptional consultative skills, which she employs to prioritize IT projects, enforce ROI accountability, and streamline resource allocation to meet ambitious timelines. Drawing upon her extensive experience as a Healthcare Revenue Cycle Executive, Trish excels in helping companies position themselves for growth, and at guiding them through the process of clarifying their vision, validating market receptiveness for their goals, charting a strategic roadmap, and optimizing resources for optimal outcomes in the ever-evolving healthcare marketplace.
Additionally, Ben has dedicated the majority of his career to the healthcare sector, with a significant focus on revenue cycle management over the last decade. Observing that the revenue cycle had remained unchanged for years, he embarked on a mission to challenge the conventional approach by initiating two groundbreaking projects. In November 2017, Ben launched the RCM Leaders Forum, an exclusive event designed to gather leaders in healthcare revenue cycle management for focused discussions without distractions. Furthermore, Ben has fostered a sense of community through his video podcast “My Good Friends,” which features interviews with event participants and professionals from various fields. Throughout the episode, Ben and Trish expand on the recent Change Healthcare cyber data breach, how the implications of the breach will impact the industry, and how the healthcare ecosystem as a whole will need to proceed going forward.
Show Notes
(0:41) Introducing Trish Rivard and Ben Reigle
(5:34) Analyzing the Recent Cyber Breach
(16:18) About Change Healthcare
(24:59) Impacts of the Cyber Breach
(34:41) What Healthcare Marketers Need to Know about Data
(38:43) Revenue Implications of the Cyber Breach
(43:54) Closing Thoughts
Listen Now
Transcript
Introducing Trish Rivard and Ben Reigle
John Farkas:
Greetings everyone. I’m John Farkas and your host for Healthcare Market Matrix. I’d love to welcome you to our show today, and we’re just going to rewind a little bit here late in February. I, like many of our listeners, was at the ViVE Conference in Los Angeles and there was a bit of a dark cloud looming over the conference at that point because just at that moment, days before, Change Healthcare, which is part of the UnitedHealth Group, got hit by a major cyber attack that has since stirred up quite a storm across the US healthcare ecosystem. And let’s just be clear, it was not just a small hiccup, it was huge. A group called ALPHV/Blackcat, now a notorious ransomware gang, has claimed responsibility for this attack. They managed to snag millions of Americans’ healthcare info, which is obviously having major implications. And the fallout has been really messy. Hospitals and pharmacies have not been able to process claims or prescriptions. Basically gumming up the works for a lot of providers and patients alike.
And right now the HHS has stepped up trying to cushion the blow for healthcare providers with some quick fixes and they’re urging payers to help out too. UnitedHealth Group is in major damage control mode. They’ve got their electronics payments mostly, I guess, back up online, and they’ve been shelling out billions of dollars to help providers stay afloat during all this chaos. It has been a real wake-up call for needing to beef up cybersecurity in healthcare. And for sure, the downstream effects are really going to be substantial and those effects are what we’re going to be talking about and exploring today. And to do that, we are welcoming into the Healthcare Market Matrix studios, some experts in the revenue cycle universe. And so I’m excited to again introduce to you Trish Rivard. Trish is a now veteran of our podcast, but she’s a member of Ratio’s Advisory Board and she’s the CEO of Eliciting Insights. They’re a healthcare technology market research and strategy company that’s bringing together just amazing amounts of experience and expertise in the revenue cycle universe and other areas.
Doing some deep collaborative work right now with HFMA doing some combined reports that are really bringing some strong insights across to folks in this space. And I know that she’s got some experience back in her backdrop with R-One and shares some resume DNA with our other guest, which is going to be my segue into introducing Ben Reigle. And Ben is the CEO of Tarpon Health, and Tarpon is a community of providers that are building their own internal automation and they’re working together. Ben’s helping facilitate some collaborative working together and support to inform each other about the process, which is not for the faint of heart and something that is becoming more and more essential in this realm every day. Ben’s also the host of another great podcast that any of you interested in the RCM space should tune into. It’s called My Good Friends and part of the RCM Leaders Forum, which you can check out wherever great podcasts are available.
In the RCM Leaders Forum, Ben is doing some great work to gather some of the top healthcare system, RCM innovators, to get together and talk about the world and all that is in front of them. And so obviously, our topic today is front page news for that group and these two have been spending a lot of time looking at what the implications are. And so today we’re going to be diving into that and talking about what do we need to know, how we need to be considering the impact as our audience looking at helping lead healthcare technology solutions and move that into the market. What do we need to be knowing and being aware of that are going to be some of the ecosystem impacts and things that are going to need to affect our efforts as we engage the market? So Ben Trish, welcome to Healthcare Market Matrix.
Ben Reigle:
Thank you for having us.
Analyzing the Recent Cyber Breach
John Farkas:
We’re hearing tons about this breach, right? I mean, it’s obviously a major deal. Just walk us through the timeline of what happened there and what we need to… It’s a pretty fascinating series of events. There’s a lot of what to do and what not to do that can be extracted from what happened, but I’d love for you guys to walk us through the anatomy of the events there.
Ben Reigle:
Well, I’ve done a lot of work on this. Trish has done more research on just what’s happening currently. I’m trying to piece together because as I told you, John, I was on vacation. So this happened, I was on vacation and I’m sure Trish would say the same thing. I thought, “I’ll figure this out in a couple of days.” I got back and then I got back to my email and I was going through my email and I had a bunch of my community leaders, big health system, VPs rough cycle, email me and say, “Hey, can you pull a town hall together?” I did these town halls in the pandemic. Just pulling people together, it was like a therapy session because we didn’t know what to do, right? If everyone remembers March, February of 2020. And so I was like, “I guess.” I didn’t realize it was that big of a deal. So this is Tuesday. The week following. By Wednesday, I had 45 health systems join a call. Less than 24 hours. And we got on a call and it was clear. Some couple of things were clear.
One is that Change reps were calling our health system leaders and asking questions that they should know the answer to. And so it was instantaneously realizing these guys don’t have access to any of their data. And so the next day, which was a Thursday, I had heard from a friend who had talked to someone on the inside at Change and had confirmed that they did not have access to their laptops. And actually I still don’t think they do. And so they couldn’t access anything. They couldn’t access their own data, that is all shut down or lost. And that the infiltrator, Blackcat actually didn’t just get data, which you think would be the primary thing that people would be worried about is actually what they did was they got the data and what we can understand is they were able to get what they call root admin access and actually delete and destroy some of the programs. Roughly a hundred and some programs were affected. And that was the bigger problem is that they just went in and damaged things. By that-
John Farkas:
Yeah, so they didn’t just take what was in the pipes, they screwed up the pipes.
Ben Reigle:
Correct. So on their way out, they’re like, “Screw it. We’re going to do whatever we’re going to do.” People are like, “Well, did they target the clearing house?” I’m like, “No. They probably literally just ran up into the system and they were like, ‘Oh, what’s all this data?’” Because clearing house would’ve had the largest amount of data by far. It wouldn’t have been close. And so they probably just ran up against it, took all the data, and then just did whatever they did. By that Wednesday, Change and moved from daily updates to bi-weekly updates, which is already a sign that was like, this isn’t going to get fixed in a couple weeks. By Friday, they were telling people, “You need to move to another clearing house.” And what’s interesting is during all this time, only thing in the news is about the pharmacy. And the pharmacy was a major problem because that could affect patients’ prescriptions-
John Farkas:
That’s really quick effect, right? People-
Ben Reigle:
Really immediate effect. Everyone can feel that. But the bigger impact really was that hospitals, big health systems and everyone else, physician groups and the like couldn’t get claims out-
John Farkas:
Were not getting paid.
Ben Reigle:
Right. And so Trish, what is it? 30% of roughly the health systems in the US have Change as they’re clearing house.
Trish Rivard:
Yeah, Change Healthcare is the largest clearing house for both hospital and for physician. Last time we read the market share, so a little bit dated, but we had Change Healthcare at about 30% of hospital claims and 30% of physician claims. That’s significant and by far the largest of any player in the market.
Ben Reigle:
And what wasn’t well known then, but is well known now, was that Change is actually the intermediary for a number of plans, payer plans. And Change has never put out a list of those to this day, by the way. So MDN actually put out a list of like, “Here’s all the plans that are payers that are affected.” Which was a problem because those payers couldn’t, A, accept claims, and B, they couldn’t get payments out. So they couldn’t even send payments if they wanted to because it was… Most people don’t realize, all this is electronic now. No one’s sending paper claims until the last six weeks, and they’re certainly not receiving paper checks. So we did another town hall next week and what we started hearing was people are getting paper checks sent in the mail, which is great, but if you’re a big health system, you haven’t cashed a check in…
John Farkas:
Long time.
Ben Reigle:
I don’t know, Trish, how far you want to go back? 10, 15, 20 years? It’s been a long time. They don’t even know they’re getting checks.
Trish Rivard:
Yeah. And where are those checks going to? What address are they going to?
Ben Reigle:
What those checks going to, right?
Trish Rivard:
Yeah, it’s a big mess. Big mess.
Ben Reigle:
So that Friday they tell people on the call like, “You’re going to have to seek another clearinghouse.” Fast-forward to the next week, we have another town hall. We hear what people are trying to do. They’re sending paper claims, they’re using a thing called Availability, which another company does, can take some of those in batch to different payers doing direct submissions to payers where payers could take those. But again, those have problems because you’re trying to keep track of all these claims. And think millions and millions and millions of claims per health system. This isn’t like, “Oh, we’re sending through a couple hundred thousand.” This is like-
John Farkas:
It’s all of them.
Ben Reigle:
Yeah. It’s all of them if you’re a health system. And by the next Friday they said, “No, no, no. Wait, wait, wait. Don’t do that. We’re going to fix this.” And they got called in front of the White House, right? The CEO of UnitedHealth group actually got called in front of the White House to meet with HSS leaders and have to give a date on which they could have this fixed. Well, they gave it tomorrow, March 18th, which up until that point, they had literally told no one they could even fix the problem. So they then tell people like, “Oh, it’s going to be fine.” Well, at this point, people are already switching clearing houses. Which to give some idea, treacherous leave this world, this isn’t even something that people would consider to do within a six-month timeframe, let alone a six-week timeframe.
Trish Rivard:
Yeah. So switching clearing houses is one of the most painful things to do. And most providers actually wait until they switch EMRs because in order to switch your clear house, you have to re-enroll with every single payer. That’s the way our healthcare system is designing.
John Farkas:
And that happens really fast.
Trish Rivard:
Yeah. So you have to go through this enrollment process specific to your clearing house. So you can’t be enrolled to submit electronic claims or enrolled to receive electronic payments and then switch clearing houses, no, you have to enroll with a new clearing house. And that process typically takes between 30 days and 60 days for the enrollment. And then of course, no other-
Ben Reigle:
And especially the smaller payers, right, Trish? I mean, this is mostly the medium-sized smaller payers. So you get this process going through, right? So there’s just so much here where it’s like, okay, now we can’t get claims out. And so then what starts to happen is HSS comes out with… They’re getting all angry. “You guys need to do your part.” And the problem is they don’t have power here. So the challenge is they don’t really have power except those Medicare Advantage plans. And so the Medicare Advantage plans, they have some power there because they’re the payer, right? Ultimately, the other payer plans are just the intermediary, but most times they don’t really have power. And so when they came out with a statement, I laughed at it. I honestly just was laughing because I was like, “This is useless. Dude, you’re not helping anybody by doing this.” Right? Because it doesn’t really affect the total of what’s going on.
So you have this, and then Optum comes. Optum’s this other company, which the UnitedHealth Group owns, which is what really bought Change. And Optum comes out with this like, “We’re going to pay people on a loan basis so that we can pay them advance payments.” But then people got it. And this was also a town hall and people were… They were laughing out loud when they got their email of what they could get because it was… One house hasn’t told me they got 0.05% of their net revenue in the offer. 0.05%, this isn’t even-
John Farkas:
That’s not quite the administrative expense.
Ben Reigle:
It wouldn’t cover anything. And then there’s been the couple of posts, I went on LinkedIn there with a physician group that got a thousand dollars or something and she’s like, “My payroll is 65,000 this week.” So there’s also strings attached to that money too, right? One of the little things one of our hospitals found was that if you sign that and you got the money, you took that advanced payment, Optum had the right to open up all their contracts and change the language on you and to go renegotiate all the contracts, which is crazy. No one in the right mind was going to sign those things. And so I think they’ve come back and probably walked back a bit on that once people figured it out. But it was those type of things where you’re like, “What are you talking about?” The other hard part was… Because we had health systems that were doing both. One was waiting. They were waiting it out, trying to send their claims the way they could, but not switching. And then we had probably the other half were just absolutely just switching as fast as possible.
And so then you’re like, “Well, which one’s making the right decision?” I was talking to several of my leaders this morning, and it’s all over the map where one is moved back to the original change product, but so many payers are accepting it. One is still not doing anything. One has changes, kept pushing their date back. Others have just completely moved. It’s all over the place and probably because there’s no guidance. So there’s a whole lesson around here around communication and what was happening as far as what they were communicating out because it kept changing and no one was coming around with a real answer, which we still haven’t heard the real answer of what really happened.
About Change Healthcare
John Farkas:
Yeah. It reminded me a lot about what happened a couple winters ago when the big storm hit Texas, and all of a sudden the power grid went down. And we all together started confronting the interconnected nature of our power grid that was having implications all over the place, not just ground zero. And it’s similar to that, right? We’re now getting educated together on just how codependent this framework is that we’ve been living in right now. And we’re having to figure out, okay, that’s not a good way to do it. What are we going to do about it? So maybe it would be good to just jump back and say, “Okay. For those who just don’t live in this world all the time, what is Change Healthcare? Let’s take a look at the scope of what they do and why this ends up being a little bit of a codependent quagmire.” So there’s a number of different elements.
Trish Rivard:
Yeah. So as Ben mentioned, so Change Healthcare is a clearing house, right? So in this day and age-
John Farkas:
And that means-
Ben Reigle:
Has lots of different technologies but yes.
Trish Rivard:
Yes, lots of different technologies, but every hospital, every provider needs to submit claims electronically and they have a clearing house vendor. And typically, there may be several, but there’s one primary that they used to submit claims electronically and then receive electronic prevences. Change Healthcare has been mentioned as also the front-end gateway for about 8% of the payers out there. We think it’s 8% like Ben said, but we don’t know the exact number. A little industry secret right now. And then Change Healthcare also offers a full suite of revenue cycle solutions. So they offer eligibility checking for health systems. They have a lot of traditional revenue cycle products for pre-service, helping to register the patient. Then they have a lot of back-end revenue cycle related solutions for following up. And Change Healthcare also operates a pharmacy, call it clearing house, call it pharmacy switch depending on who you talk with. And that was what has been mentioned. That was what was in the news. The pharmacy switch went down for Change Healthcare, and that is currently somewhat restored.
If you look at the Wall Street Journal or New York Times, everybody thinks it’s all set, everybody thinks it’s back to normal. It’s not. But patients are getting prescriptions. And so that’s why it seems like the spotlight from a mainstream media has come off of Change Healthcare. Change healthcare-
John Farkas:
Yeah, safe to say nothing’s back to normal right now.
Trish Rivard:
Yes, exactly, when it’s not. Change Health Care-
John Farkas:
Functioning at some level.
Trish Rivard:
Yeah. Change Healthcare was acquired by Optum slash UnitedHealthcare in the fall of 2022. There was a lot of industry concerns-
Ben Reigle:
Which was fault.
Trish Rivard:
About these mega mergers and everything. And quite frankly, I was surprised. As a former clearing house person, I was really surprised that the DOJ approved it because essentially what that did… So I do have to question whether the regulators understood what they were doing. The way we really fully understood the scope of what they were allowing, but Change Healthcare being part of UnitedHealthcare… United Healthcare is the largest private health insurance company and UnitedHealthcare is acquisition of Change Healthcare, now has access to rates of every single one of their competitors because when you process remittance advices, that includes the actual amount paid for every single service. So in terms of the scope of Change Healthcare and the reach of Change Healthcare, this is significant. And the fact that it’s now part of UnitedHealthcare is that much more significant in terms of the role it plays.
Ben Reigle:
It was a big deal at the time, and it was fought heavily by the hospitals. AHA, everybody was fighting that acquisition to the point where they then… A week prior, I believe, to the actual breach, there was another… DOJ filed another potential lawsuit around it. They went back at it basically right before the breach, realizing that it’s a total conflict of interest to be a payer, the largest payer in the US and now the largest company, mind you, the largest healthcare company in the United States, also owning a bunch of the data parts of this other third party process. It made no sense at the time and now look at it. My opinion is that if Change had been independent, we would’ve gotten a totally different type of communication. I personally believe that.
John Farkas:
Yeah, they probably had a whole lot of crisis communications conversations going on that were-
Ben Reigle:
I can’t even imagine.
John Farkas:
Where each end was conflicting against the other, because the agendas were very different.
Trish Rivard:
For one-
John Farkas:
I got a-
Ben Reigle:
The clearing house alone, John, is $180 million business. So at some point it being clear, it was business preservation. That’s the agenda. And I get it. If I’m a business owner, I totally understand it. And I preface everything with Change is a victim here. It could have happened to anyone. But definitely I think the UnitedHealth group acquisition and being the parent owner, it definitely affected how it’s come out. I can’t say that it hasn’t had a huge effect.
Trish Rivard:
The fact that it was owned by UnitedHealthcare could have raised the likelihood of it being the target for the hackers, could have made it more interesting.
Ben Reigle:
Possible, yeah.
Trish Rivard:
What’s really what we get a kick out of, I mean, Eliciting Insights team is that as soon as the acquisition went through, United’s acquisition of Change Healthcare. Change Healthcare was rebranded as Optum and the Change Healthcare name disappeared. And then as soon as the breach happened, all of a sudden it was Change Healthcare was like-
Ben Reigle:
It’s like, “Oh, it’s Change.”
Trish Rivard:
A lot of PR work was spent on let’s reinvigorate that name and let’s show that it was Change Healthcare, it wasn’t Optum and it wasn’t United Healthcare. It was this asset that we purchased.
Ben Reigle:
Yeah. Oh, I mean, we don’t really know much about it. It’s weird.
Trish Rivard:
Yeah, so.
John Farkas:
Okay. So certainly, like I said, just this interesting codependent quagmire that we’re facing right now and not getting the kind of communication we need because an organization is at odds with itself and how they are needing to bring things together. So the transparency has not been what it’s needed to be, and so it’s made it hard for everybody in and around it to get the information that’s needed to adequately navigate and move things forward. Is that safe to say?
Trish Rivard:
Yeah, there’s a lack of information and then there’s miscommunication. So if you’re a provider, you don’t know when they do communicate, should I even listen to what they’re saying? At this point, there’s a lot of distrust here right now. Yeah.
Ben Reigle:
At one point, John, I told Trish three weeks ago, two weeks after it happened, marketing team put out something that said like, “80% of claims are being rerouted and being functionally sent through.” They put that out as marketing. And I was like, “A, you don’t even know. So I don’t know how you’d ever know that answer because it’s not running through you.” So I was like, “We know yours isn’t working. So it’s not running through you. So there’s no way you could actually know that. And so then don’t tell people that.” And 80% is a pretty round number. So I’m pretty sure we just made that up. You can’t bring that stuff out. It’s not helping anybody. So it’s like those kinds of things that were coming out and you’re like, “You can’t say stuff like that. That doesn’t mean anything.”
Impacts of the Cyber Breach
John Farkas:
So let’s push toward what we know about the impact. And I know, Trish, you’ve been asking a lot of folks in the provider side of the market, what is this meaning to you and what are the implications? Let’s start with what you’re learning from the providers. And let me back up a second and say there’s a pretty easy way for you all to get some direct insight. And Trish has made public some reports that have some really helpful statistics to give some context. And I think for anybody who is selling into the provider space right now, to have a good understanding of what this means is important because it’s going to affect our world for some time still because this is not a small ripple. So Trish, start by telling us, if somebody is wanting to get their hands on what you’ve published around this, what’s the best place for them to go?
Trish Rivard:
Yeah, sure. So today we’ve published three market pulses in conjunction with the HFMA, and they’re all available on the Eliciting Insights website. They’re available for free. Just go to the market studies tab, you can download them. The other thing I’d like to recommend as well is highly recommend you follow Ben Reigle on LinkedIn because he’s been publishing a lot from his town halls of what he’s hearing from providers as well. I’ll get started and then pass it over to Ben. But in terms of the impact, I think from a provider standpoint, you can’t get your claims in, you’re getting paper checks, you’re getting the remittances, you’re going to the parent website and you’re pulling them, your cash is slow. And Change Healthcare’s, quote-unquote, line of credit is a joke and the payers aren’t helping. The payers aren’t saying, “You know what? We normally pay this hospital $2 million a week. Let’s just pay them 2 million, a million and a half. Just keep the doors open for them.” Payers aren’t doing that.
They’re just sitting on the cash and saying, “Oh, that would be really hard to do.” Yeah, be administratively challenging, things to think through, but it’s been done before. But from a provider standpoint, cash is a big problem. Line of credit, we all know interest rates are high. Prime is currently sitting in about eight and a half percent. This is a significant cost. And then the cost to run revenue cycle, the cost… Overtime costs are really high right now. So if you’re manually posting every single remit by hand, I mean, that’s a lot of expenses. Looking for other ways to submit your claims, like Ben said, dropping things to paper. Some payers don’t even accept claims by paper. So the staff time to just try to figure out solutions, viable solutions and do things through paper processes, I mean, this is all very expensive and it’s consuming. Most health systems out there are not for profit, so they’re not sitting on a ton of cash.
I mean, this is problematic-
John Farkas:
It’s a severe destruction.
Trish Rivard:
And the concerns are, what does this mean for staffing? What does this mean long-term for patient care if this doesn’t get resolved quickly? Patient statements, we know patient statements are going to be delayed. And the longer it takes you get a statement out to the patient, the less likely they’re to pay. So there’s a lot of implications and there’s going to be a lot of cleanup. Even if the clearing house turns on tomorrow for Change Healthcare and it were fully functional and running like it should be, it would take providers-
Ben Reigle:
Six months.
Trish Rivard:
Still weeks to dig out of this.
Ben Reigle:
Yeah. The bigger health systems are going to figure it out. They have enough cash typically on hand and in reserves. They’re going to either move to another clearing house or they’re going to figure it out. They have resources. It sucks. It’s awful. It’s terrible. I’ve said from the very beginning, the biggest challenge actually is that physician groups and smaller community hospitals are screwed. They have the biggest chance of actually just flat out not being able to continue functions because they don’t get the same priority. If I go to another vendor, they’re not getting priority over Henry Ford or Advocate. Those are enormous health systems or Providence, right? These are going to get priority over everybody else. I’m a community health system-
John Farkas:
And they’re coming from a already compromised spot.
Ben Reigle:
Correct. They don’t have a ton of staff and they probably don’t have a ton of day’s cash on hand. I mean, and even they did, it’s significant impact. I think those are the groups that they’re left to who the devices of the whims of the… And that’s the groups that I think the government should have stepped in sooner and been like, “Here’s what we’re doing. And if you’re this size and you’re this… Here’s the loan you can take or here’s the advanced payment.” Or whatever they needed to do and that’s actually what they’ve not done. I’m still shocked by this, to be honest.
Trish Rivard:
Yeah. I mean, when Covid hit four years ago the government knew-
Ben Reigle:
They did it immediately, almost.
Trish Rivard:
There was going to be a significant impact to the provider community. And now it feels like the government knows and they can’t push UnitedHealthcare to do anything, they can’t push the payers to do anything. So they’re taking this really weird position right now.
Ben Reigle:
Yeah.
John Farkas:
Well, in some sense, it ought to be more apparent than what happened with Covid because it’s directly about the pipeline, right? I mean, it’s just saying, “You’re not getting paid.” And so that seems a little different than we’re not sure how-
Ben Reigle:
Yeah, but Covid was about illness. Covid was an actual illness and so they knew the health system, right? This is nebulous. Well, some are affected. And it’s like, well, it seems like they should figure this out. This will run its course. I’m like, “Maybe.” Hopefully it will. Hopefully it will run its course.
John Farkas:
Yeah. But we are at this point, past a month of this being an issue, and it’s still an issue., right? They’re still mop buckets out and they’re trying to get the water off the floor because it’s still a wet mess.
Trish Rivard:
And Optum…
Ben Reigle:
And there’s still another outlying issue that no one’s really talking about is the fact that data is still out there. So they got six terabytes of data, they paid the ransom, and this is a… You can’t make this stuff up. The two leaders of that Blackcat took off with the money. And so they got another post that came out. I didn’t tell this part of the story that was like, “Hey, we were the actual people that were working on this breach and we have your data.” And they talked about their money. So UnitedHealthcare did pay or Optum did pay $22 million in ransom. That was confirmed, in Bitcoin. I mean, you can’t make this stuff up. And then that data’s still out there. That would be the largest HIPAA violation breach in history, if I’m not mistaken. And we in theory would have to notify every single one of those patients, which Trish, I think the estimates are, what? A third of the population in the US who have some type of breach.
Trish Rivard:
Well, yeah. The way that I tell my neighbors and my family is, if you’ve been to the doctor in January or February of 2024, you’ve been to the hospital, you’ve been to a physical therapy appointment, you’ve been to the dentist, you’ve had any procedure, you’ve gone for an X-ray, you’ve gone for an MRI, you’ve basically done anything in a medical setting, there’s a good chance that your data was breached. So-
Ben Reigle:
There’s a good chance.
Trish Rivard:
I think we all just need to assume our data was breached unless we hear otherwise.
John Farkas:
Yeah, so $22 million in ransom, and who knows how much in continuing black market profits from selling off the data that they get to sell off in those strange Tor networks where all that stuff ends up being marketed. I just was listening to some information about that this morning. So-
Ben Reigle:
Yeah. And I don’t know anything about that world. That’s not a world I understand or do I-
John Farkas:
Well, I’m glad to hear that better, Ben.
Trish Rivard:
Yeah, and there was an article.
Ben Reigle:
But it’s like the thing that we’re not talking about still, right? Because it’s just sitting out there. Those guys are saying they own it still, so it’s not like they got it back.
John Farkas:
No, it’s not just sitting out there, it’s an asset for some-
Ben Reigle:
It’s an asset asset.
John Farkas:
For somebody.
Ben Reigle:
Yeah.
Trish Rivard:
And the questions become, who’s responsible for notifying the patients? Right?
Ben Reigle:
Right.
Trish Rivard:
So now providers where they’re running overtime and they’re taking out loans and maxing out their lines of credit, are they going to bear the responsibility for notifying patients because it’s considered their patients? I mean, that really bothers me. That really bothers me that, A, patients haven’t been notified and then B, that there’s even a consideration that providers are the ones that are going to have to be responsible for the notification.
What Healthcare Marketers Need to Know about Data
John Farkas:
Okay. So it’s a big muddy mess. I’m a healthcare technology company that has some touch into… Well, I mean, any healthcare technology is going to be involved in this somewhere somehow because they’re all touching data, they’re all selling into health systems. Not all, but many are selling into health systems that are severely affected. As a marketing expert, as somebody trying to communicate to the market, what do I need to know? What do I need to be carrying forward? What’s the sensibility I need to have? What do I need to be putting forward? How do I need to be talking about my data? All of those things. What are the downstream impact for the folks who are part of the Healthcare Market Matrix community?
Trish Rivard:
So one of the things that we found in the last market study we did of CFOs is that hospitals and health systems are spending a lot on cybersecurity. I mean, this is like a slap in the face to the health systems and the providers. They have to spend all this money and then they work with a third party vendor and the third party vendor’s like, “Oops.” And not only is it cybersecurity that they’re spending on, but they’re also spending money on cybersecurity insurance, right? So from a health system standpoint, there’s going to be a lot of scrutiny for third party vendors coming in. And before you even have a conversation, I think there’s going to be a, see what your policies, your procedures are. We want to know that the data is secure from the second that it leaves us. So the pipes that connect with you as well as we want to understand your infrastructure. Are you using AWS? What are you using? So we know we’re secure.
And then when the data comes back, we need to know that it’s fully secure. So don’t have a conversation with us until we know that. And then I think from a data standpoint, there’s going to be, if I’m a health system, I’m going to say, “You know what? Epic may not have the best solution, but it never leaves Epic, so maybe I should just use the Epic vanilla solution for RevCycle, for clinical care.” So I think it’s going to be really hard for vendors that, most vendors do, you need the data to move in and out, and if you don’t have a tight story, it’s going to be really hard.
Ben Reigle:
Yeah, cybersecurity just become the number one priority for a CIO and even maybe the CEO.
John Farkas:
Yeah, so what they hear-
Ben Reigle:
Overnight.
John Farkas:
Is that if how you handle data has not been a primary part of your message, at least for the foreseeable, you’ve got to fly it farther forward. And if you don’t have something that’s worth bragging about, you need to go figure out how you’re going to put something together that’s worth bragging about because it’s going to be under tighter scrutiny. And so as an organization, if there are some holes in your data protocol, you’re going to want to fill those quickly and diligently and then talk about it. Because that’s going to be pretty front and center for anybody who’s having healthcare data flow through your pipes in any form. Is that a fair summation?
Trish Rivard:
Absolutely, yeah.
Ben Reigle:
Or changing your whole process to be, it’s using data within their system, your things on their system. I know some groups that have totally switched around how they’re even doing it. They’re not getting data anymore, they’re putting it on their system on their data within their own network. So they’re never leaving. So you’re going to see all kinds of stuff like that I think happen where it’s definitely going to slow it down. And I think before you’d be like, “Oh yeah, we’re certified.” Or, “We’re this and we have this.” It’s like, no, no, no. You’re going to go through whole audit process and quality process is my guess. Whereas that wasn’t commonplace before.
Revenue Implications of the Cyber Breach
John Farkas:
Yeah. And so being ready to move into a more rigorous posture or communicate the rigor of what it is that you’re doing so that the health system doesn’t feel like they have to do it for you, but also just being ready to have that light shown on that part of your process is going to be really important. Talk about the revenue implications and what this might mean for the innovation ecosystem.
Ben Reigle:
Well, in the short term, I think it puts projects on hold. I think if they’re feeling the pinch at all with seeing day’s cash on hand drop significantly, if I’m the CFO, I’m saying, “Look, we’re not doing anything at this point. We’re holding steady.” Because they were already just coming out. You had to think about a little bit of history here. In the pandemic in the first couple of years, in ’20 and ’21, they actually had decent years because they were getting compensated for care that was Covid. Then that stops. Almost every single health system in ’22 was losing money significantly. In ’23, I’d say probably 70% of them were, or maybe 60%. Right, Trish? I mean, you’re not disagreeing with me on this.
John Farkas:
Yeah, no, it’s-
Ben Reigle:
So in ’23 was really like, okay, none of those 2019 volumes are coming back. This is probably not well thought through but thing of in healthcare, some CFOs thought 2019 would return. Well, those people are gone. Your sick ass patients, I hate to say, this is morbid, but they didn’t make it through. We won’t see 2019 volumes for a while. So the volumes actually dropped pretty significantly and so they had to adjust everything. So ’23 was a year, I would say, of trying to figure out how to make money again, which I would say most of them figured it out. So then you get to ’24 and you’re like, “Okay, we’re going to be good.” I was just talking to a CFO friend of mine, a big health system, and he is like, “Okay, we’re coming to ’24. I feel like we’re on the right path. We’re getting a two or 3% operating margin, which for a health system is not bad.”
John Farkas:
And then we got a gut punch.
Ben Reigle:
And they just got a punch in the gut, right? So you imagine being like, “Okay. Well, we’re doing the same things. Stop everything that we don’t have to until we can be sure that we’re going to get stuff out.” I mean, I knew a health system that was holding $9 billion in claims. Just think that through just a little bit. $9 billion. And Kodiak’s been putting-
John Farkas:
That’s not RevCycle, that is RevUncycle.
Ben Reigle:
Uncycle because we’re not cycling anything. It’s just holding. And I know if you’ve seen Kodiak stuff, Trish, but Kodiak is a company that used to be the Old Crow, which does a lot of financial metrics for groups. They have half the hospitals. And they were saying claim submission, cash or cash coming back in was down more than 50% over their whole part, which isn’t all Change, right? They don’t all have Change clearing houses. So think about that for a minute. That’s significant.
Trish Rivard:
Yeah. Wow. Yeah. So yeah, like Ben said, I mean, the Kaufman Hall publishes health system margins and the end of 2023 hospitals were back to a 2% margin, which is actually decent for hospitals-
Ben Reigle:
Which was way better than-
John Farkas:
It’s a positive-
Trish Rivard:
It’s a positive number. It’s a little bit of margin. It’s on average. So we still have a lot of health systems struggling. They’re not for profits. And then this hits and yeah, this is significant and vendors coming in. So I think the vendors that are in RevCycle, I mean, they’re on the phone with providers every day right now because there’s impacts. Even if you’re an ancillary RevCycle, you do contract management, you need a claim file so you really have a pulse on what’s going on. Either the vendors that do OCR for paper remittances, they’re getting phone calls, “Hey, we need help.” The clearing houses. So the RevCycle vendors have a strong sense of what’s going on, but the vendors that aren’t close to RevCycle, provided they aren’t going to be calling them back, right? They’re going to be too busy, they’re not going to be getting back to them. And they need to know that there’s a crisis going on right now, and until the crisis settles, providers aren’t going to be in a position to buy new technology, implement new technology, really focus on innovation.
I think the only things that are going to be a focus for health system right now in terms of buying for the next couple of months is going to be anything that’s cybersecurity related and then anything that’s compliance related, anything that they have to do is going to be the focus.
Closing Thoughts
John Farkas:
Yeah. So there it is. I mean, if we’re going to sum it up for those who are affected by this deal, that’s going to be the order of the day. So we just need to be aware of that moving forward and knowing that what this has signaled to the entire ecosystem is a pretty high alert around cybersecurity, around really looking at how data is being handled and who has the opportunity to access and where the vulnerable points might be. I think that that’s going to be an increasingly important thing. We’re about at time here. I’m really wanting to make sure. So what’s very apparent to me, and I’m sure to the rest of the folks listening, is that we’ve got a wealth of insight around this area sitting in this little interview here. So I want to make sure that our audience knows where to get ahold of you both. So if we could just reiterate that, I know I talked about it at the front end, but Trish, if somebody’s wanting to find you, what are the good places to do that?
Trish Rivard:
Sure. So reach out on LinkedIn and I have a website, so Eliciting Insights. If you want to get a copy of the market pulses, you can certainly download them. And there’s a contact form on the website or just send an email to info@elicitinginsights.com. And yeah, we would love to hear from you.
John Farkas:
And Ben, how about you?
Ben Reigle:
Probably similar. Obviously, I’m on LinkedIn. You can find me on there. I try to be honest and give real thoughts and what I think is happening on there. I have a unique perspective, I’d say, because in the middle of these things. I have a community of providers. They can also find me tarpon.health, if they’re interested in Tarpon at all. And then I have a podcast called My Good Friends, which is available on iTunes and Spotify, and do similar things to this.
John Farkas:
Very good. Well, Ben and Trish, I really appreciate you giving us the rundown here. It’s a tricky moment, and it’s going to be certainly a lot of folks very interested in how this continues to work itself out and what the downstream implications will continue to be and how the world’s going to change. So we’ll probably double back with you guys in a little while and see what has become of this all because let’s hope that it finds itself to a better spot than where it is because it needs to. Right?
Ben Reigle:
Mm-hmm (affirmative).
Trish Rivard:
Absolutely.
John Farkas:
Thanks for joining us today and really grateful for your perspective. Healthcare Market Matrix is a Ratio original podcast. If you enjoyed today’s episode, then jump over to healthcaremarketmatrix.com and subscribe. And we’d really appreciate your support in the form of a five star rating on your favorite podcast platform. It does make a difference. Also, while you’re there, you can become a part of the Healthcare Market Matrix community and get access to courses and content that’s created just for you by signing up for InsightSquared, a monthly newsletter dedicated to bringing you the latest health-tech marketing insights right to your inbox.
Outro:
Ratio is an award-winning marketing agency headquartered in the Nashville, Tennessee. We operate at the intersection of brand and growth marketing to equip companies with strategies to create meaningful connections with the healthcare market and ultimately drive growth. Want to know more? Go to Goratio.com. That’s G-O-R-A-T-I-O dot com. And we’ll see you at Noon Central next week for an all-new episode. From our team at Ratio Studios, stay healthy.
Transcript (custom)
Introducing Trish Rivard and Ben Reigle
John Farkas:
Greetings everyone. I’m John Farkas and your host for Healthcare Market Matrix. I’d love to welcome you to our show today, and we’re just going to rewind a little bit here late in February. I, like many of our listeners, was at the ViVE Conference in Los Angeles and there was a bit of a dark cloud looming over the conference at that point because just at that moment, days before, Change Healthcare, which is part of the UnitedHealth Group, got hit by a major cyber attack that has since stirred up quite a storm across the US healthcare ecosystem. And let’s just be clear, it was not just a small hiccup, it was huge. A group called ALPHV/Blackcat, now a notorious ransomware gang, has claimed responsibility for this attack. They managed to snag millions of Americans’ healthcare info, which is obviously having major implications. And the fallout has been really messy. Hospitals and pharmacies have not been able to process claims or prescriptions. Basically gumming up the works for a lot of providers and patients alike.
And right now the HHS has stepped up trying to cushion the blow for healthcare providers with some quick fixes and they’re urging payers to help out too. UnitedHealth Group is in major damage control mode. They’ve got their electronics payments mostly, I guess, back up online, and they’ve been shelling out billions of dollars to help providers stay afloat during all this chaos. It has been a real wake-up call for needing to beef up cybersecurity in healthcare. And for sure, the downstream effects are really going to be substantial and those effects are what we’re going to be talking about and exploring today. And to do that, we are welcoming into the Healthcare Market Matrix studios, some experts in the revenue cycle universe. And so I’m excited to again introduce to you Trish Rivard. Trish is a now veteran of our podcast, but she’s a member of Ratio’s Advisory Board and she’s the CEO of Eliciting Insights. They’re a healthcare technology market research and strategy company that’s bringing together just amazing amounts of experience and expertise in the revenue cycle universe and other areas.
Doing some deep collaborative work right now with HFMA doing some combined reports that are really bringing some strong insights across to folks in this space. And I know that she’s got some experience back in her backdrop with R-One and shares some resume DNA with our other guest, which is going to be my segue into introducing Ben Reigle. And Ben is the CEO of Tarpon Health, and Tarpon is a community of providers that are building their own internal automation and they’re working together. Ben’s helping facilitate some collaborative working together and support to inform each other about the process, which is not for the faint of heart and something that is becoming more and more essential in this realm every day. Ben’s also the host of another great podcast that any of you interested in the RCM space should tune into. It’s called My Good Friends and part of the RCM Leaders Forum, which you can check out wherever great podcasts are available.
In the RCM Leaders Forum, Ben is doing some great work to gather some of the top healthcare system, RCM innovators, to get together and talk about the world and all that is in front of them. And so obviously, our topic today is front page news for that group and these two have been spending a lot of time looking at what the implications are. And so today we’re going to be diving into that and talking about what do we need to know, how we need to be considering the impact as our audience looking at helping lead healthcare technology solutions and move that into the market. What do we need to be knowing and being aware of that are going to be some of the ecosystem impacts and things that are going to need to affect our efforts as we engage the market? So Ben Trish, welcome to Healthcare Market Matrix.
Ben Reigle:
Thank you for having us.
Analyzing the Recent Cyber Breach
John Farkas:
We’re hearing tons about this breach, right? I mean, it’s obviously a major deal. Just walk us through the timeline of what happened there and what we need to… It’s a pretty fascinating series of events. There’s a lot of what to do and what not to do that can be extracted from what happened, but I’d love for you guys to walk us through the anatomy of the events there.
Ben Reigle:
Well, I’ve done a lot of work on this. Trish has done more research on just what’s happening currently. I’m trying to piece together because as I told you, John, I was on vacation. So this happened, I was on vacation and I’m sure Trish would say the same thing. I thought, “I’ll figure this out in a couple of days.” I got back and then I got back to my email and I was going through my email and I had a bunch of my community leaders, big health system, VPs rough cycle, email me and say, “Hey, can you pull a town hall together?” I did these town halls in the pandemic. Just pulling people together, it was like a therapy session because we didn’t know what to do, right? If everyone remembers March, February of 2020. And so I was like, “I guess.” I didn’t realize it was that big of a deal. So this is Tuesday. The week following. By Wednesday, I had 45 health systems join a call. Less than 24 hours. And we got on a call and it was clear. Some couple of things were clear.
One is that Change reps were calling our health system leaders and asking questions that they should know the answer to. And so it was instantaneously realizing these guys don’t have access to any of their data. And so the next day, which was a Thursday, I had heard from a friend who had talked to someone on the inside at Change and had confirmed that they did not have access to their laptops. And actually I still don’t think they do. And so they couldn’t access anything. They couldn’t access their own data, that is all shut down or lost. And that the infiltrator, Blackcat actually didn’t just get data, which you think would be the primary thing that people would be worried about is actually what they did was they got the data and what we can understand is they were able to get what they call root admin access and actually delete and destroy some of the programs. Roughly a hundred and some programs were affected. And that was the bigger problem is that they just went in and damaged things. By that-
John Farkas:
Yeah, so they didn’t just take what was in the pipes, they screwed up the pipes.
Ben Reigle:
Correct. So on their way out, they’re like, “Screw it. We’re going to do whatever we’re going to do.” People are like, “Well, did they target the clearing house?” I’m like, “No. They probably literally just ran up into the system and they were like, ‘Oh, what’s all this data?’” Because clearing house would’ve had the largest amount of data by far. It wouldn’t have been close. And so they probably just ran up against it, took all the data, and then just did whatever they did. By that Wednesday, Change and moved from daily updates to bi-weekly updates, which is already a sign that was like, this isn’t going to get fixed in a couple weeks. By Friday, they were telling people, “You need to move to another clearing house.” And what’s interesting is during all this time, only thing in the news is about the pharmacy. And the pharmacy was a major problem because that could affect patients’ prescriptions-
John Farkas:
That’s really quick effect, right? People-
Ben Reigle:
Really immediate effect. Everyone can feel that. But the bigger impact really was that hospitals, big health systems and everyone else, physician groups and the like couldn’t get claims out-
John Farkas:
Were not getting paid.
Ben Reigle:
Right. And so Trish, what is it? 30% of roughly the health systems in the US have Change as they’re clearing house.
Trish Rivard:
Yeah, Change Healthcare is the largest clearing house for both hospital and for physician. Last time we read the market share, so a little bit dated, but we had Change Healthcare at about 30% of hospital claims and 30% of physician claims. That’s significant and by far the largest of any player in the market.
Ben Reigle:
And what wasn’t well known then, but is well known now, was that Change is actually the intermediary for a number of plans, payer plans. And Change has never put out a list of those to this day, by the way. So MDN actually put out a list of like, “Here’s all the plans that are payers that are affected.” Which was a problem because those payers couldn’t, A, accept claims, and B, they couldn’t get payments out. So they couldn’t even send payments if they wanted to because it was… Most people don’t realize, all this is electronic now. No one’s sending paper claims until the last six weeks, and they’re certainly not receiving paper checks. So we did another town hall next week and what we started hearing was people are getting paper checks sent in the mail, which is great, but if you’re a big health system, you haven’t cashed a check in…
John Farkas:
Long time.
Ben Reigle:
I don’t know, Trish, how far you want to go back? 10, 15, 20 years? It’s been a long time. They don’t even know they’re getting checks.
Trish Rivard:
Yeah. And where are those checks going to? What address are they going to?
Ben Reigle:
What those checks going to, right?
Trish Rivard:
Yeah, it’s a big mess. Big mess.
Ben Reigle:
So that Friday they tell people on the call like, “You’re going to have to seek another clearinghouse.” Fast-forward to the next week, we have another town hall. We hear what people are trying to do. They’re sending paper claims, they’re using a thing called Availability, which another company does, can take some of those in batch to different payers doing direct submissions to payers where payers could take those. But again, those have problems because you’re trying to keep track of all these claims. And think millions and millions and millions of claims per health system. This isn’t like, “Oh, we’re sending through a couple hundred thousand.” This is like-
John Farkas:
It’s all of them.
Ben Reigle:
Yeah. It’s all of them if you’re a health system. And by the next Friday they said, “No, no, no. Wait, wait, wait. Don’t do that. We’re going to fix this.” And they got called in front of the White House, right? The CEO of UnitedHealth group actually got called in front of the White House to meet with HSS leaders and have to give a date on which they could have this fixed. Well, they gave it tomorrow, March 18th, which up until that point, they had literally told no one they could even fix the problem. So they then tell people like, “Oh, it’s going to be fine.” Well, at this point, people are already switching clearing houses. Which to give some idea, treacherous leave this world, this isn’t even something that people would consider to do within a six-month timeframe, let alone a six-week timeframe.
Trish Rivard:
Yeah. So switching clearing houses is one of the most painful things to do. And most providers actually wait until they switch EMRs because in order to switch your clear house, you have to re-enroll with every single payer. That’s the way our healthcare system is designing.
John Farkas:
And that happens really fast.
Trish Rivard:
Yeah. So you have to go through this enrollment process specific to your clearing house. So you can’t be enrolled to submit electronic claims or enrolled to receive electronic payments and then switch clearing houses, no, you have to enroll with a new clearing house. And that process typically takes between 30 days and 60 days for the enrollment. And then of course, no other-
Ben Reigle:
And especially the smaller payers, right, Trish? I mean, this is mostly the medium-sized smaller payers. So you get this process going through, right? So there’s just so much here where it’s like, okay, now we can’t get claims out. And so then what starts to happen is HSS comes out with… They’re getting all angry. “You guys need to do your part.” And the problem is they don’t have power here. So the challenge is they don’t really have power except those Medicare Advantage plans. And so the Medicare Advantage plans, they have some power there because they’re the payer, right? Ultimately, the other payer plans are just the intermediary, but most times they don’t really have power. And so when they came out with a statement, I laughed at it. I honestly just was laughing because I was like, “This is useless. Dude, you’re not helping anybody by doing this.” Right? Because it doesn’t really affect the total of what’s going on.
So you have this, and then Optum comes. Optum’s this other company, which the UnitedHealth Group owns, which is what really bought Change. And Optum comes out with this like, “We’re going to pay people on a loan basis so that we can pay them advance payments.” But then people got it. And this was also a town hall and people were… They were laughing out loud when they got their email of what they could get because it was… One house hasn’t told me they got 0.05% of their net revenue in the offer. 0.05%, this isn’t even-
John Farkas:
That’s not quite the administrative expense.
Ben Reigle:
It wouldn’t cover anything. And then there’s been the couple of posts, I went on LinkedIn there with a physician group that got a thousand dollars or something and she’s like, “My payroll is 65,000 this week.” So there’s also strings attached to that money too, right? One of the little things one of our hospitals found was that if you sign that and you got the money, you took that advanced payment, Optum had the right to open up all their contracts and change the language on you and to go renegotiate all the contracts, which is crazy. No one in the right mind was going to sign those things. And so I think they’ve come back and probably walked back a bit on that once people figured it out. But it was those type of things where you’re like, “What are you talking about?” The other hard part was… Because we had health systems that were doing both. One was waiting. They were waiting it out, trying to send their claims the way they could, but not switching. And then we had probably the other half were just absolutely just switching as fast as possible.
And so then you’re like, “Well, which one’s making the right decision?” I was talking to several of my leaders this morning, and it’s all over the map where one is moved back to the original change product, but so many payers are accepting it. One is still not doing anything. One has changes, kept pushing their date back. Others have just completely moved. It’s all over the place and probably because there’s no guidance. So there’s a whole lesson around here around communication and what was happening as far as what they were communicating out because it kept changing and no one was coming around with a real answer, which we still haven’t heard the real answer of what really happened.
About Change Healthcare
John Farkas:
Yeah. It reminded me a lot about what happened a couple winters ago when the big storm hit Texas, and all of a sudden the power grid went down. And we all together started confronting the interconnected nature of our power grid that was having implications all over the place, not just ground zero. And it’s similar to that, right? We’re now getting educated together on just how codependent this framework is that we’ve been living in right now. And we’re having to figure out, okay, that’s not a good way to do it. What are we going to do about it? So maybe it would be good to just jump back and say, “Okay. For those who just don’t live in this world all the time, what is Change Healthcare? Let’s take a look at the scope of what they do and why this ends up being a little bit of a codependent quagmire.” So there’s a number of different elements.
Trish Rivard:
Yeah. So as Ben mentioned, so Change Healthcare is a clearing house, right? So in this day and age-
John Farkas:
And that means-
Ben Reigle:
Has lots of different technologies but yes.
Trish Rivard:
Yes, lots of different technologies, but every hospital, every provider needs to submit claims electronically and they have a clearing house vendor. And typically, there may be several, but there’s one primary that they used to submit claims electronically and then receive electronic prevences. Change Healthcare has been mentioned as also the front-end gateway for about 8% of the payers out there. We think it’s 8% like Ben said, but we don’t know the exact number. A little industry secret right now. And then Change Healthcare also offers a full suite of revenue cycle solutions. So they offer eligibility checking for health systems. They have a lot of traditional revenue cycle products for pre-service, helping to register the patient. Then they have a lot of back-end revenue cycle related solutions for following up. And Change Healthcare also operates a pharmacy, call it clearing house, call it pharmacy switch depending on who you talk with. And that was what has been mentioned. That was what was in the news. The pharmacy switch went down for Change Healthcare, and that is currently somewhat restored.
If you look at the Wall Street Journal or New York Times, everybody thinks it’s all set, everybody thinks it’s back to normal. It’s not. But patients are getting prescriptions. And so that’s why it seems like the spotlight from a mainstream media has come off of Change Healthcare. Change healthcare-
John Farkas:
Yeah, safe to say nothing’s back to normal right now.
Trish Rivard:
Yes, exactly, when it’s not. Change Health Care-
John Farkas:
Functioning at some level.
Trish Rivard:
Yeah. Change Healthcare was acquired by Optum slash UnitedHealthcare in the fall of 2022. There was a lot of industry concerns-
Ben Reigle:
Which was fault.
Trish Rivard:
About these mega mergers and everything. And quite frankly, I was surprised. As a former clearing house person, I was really surprised that the DOJ approved it because essentially what that did… So I do have to question whether the regulators understood what they were doing. The way we really fully understood the scope of what they were allowing, but Change Healthcare being part of UnitedHealthcare… United Healthcare is the largest private health insurance company and UnitedHealthcare is acquisition of Change Healthcare, now has access to rates of every single one of their competitors because when you process remittance advices, that includes the actual amount paid for every single service. So in terms of the scope of Change Healthcare and the reach of Change Healthcare, this is significant. And the fact that it’s now part of UnitedHealthcare is that much more significant in terms of the role it plays.
Ben Reigle:
It was a big deal at the time, and it was fought heavily by the hospitals. AHA, everybody was fighting that acquisition to the point where they then… A week prior, I believe, to the actual breach, there was another… DOJ filed another potential lawsuit around it. They went back at it basically right before the breach, realizing that it’s a total conflict of interest to be a payer, the largest payer in the US and now the largest company, mind you, the largest healthcare company in the United States, also owning a bunch of the data parts of this other third party process. It made no sense at the time and now look at it. My opinion is that if Change had been independent, we would’ve gotten a totally different type of communication. I personally believe that.
John Farkas:
Yeah, they probably had a whole lot of crisis communications conversations going on that were-
Ben Reigle:
I can’t even imagine.
John Farkas:
Where each end was conflicting against the other, because the agendas were very different.
Trish Rivard:
For one-
John Farkas:
I got a-
Ben Reigle:
The clearing house alone, John, is $180 million business. So at some point it being clear, it was business preservation. That’s the agenda. And I get it. If I’m a business owner, I totally understand it. And I preface everything with Change is a victim here. It could have happened to anyone. But definitely I think the UnitedHealth group acquisition and being the parent owner, it definitely affected how it’s come out. I can’t say that it hasn’t had a huge effect.
Trish Rivard:
The fact that it was owned by UnitedHealthcare could have raised the likelihood of it being the target for the hackers, could have made it more interesting.
Ben Reigle:
Possible, yeah.
Trish Rivard:
What’s really what we get a kick out of, I mean, Eliciting Insights team is that as soon as the acquisition went through, United’s acquisition of Change Healthcare. Change Healthcare was rebranded as Optum and the Change Healthcare name disappeared. And then as soon as the breach happened, all of a sudden it was Change Healthcare was like-
Ben Reigle:
It’s like, “Oh, it’s Change.”
Trish Rivard:
A lot of PR work was spent on let’s reinvigorate that name and let’s show that it was Change Healthcare, it wasn’t Optum and it wasn’t United Healthcare. It was this asset that we purchased.
Ben Reigle:
Yeah. Oh, I mean, we don’t really know much about it. It’s weird.
Trish Rivard:
Yeah, so.
John Farkas:
Okay. So certainly, like I said, just this interesting codependent quagmire that we’re facing right now and not getting the kind of communication we need because an organization is at odds with itself and how they are needing to bring things together. So the transparency has not been what it’s needed to be, and so it’s made it hard for everybody in and around it to get the information that’s needed to adequately navigate and move things forward. Is that safe to say?
Trish Rivard:
Yeah, there’s a lack of information and then there’s miscommunication. So if you’re a provider, you don’t know when they do communicate, should I even listen to what they’re saying? At this point, there’s a lot of distrust here right now. Yeah.
Ben Reigle:
At one point, John, I told Trish three weeks ago, two weeks after it happened, marketing team put out something that said like, “80% of claims are being rerouted and being functionally sent through.” They put that out as marketing. And I was like, “A, you don’t even know. So I don’t know how you’d ever know that answer because it’s not running through you.” So I was like, “We know yours isn’t working. So it’s not running through you. So there’s no way you could actually know that. And so then don’t tell people that.” And 80% is a pretty round number. So I’m pretty sure we just made that up. You can’t bring that stuff out. It’s not helping anybody. So it’s like those kinds of things that were coming out and you’re like, “You can’t say stuff like that. That doesn’t mean anything.”
Impacts of the Cyber Breach
John Farkas:
So let’s push toward what we know about the impact. And I know, Trish, you’ve been asking a lot of folks in the provider side of the market, what is this meaning to you and what are the implications? Let’s start with what you’re learning from the providers. And let me back up a second and say there’s a pretty easy way for you all to get some direct insight. And Trish has made public some reports that have some really helpful statistics to give some context. And I think for anybody who is selling into the provider space right now, to have a good understanding of what this means is important because it’s going to affect our world for some time still because this is not a small ripple. So Trish, start by telling us, if somebody is wanting to get their hands on what you’ve published around this, what’s the best place for them to go?
Trish Rivard:
Yeah, sure. So today we’ve published three market pulses in conjunction with the HFMA, and they’re all available on the Eliciting Insights website. They’re available for free. Just go to the market studies tab, you can download them. The other thing I’d like to recommend as well is highly recommend you follow Ben Reigle on LinkedIn because he’s been publishing a lot from his town halls of what he’s hearing from providers as well. I’ll get started and then pass it over to Ben. But in terms of the impact, I think from a provider standpoint, you can’t get your claims in, you’re getting paper checks, you’re getting the remittances, you’re going to the parent website and you’re pulling them, your cash is slow. And Change Healthcare’s, quote-unquote, line of credit is a joke and the payers aren’t helping. The payers aren’t saying, “You know what? We normally pay this hospital $2 million a week. Let’s just pay them 2 million, a million and a half. Just keep the doors open for them.” Payers aren’t doing that.
They’re just sitting on the cash and saying, “Oh, that would be really hard to do.” Yeah, be administratively challenging, things to think through, but it’s been done before. But from a provider standpoint, cash is a big problem. Line of credit, we all know interest rates are high. Prime is currently sitting in about eight and a half percent. This is a significant cost. And then the cost to run revenue cycle, the cost… Overtime costs are really high right now. So if you’re manually posting every single remit by hand, I mean, that’s a lot of expenses. Looking for other ways to submit your claims, like Ben said, dropping things to paper. Some payers don’t even accept claims by paper. So the staff time to just try to figure out solutions, viable solutions and do things through paper processes, I mean, this is all very expensive and it’s consuming. Most health systems out there are not for profit, so they’re not sitting on a ton of cash.
I mean, this is problematic-
John Farkas:
It’s a severe destruction.
Trish Rivard:
And the concerns are, what does this mean for staffing? What does this mean long-term for patient care if this doesn’t get resolved quickly? Patient statements, we know patient statements are going to be delayed. And the longer it takes you get a statement out to the patient, the less likely they’re to pay. So there’s a lot of implications and there’s going to be a lot of cleanup. Even if the clearing house turns on tomorrow for Change Healthcare and it were fully functional and running like it should be, it would take providers-
Ben Reigle:
Six months.
Trish Rivard:
Still weeks to dig out of this.
Ben Reigle:
Yeah. The bigger health systems are going to figure it out. They have enough cash typically on hand and in reserves. They’re going to either move to another clearing house or they’re going to figure it out. They have resources. It sucks. It’s awful. It’s terrible. I’ve said from the very beginning, the biggest challenge actually is that physician groups and smaller community hospitals are screwed. They have the biggest chance of actually just flat out not being able to continue functions because they don’t get the same priority. If I go to another vendor, they’re not getting priority over Henry Ford or Advocate. Those are enormous health systems or Providence, right? These are going to get priority over everybody else. I’m a community health system-
John Farkas:
And they’re coming from a already compromised spot.
Ben Reigle:
Correct. They don’t have a ton of staff and they probably don’t have a ton of day’s cash on hand. I mean, and even they did, it’s significant impact. I think those are the groups that they’re left to who the devices of the whims of the… And that’s the groups that I think the government should have stepped in sooner and been like, “Here’s what we’re doing. And if you’re this size and you’re this… Here’s the loan you can take or here’s the advanced payment.” Or whatever they needed to do and that’s actually what they’ve not done. I’m still shocked by this, to be honest.
Trish Rivard:
Yeah. I mean, when Covid hit four years ago the government knew-
Ben Reigle:
They did it immediately, almost.
Trish Rivard:
There was going to be a significant impact to the provider community. And now it feels like the government knows and they can’t push UnitedHealthcare to do anything, they can’t push the payers to do anything. So they’re taking this really weird position right now.
Ben Reigle:
Yeah.
John Farkas:
Well, in some sense, it ought to be more apparent than what happened with Covid because it’s directly about the pipeline, right? I mean, it’s just saying, “You’re not getting paid.” And so that seems a little different than we’re not sure how-
Ben Reigle:
Yeah, but Covid was about illness. Covid was an actual illness and so they knew the health system, right? This is nebulous. Well, some are affected. And it’s like, well, it seems like they should figure this out. This will run its course. I’m like, “Maybe.” Hopefully it will. Hopefully it will run its course.
John Farkas:
Yeah. But we are at this point, past a month of this being an issue, and it’s still an issue., right? They’re still mop buckets out and they’re trying to get the water off the floor because it’s still a wet mess.
Trish Rivard:
And Optum…
Ben Reigle:
And there’s still another outlying issue that no one’s really talking about is the fact that data is still out there. So they got six terabytes of data, they paid the ransom, and this is a… You can’t make this stuff up. The two leaders of that Blackcat took off with the money. And so they got another post that came out. I didn’t tell this part of the story that was like, “Hey, we were the actual people that were working on this breach and we have your data.” And they talked about their money. So UnitedHealthcare did pay or Optum did pay $22 million in ransom. That was confirmed, in Bitcoin. I mean, you can’t make this stuff up. And then that data’s still out there. That would be the largest HIPAA violation breach in history, if I’m not mistaken. And we in theory would have to notify every single one of those patients, which Trish, I think the estimates are, what? A third of the population in the US who have some type of breach.
Trish Rivard:
Well, yeah. The way that I tell my neighbors and my family is, if you’ve been to the doctor in January or February of 2024, you’ve been to the hospital, you’ve been to a physical therapy appointment, you’ve been to the dentist, you’ve had any procedure, you’ve gone for an X-ray, you’ve gone for an MRI, you’ve basically done anything in a medical setting, there’s a good chance that your data was breached. So-
Ben Reigle:
There’s a good chance.
Trish Rivard:
I think we all just need to assume our data was breached unless we hear otherwise.
John Farkas:
Yeah, so $22 million in ransom, and who knows how much in continuing black market profits from selling off the data that they get to sell off in those strange Tor networks where all that stuff ends up being marketed. I just was listening to some information about that this morning. So-
Ben Reigle:
Yeah. And I don’t know anything about that world. That’s not a world I understand or do I-
John Farkas:
Well, I’m glad to hear that better, Ben.
Trish Rivard:
Yeah, and there was an article.
Ben Reigle:
But it’s like the thing that we’re not talking about still, right? Because it’s just sitting out there. Those guys are saying they own it still, so it’s not like they got it back.
John Farkas:
No, it’s not just sitting out there, it’s an asset for some-
Ben Reigle:
It’s an asset asset.
John Farkas:
For somebody.
Ben Reigle:
Yeah.
Trish Rivard:
And the questions become, who’s responsible for notifying the patients? Right?
Ben Reigle:
Right.
Trish Rivard:
So now providers where they’re running overtime and they’re taking out loans and maxing out their lines of credit, are they going to bear the responsibility for notifying patients because it’s considered their patients? I mean, that really bothers me. That really bothers me that, A, patients haven’t been notified and then B, that there’s even a consideration that providers are the ones that are going to have to be responsible for the notification.
What Healthcare Marketers Need to Know about Data
John Farkas:
Okay. So it’s a big muddy mess. I’m a healthcare technology company that has some touch into… Well, I mean, any healthcare technology is going to be involved in this somewhere somehow because they’re all touching data, they’re all selling into health systems. Not all, but many are selling into health systems that are severely affected. As a marketing expert, as somebody trying to communicate to the market, what do I need to know? What do I need to be carrying forward? What’s the sensibility I need to have? What do I need to be putting forward? How do I need to be talking about my data? All of those things. What are the downstream impact for the folks who are part of the Healthcare Market Matrix community?
Trish Rivard:
So one of the things that we found in the last market study we did of CFOs is that hospitals and health systems are spending a lot on cybersecurity. I mean, this is like a slap in the face to the health systems and the providers. They have to spend all this money and then they work with a third party vendor and the third party vendor’s like, “Oops.” And not only is it cybersecurity that they’re spending on, but they’re also spending money on cybersecurity insurance, right? So from a health system standpoint, there’s going to be a lot of scrutiny for third party vendors coming in. And before you even have a conversation, I think there’s going to be a, see what your policies, your procedures are. We want to know that the data is secure from the second that it leaves us. So the pipes that connect with you as well as we want to understand your infrastructure. Are you using AWS? What are you using? So we know we’re secure.
And then when the data comes back, we need to know that it’s fully secure. So don’t have a conversation with us until we know that. And then I think from a data standpoint, there’s going to be, if I’m a health system, I’m going to say, “You know what? Epic may not have the best solution, but it never leaves Epic, so maybe I should just use the Epic vanilla solution for RevCycle, for clinical care.” So I think it’s going to be really hard for vendors that, most vendors do, you need the data to move in and out, and if you don’t have a tight story, it’s going to be really hard.
Ben Reigle:
Yeah, cybersecurity just become the number one priority for a CIO and even maybe the CEO.
John Farkas:
Yeah, so what they hear-
Ben Reigle:
Overnight.
John Farkas:
Is that if how you handle data has not been a primary part of your message, at least for the foreseeable, you’ve got to fly it farther forward. And if you don’t have something that’s worth bragging about, you need to go figure out how you’re going to put something together that’s worth bragging about because it’s going to be under tighter scrutiny. And so as an organization, if there are some holes in your data protocol, you’re going to want to fill those quickly and diligently and then talk about it. Because that’s going to be pretty front and center for anybody who’s having healthcare data flow through your pipes in any form. Is that a fair summation?
Trish Rivard:
Absolutely, yeah.
Ben Reigle:
Or changing your whole process to be, it’s using data within their system, your things on their system. I know some groups that have totally switched around how they’re even doing it. They’re not getting data anymore, they’re putting it on their system on their data within their own network. So they’re never leaving. So you’re going to see all kinds of stuff like that I think happen where it’s definitely going to slow it down. And I think before you’d be like, “Oh yeah, we’re certified.” Or, “We’re this and we have this.” It’s like, no, no, no. You’re going to go through whole audit process and quality process is my guess. Whereas that wasn’t commonplace before.
Revenue Implications of the Cyber Breach
John Farkas:
Yeah. And so being ready to move into a more rigorous posture or communicate the rigor of what it is that you’re doing so that the health system doesn’t feel like they have to do it for you, but also just being ready to have that light shown on that part of your process is going to be really important. Talk about the revenue implications and what this might mean for the innovation ecosystem.
Ben Reigle:
Well, in the short term, I think it puts projects on hold. I think if they’re feeling the pinch at all with seeing day’s cash on hand drop significantly, if I’m the CFO, I’m saying, “Look, we’re not doing anything at this point. We’re holding steady.” Because they were already just coming out. You had to think about a little bit of history here. In the pandemic in the first couple of years, in ’20 and ’21, they actually had decent years because they were getting compensated for care that was Covid. Then that stops. Almost every single health system in ’22 was losing money significantly. In ’23, I’d say probably 70% of them were, or maybe 60%. Right, Trish? I mean, you’re not disagreeing with me on this.
John Farkas:
Yeah, no, it’s-
Ben Reigle:
So in ’23 was really like, okay, none of those 2019 volumes are coming back. This is probably not well thought through but thing of in healthcare, some CFOs thought 2019 would return. Well, those people are gone. Your sick ass patients, I hate to say, this is morbid, but they didn’t make it through. We won’t see 2019 volumes for a while. So the volumes actually dropped pretty significantly and so they had to adjust everything. So ’23 was a year, I would say, of trying to figure out how to make money again, which I would say most of them figured it out. So then you get to ’24 and you’re like, “Okay, we’re going to be good.” I was just talking to a CFO friend of mine, a big health system, and he is like, “Okay, we’re coming to ’24. I feel like we’re on the right path. We’re getting a two or 3% operating margin, which for a health system is not bad.”
John Farkas:
And then we got a gut punch.
Ben Reigle:
And they just got a punch in the gut, right? So you imagine being like, “Okay. Well, we’re doing the same things. Stop everything that we don’t have to until we can be sure that we’re going to get stuff out.” I mean, I knew a health system that was holding $9 billion in claims. Just think that through just a little bit. $9 billion. And Kodiak’s been putting-
John Farkas:
That’s not RevCycle, that is RevUncycle.
Ben Reigle:
Uncycle because we’re not cycling anything. It’s just holding. And I know if you’ve seen Kodiak stuff, Trish, but Kodiak is a company that used to be the Old Crow, which does a lot of financial metrics for groups. They have half the hospitals. And they were saying claim submission, cash or cash coming back in was down more than 50% over their whole part, which isn’t all Change, right? They don’t all have Change clearing houses. So think about that for a minute. That’s significant.
Trish Rivard:
Yeah. Wow. Yeah. So yeah, like Ben said, I mean, the Kaufman Hall publishes health system margins and the end of 2023 hospitals were back to a 2% margin, which is actually decent for hospitals-
Ben Reigle:
Which was way better than-
John Farkas:
It’s a positive-
Trish Rivard:
It’s a positive number. It’s a little bit of margin. It’s on average. So we still have a lot of health systems struggling. They’re not for profits. And then this hits and yeah, this is significant and vendors coming in. So I think the vendors that are in RevCycle, I mean, they’re on the phone with providers every day right now because there’s impacts. Even if you’re an ancillary RevCycle, you do contract management, you need a claim file so you really have a pulse on what’s going on. Either the vendors that do OCR for paper remittances, they’re getting phone calls, “Hey, we need help.” The clearing houses. So the RevCycle vendors have a strong sense of what’s going on, but the vendors that aren’t close to RevCycle, provided they aren’t going to be calling them back, right? They’re going to be too busy, they’re not going to be getting back to them. And they need to know that there’s a crisis going on right now, and until the crisis settles, providers aren’t going to be in a position to buy new technology, implement new technology, really focus on innovation.
I think the only things that are going to be a focus for health system right now in terms of buying for the next couple of months is going to be anything that’s cybersecurity related and then anything that’s compliance related, anything that they have to do is going to be the focus.
Closing Thoughts
John Farkas:
Yeah. So there it is. I mean, if we’re going to sum it up for those who are affected by this deal, that’s going to be the order of the day. So we just need to be aware of that moving forward and knowing that what this has signaled to the entire ecosystem is a pretty high alert around cybersecurity, around really looking at how data is being handled and who has the opportunity to access and where the vulnerable points might be. I think that that’s going to be an increasingly important thing. We’re about at time here. I’m really wanting to make sure. So what’s very apparent to me, and I’m sure to the rest of the folks listening, is that we’ve got a wealth of insight around this area sitting in this little interview here. So I want to make sure that our audience knows where to get ahold of you both. So if we could just reiterate that, I know I talked about it at the front end, but Trish, if somebody’s wanting to find you, what are the good places to do that?
Trish Rivard:
Sure. So reach out on LinkedIn and I have a website, so Eliciting Insights. If you want to get a copy of the market pulses, you can certainly download them. And there’s a contact form on the website or just send an email to info@elicitinginsights.com. And yeah, we would love to hear from you.
John Farkas:
And Ben, how about you?
Ben Reigle:
Probably similar. Obviously, I’m on LinkedIn. You can find me on there. I try to be honest and give real thoughts and what I think is happening on there. I have a unique perspective, I’d say, because in the middle of these things. I have a community of providers. They can also find me tarpon.health, if they’re interested in Tarpon at all. And then I have a podcast called My Good Friends, which is available on iTunes and Spotify, and do similar things to this.
John Farkas:
Very good. Well, Ben and Trish, I really appreciate you giving us the rundown here. It’s a tricky moment, and it’s going to be certainly a lot of folks very interested in how this continues to work itself out and what the downstream implications will continue to be and how the world’s going to change. So we’ll probably double back with you guys in a little while and see what has become of this all because let’s hope that it finds itself to a better spot than where it is because it needs to. Right?
Ben Reigle:
Mm-hmm (affirmative).
Trish Rivard:
Absolutely.
John Farkas:
Thanks for joining us today and really grateful for your perspective. Healthcare Market Matrix is a Ratio original podcast. If you enjoyed today’s episode, then jump over to healthcaremarketmatrix.com and subscribe. And we’d really appreciate your support in the form of a five star rating on your favorite podcast platform. It does make a difference. Also, while you’re there, you can become a part of the Healthcare Market Matrix community and get access to courses and content that’s created just for you by signing up for InsightSquared, a monthly newsletter dedicated to bringing you the latest health-tech marketing insights right to your inbox.
Outro:
Ratio is an award-winning marketing agency headquartered in the Nashville, Tennessee. We operate at the intersection of brand and growth marketing to equip companies with strategies to create meaningful connections with the healthcare market and ultimately drive growth. Want to know more? Go to Goratio.com. That’s G-O-R-A-T-I-O dot com. And we’ll see you at Noon Central next week for an all-new episode. From our team at Ratio Studios, stay healthy.
About Ben Reigle & Trish Rivard
Ben Reigle
Ben Riegle is a seasoned professional with an extensive career in healthcare, primarily focusing on revenue cycle management for over a decade. With a critical eye for industry standards and a forward-thinking mindset, Ben recognized the stagnant nature of revenue cycle processes, which had seen little to no innovation in the past decade. Motivated to disrupt the status quo, he embarked on a mission to bring fresh perspectives and transformative ideas to the forefront of healthcare financial management. In November 2017, Ben took a significant step towards realizing this vision by founding the RCM Leaders Forum. By gathering leading minds in the field, the forum provides a unique platform for distraction-free dialogue, enabling participants to explore new strategies, share insights, and collaborate on future-forward solutions to industry challenges.
Trish Rivard
As an accomplished ROI-driven leader and consultant for Health Care technology companies, Trish provides a 15+-year cumulative track record of success in driving EBIDTA improvement and market share growth within the healthcare and payment industries. She is trusted for her consultative ability in prioritizing IT projects, driving ROI accountability, and aligning resources needed to meet aggressive timelines.
By leveraging insights as a Healthcare Revenue Cycle Executive, she assists companies in positioning themselves for growth by helping them to clarify their vision, validate market receptiveness for that vision, set and execute a roadmap, and optimize resources to maximize the best results within a fickle marketplace.