How to recover from a crippling cyberattack

In early March, Marla Vannucci, PhD, a clinical psychologist and owner of a small group practice based in Chicago, frequently awoke in the middle of the night because she was worried about running out of money to pay her staff. The six psychologists in the group had not received payments from insurance companies for 3 weeks because of the debilitating cyberattack on Change Healthcare, the largest clearinghouse for medical claims in the United States.

To preserve money for payroll, Vannucci had started putting monthly expenses such as malpractice insurance, rent, and her Zoom account on a credit card. She was nervous about the high interest rate on her credit card debt, especially because it was unclear how long Change would remain shut down. She temporarily switched to other clearinghouses to submit bills, but the process was onerous and complicated.

By mid-March, Vannucci was relieved to see payments start trickling in from insurance companies, and by early April she was receiving reimbursements for about 70% of the claims submitted. Though the sense of panic subsided, the data breach exposed vulnerabilities in the health care system that needed to be addressed, said Marnie Shanbhag, PhD, senior director of APA’s Office of Independent Practice. “Not only were hospitals and doctors affected, but so was the entire mental health care system,” she said. “Many of us did not realize Change Healthcare was involved in the billing process.”

Many psychologists provide mental health care services in small practices that often lack the cash reserves and administrative staff to endure weeks without pay. “Psychologists worked very hard to minimize the impact on patients, so what happened in reality is that many providers did not take their paychecks in order to keep their practices running,” said Shanbhag.

Psychologists frequently use electronic health record (EHR) systems, such as SimplePractice, Valant, and TherapyNotes, to schedule appointments, document notes, and submit bills, and Change is a “middleman between the provider’s EHR and the health insurance plan,” said Leanna Fortunato, PhD, director of quality and health care innovation in APA’s Office of Health Care Innovation. Change processes billions of claims submissions, provider payments, eligibility confirmations, and prior authorization requests each year. Hackers can use medical records to submit false claims, and unlike a credit card, medical information cannot be quickly canceled or changed.

The Change incident was a ransomware attack (PDF, 2.43MB)opens in new window, a type of malware (malicious software) that attempts to deny access to a user’s data. Ransomware usually encrypts the data with a key known only to the attacker who deployed the malware until a ransom is paid. Seven weeks after the attack, there were also reports that the stolen data may be changing hands to a new ransomware group.

On March 11, APA Services sent a letter to the U.S. Department of Health and Human Services (HHS) emphasizing that Change Healthcare bore the responsibility for its cybersecurity failures, and that small group practices and individual psychologists have little capacity to navigate the disruptions those failures caused. Mental health care providers are motivated to increase public awareness about the risks the current billing system poses to the country’s mental health and to explore new strategies to protect themselves and their patients from data breaches in the future.

“This is a systemic issue,” said Shanbhag. In 2022, United­Health, one of the largest health insurance providers in the country, acquired Change after fending off a U.S. Department of Justice lawsuit that alleged that the deal would harm competition in the insurance market. “We have had national conversations about the risks when banks are too big to fail, and we need to have those conversations about health insurance organizations,” she said.

Though many clinicians were willing to continue providing mental health services without receiving payments, pharmacies affected by the data breach did not have that option, and many patients could not access the medications they needed. Vannucci treated a new patient who went to a pharmacy to pick up antidepressant medication, and the pharmacist could not access the patient’s insurance records. The clerk explained that she would have to pay $1,500 out of pocket if she wanted the medication. Psychologists like Vannucci are concerned that these stressors are exacerbating the nation’s mental health crisis.

When the breach occurred on February 21, many patients had already been paying out of pocket for services since the beginning of the year while they waited to reach their deductibles. For weeks after the cyberattack, it was impossible for providers to determine if patients had met them.

Psychologists who own group practices also felt the emotional and physical toll of protecting their patients and employees from the consequences of the hack. “It’s been so important to me to keep our staff informed but not give them too much reason to worry,” said Brad Larsen, PsyD, owner of Portland Mental Health and Wellness. “It’s been incredibly stressful. I’m responsible for the livelihoods of more than 75 people and their families, and the current circumstances have not had me sleeping well since February.”

Many psychologists switched to clearinghouses such as Availity and Office Ally to submit claims as they waited for Change to remedy its system, but these alternate tools were far more labor intensive. Previously, providers could click “submit” in TherapyNotes—which uses Change as a clearinghouse—to send claims after appointments with patients. With Availity and Office Ally, providers had to begin inputting each patient’s address, date of birth, the primary insurance carrier in the family, and other information before submitting a claim. “What used to take me 15 minutes now takes 4 or 5 hours,” said Vannucci.

The payments that providers started receiving in March also lacked information about which claims were being paid. “We do not know how to allocate payments to patient accounts,” said Laura Steensen, PsyD, owner of GBCC Behavioral Health based in Maryland, a group that includes 77 providers and submits more than 1,000 claims each week. “To figure this out, we would need to log on to each insurance company and individually look up the patient’s claims information, and I am concerned about how much time that will take.” Vannucci has paid thousands of dollars to compensate her billing contractor and other staff who are working overtime to manually enter data for each claim.

Psychologists have also been frustrated that their efforts to apply to UnitedHealth for funding assistance have yielded paltry results. The organization announced that it had paid $3.3 billion in advances to providers that have been affected by the cyberattack. Vannucci submits $5,000–$7,000 in claims to UnitedHealth each month, and she was offered $20 of assistance.

Providers are calling for more regulation of the commercial insurance industry. “If the tables were turned, and we failed to file claims on time or we owed money and didn’t pay on time, we would be refused payment or owe interest and penalty fees,” Larsen said. “The insurance companies have been collecting interest on the funds that they weren’t sending out during the breach, likely to the tune of millions a day.”

Some 7 weeks after the data breach, Change had still not released any information about what data had been compromised. “This is of particular interest to providers,” said Fortunato. “They are very invested in knowing what has happened to this incredibly sensitive health data, how the affected will be notified, and what the remediation plan is.”

The fact that cyber criminals were able to take advantage of vulnerabilities in a large organization like Change could lead small business owners to question whether they have the expertise and time to learn how to protect themselves from hackers. But Shanbhag cautions psychologists to “avoid the mindset that there is nothing they can do,” she said. “We have to weatherize our practices to reduce the risk, as much as possible, of getting hacked.”

Fortunato urges practitioners to create training programs and best practices that promote cyber hygiene, such as creating strong passwords, not reusing passwords, and using a secure Wi-Fi network and multifactor authentication. Make sure devices, such as laptops, phones, and tablets, are encrypted. If the device is stolen or lost, the data are generally considered secure because they will only be readable with the encryption key. Most operating systems have built-in encryption software that can be turned on, and the Cybersecurity and Infrastructure Security Agency provides online instructions about how to do this as well as other strategies to protect dataopens in new window.

It is also important to train staff to be aware of emails, attachments, and links that may be phishing attempts from scammers to gain access to personal information. It is also wise to purchase cyber liability insurance, which provides protection and resources if a practitioner’s data are breached.

If a practice is using an EHR service, practitioners should understand the security protocols of the service, such as how backups are done, said Fortunato. If providers are maintaining the data themselves, “they absolutely need to have a secure backup of that data,” she said. This could be on a HIPAA-compliant cloud platform or an encrypted external hard drive.

Steensen also recommends creating a disaster plan, such as having paper intake forms on hand for new patients in the event that access to key systems like EHRs shuts down. For businesses that use voice over internet protocol (VoIP) for receiving calls from patients, plan to forward calls to an alternate phone number.

For some psychologists, the financial fallout from the cyberattack has also highlighted the need to protect practices by creating new strategies for generating revenue. “The hack was a reminder of the danger of being reliant on third-party payers,” Vannucci said. For years, she has been frustrated that insurance companies essentially operate like employers who determine payment structures, and psychologists have little power in negotiating the fees they will receive.

The stress caused by the data breach confirmed her group’s plan to stop working with certain third-party payers that pay particularly low fees or sometimes do not pay at all. Rather than relying solely on insurance companies for reimbursement, Vannucci’s group intends to start offering new suites of services at reasonable rates that patients will pay out of pocket. The team will also offer a sliding scale and pro bono services to a subset of patients who cannot afford the fees. She asked each clinician on her team to develop one idea to pursue with this new model in mind, and the practitioners are considering options such as groups focused on body image during pregnancy, consultation for family members of people with eating disorders, parenting training, and short-term intensive programs for couples.

Though cutting ties with certain insurance providers could reduce access to care for some patients, the lack of financial support from third-party payers and Change Healthcare after the cyberattack put many behavioral health group practices at risk of closing their doors entirely. Psychologists like Vannucci hope the impact of the hack throughout the country will fuel efforts to advocate for regulation of the health insurance industry to ensure that mental health providers can be appropriately compensated for their work. In the meantime, Vannucci and others must find creative solutions to stay financially viable. “People do not become psychologists to become rich, and these decisions about whether to continue working with third-party payers is painful,” Vannucci said. “But when insurance companies decide what to pay and how much, we are really at their mercy.”