By the American Medical Association and ISMA staff

On Feb. 21, Change Healthcare began experiencing a cybersecurity issue and isolated its systems to prevent further impact. Optum, UnitedHealthcare, and UnitedHealth Group (UHG) systems were unaffected by the issue, according to information provided by UHG. UHG has indicated it has taken action to contain the incident so that customers and partners do not need to sever network connections and disrupt vital services. 

Optum Rx CEO Patrick Conway said in a letter to Optum pharmacy partners that Optum disconnected its systems from Change Healthcare as soon as it became aware of the attack.

 “We have a high level of confidence that Optum (including Optum Rx), UnitedHealthcare and UnitedHealth Group systems have not been affected by this issue,” Conway wrote.

Cybersecurity experts and the HHS Administration for Strategic Preparedness and Response (ASPR) suggest taking these steps to protect your networks:

• With consideration of the written attestation from UHG that the Optum network is safe, organizations should evaluate their risk of using Optum, UnitedHealthcare and UHG systems.
• While UHG asserts that any system that is currently live and available is safe to use, organizations should evaluate their risks and make determinations if connections to Change Healthcare are appropriate at this time.

According to the AMA, as part of the risk evaluation, health care organizations should consider the impacts of severing connectivity to Optum, including but not limited to loss of prior procedure authorizations, electronic prescribing and other patient care functions. Ultimately, your organization should make its own determination on whether or not to block Optum specifically while considering all the risks and consequences of doing so.  

ISMA has been told practices having trouble getting controlled substance prescriptions filled because the e-prescribing systems aren't working can call the pharmacy for C3, C4 and C5s. Or, practices can issue a paper prescription (on tamper resistant prescription pad) for C2, C3, C4, and C5s and have the patient take it directly to the pharmacy.  

Change Healthcare has stated they intend to establish an interim payment portal for impacted medical practices on March 1. While the details are not clear, the AMA has reached out to UnitedHealth Group (UHG) requesting more detailed information. Once the payment portal is live, the AMA and ISMA will post updates on this site and through our normal communication channels.

The AMA has compiled a list of resources and created a webpage providing updates on the cyberattack. These additional resources and updates on the cyberattack can be found here.