UnitedHealth touted cyberattack repairs when Utah was still reeling

(Bloomberg) –UnitedHealth Group Inc.’s claims that it had made progress fixing some systems in the weeks after a crippling cyberattack frustrated state health officials who said they were still having problems.

Utah officials were waiting for UnitedHealth to fix pharmacy systems that served thousands of low-income residents when the company said in a March 7 news release that all major pharmacy claims and payment systems had been restored, according to documents obtained through a public-records request. 

“This is going to cause confusion for our providers,” Tracy Gruber, the top official in Utah’s Department of Health and Human Services, wrote in a March 8 internal email. “It’s too bad they put this out at least in terms of Utah.”

At the time, UnitedHealth was working to bring back systems damaged in a ransomware attack on its Change Healthcare subsidiary two weeks earlier. The hack, one of the largest such attacks ever in the US, disrupted the movement of patient data and billions of dollars among doctors, pharmacies and insurance companies. 

Medicaid officials broadly felt that UnitedHealth overstated how quickly systems were being restored following the Change breach, said Lindsey Browning, director of Medicaid programming at the National Association of Medicaid Directors.

“It felt like the communications coming out from UnitedHealth Group and Change were overly optimistic,” Browning said in an interview. 

A UnitedHealth spokesperson said in an email that the March 7 announcement applied to “the vast majority” of Change’s pharmacy technology and that the company was in touch with individual states about “one-off systems.”

A representative for Utah’s Department of Health and Human Services referred Bloomberg News to the agency’s public statements. A recent document the state prepared for pharmacists said that “limited functionality” was restored March 13, while some functions, including prior authorizations and drug-price updates, still weren’t working, with no timeline to fully restore them.

Chaotic Weeks

The records obtained by Bloomberg show how chaotic the weeks following the Change attack were for Utah state officials, medical providers and others. 

In the immediate aftermath of the attack, Utah Medicaid staff called thousands of members whose prescriptions might be affected and used a Google form to handle payment requests from pharmacies. The agency limited time off for staff at busy call centers. On the Saturday after the hack, University of Utah Health suggested patients pay full price for prescriptions if they could.

The emails also reveal appeals from clinics whose payments were stuck. Utah’s insurance commissioner personally pleaded with leaders of health plans to make money available, noting some providers were “literally within weeks of insolvency.” While some medical providers reverted to mailing claims, Utah’s Medicaid program stopped accepting paper claims in 2023, the emails show.

A March 13 agenda for a weekly meeting said that the Utah Department of Health and Human Services was drafting a request for proposals to find a new system to replace Change Healthcare.

‘Not Helpful’

Utah officials told UnitedHealth executives they were troubled that the company’s statements didn’t line up with what was happening in their state. Nate Checketts, a senior state health official, wrote to UnitedHealth representatives the day after the company issued its news release saying pharmacy services had been restored. 

“That is not the case for Utah Medicaid,” he wrote.

The company’s statement in the release “sets an expectation for services in Utah that the system cannot currently deliver,” Checketts wrote. He asked the representatives to tell the company’s communications team “how problematic we find this broad statement that doesn’t reflect our reality.”

That afternoon, he wrote to tell company representatives that he was on a call where two people from UnitedHealth repeated the claim. “This messaging is not helpful,” he wrote.

A company executive, identified in the emails as Allison Davenport, president of public sector and government markets for the firm’s Optum Rx pharmacy division, responded to Checketts and acknowledged “the disconnect.” 

“That messaging is not helpful for Utah and other Change PBS states that remain down,” she wrote, adding that she would address it with the company’s communications team.

After the company’s statement, the Utah agency issued its own news release in response, noting that “critical parts of the process for Utah Medicaid are still not online.” 

Slow Recovery

UnitedHealth has said that the crisis is largely over.

“There are still a small number of very small providers who struggle to reconnect into the systems for all sorts of legacy reasons,” Chief Executive Officer Andrew Witty said at an investor conference last week. “But overwhelmingly, the marketplace is back to normal.”

A status page on UnitedHealth’s website listed 17 Change services as partially available and two others as not yet restored, compared with nine that were fully functional, as of May 20. A company spokesperson said Change’s major functions have been largely restored and that the services that are yet to be repaired are “mainly ancillary features.”

At the same time, doctors are still dealing with the after-effects of the attack, which may have compromised the personal data of as many as one-third of all Americans.

“The recovery’s been slow,” said Jesse Ehrenfeld, president of the American Medical Association. He said his personal doctors who he’s seen since the hack haven’t been paid, and many practices still face backlogs. Federal officials want to ensure that UnitedHealth “is specifically addressing those stragglers” that haven’t found fixes yet, said Andrea Palm, deputy secretary of the US Department of Health and Human Services. 

“We’re watching very closely to make sure every last provider who bills Medicare is back up and running and able to process claims,” she said in an interview.

Witty said at the conference that reconnecting is “a two-way deal,” requiring both providers and insurance companies to get back online.