How a cyberattack crippled the U.S. health care system

Read the Full Transcript

• Amna Nawaz:

  A cyberattack on a little-known health care company last month has caused major trouble and serious financial consequences for hospitals, doctors and patients around the country.

  Stephanie Sy looks at the impact and the efforts to solve these problems.

• Stephanie Sy:

  Amna, the American Hospital Association has described the hack as — quote — "the most serious cyberattack in history on the health care system."

  It began about two weeks ago, when hackers shut down a payment processing system run by a company called Change owned by UnitedHealthcare. Change essentially functions as a middleman between insurers, providers, hospitals, and pharmacies. Hospitals and other medical practices have not been able to process bills and get payments they need to operate.

  Doctors and patients have been unable to get insurance approvals for some procedures. And until a few days ago, pharmacies were also impacted.

  Here's what one doctor in Texas posted on TikTok.

• Woman:

  This morning, I spent probably several hours calling several pharmacies because my patients hadn't received their prescriptions that I prescribed last week. So I — it's not usual that I have to call the pharmacies. Like, usually, I only call the pharmacies if there are, like, shortages or controlled substances or something else is going on.

• Stephanie Sy:

  She suspects the delays were because of the health care hack.

  This week, the Department of Health and Human Services announced steps to help, including providing some advanced payments for providers. But problems remain.

  Dan Diamond has been covering this for The Washington Post and joins me now.

  Dan, welcome to the "NewsHour."

  You heard me describe some of the problems. Give us a sense of the scope and the magnitude of the disruptions and who has borne the brunt of the impact.

• Dan Diamond, The Washington Post:

  Stephanie, Change Healthcare was the middleman for tens of millions of insurance claims every day. So that means virtually everyone in health care is being touched by this directly because they're waiting to get paid or they work with performers and players that are waiting.

  Right now, there are real pains for physicians. Physicians don't necessarily have the cash flow for now two weeks of not getting paid. So we have talked — here at The Washington Post, we have talked to doctors who have had to take out emergency loans, that have gone on heroic measures to just keep their practices open.

  Hospitals also have been able to scramble and try to figure out how to keep their operations paid for, pharmacists that you mentioned earlier. I talked to a therapist who hasn't been paid. It really is touching every corner of health care right now.

• Stephanie Sy:

  Is critical patient care being impacted?

• Dan Diamond:

  Right now, no.

  There are efforts to make sure that patients are being protected. There are procedures that are still taking place. It's a back end issue, but the back end issues are so severe that, inevitably, if this continues, there will be problems facing the front end. There will be doctors who can't keep their lights on. There will be staff who might have to be furloughed.

  So, eventually, there will be a crisis point. And that's what health officials are trying to stave off by talking about or starting to advance emergency loans to keep these providers open.

• Stephanie Sy:

  So, we're now already at least two weeks in to since the hack was reported. And there have been reports that UnitedHealthcare may have paid a $22 million ransom to the cyber gang purportedly behind the attack. Why isn't the system back up and running if that is the case?

• Dan Diamond:

  First, I think ransomware groups, hackers, are not necessarily the most reliable partners here.

  And even though there may have been a payment from UnitedHealth — they have not confirmed that — it's not necessarily going to resolve the issue when you're dealing with one of these groups. There still are systems that need to be checked. There's data that was encrypted and was taken and may not be back in the hands of United, assuming they made this payment.

  So it's very risky when dealing with ransomware to begin with. And the scope of this hack was so extensive, it's hard to just flip the switch back on, even if the hackers have returned what was taken.

• Stephanie Sy:

  What made Change Healthcare vulnerable to this? And more broadly, Dan, what is it exposed about the weaknesses in our health care system?

• Dan Diamond:

  Change was vulnerable in part because they're a big target.

  Even before United bought them, and United is a major health care company, one of the largest companies in the United States, Change was already this major processor of claims. And they take data from hospitals, from doctors, and then check that data, pass it on to the insurance company.

  They're in the middle of all of these transactions. They have sensitive medical data that is very alluring to hackers. So I'm not exactly sure. I don't think we know the ways that hackers found their way into Change, but health care companies are under attack in this way all the time. This just happens to be a particularly large hack.

  And it also has pointed to how much we rely on just a handful of health care companies as consolidation increases across the industry. Change is this major middleman. They're owned by UnitedHealth, which has its fingers all over health care right now. And that is something that government officials that I have talked to this week have been thinking about as well.

  There's an antitrust probe into United through the Justice Department preceded this. But there is a real question about, what are the risks if so much of health care is concentrated in just a few hands?

• Stephanie Sy:

  We talked a little bit about the Department of Health and Human Services' response. How do physicians and hospitals feel about how the government has reacted?

• Dan Diamond:

  They're not feeling great, Stephanie.

  No one is happy with the response so far. Hospitals have gotten more help. They have deeper pockets, that they're able to weather the pain better than some other organizations. But even hospitals say they need more than the loans that are being offered potentially by the federal government.

  Physicians are not eligible for those loans right now from the federal government. UnitedHealth has made available emergency loans for doctors, but what they have told us, they're getting offered pennies on the dollar. They might be down hundreds of thousands of dollars, millions of dollars at this point in claims that haven't been paid, and they're being offered thousands of dollars, maybe $10,000 to patch that hole, which they can't do.

  So there is bipartisan outrage in Congress. I was at the White House earlier today talking with officials, who say this is really something that they're looking to the private sector right now to try and solve before the federal government steps in more.

• Stephanie Sy:

  Dan Diamond with The Washington Post.

  Dan, thanks so much for your reporting.

• Dan Diamond:

  Thank you, Stephanie.