Update on Change Healthcare’s Cybersecurity Breach

In February, Change Healthcare — a subsidiary of UnitedHealth Group Inc. — announced that its systems were adversely affected by a security incident, and HCAM has been providing updated information as it becomes available. On March 13, the Centers for Medicare and Medicaid Services (CMS) posted a fact sheet with additional guidance for Medicaid providers and administrative contractors impacted by the cybersecurity incident. The fact sheet specifically focuses on frequently asked questions about implementing the Change Healthcare/Optum Payment Disruption (CHOPD) Accelerated Payments program. It includes Application Criteria FAQs that may be especially helpful for providers: 

• Question 6: Clarifies that a skilled nursing facility receiving a Periodic Interim Payments (PIP) for bad debts but does not receive Medicare Part A PPS payments via PIPs is eligible to receive an Accelerated Payment if all other requirements are met. 
• Question 10: Clarifies that a provider is eligible to receive an Accelerated Payment if they experience a delay in claims submission and processing, which has resulted in a disruption of some Medicare claims payments related to this cyber incident. All other requirements must also be met. CMS does not require providers to quantify the level or percentage of impact to their Medicare claims. 

Option for Interim Medicaid Payments to Providers as Needed

On March 15, CMS announced important flexibilities to ensure that state Medicaid agencies can start making interim payments to providers affected by the cybersecurity incident. CMS is encouraging states to submit Medicaid state plan amendments (SPAs) to receive the authority needed to make certain interim payments for services that providers have rendered but for which they cannot submit claims.

To support states considering this option, CMS released guidance on related flexibilities, including the option for states to start making interim payments that could be effective retroactively to the date when claims payment processing was disrupted, and may begin to draw federal financial participation (FFP) as soon as the state submits an appropriate Medicaid SPA, subject to certain guardrails and conditions outlined in the guidance.

Additionally, CMS previously extended the data submission deadline and is now reopening the 2023 Merit-based Incentive Payment System Extreme and Uncontrollable Circumstances Exception Application to provide relief to clinicians impacted by this cybersecurity incident. The application will be open for the remainder of the data submission period, which closes April 15, 2024.