CBS News
Health care providers may be losing up to $100 million a day from cyberattack. A doctor shares the latest
Last month’s suspected ransomware attack on a major health technology company has sent the health care system reeling — costing providers an estimated $100 million daily as payment disruptions continue, according to an estimate from First Health Advisory, a digital health risk assurance firm.
“This is by far the biggest ever cybersecurity attack on the American healthcare system ever,” Dr. Céline Gounder, a CBS News medical contributor and editor-at-large for public health at KFF Health News, said Tuesday. “This is a system, Change Healthcare, that processes medical payments and touches one out of every three patients in this country. So the magnitude of the scope of this attack is really quite large.”
Change Healthcare is a Tennessee-based company, part of the health services provider Optum, Inc. and owned by the massive conglomerate UnitedHealth Group. It first reported experiencing company-wide connectivity problems in February.
Here’s what else to know:
What is the attack impacting?
Gounder says providers are facing numerous challenges due to the cyberattack, including impacts to a provider’s ability to bill and process things like prior authorizations.
“Can you get those medications? Can you get an estimate, say, on a surgery that you want to schedule? What is that going to look like in terms of your insurance coverage, and so on. All of those kinds of things are being affected,” she said.
It’s also affecting patients’ ability to fill their prescriptions at some hospitals.
“Here, for example, we’re only able to give some patients only two weeks of refill,” Gounder said. “So it means that they may need to come back over and over again. And some patients are even having to pay out of pocket for their refills.”
Is the government doing anything to help?
On March 5, almost two weeks after Change Healthcare first reported what it initially called a cybersecurity “issue,” the U.S. Department of Health and Human Services announced several assistance programs for health providers affected.
“The government is trying to create some supports for health care systems — not directly supporting patients, but the systems,” Gounder explains. “This is because without revenue coming in through the billing process, you don’t have money to make payroll to be able to pay your doctors and your nurses and your janitors and all the staff that you need to run a health care system.”
It’s also interfering with the ability to order needed medications and supplies, she adds.
“So the idea is to try to help support health care systems through this, but especially Medicaid providers, those who have less of a buffer, so to speak, financially — they’re really in deep trouble here,” Gounder said.
HHS Secretary Xavier Becerra, White House domestic policy chief Neera Tanden and other administration officials met Tuesday with United Health CEO Andrew Witty and urged him to take more steps to stabilize the U.S. health system amid the payment crisis, two sources briefed on the meeting told CBS News.
Officials encouraged UnitedHealth and other insurers in attendance to account for premiums that they’re collecting from patients but not paying out to health care providers, as unpaid bills pile up for hospitals, medical practices and pharmacies nationwide.
Doesn’t HIPAA protect health information?
While there are tight controls around patient records, Gounder says there are potential loopholes hackers could exploit. For example, a medical device connected to the hospital’s internet or an HVAC system could be vulnerable.
“Those provide backdoors to enter and hack the internet system of a health care system,” Gounder explains.
–Nicole Sganga contributed reporting.
CBS News
10/27/2024: Deportation; Sanctions; Surfmen – CBS News
Be the first to know
Get browser notifications for breaking news, live events, and exclusive reporting.
CBS News
10/27: The Takeout: Chris Moody and David Becker
Be the first to know
Get browser notifications for breaking news, live events, and exclusive reporting.
CBS News
McDonald’s beef patties test negative for E. coli in Colorado, Department of Agriculture says
Colorado has seemingly eliminated one ingredient as a cause for death and illness, as states continue to investigate the source of an E. coli outbreak involving the Quarter Pounder hamburger at dozens of McDonald’s locations. As a result, the Quarter Pounder will begin to return to certain locations.
The Colorado Department of Agriculture announced McDonald’s brand “fresh and frozen beef patties” tested negative for E. coli after its lab analyzed dozens of subsamples.
CDA says it has completed all beef testing and does not anticipate receiving further samples.
Meanwhile, the federal investigation into the deadly E. coli outbreak in Colorado has focused on ground beef patties and onions. There continues to be no evidence that onions grown in Colorado are linked to the outbreak.
According to McDonald’s, The 900 restaurants that historically received slivered onions from Taylor Farms’ Colorado Springs facility will resume sales of Quarter Pounders without slivered onions. Those restaurants are in Colorado, Kansas, and Wyoming, as well as portions of Idaho, Iowa, Missouri, Montana, Nebraska, Nevada, New Mexico, Oklahoma and Utah. The restaurant chain also noted it has stopped getting onions from that facility indefinitely.
“The issue appears to be contained to a particular ingredient and geography, and we remain very confident that any contaminated product related to this outbreak has been removed from our supply chain and is out of all McDonald’s restaurants,” McDonald’s North American Chief Supply Chain Officer Cesar Piña said in a statement Sunday
Since the outbreak was first announced, CBS News Colorado confirmed one older man on the Western Slope died after consuming a Quarter Pounder from a McDonald’s location in the state. Initial information also confirmed more than two dozen people had become ill due to E. coli-affected Quarter Pounders.
Nationwide, this outbreak has sickened 75 people in more than a dozen states, but Colorado remains the only state impacted that has experienced a death due to it.
The Colorado Department of Public Health says there have been 26 cases reported in nine different Colorado counties, and they are located in several different parts of the state:
- Arapahoe County
- Chaffee County
- El Paso County
- Gunnison County
- Larimer County
- Mesa County
- Routt County
- Teller County
- Weld County
The illnesses were reported between the last days of September and through Oct. 11. An investigation by the Centers for Disease Control and Prevention into the outbreak is ongoing.
McDonald’s company leaders previously said they’ve taken Quarter Pounders off the menu in states where there have been outbreaks.