The Change Healthcare Debacle

Ch-Ch-Ch-Ch-Change's (hacked)

Change Healthcare, one of the largest clearinghouses in the US, has been down for two weeks. I’m returning from Nashville, which is where Change Healthcare is based. I personally went to turn it on and off again to save the country and was promptly escorted off the premises.

I had a lot of interesting conversations about the Change Healthcare fiasco, and thought it might be a good question to put out to the newsletter. So my question this week is, what do you think about the Change Healthcare situation? Tell me about firsthand experiences you’re having with the outage, what you think the ripple effects will be, any hot takes on clearinghouses, etc.

A couple thoughts below.

Background: What’s a clearinghouse?

For those that don’t know, Change Healthcare is a clearinghouse. We go over the basics of a clearinghouse and revenue cycle on the first day of the healthcare 101 course, and it’s definitely one of the more “wtf” moments students have.

At a very high level, a clearinghouse provides the pipes that allow providers/pharmacies and payers/PBMs to communicate with each other about claims and payment. The provider/pharmacy can use a clearinghouse to check a patient’s eligibility, send the claim to a payer, receive information from the payer about whether or not the claim is going to be paid, and get denial reasons, how much they’ll be paid, etc. There are a lot more interesting details about the X12 data standard which encodes that information here. Clearinghouses typically sit on top of this and make it usable.

Most payers have relationships with a few different clearinghouses, but most providers use one clearinghouse based on what’s cheapest or if it’s bundled into the electronic medical record they use. Over the years, more payers have moved to  “managed gateway” relationships where they pick one clearinghouse to do all of their claims, and all the other clearinghouses basically have to send everything through them. Change’s 10-K says 480 of their payer customers use them as a managed gateway.

As per usual with anything in healthcare, the business started as a simple administrative function but eventually expanded into way more things since transmitting info via the clearinghouse is sort of a commodity. 

For example, many clearinghouses will now take a “first pass” of a claim that comes in to the payer and greenlight ones based on the custom rules a payer has or tell the submitting pharmacy/provider that something is wrong before they submit. Change had a business called claimsXten that did this which it divested because of antitrust issues.

Another might be bundling several claims together, sending a bulk payment, and reconciling to make sure the claims that come in and payments that go out are the same amounts.

Even if you’re not using Change for the clearinghouse portion, it’s likely that some part of your revenue cycle management flow does touch Change Healthcare because that’s who your payer uses. For example, you might use one clearinghouse to submit the claim but your payer uses Change to actually get you the payment via their EFT (Electronic Funds Transfer).

A big thing is that Change and other clearinghouses in many cases will retain rights to use the data that passes through their system for other things. There was a very specific time in healthcare where processes were being digitized for the first time and customers didn't understand the value of the data exhaust. Companies like Change Healthcare rode this and negotiated data use rights in a way that would be hard to do today. Change for example has secondary data use rights over 60% of the claims that flow through it. 

This data powers different non-clearinghouse products like fraud waste & abuse, de-identified data sales, clinical decision support tools, and more. These products become better with access to more data, and it’s a big part of the sell to payers for why they should let Change handle everything from end-to-end. In fact, it seems like the non-clearinghouse functions are a much higher revenue area for Change, though the clearinghouse is a better margin business.

The clearinghouse space consolidated very rapidly because the entire business is owning the pipes and integrations between payers and providers. You could build those integrations yourself, or go out and buy companies that had done the legwork of integrating already. Just look at the history of Change Healthcare on Wikipedia:

1. A company called Emdeon bought a dozen small companies in the revenue cycle space mostly targeting payers.
2. It was then taken private by Blackstone.
3. During this time it bought more companies including Change Healthcare and companies that worked on the provider and pharmacy benefits side.
4. It then…rebranded the entire thing to Change Healthcare which was a much smaller company and brand name? There’s a story there for sure.
5. Change Healthcare combines with a bunch of McKesson IT assets, where McKesson is the majority holder. This spins out and goes public.
6. Change gets bought by Optum.

A lot of clearinghouses have a similar story (see Availity or Waystar’s S-1). The result is that the clearinghouse industry consolidated to a very small number of players, with basically a small handful dominating the market (Change, Availity, Waystar, Navinet, Relay Health). In its value proposition to investors, Change explains how 2/3rds of transactions go through its clearinghouse and how “the healthcare system wouldn’t work without Change”. What an oddly specific claim to make! Hope that doesn’t come back to bite them!

During this time, the providers and payers themselves were consolidating as well. The end result is a ton of janky, haphazard integrations under the hood. A disgusting mishmash of legacy tech that God’s light doesn’t reach.

It also makes it incredibly sticky; trying to rip and replace all of these integrations is a massive pain and honestly for the most part it’s been ~*fine*~. Until now dun dun dun.

Fallout from the hack

Change has been down now for two weeks. Millennials are sobbing wondering which button turns on the fax machine. The Boomers are “I told you so”-ing and whipping out the pen and paper, writing it in cursive just because. Gen Z are dgaf and posting on r/antiwork about it probably. 

Operationally, most places have ways to “delay” the claim being sent, but you need to guess how much patients owe in copays or if their insurance is actually valid. Plus you need cash to actually make payroll, so you can only delay so long. The Reddit threads are going absolutely nuts and a lot of people are basically saying this is the last straw and they’re leaving healthcare.

There’s still a lot of information coming out slowly, but the general gist is that the ransomware group BlackCat is behind it and UnitedHealthcare has potentially paid them out $22M in Bitcoin. I would have personally paid $22M just to see United try to set up a Bitcoin wallet.

And as you can imagine, paying the ransomware still has not resolved the issue. Because…guess what…they paid the criminal group BlackCat and BlackCat didn’t pay the subcontracted hacker that actually found the exploit! That hacker actually holds all of the data! I cannot believe the criminals did not keep their word!!! There is a very funny joke about subcapitation that I cannot think about right now cause I’m just laughing at the absurdity that they paid the wrong person.

Even when the systems are back up, it will likely take months to actually figure out who all needs to get paid and go through the backlogs of everything.

Let’s just get all the jokes out of the way:

• “Change Healthcare hasn’t resolved it because the hackers required a prior auth guffaw guffaw”
• “It’s taking this long because the hackers required additional documentation”
• “United can do a peer-to-peer with the criminals”
• “BlackCat did $22M in revenue, that’s more than any digital health company”
• “Change healthcare? More like Change vendors”

Beyond the jokes, let me just rattle off a bunch of thoughts and questions that are on my mind after this hack.

• Let’s be clear about it - the entire issue here is consolidation. Core parts of the US healthcare infrastructure are run by oligopolies at every node that interlock with each other. Change is not even the biggest player on the pharmacy clearinghouse side, tomorrow it could be RelayHealth which is much larger. I don’t think the FTC will ever win a case on vertical integration despite it trying 13x times with UnitedHealth, but I think unwinding horizontal consolidation is much more plausible. Maybe this episode gives the FTC some ammo to focus on infrastructure companies.

• In the parallel universe of financial services, the Federal government launched FedNow to offer Automated Clearinghouse solutions (aka ACH payments) as an alternative to the private bank owned ACH rails. This episode feels like a good time for the government to launch their own clearinghouse alternative in healthcare, since they seem to have the capacity to do so.
• Relatedly, when does this feel like a national security issue? The Tricare pharmacies were all affected, so veterans couldn’t get their meds. Going from Call of Duty to Call for Refills.
• This feels like the Silicon Valley Bank moment but for hospitals, payers, and pharmacies. Once you’re a few days from figuring out if you can make payroll, everyone suddenly will want to be hedged and use multiple clearinghouses.
• I can understand the logic of why the ransomware was paid, but this potentially has bad second order effects. This now signals that taking out healthcare infrastructure pieces is a good business for hackers, and there are LOTS of vulnerabilities because of how old and consolidated the system is. I can imagine with AI deepfakes that social engineering related hacks will get more sophisticated as well. Cybersecurity companies have an opportunity and price point now to point to.
• This episode solidifies the idea that I am going to die before the fax machine does.
• Shutting down the systems was only one part of this fiasco. A bigger concern is what the breach of health information looks like. The largest health breach previously was Anthem at a whopping 78M records, which had the hilariously tiny fine of $16M. Change says it took down the systems when it realized they had access, so it’s still difficult to say how much data they accessed. But this breach could be 2x larger or more. If the fine is negligible, HHS is signaling that companies do not need to care about privacy and we should stop the charade that patient data protections matter. 
• Between the Change Healthcare hack + the Equifax hack, we should default assume all of our social security numbers and now a lot of our private health data are available to purchase on the dark web. Too bad they’re now going to have to deal with the clusterfuck of cleaning claims data like the rest of us (wow we’re seeing a lot of blackcat domains signing up for the claims 101 course).

• While people are skewering United for a whole host of reasons, I actually think this entire fiasco might have been an even bigger disaster if Change was still independent. United knows how in the crossfire they are, so they both have the resources and impetus to resolve this quickly. 
• The biggest losers in this have been independent practices and pharmacies. Many of them operate with a few weeks of cash as a buffer and they also struggled to switch using clearinghouses more than hospitals and pharmacy chains. For some reason they are being excluded from the HHS relief funding. Optum has offered to provide some loans, but physicians online + in my circles have said the loan amounts are somewhere between 1-5% of the actual claims they’re owed. Apparently the AHA says the terms of the loan are bad. I take whatever the lobbying groups say with a grain of salt, but:

“Second, the terms and conditions of the agreement are shockingly onerous. Among other things, your form agreement: (1) requires repayment of loans within 5 days of receiving notice; (2) allows your bank, Optum Financial Services, to recoup funds “immediately and without prior notification”; (3) permits Optum to change the agreement simply by providing notice; (4) requires providers to give UnitedHealth Group and its subsidiaries access to past, current and future claims payment data; and (5) contains broad waivers of liability and strict limitations on damages.”

This is going to lead to more practices shutting down, people retiring early, and hospitals getting bigger. Just sad really.

• The academic papers out of this are going to be…absolute bangers. PhDs get a little horny whenever point in time dislocations affect a lot of people at once. How many patients ended up delaying their meds because of this and what happened to them? CMS is expected to relax prior authorizations for Medicare Advantage and Managed Medicaid during this - how does that end up affecting drug choice? How did claims data itself change during this three week period? Did it affect benchmarks for value-based care arrangements?
• Do…we need clearinghouses anymore? We do, of course, I mean banks still have clearinghouses. Unless?? No, that would be crazy. Or would it? At the edges there seem to be movement to a system where patients are given some form of upfront cost that’s decided. I wrote about it here + Good Faith Estimate provisions in the No Surprises Act are trying to implement this. If the payer, provider, and patient can all agree to a price for a specific visit type before the patient arrives then you should be able to just pay the provider at the point of sale, right? No healthcare clearinghouses needed.
• Maybe this is a sign that fee-for-service has perils and predictable revenue like a flat fee per month or yearly budgets which don’t require essentially analyzing every single patient transaction would make things easier. 

Those are some of the things rattling around my head and I’m sure more will come out. Tell me what your thoughts or experiences are about the Change Healthcare hack in a couple paragraphs or less.

Thinkboi out,

Nikhil aka. “Call me Change Healthcare the way I’m down bad”

Twitter: @nikillinit

IG: @outofpockethealth

Other posts: outofpocket.health/posts

Thanks to Vishnu Rachakonda who read drafts of this

P.S. We recorded an excellent podcast with the Carbon Health folks where they actually talk about tactical ways they use automation on the billing side and why they killed slack for product feedback, highly recommend checking it out.

--

{{sub-form}}

‎If you’re enjoying the newsletter, do me a solid and shoot this over to a friend or healthcare slack channel and tell them to sign up. The line between unemployment and founder of a startup is traction and whether your parents believe you have a job.