Change Healthcare Outage Prompts Switch in Pharmacy Claims Processing, Cranks Up Tensions Between Independent Pharmacies and PBMs

As the outage of Change Healthcare triggered by a cyberattack extended into its seventh day today, prescribers scrambled to find other ways to get pharmacy claims processed and leaders of an organization representing community pharmacists expressed frustration with how pharmacy benefit managers (PBMs) are handling the crisis.

A status update on an Optum website at 9:30 a.m. EST this morning repeated the wording of numerous other status updates during the past several days, saying that “the disruption is expected to last at least through the day” and that the company had a“high-level of confidence that Optum, UnitedHealthcare and UnitedHealth Group systems have not been affected by this issue.”

Change Healthcare is part of Optum, which is the healthcare services division of UnitedHealth Group, the largest healthcare company in the U.S. by many measures that is best known for its United Healthcare health insurance products.

UnitedHealth said in an email sent late last night that the company estimated that 90% of the country’s 70,000 pharmacies had adjusted their claims processing to limit the effects of the Change Healthcare outage. The company also said in that email that both Optum Rx and UnitedHealthcare are seeing “minimal reports” of effects on the dispensing of prescriptions with less than 100 out of more than 65 million PBM members not being able to get their prescriptions. Hospitals, health systems and providers have connections to multiple clearinghouses and access manual workarounds, the email said.

Kraig McEwen, MBA

“We are getting slammed by volume,” Kraig McEwen, MBA, CEO of RedSail Technologies in Spartanburg, South Carolina, said in an interview with Managed Healthcare Executive yesterday.

RedSail operates PowerLine, pharmacy claims processing software that, like Change Healthcare, connects prescribers to PBMs for payment of claims and information about coverage, copays and possible drug-to-drug interactions.

McEwen said RedSail is working cooperatively with Change Healthcare to take over some of its claims processing while the Change Healthcare systems are disconnected as a way to limit the damage of cyberattack that UnitedHealth says started on Feb. 21. The number of claims PowerLine is processing has doubled since the outage, McEwen said.

McEwen described Change Healthcare as being cooperative and communicative during its cybersecurity crisis and had harsh words for the perpetrators of the attack that led UnitedHealth to disconnect Connect Health’s systems. In an Securities and Exchange Commission filing last week, UnitedHealth said it had identified “a suspected nation-state associated cyber security threat actor.”

“People are dying in this country because of these ---------,” McEwen said.

The Change Healthcare outage has played into the long-running antagonism between small, independently owned pharmacies and the PBM industry, particularly the major PBMs.

“Our frustration has been lack of prompt information from the pharmacy benefit managers,” Patrick Berryman, senior vice president of special projects and relationships at the National Community Pharmacists Association, a trade association for independent pharmacies, said in an interview yesterday.

Patrick Berryman

The association’s public affairs staff said the association sent the Pharmaceutical Care Management Association (PCMA), the main trade association for the PBM industry, a six-point email on Friday [Feb. 23] that asked the PBMs to relax a variety of rules in way they might in during natural emergency, including those covering utilization management, proof of delivery and proof of copay collection.

Related: UnitedHealth Group Unplugs Change Healthcare Information Systems To Contain Cyberattack

The association’s public affairs staff says PCMA has acknowledged receipt of that message but has not responded in a substantive way. PCMA did not respond to a request for comment from Managed Healthcare Executive.

Berryman said the uncertainty about claims processing and whether patients’ drugs are covered and their copays means pharmacies may have some financial exposure as a result of outage. He also expressed by future audits by the PBMs. “All the risk really falls on them [the pharmacies],” he said.

Berryman said Optum Rx, the PBM owned by UnitedHealth Group, is the only PBM that has communicated with pharmacists to provide guidance. Optum Rx suggested supplying patients with three-day’s worth of medication, he said, although it didn’t offer any assurances about the financial risk some pharmacies might be facing.

“There has been very little communication out there,” said Berryman.

Change Healthcare, which UnitedHealth Group acquired for $13 billion in 2022, provides a variety of healthcare data handling and analytics services. But in this context of pharmacy claims it is known as a switch that conveys claims and coverage information about a prescription digitally from a prescribing location to the PBMs and the PBMs, in turn, send information back about coverage, copays and so on. Switches have been compared to funnels that gather information and channel it between prescribers and PBMs and also to air traffic controllers that guide information to the appropriate parties.

According to McEwen, there are roughly 80,000 prescribing location in the U.S., which include hospitals, clinics and other providers in addition to pharmacies and other retail outlets. McEwen said his company, which was founded in 2020 and is funded by private equity investors, is the switch for 10,000 of those locations. The rest of the market is dominated by McKesson but Change Healthcare is the second largest with roughly 25% share. McKesson has put its switch product under its CoverMyMeds brand, but McEwen said that most people who familiar with this niche of the drug supply chain continue to refer to it by its traditional name, RelayHealth.

Change Healthcare as a switch provider has been strong among independently owned pharmacies, regional pharmacy chains and regional supermarket chains that have pharmacies, McEwen said.

Berryman said it is not uncommon for switches to have short outages of the kind commonly seen with software glitches. He said there was no indication from a prior event or outage that Change Healthcare was vulnerable to a disabling cyberattack.

McEwen said the cyberattack and disconnection of Connected Health is the consequence of aging healthcare information systems in the U.S. that haven’t been adequately updated in decades. “The healthcare information infrastructure in the U.S. is archaic and hard to protect,” he said. McEwen presented his company’s technology as an up-to-date counterexample that is cloud-based and with built-in security features.