Episode 87 – Mr. Witty goes to Washington: Analysis on the Change Healthcare cyber-attack hearings.

Recap of Episode 86 of the FLATLINING Podcast

Matthew and Ron follow up on the Change Healthcare cyber-attack with the recent hearings on Capitol Hill by United Health Group CEO Mr. Andrew Witty on May 1st. Both Houses of Congress called Witty to testify so federal legislators could query him on a range of issues related to the cyber-attack. United Health Group (UHG) is the parent company of Optum and United Health Care (UHC). Change Healthcare is part of Optum. UHG is one of the world’s largest companies and the largest healthcare company by revenue in the U.S.

LIVE UnitedHealth Group stock price: UNH 0.00%↑

Matthew asked Ron to remind us of what happened with the cyber-attack and why it would require congressional testimony. He said that Change Healthcare, a company that acts as kind of a portal to process a wide variety of medical transactions, such as billing information between providers and insurers, prescription information between providers and pharmacies along with a variety of other information-driven medical and business services, was hacked by cybercriminals in February. The criminals then installed ransomware shutting down all these transactions overnight in February and lasting over a month. This resulted in providers not receiving revenue for filed claims and pharmacies not receiving prescriptions to fill for patients creating a tremendous backlog of all these processes, something regulators were keen to get answers on.

Ron said Change Healthcare was acquired by United Health Group, in October of 2022 and Mathew explained that the attack not only affected UHC insurance holders and providers but also providers that used Change Healthcare to process claims with other insurers. Ron further described that if a provider was using Change Healthcare for its clearing house, it affected all the claims to other insurers they were using the system for. Meaning that the practice did not receive any compensation for seeing patients during the shutdown. Ron said that “Change Healthcare handles about 15 billion transactions a year and touches roughly one-third of all the people in this country would have something flowing through Change Healthcare.”  Which, he said, means there is a lot of personal data flowing through that system.  

Matthew played a clip from Oregon’s Sen Ron Wyden, the Chair of the Senate Committee on Finance. He started by asking Mr. Witty about how many U.S. Military or U.S. Government employees’ data had been breached and about physicians not getting paid.  Sen Widen then asked how quickly Mr. Witty would be able to provide just how many and who in the U.S. Military or U.S. Government had their information breached. Witty, after some back and forth, agreed to “prioritize” the effort, but stopped short of committing to providing this information by the deadline Wyden set.  

Photo by Ian Hutchinson on Unsplash

Widen then shifted to the backlog of payments to physicians, some of whom submitted for payments in February, and Witty stated “Our belief at this point is that claims-flow across the entire country is essentially back to normal. Certainly, from a United Health Group’s perspective, we are paying claims as soon as they arrive.” Widen cut off Witty and said that “Providers are telling me, it’s going to take at least until June to clear the backlog.” He put Witty on the spot and asked, “Can you do that earlier?” Witty responded that they could move faster than that and explained that in the meantime they are providing some financial support and reiterated that by and large, the system is back to normal. Witty then asked the senator to put particular providers in touch with UHG to sort out individual issues, but Widen was not having it and stated with some exasperation, “Practically every provider I bump into says he is waiting to be paid.” Witty reiterated that all United payments are caught up and the Senator tried to pin down the CEO on the issue of waiving deadlines for timely fillings and appeals until everything is caught up. Witty said they are already waiving those deadlines.

Widen went for the next target and asked Witty if they would commit to “paying meaningful compensation to each provider and plan whose business operation you disrupted?” The UHG boss answered, “We are happy to engage providers to discuss that.”  Widen then instructed Witty to send him the description of how this compensation would work, before moving on to his next topic. Wyden then focused on how many people were actually impacted, citing the Department of Justice which reported in 2022 that Change Healthcare retains nearly 211 million individuals’ information going back to 2012. He then called Witty out on some of his fuzzy math calculations accusing him of downplaying the impact and asked three questions: what is the number of people impacted by the attack? where did they (UHG) find the files? and what medical information was stolen. Witty expressed that this is a “Top priority” for them and they had not seen any medical information but they had seen claims information. Widen, clearly frustrated, pointed out that UHG doesn’t know, because the committee has asked for this information and has not received it.  You can watch the entire two-hour testimony here.

Matthew stepped back in to get Ron’s take on what was said, and Ron went straight to the tightrope that Witty walked throughout the opening segment of the hearing.  He pointed out that Witty used key talking points and phrases such as, “We are committed” or “Top priority” and things are “Broadly back to normal” but without giving any clear answers to the senator’s questions and staying in spin mode with the congressman.

Ron pointed out what Witty said about no medical records had been stolen, which sounds good on the surface, and explained that anyone inside the medical business would know that claims information, something Witty said they know was taken, can very easily tell you exactly what treatments a person was receiving and for what conditions. Ron said he understood that Witty is the CEO and is not going to come right out and admit failure to the U.S. Congress, but he said his answers were a bit frustrating to listen to.

Matthew brought up another Senator’s question, Sen. Bill Cassidy, the senior senator from Louisiana and a physician, asked if UHG was too big to fail. Ron described that Witty’s answer to this question tried to downplay their size, playing a shell game by stating that UHG employed less than 10,000 physicians and “contracted or affiliated” with another 80,000 that “voluntarily” work alongside their Optum team. Matthew and Ron chuckled at this statement as the Fulcrum team has discussed on numerous occasions the large number of physicians that are under UHG’s employment. Ron clarified that Witty’s answer to try and make it sound like physicians working for UHC, or with Optum, were somehow not employees of UHG was disingenuous and he provided some clear parallels to his own company demonstrating the absurdity of the response.

Matthew pointed out that the whole discussion around the number of doctors employed by UHG did not really address the question. Ron agreed and stated that when you have a company as large as UHG and there is a problem like the cyber-attack, the scale of the issue is problematic. Then, he said, add to the fact that this issue is in the healthcare space, it is very serious. When failures happen, people don’t get the care or medicine they need and in extreme cases, people could die, he noted.

Matthew shifted to the House committee hearing where Mr. Witty appeared in front of the Subcommittee on Oversight and Investigations on the same day. He played a clip from Georgia Rep. Buddy Carter, who owned pharmacies in southern Georgia for 32 years. He talked about UHG’s vertical integration and how it affects accessibility and to him there appears to be a conflict of interest when one company owns that much of the healthcare delivery system. He asked Witty how many practices UHG acquired since the cyber-attack, and Witty responded that they have acquired one practice and two Independent Physician Associations (IPA) since the attack, but he stated that their valuations were calculated prior to the attack, and they would never use the attack as an opportunity to take advantage. You can watch the hearing here.

Matthew said there was speculation by some about UHG purchasing more practices in the wake of the attack, pointing out Witty’s counter-statement to this idea.  He then brought up the amount of loans UHG was offering to providers that were impacted by UHG’s failure. Ron’s take was that Witty was accurate in his statement, but the better question would have been “How many practices during the attack have you either come to terms with acquiring or approached to acquire but won’t close the deal until after.” To Ron that would have given us a better number, since there could have been someone who wasn’t going to sell, but during the Change Healthcare shutdown, decided they would. He reminded us that these deals take months to complete.  Ron admitted that even if asked this question, Witty would not have answered it directly anyway given his responses to other questions.

Ron went on to explain the “loans” that Witty mentioned stating that these were interest-free loans given out to those impacted. These, he said, would remain interest-free up to 45 days after UHG has confirmed operations had returned to normal.  Ron pointed out this approach begs two more questions. One, how long will it take until the backlog of payments is cleared? And the second, is UHG going to pay interest or damages on the lost revenue? He pointed out he is familiar with several practices that have had to reach into their lines of credit to make payroll, pay utilities, etc. The answer, in his opinion, to this second question is no, United is not going to pay any type of damage compensation.

Ron reminded us that while doctors were not getting paid, UHG continued to receive premium payments from employers and members, and not paying out claims because of the cyber-attack.  He also explained that when insurers receive premiums, they invest those funds. So, it’s not like UHG is going to take a huge financial hit over this issue. Ron was glad that UHG is loaning out funds and said they should, and probably ought to do more.

Matthew then asked Ron if we were looking at possible class action lawsuits from providers or others. Ron said yes and speculated that the team at United might be thinking this could not have come at a worse time since UHG is being investigated by the Dept. of Justice for antitrust and anticompetitive behavior. Not that these issues are tied together, but it doesn’t look good, he said. Matthew pointed out Sen. Elizabeth Warren asked about this investigation, to which he said Witty would not acknowledge it even though it is being reported publicly. Ron said, the investigation is probably Witty’s biggest concern, and acknowledged that Witty is not the first CEO to come to Congress and take a beating then get on his private jet and go home. But if UHG is broken up, he said, that could affect the stock price, which is a problem for Witty.

Ron put things in perspective when Witty finally admitted that they had paid the ransom of $22 million. He said that UHG made $23 billion in profit last year, so the ransom was one-tenth of one percent of their profit for 2023.  He pointed out that is like someone who makes $100 thousand in profit paying a fine of $100, not likely to impact the bottom line much. Ron wished the congressmen would have asked “Why did you not pay it sooner?”

Matthew asked Ron if we are likely to see more congressional interest in UHG and their behavior. Ron said the political aspect of this event makes United a good target for elected officials on the right and the left which was on full display in the hearings. He expects to see United keep their head down, take the body blows, and hope the Dept. of Justice investigation goes away, and probably not do much until after the election in November.  If United tried to make a big acquisition, for example, and try to buy Humana’s Medicare business, “That would cause all sorts of problems.” He said.

Matthew wrapped up and thanked Ron for the in-depth analysis covering one of the biggest healthcare stories this year and reminded us you can always stay up to date on important healthcare news and analysis by visiting FLATLINING.net.