Original Story

A cyberattack on a health-care company has created problems for many patients trying to fill drug prescriptions. For some consumers, the hack has forced them to pay cash for expensive drugs, denied their use of pharmaceutical discount coupons or left them unable to get their refills at all.

The reason behind the chaos is a ransomware attack on a little-known company called Change Healthcare, which is believed to process 50 percent of the medical claims in the United States. But most people won’t know if the hack has affected their medical data until they try to fill a prescription or visit a doctor.

We spoke to experts about the hack and whom it has hurt. Here’s what they had to say.

What to know

• Who is affected by the Change Healthcare hack?

• What is the effect on people trying to fill prescriptions?

• What should I do if I can’t get my prescription filled?

• What other ways has the hack affected patients?

• Will cancer patients receiving chemotherapy be affected?

• What info did the hackers get?

Who is affected by the Change Healthcare hack?

The hack is affecting millions of patients, either directly or indirectly through their prescriptions, physicians and hospitals. But most patients whose health-care claims are processed by Change Healthcare aren’t aware of it, and won’t discover they have been affected by the hack until something goes wrong. The company is owned by UnitedHealth insurance, but it manages claims from many insurance providers. Change Healthcare says it manages 15 billion claims totaling more than $1.5 trillion a year.

The company works with tens of thousands of insurance companies, doctors, pharmacists and hospitals to help determine what patients owe. But the hack forced the company to shut down many of its systems. That means many hospitals and doctors can’t collect payments, and many patients can’t get their drugs paid for when they try to fill prescriptions.

Erin Fox, associate chief pharmacy officer at University of Utah Health, said part of the problem is that Change Healthcare hasn’t explained everything that’s been affected by the hack, so patients only discover their coverage has been affected when they try to fill a prescription or get treated by a doctor. “You kind of have to wait until it doesn’t work to figure out if it’s working or not,” said Fox.

What is the effect on people trying to fill prescriptions?

Patients tell stories of being billed hundreds or more than a thousand dollars for prescriptions that previously were covered by insurance. Some can’t get their prescriptions filled at all and drug company discount coupons also may not be working right now.

Nicole H., a 32-year-old in Connecticut, wasn’t able to fill a prescription of Caplyta that her psychiatrist prescribed for her bipolar depression. She asked that her full name not be used to protect her medical privacy.

Nicole said that she couldn’t get the prescription filled at all until her psychiatrist’s office called the pharmacy. Her pharmacist then told her the medication would cost $1,700 for a four-week supply because their system wasn’t working and her insurance wasn’t going through. “I left without the medication because I don’t have $1,700,” she said.

Nicole said her doctor gave her sample packs of the pills to tide her over until the issue could be resolved. She said her insurance is now working, but she’s still waiting for a drug coupon to be accepted again. Without it, her drug would cost her $450 a month. The coupon brings the price of the medication down to $15 a month.

“It’s creating stress in an environment where I need to reduce stress,” Nicole said. “I realize nobody can do anything for me, and it’s going to be okay, but I’ve had to spend a lot of time on the phone with six different parties and advocate for myself and that’s kind of tough to do when you’re struggling.”

Lynn Nye, 90, who lives in Edgewater, Md., tried last week to fill his prescription for verapamil, a blood pressure medication. The pharmacist told him they were not able to get through to his insurance company. To get his pills, he would have to pay $120 instead of his usual $10 copay.

“Fortunately, he wasn’t out of pills, so he opted to wait,” said his daughter Laura Nye Falsone. “I went in a few days later to try to get it, and the pharmacist told me the same thing, and that this was happening at pharmacies all over the place. So I didn’t get it then either.”

What should I do if I can’t get my prescription filled?

Talk to your pharmacist about your options. A CVS spokesperson said the pharmacy will work with patients “to ensure they continue to have access to their medication,” but declined to offer specifics on what they are doing.

Doctors may also be able to give patients sample packs of pills until the hack is resolved or offer a more affordable substitute prescription if the patient needs to pay out of pocket.

“Patients will have to try to work with their pharmacy, pay full price or maybe even go back to their doctor to try to get a medication they can afford,” Fox said.

What other ways has the hack affected patients?

Some doctors are having trouble getting prior authorization for tests, medications and procedures, so some patients may be delayed in getting medical care, said Anders Gilberg, senior vice president of government affairs for the Medical Group Management Association, which supports medical practices.

“Those providers are finding alternative vendors to Change, so that may be getting a little bit better from last week,” he said. “But every time you think something is resolved, it’s more persistent than many people thought it would be.”

One concern is that the hack has affected payments to hospitals and providers, and some may not be able to pay their workers, which could ultimately lead to delays in patient care.

When that happens “decisions may be made around elective procedures and rescheduling,” said Mary C. Mayhew, president and CEO of the Florida Hospital Association. She noted that hospitals have experience with various crises, and “they are very focused on how to regroup and reprioritize their resources to sustain access to services for as long as they can.”

Jesse M. Ehrenfeld, an anesthesiologist and president of the American Medical Association said the hospital where he practices couldn’t fill prescriptions for five days because of the hack. He said he is hearing from practices all over the country that they can’t send claims, verify coverage or get prior authorization for care.

“A considerable number of these processes have ground to a halt,” Ehrenfeld said. “It is a huge financial hardship. Most practices don’t carry cash reserves and are totally dependent on cash flow being tied to timely claim submission and payment.”

Will cancer patients receiving chemotherapy be affected?

Oncologist Barbara McAneny, chief executive of New Mexico Oncology Hematology Consultants, treats cancer patients in Albuquerque and Gallup, N.M. Because of the hack against Change Healthcare, she’s concerned that she won’t be able to make payroll or pay for the chemotherapy her patients need. Her practice spends about $5 million every month on cancer drugs. She also needs the money to pay 270 employees, but right now no cash is coming in.

“This affects way more than just prescriptions,” said McAneny, also a former president of the American Medical Association.

She said that during normal operations, she’s not allowed to bill insurance companies or Medicare directly. All bills go to Change Healthcare first. “So when the clearinghouse got hacked, none of our claims went anywhere,” she said. “All of a sudden, I can’t prescribe anything for my patients. I can’t submit a bill or get any cash back.”

McAneny said she has a limited supply of chemotherapy she can give to patients for the next week or two. She’s also asked her physician colleagues to forgo paychecks for now. “With them hacked, everything is shut down. No bills are going out, and no money is coming in,” she said. “I don’t have $5 million sitting around in reserve. How can I get the chemotherapy my patients need?”

She said the practice has asked its chemo distributors to send the drugs now and give the practices 90 days to pay. “I’m hoping they will agree,” she said. “We can’t let patients go without treatment. If they can let us pay after 90 days, we can weather this and treat our patients on time.”

What info did the hackers get?

The hackers stole data about patients and encrypted company files. “This is definitely a concern,” said Cliff Steinhauer, director of information security and engagement at the National Cybersecurity Alliance. Change Healthcare “hasn’t given us an idea of what’s been taken or held, but with medical records, there’s plenty of personally identifiable information and sensitive health information that can be used again.”

AMA’s Ehrenfeld said the hack appears to include banking information for medical practices that receive payments. It’s not clear whether the hack includes patient banking information. “We are very worried about the impact of the breach,” he said. “There has been no clarity about what data was compromised or stolen. They haven’t said anything about any loss of data, and there are significant concerns about data privacy — not just about patients, but also about practices. Remember: they all have our bank account information.”