UnitedHealth CEO Andrew Witty testified before the Capitol Hill Senate Finance Committee in Washington on May 1, 2024.
Kent Nishimura | Getty Images
Following a massive cyber attack UnitedHealth Group’s Healthcare Unit Changes Last year, the company launched a temporary funding assistance program to support medical practices with short-term cash flow needs, offering profit-free loans with no additional fees.
A year later, UnitedHealth is actively chasing borrowers, “quickly repaying” their outstanding balances, according to documents viewed by CNBC and funded providers. Some groups are being asked to repay hundreds of thousands of dollars in a few days.
Optum, the Financial, Pharmacy and Care Services Arm of UnitedHealth, informs borrowers that they reserve the right to “settle claims paid” against their practices. This means that the company withholds individual funds until it collects the loan.
This is a major change in attitude for the company that was cyberattacked in February 2024 and breached data from around 190 million Americans, the biggest medical breach in US history. The subsequent disruption has resulted in serious fallout throughout the healthcare system, with many providers temporarily unable to receive payment for their services. Some have soaked up their personal savings because they floated their practices.
During a senator’s hearing about the attack in May, UnitedHealth CEO Andrew Witty said they should only pay off the loan if “not me, they make sure that cash flow is normalized.”
Several doctors who used the funding told CNBC they were unable to meet the company’s new needs. Dr. Christine Meyer, an internist who began practicing in Exton, Pennsylvania, received a letter from Optum earlier this month telling her to submit payments for her organization immediately.
“We are not in a position to start paying off this loan,” Meyer, who started practicing about 20 years ago, told CNBC. She was a critic of United Health’s voices following the violation.
“At this point, we’re just looking at all the legal options,” Meyer said. “But it obviously doesn’t happen to pay $750,000 in five days.”
UnitedHealth did not comment on any particular cases, but a Change Healthcare spokesman confirmed that the company has begun collecting the loan.
“Now, more than a year after the event, we have begun a process of collecting interest-free funds that we provided to our providers as our services have been restored,” the spokesperson said in a statement.
The company said the U.S. Department of Health and Human Services took the same approach last year “under its own cyberattack lending program.” HHS launched another fundraising assistance program through the Centers for Medicare and Medicaid Services last March. CMS said it will automatically collect payments from Medicare claims, and that providers can earn interest, according to the release.
“We continue to work with providers on repayments and other options, and continue to reach out to providers who have not requested details on previous calls or email requests.”
The provider was said to have reserved the right to withhold future payments when UnitedHealth signed up for its funding assistance program, the company added. CNBC independently reviewed copies of the program’s loan agreement and confirmed this statement.
Changes to Healthcare, which provides payment and revenue cycle management tools, were acquired by Optum in 2022.
After discovering the violation last year, UnitedHealth said it had isolated and disconnected the affected system. The company paid more than $9 billion to its providers in 2024, and more than $4.5 billion has already been repaid, according to its fourth quarter revenue report in January. UnitedHealth said providers will receive invoices once standard payment operations resume, and will be subject to a 45-day repayment period.
“A change in HealthCare will notify recipients that the billing or payment processing service will resume and that the funds will be paid after payments are processed during the service’s disruption period,” the website says.
Decreased deposits, loss of revenue
According to UnitedHealth’s CyberTack Response website, the majority of Healthcare’s services were restored during the last year, but three products are still listed as “partial service available.”
And the doctor is still upset.
Meyer said when the violation occurred, she saw daily deposits of practice shrink from the $60,000 to $80,000 range to “a night” of about $150. She applied for Optum’s temporary fundraising assistance program and after some difficulty and traveling between the company, she eventually received a total of $756,900 in financial support.
Former Senator Bob Casey Jr., D-PA. shared Meyer’s story at a council hearing in May. He was resourceful about the company’s approach to the repayment process.
“I would absolutely want to confirm with you and Dr. Meyer that I am not going to ask you to pay off the loan until after we determine that her business is back to normal,” Witty told lawmakers. “Even then, we will not ask for repayments up to 45 business days to 60 calendar days after that.
“So, is that a decision she’ll do?” Casey asked.
“That’s definitely right,” Whitty said.
Meyer said that wasn’t what happened.
UnitedHealth Group Inc. is headquartered in Minnetonka, Minnesota, USA
Mike Bradley | Bloomberg | Getty Images
She received a notification from Optum on January 24th that CNBC viewed. This demanded repayments since “most clients’ service disruptions have ended.” Meyer called and said she was “not in a position to pay” to the company.
Meyer claims her practice lost more than $1 million in revenue due to changes in healthcare cyberattacks. She told CNBC that the figures are based on forensic financial analysis made by comparing claims against payments in recent years. Meyer said the $1.2 million figure accounts for losses not only for UnitedHealthcare, but for all insurance companies.
On April 1st, Meyer received another notice requesting immediate repayment within five business days. The letter was addressed to Meyer. However, the name of the letter practice, insight counseling, and the total amount of $925,200 was wrong.
Meyer said she called Optum again and was told by the company that she made a mistake, but that she had five days to pay off the actual total of $750,000. At that point, the company began withholding payments for UnitedHealthCare, which she described as her “shakedown.”
Meyer said her practice typically receives annual billing claims of around $150,000 to $200,000 from UnitedHealthcare.
“I think we’ll just have them get those payments back for the next three years until they get their money back,” she told CNBC.
In a LinkedIn post Thursday, Meyer wrote that she and her team “planned to leave minimal money in the accounts set up to receive payments from UnitedHealthcare. If it wasn’t there, they wouldn’t be able to get it.”
“A very frustrating experience”
Dr Purvi Parikh, an allergy and immunologist with personal practices in New York, shared a similar story.
Parif’s practice received approximately $440,000 in funding assistance following the violation. She began obtaining repayment notices later last year, saying Optum is threatening to offset claims paid in practice.
“We’ve already been hit very hard by the healthcare hack changes,” Parif said in an interview. “Additionally, they’re going to either get all this money back or pay the ransom for future payments. It was a very frustrating experience dealing with Optum.”
Parikh’s practice required a month’s extension in January with a final payment of $101,650, preventing UnitedHealth from withholding other payments. In an email request, a colleague at Palic wrote that “financial recovery is extremely difficult.”
Optum has given extensions to Parif’s practice.
“People don’t just have a sum of money to sit,” Parif said. “We paid it all back, but it wasn’t without our struggles.”
On Friday, the American Medical Association sent a letter to Optum urging the company not to use a “one size fit” approach to paying off loans. The AMA also urged Optum to respect its commitment to allowing doctors to decide when to begin the repayment process.
“Each practice requires a repayment plan that does not replicate the same disastrous financial straits experienced during cyberattacks when the CHC system was non-functional,” writes Dr. James Madara, AMA CEO.
A doctor who runs pediatric care in New Jersey said UnitedHealth has already begun withholding payments from the organization. The practice received more than $500,000 in funding support following changes to Healthcare Breach.
The doctor, who asked not to name due to the sensitive nature of the situation, said he began receiving calls and emails from Optum, demanding repayments, starting late last year. The group showed that they had no money but had started a payment plan and started the process.
However, doctors said the claims agency noticed UnitedHealth was already beginning to curb bill payments. The benefits description detailing what the insurance company covers says, “The amount paid in this statement is used to repay the amount paid under an agreement with Change Healthcare Operations, LLC.”
WATH: Health and Human Services Department begins investigating hacks at UnitedHealth’s Change Healthcare
