Health Plan Weekly

The Biden administration has launched an investigation into UnitedHealth Group following the cyberattack on its subsidiary Change Healthcare, which caused significant disruption in payments and claims processing for pharmacies and health systems across the nation. Cyberattacks targeting the nation’s largest insurer — UnitedHealthcare — have been on the rise in recent years and exposed almost 750,000 patient records in 2023 alone, according to the HHS Office for Civil Rights (OCR).

Since 2010, UnitedHealthcare reported 21 data breaches to OCR that affected more than 829,000 members, with six of them caused by hacking or IT incidents. As of March 14, the most recent Change Healthcare data breach has not been filed to the OCR breach portal. To meet the requirements of the HIPAA Breach Notification Rule, OCR must be notified within 60 days of the discovery of a data breach.

At least seven states plan to raise capitated payment rates to their contracted Medicaid managed care plans in fiscal year 2025, Modern Healthcare reported. Craig Kennedy, president and CEO of Medicaid Health Plans of America, told the publication that the rates are likely going up “because utilization is increasing post-pandemic.” The article noted that Arizona has proposed a 3% rate increase, California's draft budget includes a 3.8% hike and Missouri is considering a 2.5% raise for managed care plans. But New York plans to reduce insurer compensation by eliminating a quality bonus program and a 1% pay increase that expires this fiscal year. 

Doctors are raising the alarm about how health insurers are making it harder for patients to receive coverage for at-home ventilators, the Associated Press reported. The noninvasive ventilators help patients breathe by forcing air into the lungs, often through a mask, and they cost around $1,200 per month. Chuck Coolidge, chief strategy officer for the respiratory supply company VieMed, told the AP that insurance rejections — including both initial approvals and reauthorizations — have increased for patients with Lou Gehrig’s disease and chronic obstructive pulmonary disease. And one neurologist told the news outlet that UnitedHealthcare Medicare Advantage plans now deny nearly all initial requests for the ventilators. 

UnitedHealth Group faces a crisis as the fallout from the hack of its Change Healthcare subsidiary continues to spread. The firm is rumored to have paid $22 million to the hackers who may have caused the breach, even as it faces falling stock prices, federal actions to stabilize provider reimbursement, payer operations disrupted by the hack, and legal risk.  

A civil suit has already been filed against UnitedHealth due to the cyberattack, and the scale of the disruption may strengthen enforcement action resulting from a newly revealed federal antitrust investigation into UnitedHealth. Because of the cyberattack, payments to thousands of providers have stalled, causing a liquidity crisis for some practices. The hack also may have exposed thousands of other health care entities to data breaches. UnitedHealth’s stock price dropped from $521.97 on Feb. 21 (the day the breach was disclosed) to $478.78 at the close of business on March 7.  

While reinsurance programs have become popular among states hoping to stabilize their individual insurance markets, a new study makes a compelling case that the premium reductions attributed to such programs may not be as helpful as they seem. 

States can apply for and implement reinsurance programs via Section 1332 waivers, which allow them to waive certain Affordable Care Act rules in order to test marketplace innovations — provided they adhere to strict guardrails. Reinsurance works by subsidizing insurers’ highest-cost claims, allowing them to charge lower premiums overall. 

The Federal Trade Commission, Dept. of Justice and HHS on March 5 released a request for information (RFI) on private equity (PE) and “other corporations’” — including payers’ — ownership of health care providers, citing concerns over patient and worker safety, consolidation, and escalating costs. In a public event held that day, the agencies presented a deeply negative view of providers currently owned by PE and tipped further enforcement actions — including a heightened emphasis on legal coordination with state antitrust regulators. 

The investigation is just the latest in a series of ambitious health care antitrust moves by the Biden administration. The FTC has also launched investigations into PBMs, while the DOJ tried to block notable transactions like UnitedHealth Group’s acquisition of Change Healthcare — and in October launched a broad antitrust investigation into UnitedHealth itself, which became public in recent days. The text of the new RFI said it “complements” CMS’s recent, separate RFI on Medicare Advantage.