MONTPELIER, Vt. – On February 21, 2024, Change Healthcare (Change), a subsidiary of United Health Group (UHG), experienced a widespread cyberattack which impacted healthcare providers, insurers and policyholders across the country. Change provides clearinghouse and administrative services for healthcare payers in Vermont, including Vermont Medicaid, MVP Health Care, Blue Cross Blue Shield of Vermont and Cigna.
Significant operational disruptions to consumers and healthcare providers across the state have occurred, which include:
- Impacts to billing and care-authorization portals.
- Delays for filling prescriptions.
- Provider and insurer issues with processing claims, billing patients and checking insurance coverage for care.
- Ability for providers to pay workers, buy medicine and supplies.
At this time, Change has not confirmed whether Personally Identifiable Information (PII) has been accessed. If the Department of Financial Regulation is notified that PII was accessed in this cyberattack, it will ensure that affected consumers are notified in accordance with Vermont law.
If consumers believe they are improperly required to pay for covered services or medications, please contact their health plan using the phone number on the back of the member identification card or on the health plan’s website.
The Department is also urging consumers to be on the lookout for scams that seek to capitalize on the uncertainty caused by the Change cyberattack. The Department has already received reports of scammers contacting consumers purporting to be representatives of Vermont hospitals, telling them that they are entitled to a refund because of the cyberattack if they provide a credit card number. Consumers who receive unsolicited phone calls purporting to be from either their health insurer or a healthcare provider relating to the Change cyberattack should hang up. Neither health insurers nor healthcare providers will ask for a credit card number over the phone to initiate a refund of payment.
United Healthcare Group has issued an initial timeline for incremental restoration of services, available through its statement here. It is not clear how this will impact Vermont Medicaid’s services, or Vermont providers using Change Healthcare Platforms, but full recovery may take several weeks.
If you see or hear a communication relating to the Change cyberattack that you think is deceptive, misleading or a scam, report it to the Department by email at dfr.insuranceinfo@vermont.gov or by phone at 800-964-1784.
Additional payer-specific information and resources are linked below:
Downloadable PDF of this Consumer Alert available.
__________________________________________________________________
Connect with the Vermont Department of Financial Regulation on Facebook, LinkedIn and X (formerly Twitter).