Transcripts For CSPAN2 UnitedHealth 20240703

This is two hours and 15 minutes. I ask all of her guests to please take their seats. The chair recognizes himself for five minutes of an opening statement. Todays hearing is about what is likely the most consequential cyber attack and healthcare history. How could Something Like this happen . How did consolidation and Health Insurance industry reach such a state that a single ransom or attack on one company crippled the flow of payments and claims for months. Change healthcare unitedhealth club subsidiary for the Cyber Security attack. Roughly 50 of claims a passthrough or touch changes clearinghouse providers have this much of the medical claims process the market share it makes them a large target for bad actors. Its even more sounding when you consider the attack itself reportedly compromise without multi factor authentication. I am concerned about patients who have been affected. Many patients were left left out of pocket for medication the pharmacy cannot process their claims or copay coupons. With that copay assistance. People walk away from diabetes medicine, antipsychotics adhd medication. One specific example is a patient having to pay 1100 for medication the pharmacy is not able to process or copay assistance card due to the cyber attack. Contractually obligated to pay for these medications. To either walk away page large sums of money for their medications or even having to borrow money from friends providers work initial phase they were provided deep uncertainty how to float on interrupted. There was minimal all shrinking bringing expenses for the provider such as switching clearinghouse theirs and managing prior authorization. It is perfectly troublesome because of doctors to keep their practices open. By shutting down its clearinghouse effectively stopping all payments on claims make it more difficult to continue providing service. One suburban philadelphia physician who run a 6 milliondollar practice was offered only 3300 bite unitedhealth emergency loan program. She might have to sell her practice. How many millions of dollars of interest loan has united made from holding onto money that would have had to pay to providers for patients how many millions of surgeries, treatments and prescriptions were delayed or worse yet, were either canceled or did not take their medicine. I understand the substantial task united is facing while dealing cyber attackers are the bad guys look for an explanation why united did not have a backup plan. And if they did have one, it obviously failed resulting federal government had to step in and try to help. Additionally we do not know how many patients had their Health Information breach last week conceded personal Healthcare Information and data of a substantial portion of americans has been stolen. At this hearing i hope we can get an understanding of just how Many Americans fall within the united step edition of substantial portion. Even though united paid the ransom, we now have reports cyber criminals are releasing patient information, billing records and other personal and sometimes very private held by health group onto the dark web. Despite having paid the ransom. I have a sweet deal of these . The shed light on these issues to the understand the full picture. I can assure this clearly watching close am always willing to hold the followup earrings if needed. That being said i yield back that Ranking Member of the subcommittee for her five minute opening statement. Cyber attacks have become an unfortunate part of our daily lives. Companies know they need to be prepared. We are so interconnected online now. Communication, energy grids, Online Platforms and Health Claims clearinghouse is like change healthcare. They are all targets. Ransom workgroups and other actors are constantly probing corporate Government Systems for vulnerability. There are reports of major data breaches almost every week. Sometimes due to malfeasance. Sometimes by a sophisticated cyber hackers. Despite all the cautionary warnings, the largest Health Insurance country in was caught unprepared. Change healthcare it was just part of the maga health conglomerate United Healthcare, did not have basic Cyber Security protection in place. Because of that it suffered a ransom were attacked and once unable to recover its systems and reasonable period of time leading to serious harm to doctors, pharmacies and patients across america. Even with limited information that has been made public it is clear they were multiple system failures. First United Healthcare was not using multifactor authentication on a Remote Desktop application. Multi factor authentication is a very basic yet Effective Security measure every day americans have implemented on their mobile devices, Bank Accounts and email logins. In fact the department of health and Human Services is recommended the practice in 2022 through its publication Cyber Security practices for medium and large Healthcare Organizations specifically called out importance of authentic vacation in a june 2023 newsletter. And that advisory hhs noted multifactor authentication other processes stronger password work necessary promoted access. United healthcare ignored that advice. Second, it appears hackers roam through change Healthcare Systems for a week without being detected. Their essential network Cyber Security monitoring features that mightve picked up and flagged unusual user activity. That apparently did not happen here. Third, whatever user credentials dhec had access to it appeared to allow them to roam across the entire change Healthcare System unimpeded. And fourth in dhec were able to deploy at reservoir attack within the change Healthcare Network suggesting a lack of adequate controlled user permission that could have prevented software from holding their system valuable health data ransom. And fifth, there appears to be a lack of continuity the testimony states rebuilding your network it is unclear why there is not a reliable backup or continuity plan in place that need for Network Reconstruction dramatically reduce the amount of time for transaction to begin moving again. At each of these points failed whether its too properly invest in cybersecurity or lack of adequate oversight and accountability within the company it is an open question. The bottom line is there were multiple opportunities to prevent and mitigate this attack Unitedhealth Group failed that every single one. In case any other companys prickly Health Companies are sleep at the wheel when it comes to cybersecurity, this is yet another wakeup call. Cyber threats are pervasive and worsening. Ransom her attacks can hold the hostage most sensitive personal data ransom or groups to grow and carry out more attacks. There are no longer exceptional events. They are a constant and must be properly prepared. There there are lessons to be learned i want to make clear this crisis is not over yet by any means. There are pharmacies and providers that have not been able to reconnect Healthcare Systems there is a massive amount of personal Health Information alpha that needs to be accounted for. And in addition to the questions you will receive today there are numerous questions outstanding from this committee in a bipartisan letter that we will present to you and i look forward to the answers to those questions in a prompt manner i want to thank chairman for putting on this important hearing and i yield back too. A gentle lady yields back i recognize a chairwoman of the full committee for her five minutes of questions. Thank you for agreeing to testify before us today. I was disappointed your organization declined more original to testify on the cyber attack on change healthcare. One of your Subsidiary Companies we had invited you to testify in front of the Health Subcommittee but appreciate your cooperation in being here today. Most americans have likely never heard of change healthcare despite how crucial its a functioning is to ensure access to care. Change acts as a clearinghouse for 15 billion medical claims each year. That means more than 50 or right at 50 of all claims passed through change that covers everything from routine checkups of primary care physicians, to lifesaving cancer treatments with specialists. Things that way until recent weeks took for granted in 2020 to your Company Acquired change healthcare as a part of the growing into every corner Healthcare System. Under the United Health Group Umbrella recites Health Insurance company with more 40 million covered lives across commercial markets. Pbm managed one or 59 billion in drug spending last year. Provider group that owns roughly one and every 12 doctors in the United States. A bank that makes payday loans to providers. That is just a few of the ventures under your purview. I say this to emphasize the massive responsibility that comes with your position. With the family of fort being crushed by inflation you think they are forking over more than 20000 per year for Health Insurance Senior Citizen scenes the aarp brand under medicare products at taxpayer federals tens of billions in subsidies to your company there is a reasonable expectation they will get a baseline level of value for their hard earned money. I will set the bar higher. You have a responsibility to protect the data, the people who put their trust in you. Or more bluntly in this case you failed. On february 21st of this year change healthcare announced it was hit with a cyber attack. Severely disrupting the healthcare ecosystem for providers, payers and patients that have been more than two months since the cyber attack and according to your own Companies Websites change has yet to fully restore services. Many negative impacts for Healthcare System persists. Criminal hackers gain access to change healthcare through compromise credentials so they were remotely accessing the Company Portal nine days before the Company Announced publicly the ransom were attacked. This portal did not have multifactor authentication enabled basic protection about Cyber Attacks allow the cyber criminals to unlock the door and break into your system. Multi factor authentication would be a basic expectation for a company handling the breath of Sensitive Information that change healthcare it does. Its been reported your company paid a ransom we have grave concerns the precedents you created by rewarding more criminals i would understand it would be a difficult decision to weigh that against protecting americans data. But here is the problem. It did not stop the data leak. Americans are personal and private information is on the dark web. This is private health data you are responsible for protecting. I suspect that decision will be a case study in crisis of mismanagement for decades to come. I would be remiss if i did not know providers especially small providers and solar practitioners continue to provide uncompensated care and submitting claims cannot be processed it is been reported some are contemplating closing and others have forced to rely on volunteers to care for patients. Others have had to furlough staff so that employees can apply for other employment benefits. I would forward to hearing how this will be fixed as soon as possible. I will note in closing we are here today to learn more about what happened in the lead up to the attack what you are doing to fix it and prevent it from happening again. The American People the millions who rely upon changes, services of those whose information was leaked deserve answers. I yield back. A gentle lady yields a back record is the Ranking Member for five minutes of Opening Statements for. Resulted in a prolonged just to earlier this year. Cyber attacks cause serious harm to patients providers and pharmacies change healthcare platform reportedly involved with one of every three patients processing 15 billion transactions every year and as a result of this attack Healthcare Providers have suffered tremendous reimbursement patients have been out of pocket expenses or to delay treatment. Pharmacies have been unable to process claims. You have to change how consensus were taken offline on february 21st. Failed to provide clarity as to when it systems would be online again. In fact status updates the same language for over a week the disruption was i quote expected to last at least through the day. This frustrated the ability of providers and pharmacies to conduct their daytoday operations. Decide whether to use systems now over two months later the system is still not back to where it was. Its unacceptable it would not accept a bank or Internet Service being offline for weeks or months without a clear end in sight. Its wrong Healthcare Providers, pharmacies and patients continue to bear the brunt of the failure by corporation that earned three and 71 billion last year to either prevent or quickly remedy the situation. I am sure we would be hearing about the things unitedhealth has done since he Cyber Attacks help provide repairs. The bottom line is the Health Status security practice were woefully inadequate the company did not have a plan in place to quickly recover from such an attack and to minimize the damage to everyone impacted. Its true the Largest Healthcare Company in the country it feels like too little too late for all those who have been harmed. To make matters worse we still do not know the full extent of the damage from the cyber attack. Even if all the providers pharmacies remain hold the system returns to normal huge volumes of protected Healthcare Information or enhance of hackers. Unitedhealth announced last week that can affect the privacy and i quote of a substantial portion of people in america. As part of her working comprehensive federal Consumer Data Privacy and security legislation the committee has held numerous committees highlighting the importance of Companies Strong privacy and Data Security protections. Its extremely frustrating to have one of the Largest Companies in the world failing to meet its obligations under existing law that adequately protects them from the most sensitive personal information but we are talking about Sensitive Information about healthcare status, what medications we take what medical services we are provided. This never should have happened and it cannot happen again. Unitedhealth group must do the hard work of adopting strong Data Security practices that include protecting against such attacks and adopting plans that minimize the impact of social tax. Its going to take a lot of work to untangle this mess. The department of health and Human Services worked very hard throughout this crisis to minimize essential health program. Hhs work ahead examines what went wrong here and the harm caused by the staff potential release of protected data. Bottom line is a sweet learn more about what went wrong this committee should examine whether additional guard rail such as establishing several security requirements on medicare contractors whether they need to be in place to prevent this from happening again. This hearing is a good start want to thank the chair for holding it on the issues raising here that can close Opening Statements. Pursuant to Committee Rules all Opening Statements will remain part of the record. We ask you provide the Opening Statements to the clerk promptly. Want to thank our witness for being here today to testify before the subcommittee. Wise to practice squad on the senate side today followed by a round of questions. Our witness today sir Andrew Whitty chief executive officer of Unitedhealth Group. We appreciate you being here and look forward to hearing from you. You are aware the subcommittees holding an oversight hearing and doing so have a practicing cap testimony under oath she have any objection to testifying under oath . No i dont serve her. Seat no objection and hearing no objection we will proceed id also advise you pursuant to house rules you desire to be advised by counsel during her testimony today . No, sir. Succeeding none if youd please rise and raise your right hand. You promised or provincial truth, holds with the nothing but the truth shall be god . Witness has responded in the affirmative. Seeing he has done so you are now sworn in and under oath such as pam is set forth in title 18 section 1001 of the night states code. With that we will now recognize for five minutes for an opening statement. Thank you. Good afternoon chairman griffith, chairwoman, Ranking Member castor, Ranking Member. Thank you for the opportunity to testify here today. I served as chief executive officer of Unitedhealth Group. Our mission is to help people live healthier lives help make the Health System work better for everyone. We pursue this mission through two distinct businesses. United healthcare which provides which brings together care delivery Pharmacy Services technology and data to advance patient centered care. Change healthcare is now part it enables information claims and payments to flow quickly echoed between physicians, pharmacists, health plans and governments. I appreciate the committees interest in the recent cyber attack on change healthcare. As a result of this malicious siebel attack providers have disruptions worried about their private health data. To all those impacted limit be very clear. I am deeply deeply sorry our response of this attack has been grounded in three principles. Secure the systems to ensure Patient Access to counter medication and tube assist providers with their needs. We have the full resource if unit health group in this effort and i want to assure the American Public we will not rest and i will not rest until we fix this. Cyber experts continue to investigate. What we will learn more in our understanding may change is what i can share today. Cyber criminals enter the change healthcare portal x full traded data and on february 21 deployed rent somewhere. The part that access was not asked that our response was swift and forceful to contain infection we immediately connectivity secured the perimeter of the attack to prevent malware from spreading it worked there has been no evidence of spread beyond change healthcare. Within hours of the ransom ware launch we contacted the fbi. We continue to share information with them to make sure these criminals can be brought to justice. As we have responded to this attack included dealing with the demand for ransom overarching priority is meant to do Everything Possible to try and protect peoples personal Health Information. The decision to pay a ransom was mine. This is when the hardest decisions i have ever had to make. I would not wish it on anyone. As you know we found files in the next full traded data containing protected Health Information. Personally identifiable information. Which could cover a substantial proportion of people in america. So far we have not seen evidence that materials such as doctors charge for full medical history were given for it will take seven months before enough information will be available to identify customers and individuals partly because the files contained and that date at work compromise in the attack. Rather than waiting to complete this review we are providing free credit monitoring and theft protection for two years along with the Call Center Staff by clinicians anyone concerned their data may have been impacted should visit changes cyber support. Com for more information. Meanwhile we continue to mixed substantial progress and restore services. First, the team built a new Technology Environment in weeks. And secondly prioritize the restoration effort on services most vital to ensuring access to care. Pharmacy Services Claims payments to providers and third, all the efforts were underway we worked quickly to provide Financial Assistance as needed. We have advanced more than 6. 5 billion in accelerated payments no interest no fee loans to thousands of providers. Most of these funds are for claims for non healthcare plans about 34 of loans have gone to safety net hospitals and federally qualified Health Centers. We will provide this assistance for as long as it takes to get providers claims flowing at preincident levels. If there are providers in your district who need help please put us in touch with them. Fighting cybercrime is an enormous task and one that requires us all industry, Law Enforcement and policymakers to come together. I look forward to answering your questions today. Think if your testament will move into questions. As a question answer portion ill begin the questioning and recognize myself for five minutes. What does that mean customer chemistry talking 20 50 are we talking 70 ellis. We continue to estimate the data it involved we do think it will be substantial. Because we have not completed the process i am hesitant to be overly precise on that and be wrong in the future but i would not want to mislead anyone in that regard. I would not shoot to mislead us either. When you say substantial government range bottoms a high dont mind was talking 20 50 . I think it may be one third or some more of that. Okay and i appreciate you letting us know that as a suspect number the worst thing you can do is come here and tell us something that sounds like its a fact youre giving us and have it be difference i appreciate that. Your country is contractually obligated to place your Beneficiary Services and medicines. Your silk looking premium dollars and collecting interest on that money you heard me sing in the opening i am concerned about the issues. Particularly i am concerned about providers in particular concerned about the report of the lady who had to spend 1100 outofpocket and see understand in my district i dont think about this ladys circumstances thats private information. The average takehome pay and my district is 50037. So 1100 to the big amount of money even people make more than that dont generally keep 1100 laying around. What you all going to do to try to make those people hold . , thank you very much for the question. On the first part of your question concerning ongoing payment versus a premium that we collect. I want to reassure you we have lifted all claim holds we have for weeks been paying claims as soon as they arrive at the company. Very accelerated formats. We know not everyone in the marketplace is doing that but we certainly are. As far as the situation of the lady of described let me say how sorry i am to hear of the situation like that. I am aware there are clearly people about the situations. Probably thousands of them we dont know about. These particular situations two things i like to reassure you of first of all the systems are back online in terms of those coupons and card systems they are back online. We have and continue to honor any prescription fulfillment for somebody it was out of pocket in good faith. We will honor the outofpocket cost. If your office would like to connect us up we be happy. Develop the proper privacy forms we dont want to be guilty of giving away secrets. They going to have to fill out a lot of forms . A lot of folks particular about 1100 its 110 if you give them a lot of paperwork to do theyre going to say forget it. Or choice of words. [laughter] no and again thank you for the followup question. To fulfill a prescription or honoring those in good faith quick to look forward to work at the on that one to solve this for all americans i look forward for toremove your company on th. I want to get to its one of those things may be an unintended consequence but i think it is a consequence. Medical practices. What we are hearing is a lot of practices are particularly in underserved areas anyway. Your company is willing to buy the practice which i think is good on its face. But, as you heard chairwoman or rogers say, one in 12 positions are doctors currently works for one of your subsidiaries already. This is giving you all a leg up on buying other practices. How many other clinics do you think were hurt by the cyber attack question mr. Chairman, thank you very much for the question. Just hundred 10,000 physicians and our practices member they talk about much larger number. That includes those over to make sure thats clear. Since this attack went to reassure you in that situation i was a transaction which was negotiated. My time is running out. Any other practices youre about to require . No not at all. I recognize member of the subcommittee for her five minutes of question progress one of the most aspects of the cyber attack how unprepared Unitedhealth Group your testimony states you are perpetually bombarded with attempted intrusions. Roughly one per minute. Change healthcare may 2022 filing extensive disclosures about the risks of eight cyber attack and the processes it has in place to mitigate the risk. That filing specifically stated quote is our employees and Business Partners employees work from home and access our system remote lately may be subject to heightened Security Privacy at risk. Including risk of cyber attack and privacy incidents. You are clearly on noticed your companys networks were regular targets for attacks and Remote Access in particular was potentially vulnerable. But that being the case why is it one of your Remote Access applications did not have something as basic as multifactor authentication enabled and is it the case it was never enabled gorgeous and not enabled at the time of the cyber attack . Congressman thank you very much for the question. We are continuing to investigate exactly why it was not on that particular services it clearly was not. I am as frustrated as you are the timing of the declarations you just described. We change healthcare it was a relatively Older Company with older technologies which weve been working to upgrade since the acquisition. For some reason which we continue to investigate this service did not have. It is not clear today. When on why was it activated . Has been going on over the last several weeks there that should have been done that were not. Who is responsible for that . Whats emily who was responsible multifactor authentication was activated wasnt . Company policy is to have multi factual on externally facing systems. In certain situations you might have for example all of the technology that have been upgraded. You may have security controls around those systems as a compensating factor. That whole framework is clearly something we ascribe too. Who in the organization would be responsible for whether or not those activated or not . That would all be part of our Information Security structure within our Technology Organization projects ultimately is that your responsibility . Whats ultimately everything in the entry is my responsibility. United health most recent reports that have systems and procedures in place to detect and contain Cyber Security incidents. Unitedhealth regulate tests and updates continuity and resiliency plans to contain it remediate potential disruptions or cyber events. UnitedHealth Systems are detecting did not work as it vibrates wealth from hackers to gain Access Healthcare through february 21 when they carried out a rant somewhere. Did unitedhealth ever test cybersecurity weather to change healthcare is tested those systems or prior to coming into the organization. That nineday. It is a focus of whether or not there was a failure of the system they are. Or some other reason why the systems did not pick up what was going on. What continuity and contingency were in place prior to the attack and account for disruptions at the scale we have seen over the last two months . Significant contingency however in this particular attack and partly because of the age of the technology within change healthcare which is been built up over many decades. The encryption rant somewhere was decimated within the system affect not just the prime system but the backup systems as well when they were not in the cloud. Some change the key systems were not in the cloud. Were they word in the cloud we were able to bring them back up very rapidly some of our services were back up within a day or two. But impact across both the backups in the prime system. Which really is a consequence of all the technologies. Reckon us the full committee for five minutes of questions. You stated nine days before the ransom or attack occurred quote criminals use compromise credentials to remotely access one of your portals what do you mean about compromise credentials and how did that happen people refer first to stealing passwords you may be aware peoples passwords being stolen and sold on the dark a web in that kind of thing we believe to that pathway they originally got credentials which allowed them access into the system. Use the server weve been talking about to prosecute the attack. Switching gears i have along the said im skeptical of arrangements for the insurance are paying for patient care maintains ownership over the doctor that supposed to be providing it. United is the poster child for such arrangements as the single largest owner of physicians in the nation. Ive a fundamental problem with the direction of consolidation or Healthcare System. I believe its increasing costst of reducing the quality of care. Again the poster child for this probably do not seem to agree that you recently said and i quote where comparative small part of the 5 trillion u. S. Health system. United has released a statement that says the company has found files containing ph i identifiable which could cover a substantial portion of people in america. How would have the phi of a substantial portion of americans . Quick to madame chairwoman thank you very much for the question. I think the distinction i would draw between those two things is a change healthcare was processing about 40 of claims point to the system on behalf of all payers. They do other work thats change activity. Change itself was relatively is relativelysmall company had t role in a clearly have we are relate the Market Leader were very rarely number one in the situations we compete in all the key areas similarly across the states we have been developing what we believe is an improved way of ensuring Higher Quality care by aligning incentives between physicians and payers. The chairman asked about substantial portion earlier. Im going to move on. You said numerous times has allowed to recover more quickly and otherwise would have. But have complying they do not want to be told less competition strongly recommend you put that to creating that system. Moving back to cybersecurity infiltrated users to remotely access your system the Ranking Member asked about why you did on the multifactors that have it now . Is a portal and now today. All facing systems across Unitedhealth Group has ms a. We have thirdparty testing technologies a rapid evolving space we have to beat relentlessly checking on that almost every day. A new application or something new happening. Policy is very clear. Think im going to move on. How are dhec communicating with unitedhealth to get the ransom question did you communicate directly with dhec . I did not. How much did you pay and ransom how was it paid was it dollars, bitcoin or of her crypto currency . 22 billion in bitcoin. Was the date you paid the ransom . Am sorry i do not have that in mind i can suddenly get back to you with that pickwick kitty or firm affirmatively say dhec you paid did not make copies of protected data at a later date pull it to the internet are dark web . I cannot affirmatively say that. Thank you. I yield back. A gentle lady yields back recognize the ranking over the full committee for his five minutes of questioning. Thank you, mr. Chairman. Required healthcare in 2022 it touted stated the acquisition would ensure physicians get paid more quickly, accurately and exact opposite of the largest in that country disruption that have persist for so long. I know you said and less site misunderstood i think you said a few times you acquired all systems, all technology but you had a year end a half from when you acquired it until the cyber attack. So i dont understand why you cannot correct it. Why you did not have an adequate backup. You had a year end a half a why couldnt you correct that . And why didnt you have an adequate backup in place . Mr. Congressman thank you much for the question. As soon as we were able to close the transaction the Core Technology the very layers of activity obsolete youre saying it would take backup plan in place . Actually backup for many of the systems ransom or attack made those backups in operable. That is one of the lessons we have to learn from this. So how we build true isolation of backups and maybe just emphasize the points about the importance of having those services in the cloud versus on premises, undated centers which is the case in that legacy change environment. Okay have three questions limited to the second and third period theres a lot been said by my colleagues about small providers and pharmacies that were particularly hard manually typing claims the required hours of labor and upfront costs. I am told these workouts were not realistic. I am wondering why whether you believe these workouts for small providers did the trick. Werent there a lot of problems with their ability to do that does that still persist . Quick thank you for the question. To work or to encourage i do acknowledge and recognize that is what we put in place the Funding Program to support small providers recognizing they probably have the longest disruption in terms of their cash flow support. And i believe the majority certainly a large fraction of the six and half billion dollars of interestfree loans have gone to smaller providers for quick let me ask you again about the small providers. Even though you are getting the system back online, they need to reconnect, right to your system. What is it doing to meet may not have the same resources as large hospitals continue to provide assistance to them so they can reconnect. Think utes are absolutely. We are reaching out to providers actively as each system comes online to help them make sure that the Technical Capability of any member wheat wit absolute prioritize making sure we get connections to the key for us is knowing who has the problem. We will do that. I appreciate your offering that you made earlier. We made some that continue to have problems. And so to the chair i do intend to get back with you and identify those for you. Thank you, thank you, mr. Chairman. What the gentleman yields back. As they are generally available a website or telephone number a practice is there generally available a website or telephone number a practice can call right now if they are have a continuing problem. Yes and thank you very much for the question. Change support. Com is the best website for anyone to access. Whether it be to provide or individual. Both sides would like to note the Number Available for individuals to call them any questions at all about data or anything like that. 866 2625342. That service line is available and makes available very quickly very simple process it wants things that credit protection Identity Theft protection, those services are all available to be enrolled through a simple phone call. Are providers still contacting you as he mentioned continue to hear from people are they still reaching out to say they have trouble . Quick sporadically. Not so many. But i certainly encourage any member who has a knowledge of folks continuing problems please send them our way we will either get them technically reconnected or make sure they have a robust offer of cash flow support so they are carried through by whats left of the cycle. A practice that uploaded data to the websites, the website gets hacked and now the information appears in the dark web who is liable if a patient finds her information has been compromised are obviously going to ask their doctor and say how did this happen and then who has the liability for that data . Mr. Congressman brad thank you very much for that question. First and foremost we are offering to take full responsibility of all notification obligations for everyone involved in this. We are working with the regulative offices to manage that process. Ideally we would like to take the oversight positions dont have to worry about the situations. We do have to make sure the various oversight organizations support that approach. That is very much that weight we went to step in and take that responsibility. Can we help you with that . Who are the regulatory agencies that would need to understand the importance of this . We are working within hhs. Those conversations are ongoing part of very much appreciate the offer and if it is acceptable to you will come back to in the future if necessary. But today those conversations are engaged. I hope we will be able to get to a simple solution which takes the anxiety notification off everyone elses shoulders. We want to be able to do that pickwick said its good to know. From the scope of this committee but you mentioned the bit coin ransom. You work with the department of justice. I want to see someone arrested and marched to the center of town and shop for doing this. Are you helping Law Enforcement track these people down . Absolutely in the very first hours we reached out to fbi i would like to acknowledge a fantastic engagement weve had from fbi through this entire period through today. We have been every step of the weight with fbi we will continue to provide them whatever information they need or is helpful to them to hopefully track down and catch these folks. I am completely aligned with you i would love to see these people brought to justice. Of course this is not the first time. Its actors from outside the United States hope we can engage on that is a problem not going away for member dealing with this very same set of circumstances in 2015. We just cannot keep doing the same things over and over again. Mention the testimony that there are loans of two practices who are having difficulties those are low interest loans. It yes they are interestfree. And no fee. And wait so far issued advanced payments or loans of 6. 5 million to about 142,000 so tax id numbers, all interestfree. No cost and no need for the provider until her back and cash flow. That is wonderful. Are you relying on stem back up to normal now you can start . Essentially yes. We will work with providers were so far weve not asked him to repay. Providers have begun to repay they have begun to come back to us i think thats a good sign still drawing down some interestfree loans work with both ends of that spectrum corrects the judgment yields back reckon is a gentle lady in the wake of the cyber attack on change health grace otherwise it would have less change and i think it may be true that resources of United Health group have allowed change health care to survive and recover parade that is good. I also think it is important those resources be used to ensure the stability of the broader Healthcare System. So, understand change and systems are being restored on a rolling basis. And the good news i have heard from Service Providers in my state of colorado they are largely back on track and submitting claims but although there are some difficulties we will be sure to call you when we hear about them. But, i think we need to do more work to get everyone reconnected. I just have a few questions. United Healthcare Group just that over three to 70 billion in revenue in 2023 is that correct . That is correct to pray. The premiums on a risk based products make up about 80 of united house revenues, is that right . Yes super. The amount of that was just over 290 billion in 2023, correct . Yes i believe so. That translates to 24 billion in premiums every month, is that right . That would be about right. I point all of that out because it while it change it was down United Healthcare is not paying out claims, that it would have received providers around the country did not stop their work. He referenced this before they were spending money purchasing supplies, paying salaries, keeping the lights on. But in many cases payments were coming in. But yet at the same time that happens, United Healthcare did not stop taking in premiums while change was down and claims were unable to be processed through change healthcare, is that right . We did but perhaps i could just explain we continue to be paid premiums but we also continue to pay on claims. United healthcare was a relatively small user of change healthcare. United healthcare continued to be able to fulfill the vast majority of its claims. But still but all of the payment to providers was not happening at that time, correct . A very small fraction for United Healthcare. For other payers there is more disruption. Right, okay. Now, in the weeks after the attack United Health group through its financial arm began making loans to providers use the change system. As of march 27 as reported in the media United Health group had paid out advances of 3. 3 billion to providers affected. I now i understand even more has been paid out. The loan program originally structured required repayment within five days of receiving notice. I allowed Financial Services to take back funds with communication. Do you think those terms were fair . Are those terms you would accept in your business . Thank you for the question. Those terms were at the very beginning of the loan program. We immediately realized they were not appropriate and we got some good feedback from providers which we eliminated all of those terms and essentially the program which is in place and has been a place for several weeks now it represents the bulk of the payments has none of those terms associated with it and fully accept that was a misstep. What do you say it you work terms and now art fair art treating providers fairly and not unnecessarily auditing or denying providers claims . Works i do believe that. As we have in place today interest fee no fee loan based on the provider declaration of the impact they have suffered. Not our assessment and they define what they need. We advance those loans they only need to repay those loans 45 Business Days after they have confirmed their back to cash flow normal. Is a crudely more favorable toward the entities. And i appreciate you changing that. But i will reserve the right to ask additional questions if i hear otherwise from the providers i yield back. Of course, thank you for. A gentle lady yields back. Reckitt is a chairman of the hill mr. Guthrie for his five minutes of questions for. Thank you, thank you for being here. According to United Health update last week your Payment Systems are functioning in the Eligibility Criteria systems are functioning at 80 levels. When you expect the Core Functions to be fully restored . And the delay sink in the systems fully restored mean in practice . If they had been able to connect to a different system, so we are looking right now with people to connect them into the more modern platforms brought back online order ready or diverted to a competitor of change to get running in the very small number and i accept its not know and we provided the loan guarantee. To change healthcare since and theres not another portal. That can be exploited. The interfaces that is something that we have been a very rigorous about and i feel very good about where we are. But theres not other legacy equipment. We are relentlessly trying to explore that possibility and use the third parties to make sure that occurs. One of the reasons its taken longer than you may expect to bring back a change is because we are building much of this from scratch with modern technologies with Security Capabilities with preexisting the attack. So both in terms of diligence around protection but then also how we are redesigning and constructing the platforms also is building in greater strength and at the same time we continue to be under enormous attack like everybody else. They issued a joint cybersecurity alert detailing the methods of a sophisticated russian hacker with access to Critical Infrastructure and especially as you just mentioned Healthcare Systems where mitigations have protected the breaches. The change of the mitigation recommendations and which of these are already in place ahead of this joint alert. Ahead of, we certainly had a those sort of protections in place. In this particular case we are still trying to investigate and understand why it didnt have that protection in place. Is this the first data breach since acquiring the change in healthcare and if not i will ask my second question followup what steps were previously taken following the earlier breaches . Every time weve had either a breach or a near miss weve always looked at Lessons Learned and how we can strengthen it to lead to continuous raises and standards and protections of new approaches, but we are also dealing with a threat of actors who continuously change the targeted approach. Every time we go back and do the root cause analysis and figure out how to solve for that of course we are doing that right now and with expedited the change situation. Weve already brought in a whole series of extra levels of screening for the company and we brought through Party Leaders in cybersecurity to actively and permanently work alongside our own a security organizations so we had more than one Organization Screening everything as an example. I dont have time for a second question so i will yield back nine seconds. Recognizing the gentlelady of illinois ms. Schakowsky for her five minutes of questioning. Thank you mr. Chairman. I have three questions im going to ask because i want to make sure i get them all asked. I think they are very simple. I want to tell you about a constituent one whos from a district who spent an entire weekend without her medications and then had to drive 40 miles in order to get a doctors certification and some patients because the situations have had to pay even thousands of dollars and i wanted to know in my first question how united is planning to compensate these constituents and these people and i think the question was asked but i would like to hear it again. I have another constituent my second question, beth runs a Mental Health clinic that addresses pregnant mothers and because of the cyber attack, she is now in a very serious situation in terms of making her program work. She is in desperate need right now and so what is united doing to address the problem that these providers are experiencing right now and last is this question. I know that i am trying to find it. Watching the time here. Ive got it. What is the first one . Okay. Change of course suffered from this very bad, actually the data breach but i wanted to talk about, here we go. And united promised earlier that it would have absolutely robust security so the final question is why should we feel confident right now that there are not going to be those kind of data breaches and also i wanted to ask if have any united employees gotten their hand on any of the data from consumers . Thank you for the questions. Let me first of all say how sorry i am to hear about your constituents in the first example that you gave. I am aware of a number of patients who have had a similar inconvenience and difficulties getting their medicines. A several things we are trying to do, first making sure that they are held as they have dispensed medicine without knowing whether it would be under benefit or not and if theres anything we can do we would be more than happy to help. Help. We will let you know. It would be very much qualifying for our interestfree loans to help cover that cash flow need until they resume to normal so we can help directly. They dont have to repay until the business is back to normal under their definitions. Many things weve done lady the most important bringing in the leading cybersecurity external organizations who are now also overseeing our security environments making sure that have any employees gotten a hold of the data . If we are talking about these data breaches wondering that no employees got any of that information. We have retrieved the information that allows us to investigate and notify people so employees are looking at it from that point of view under the process. The chairman of the Energy Subcommittee on energy and commerce. Mr. Duncan of South Carolina. Its been a long day with of the secretary of energy, but the chairman, thanks for holding this important hearing through the leadership on oversight matters. I represent the rural district in South Carolina that consists of providers that rely on the service whether that includes community pharmacists, Health Centers were faithbased services, constituents or the Third District that rely on the providers to maintain quality and to process their healthcare transactions. During the first two weeks following the attack if smaller providers in financial need want to communicate with change healthcare, how do they do so . During the first couple of weeks would have been the best approach. One of the challenges we realized through all of this is many small providers didnt have a direct relationship with change but they would operate through a company that of themselves had connectivity. We made sure you as soon as we understood what was happening that it was going to be more than a very brief. It calls for participants in the marketplace and made available various website sources of information. Was every proprietor that reached out responded to . We hope so, but i would hope that that would be the case. No provider was left out in the dark when they reached out. The goal was to be as responsive as we could to every provider that reached out to us. I know at the beginning there were some providers that were frustrated for example the terms and conditions and im sorry and that is why we changed the programs and completely eliminated those conditions. Were you able to justify your communication with providers by as good today as it was in the first two weeks after . I think weve continued to try to improve every stage and how we communicate. Im sure there are lessons we can learn to do better and one of the challenges, which weve had within this attack is the customer database was encrypted in the attacks. Weve reached out to other healthcare associations and weve run a number of national calls to try to get the word out around where the service was for example the loan programs to make sure providers knew about it. What im hearing is its been very receptive. They know they had an account and Payment Processing issue somebody they could reach out to. I ask unanimous consent to insert in the record wall street journal article entitled United Health grapples with communications from april 3rd, 2024. And we will take that up at the end of the list. I appreciate you being proactive in pushing the information out and i think a lot of based on the research, a lot of people were left in the dark and had no access to get their questions answered and i would recommend some sort of call center and communication because these folks know they have payments and processes they could have provided so the customers know what they have in process and they have business with you guys and it would have been helpful so Going Forward, setting up a system where those folks can communicate directly versus pushing information out showing that these things havent been done like to be a little better but i appreciate you being here and yield back, mr. Chair. I want to talk about prior authorization requirements that can delay care and earlier in the outage they expressed concerns that insurers were not appropriately modifying their Prior Authorization Practices to help providers who cannot process prior authorization for services during the outage. Im pleased United Healthcare ways that certain requirements for some Medicare Advantage plans and services during the destruction prior authorization remains in effect for nonMedicare Advantage plans. Why did they only suspend prior authorization for its Medicare Advantage plans and not all of its plans affected by the outage . Thank you for the question. You are absolutely correct we did suspend temporarily. That is the one part of our business where we have the ability to make that decision quickly. Why did you decide to do it for Medicare Advantage and not all of its plan . Medicaid is a decision for the state and the states needed to make those decisions so the commercial marketplace is an employerbased decision. With prior authorization it would remain in effect for Durable Medical Equipment and many procedures. Given the size of the disruption what did the group lot way out for all services making sure by making those steps and i think cms felt good about what we were doing within that set of decisions we were making the maximum contribution for the prior office. The same press release read they would resume prior authorization but as we know, some change does remain offline beyond the 31st so is your Company Still offering any prior authorization suspensions for those whose systems are still offline . Thank you sir we actually did not bring them back first. We brought them back on april 15th when the major systems were back. Providers that took advantage of these flexibilities are understandably concerned that they could be subject to cumbersome audits and the United Health group might secondguess the decisions users had to make while systems were down. This would put a strain on time and resources particularly for the providers that have already experienced tremendous hardships from the change healthcare disruption. Can you provide any assurance that they will not pursue unfair retroactive denials and clawbacks based on Services Providers performed while prior authorization was waived for certain plants . I can certainly give you that, yes. Its a very important. We will be keeping a close eye on the Recovery Process to make sure all providers are able to resume regular operation and patients can be confident they have consistent access to the care they need and with that i yield back. Mr. Palmer of alabama for his five minutes of questioning. Thank you mr. Chairman. Based on the initial sampling today, your Company Found titles with protected information and notification information which could cover a substantial portion. Where did you find those files referenced on the internet, the dark web . Thank you very much for the question. So has to be brief. After the attack im just asking did you find them on the internet or the dark web . Those are in the data that we were able to retrieve, so we were able to retrieve a copy of the data within that investigation. You said its likely to take several months of continued analysis before there is enough Information Available to identify and notify the impacted customers and individuals. Are you telling us that the fallout from the cyber hack could last until christmas . I think the Operational Impact weve been talking about will rapidly becoming back to normal. I have a different point. I think my colleagues on both sides of the aisle have done a good job at addressing the Customer Impact and Healthcare Providers impact. There is another issue that im concerned about because thousands of Government Employees including many federal employees who have very highlevel security clearances who were customers of united, were any of the Government Employees healthcare records who were federal Government Employees a part of the data files that were accessed by the hackers . We continue to investigate those files and we havent completed that process. You should know by now whether or not federal employees files were accessed. I would expect that within the data what we are seeing is it represents i understand youre trying to avoid a direct answer to a direct question. Were they hacked . Its important because if federal employees with highlevel security clearances had their personal identifiable information, in particular their personal Health Records do you understand the problems that could create a down the road from a National Security perspective . What im asking is that you make it a priority for those individuals to notify them because it is extremely important that we do that mr. Chairman that is a priority we are going as fast as we possibly can and we will get that notification as fast as we can. It raises concerns about the possibility of the bridge to National Security and some of this information that is handed over to adversarial nations and its very likely that it will be. I think that this should be a top priority. Im not discounting the need to make sure that your customers records are protected and bills are paid for and providers are compensated. There is this next level that i think should raise concerns for every member of the committee and with that i will yield back. Im pleased to assure it is a top priority for us to deal with. Im sure that he will follow up with questions for the record but also you may want to get that information to the committee to ensure that those folks know if theres a risk they might be looking at a black male or something from a foreign adversary. With that, the gentleman is yielded back and mr. Tucker from new york. First lets take a moment to recognize that this breach has greatly impacted a lot of critical institutions, providers and patients in our communities. Personally, ive heard directly from providers, hospitals, pharmacists, home care providers into so many others of new yorks 20th district. I want to make certain everyone knows that this is unacceptable and that we need to make sure there is a accountability and oversight so nothing like this happens again. With the announcement last week that hackers may have access to protected Health Information or a substantial portion of people some of our worst fears are coming true. The Sensitive Health data for tens of millions of americans is at risk and that is why hipaa is so important. It requires establishing minimum Data Security standards versus covered entities like United Health group to try to prevent breaches of sensitive data. While the security rule provides covered entities with some flexibility determining best how to secure information it does require the companies, and i quote, protect against any reasonably anticipated threats, which as your testimony points out, an attack like this was. Is it your position United Health group didnt change healthcare would fully comply with of the security rule even though the multifactor authentication was not being used or moved to citrix access and the systems failed to detect and prevent the attack . Mr. Congressman, thank you for the question. Compliance is a tough priority and i believe across our organization and that is incredibly serious. Unfortunately, the situation did not always it was used to penetrate into the healthcare which was a platform that had only recently become a part of the company with the process of being upgraded. Did United Health group conduct any audits or tests to ensure the change Healthcare Systems were fully compliant with of the security rule and also were in line with industrys best practices . It was a Public Company prior to the acquisition prohibited from doing any preacquisition audits of that type. Once we acquired the company, we began to go through the process of understanding it and given the size and complexity, that takes some time to do it was underway when this attack happened. It also requires a risk analysis be conducted. Part of your companys Security Management processes to identify and address potential risks to protected Health Information. Did change healthcare conduct such an analysis after being acquired by United Health group and if so, will you be changing that risk analysis conducted Going Forward to account for what went wrong . Thank you for the question and certainly we are reviewing all of our management of those types of risks to make sure we are eliminating any residual risks and the outcome. And hepa requires they violate the breach notification with hhs office of civil rights within 60 days i believe of discovering of a breach of protected Health Information as today more than two months after the attack you still havent filed that mandatory notification. Why have you not filed the breach notification even though you have been aware of a data breach for over 60 days and when do you intend to bring United Health group and with that requirement . Thank you for the question. At the beginning of this was being able to access the data as we could understand what they can exfiltrate and we didnt have that until the middle of march. Weve been working diligently with the thirdparty use to understand that and we are working with regulative authority. We are still trying to grasp the full consequences of the cyber attack in the data that was compromised in the process. As the data that was stolen harms to individual patients continue to fire into the future. Do we await the findings of the investigation that United Health and by hhs can be a meaningful accountability and harder lesson to lead across the industry and with that i yield back the gentlelady from arizona thank you for being here. Youve had a long day. I have two, but youre on the hot seat i guess. I have a couple questions. First, does United Healthcare and change healthcare have its own cybersecurity employees . Yes, yes they do, madame vice vicechair, yes. And what vendors did you use when this breach happened . In terms of the response to the breach a number of different vendors but most notably palo alto systems and a Company Called bishop fox but many others included the Significant Technology company but from the cybersecurity advisory capacity and testing capacity, those groups and i might add also that weve now asked to become a permanent advisor to the company in fact to the board of directors to make sure at the top of the company we have the very most elite cybersecurity advice available. Were they working while the breach happened . One of your vendors while it happened or was that after the fact . They were brought in after. I was just curious who the vendors were that were supposed to be doing cybersecurity for the company so that people would know and are they doing a good job or not. I dont have those numbers for you today. Okay. And i think you said you reviewed your decisions on cybersecurity. Have you come up with any analysis of how you are going to change things besides . Thank you for the question. First of all we brought into the organization supplemental screening capabilities with thirdparty organizations making sure that we have secondary level screenings going on in the organization in addition to our own capabilities and we are also reviewing any Lessons Learned from this attack which will obviously not only be implement would with united but other partners in the system. And did your insurance cover the cost of the ransom where . We are selfassured in this situation. I have a switching subject of it. Ive gotten letters on this and this is where im asking does aarp get a paid percentage on your United Healthcare Medicare Advantage plan do they get a cut of it . I do not have the details of that arrangement i do not want to give you an incorrect answer on that. Im getting all kinds of letters about it. Then my last, its not a question its just a comment this was a few years ago but when i was helping my mothers lineup for medicare, it was very difficult and she ended up using the Medicare Advantage plan but i have to say the listings that the Insurance Companies have for the doctors were not very accurate, like who was covered so for instance i remember like it was listed as a primary care doctor and when i called them to make sure they were still taking patients, they were a cancer specialist or something so i would encourage not just your Insurance Companies but all the Insurance Companies that it is extremely confusing for me let alone my mother, my mother wouldnt be able to do it i dont think at all and if there is any way you can fix that, i would greatly appreciate it. That liability to make sure when they walk into the reception of the facility they know that they are going to be accepted and that is not good enough. We would love to see that improved and we are working hard ourselves but its something we have to do with partnerships and we would like to work with policymakers as well because it is a national challenge. I appreciate you coming here. I know this is a problem but its not just your company thats been breached. I will probably get a letter maybe every three months that someone has hacked into my information and to give a years worth of credit thats not going to help me very much but its not just your problem, its a problem nationwide, worldwide and i dont know how we are going to address it but weve got to. The gentleman from california for five minutes. Thank you mr. Chairman. The description underscored the need across the Healthcare System to invest and maintain cybersecurity practice. In 2021 we saw this near my home in san diego the compromised data and lost more than 100 million of revenue. To reflect that we are in a economy of private actors and in many cases performing public functions and heres the Healthcare System i dont advocate a public Healthcare System but i do think we have to look out for the people that learn the Healthcare System much as when equity facts and a breach in the lending area we have to Pay Attention to that and how people get their news and whether thats distorted through private actors. So this is an important hearing and i know you are in the middle of your investigation but i hope at the end i wouldnt intend to drag you back here for another day of this fun but i would like to have the information help us with National Standards that we might use to make sure that and i hope you will commit to doing that for us. Thank you for your comment and request and we are very happy to share with you as appropriate the Lessons Learned from this and i would like to reassure you about the scale of the commitment we invest about 300 million thats not the technology thats cybersecurity. The groups which i would really encourage some of the focus that you describe policy reflection on some of the small and Midsize Organization across the country we just dont have that so to agree with of the observation if you could help i would ask that you would. This is sort of a Lessons Learned i think that it could affect the whole Healthcare System. Its critical everyone begin to work too hard in the data systems to quickly recover from breaches while keeping the protected Health Information safe so again recognizing that youre in the middle of this you now no specific improvements to the protocol for cybersecurity to prevent and respond to ransom where and other attacks and what systems now require the multifactor authentication and what different protections for the robust systems today . Maybe just pick a couple of examples so certainly enforcement of the Actual Services but also having an enhanced screening capability to make sure they are constantly on. Number two as weve rebuilt weve redesigned it for those environments in which they were never envisioned and to make it easy to navigate and focus on how we make sure the complete compliance with the policy we have on things. In addition to that weve brought screening organizations to give a check on making sure any abnormal activity could be as much as possible. When you think your going to how do you get your customers to be confident in that . Thats been very much a focus of the work that weve done and its why weve rebuilt changed e essentially in a new environment not to try to resuscitate the old system because it would have been very difficult and may be impossible to reconnect with the system that had been attacked with malware because of the risk of contagion or Something Like that so weve endeavored to build new platforms and weve had those platforms tested by all the best Cybersecurity Companies in the country including to prove they could withstand the highest levels of assault and we share that information with the key partners in the system. Last question what lessons do you have for us about what they can take away working with Healthcare Systems to support them to make sure they dont go through this again . The department of health and Human Services. We had a regular ongoing relationship and theyve been extraordinarily forward leaning. I think the areas where we could all Work Together are things like communication providers and a question that came up earlier we could Work Together to figure out how to communicate through the system and i think making sure that would be my top recommendation. Thank you mr. Chairman for chair indulging in that question. Thank you for being here. I was a doctor before so some of my comments will be tainted by that. So, you couldnt investigate change healthcare before you purchased them to find out they had an insufficient a Cyber Program and they were not in compliance with federal government recommendations. You couldnt find that out . During the acquisition phase as you may know it was quiet for a long process. That wouldnt be regarded in terms of the engagement so you have a ton of closed walls between the two companies until after the transaction. You buy a new house you want to know if the sewer line is bad before you buy it, right . I believe the consolidation of healthcare is not a good thing. It led to the increased cost. It doesnt matter the industry, less competition, it doesnt encourage Better Quality Service to product just doesnt. My understanding is with hiss s have deadlines like 60 or 90 days to file claims for reimbursement is that correct . Ive heard its just a few Million Dollars in claims through changes since the attack it takes a lot longer they didnt feel like they had the ability to change clearinghouses and my understanding is it might be helpful to have a filing deadline suspended or extended from whatever their plan is. In your case have you communicated with any providers to express similar concerns and do you intend to extend for United Healthcare claims . Yes we have waived those deadlines. It would be reasonable to extend them six months or something. You may or may not want to comment on this, should other health plans extend the dissipate until we can be confident that this is fixed . Thank you for the question. It wouldnt be appropriate to talk about what they should or shouldnt do. What weve tried to do is offer every support and service for the folks that have been impacted and that is what weve been doing. My recommendation to all the health plans affected by this to extend the deadlines because when you start denying claims for that, whoever does that is probably going to be sitting in your chair. Im just recommending that to everyone out there listening to this hearing because providers that have been financially assisted are because of the breach and then they file their claims late and i can see a circumstance where there and theres going to be a call back and what youve described what happened with United Healthcare, but when it does happen, at some level in congress we will have a hearing on why that is and consider giving people more time to file their claims if theyve been impacted by this. Also someone brought this up earlier, but ive heard from providers that the provider assistant option from united is providing access to Bank Account Information that goes beyond what is necessary to say that under the terms of the agreement united can simply change the terms and conditions by providing notice. That to me sounds like potentially an entity that wants to buy out clinics. Youve already answered that question. It hasnt happened but i would highly recommend anyone out there thats thinking about buying out clinics based on the fact they cant file their claims would reconsider. Because again they may be sitting in a congressional congressionalhearing explaininge doing that and so, have you read the report on Medicare Advantage plans thats been published in the last year or two . Do you know are you aware of that . Im not specific about the one youre referring to. Being denied 14 of the time roughly by any plans that would be paid for by a traditional medicare and if your team has not read the report that talks about the claim denials compared to traditional medicare i would suggest that you do because when you hear from providers out there, the number one name that comes up happens to be your company. Cms has dealt with of this into some of it doesnt go far enough. The gentlelady from washington for her five minutes of questions. Thank you, mr. Chairman, and thank you mr. Ranking member. First, thank you for your comments we are definitely on the same wavelength and hearing the same story. I know that youve been through a lot of questioning today and i want to get right to the point. As this change has just been devastating and i am extremely concerned that we are seeing the start of the impact of the cyber attack model only have providers been shortchanged reimbursement claims and has location data been leaked possibly to a foreign adversary and not only were patients at least temporarily unable to access their medication, but i even received reports from utilities in my district that they were unable to build and process payments because change was also there clearinghouse so the affects are really farreaching and frankly the consequences of United Health group and change health group as a merger in 2022 that they tried to block on the basis that it would give united control over half of the Health Insurance claims. I think we all sympathize with this and appreciate the efforts youve taken to get through this but the reality is that this map of the farreaching attack has disproportionately impacted small independent practices that were struggling to stay afloat and theyve done nothing to help. Its in their interest to hold onto that money. Im going to give you an example. Balanced physical therapy employees just fix physical therapists. Its devastated them to the point where the owners had to mortgage their home in order to pay rent and make payroll and now that money has run out. Your Company Reported 371 million in revenue last year. Do you want to guess how much balanced physical therapy was paid in the first round . No but im very keen. Its good you didnt answer yes. Seventy. This is after youre kind of revenue it seems you have enough information to know what clinics build in the prior months or even in that month the prior year that you should be able to do better than that and i know youve said that you wont rest until you get this right and so i guess one question is to make this right. The physiotherapy clinic we are talking about im sure would be eligible for a very substantial levels that would cover the kind of challenges they have and that would be available to them and just three, no cost and not need to be repaid until well after. Thank you for saying that. I want to jump to that part about the loans because another thing that im hearing in my district is that some of the loan the conditions were, that many people, many clinics even hospitals decided not to take these loans because there were clauses saying you couldnt use any of your competitors, you could be asked to pay off the loan immediately and this could actually be used to in a predatory way almost to put these clinics out of business because they do have a reputation for buying out clinics that are in trouble and i would like to hear whether you will guarantee that you will not damage these practices by not reimbursing sufficiently including these unfair terms and then going and just buying up the practice. Absolutely i can reassure you of that. The terms you are referring to were unfortunately included in various parts of the process. We realized quickly that was a misstep and mistake and we got rid of all of those terms. All of the terms are gone now and it is an incredibly simple process. Also to the second point, we would never want to act opportunistically from the back of the sand where weve had agreements to acquire clinics we have preexisting cash flows before the attacks and a very good suggestion came up this morning from the Senate Finance committee which we will institute which is to put a firewall between everybody who knows about the visibility to these loans and the people that are involved in potentially working via clinics who want to join the organization to make sure the risk identified. The gentleman from pennsylvania for five minutes of questions. Thank you for allowing me to waive and thank you to the witness for appearing. That change health care attack caused massive disruptions in patient care and resulted in severe burdens for providers, pharmacies, hospitals trying to deal with a full impact of the hack on their daily operations. As we see increased consolidation and healthcare, i worry that incidents such as this will be increasingly more. Weve already seen consolidations drive up prices and decrease access to patient care and now patients and physicians are encountering yet another cost and i might add another very significant cost to the fallout from the cybersecurity attack. Aside from the data business that is the new topic of the conversation today, your company is the largest forprofit domestic Health Insurance company and you also employee nearly 100,000 physicians in the u. S. , making you the largest employer of physicians in the country. To better understand your reach into my home state in pennsylvania, do you have the total number of employee physicians in the commonwealth in pennsylvania . Im sorry, i do not have that number. Would you provide that . Knowing the scope of United Healthcare has become, what impact did the attack have on other entities and subsidiaries aside from change . Thank you for the question. There was no direct impact so there was no contagion of the attack. The change environment because of the way that we shut down all connectivity which meant it didnt spread to any part of the united or any other organization which was working with the change before the attack. So most of the impact was on as i mentioned physicians, hospitals and patients. Are you able to provide a breakdown of the total number of patients, doctors, pharmacies and hospitals that have had the transaction impacted either today or in a followup writing . I think in the future we ought to be able to estimate that for you. We look forward to receiving that. One of the largest impacts on medical care every day is the use of utilization tools like prior authorization in light of the cyber attack for which the services please explain the rationale for some but not for other services. Thank you for that question. In line with the suggested recommendations from cms, we suspended Medicare Advantage during april. Those are for the employers to make the decision and similarly state is to make the decision on medicaid. Its my understanding the requirements have now resumed is that correct . On the 15th of april, correct. Do you intend to pursue reimbursement for providers who provided services during that suspension that would have normally been required to have prior authorization and may have been denied . Know we will not. You will not provide reimbursement . You will require or not provide . We will reimburse we will not deny. In other words would it be prior all three views were have you completely waived the Medicare Advantage prior authorization policy . We waived for that period. I think we realize that some of the questions you answered for us today do provided that information that is so important moving forward, but the utilization that has been suspended needs to be carefully reviewed because the prior authorization, whether it is with a Medicare Advantage or an employee or contract has an impact it delays care, it delays the ability for patients to seek that out. We could also ask to followup and review how that prior authorization has affected Patient Outcomes and i think that is something you should be able to provide for us. I would be very happy to do that and let me go further than that to say we have certainly more than been low open minded to work with yourself and others on ideas of how we can further improve ensuring both best quality safest care delivered alongside avoidance of waste, which is the historic and im glad you brought that into the conversation i think that is what i really want a direct answer, to see how that prior authorization and how its been suspended, seeing that impact on patient care. There are many physicians that serve on energy and commerce like myself and there are many Healthcare Providers. Im sitting between two of them today and those are answers we would all like to see. Again mr. Chairman thank you for allowing me today and i yield. Now recognizing doctor miller meeks for her five minutes of questions. Thank you mr. Chairman allowing me onto the Oversight Committee in the thank you sir for testifying today. According to data from the american medical association, 80 of practices reported lost practices and 85 stated they had to allocate additional staff time to complete additional administrative requirements, and we already have that burden on the small business. Neither doctors nor the nonphysician staff will receive any additional compensation for the time of mitigating the fallout of the change attack just like we are not compensated for the hours of claims. In iowa doctors were very hesitant to take advanced payment of dollars without confirmation that the claimed submissions will be paid at the rate submitted and are concerned they will be required to pay back more than what ultimately would be approved once the processing is completed. The survey also found 55 of doctors said they had to use personal funds to cover the expenses and notably the overall effect of the change attacks have been most acutely felt by the practices with fewer physicians. What has been the uptake on the advanced Payment Program among small Physician Practices and what do you plan to do to offer more advanced payments with a particular focus on small providers . First of all, let me reassure you we have remained focused on ensuring the providers that we know are the ones that often times have the most difficult technical challenge and mets to switching and the like which is why weve made every effort we can to outreach through the program and oversimplify that loan program and eliminate the terms and conditions at the beginning. I can tell you about 142,000 tax id numbers have taken advantage of that program. I cant tell you how many providers are underneath because it varies, but 142,000 that is about a third of all of the providers that were associated with change healthcare before the attacks, some a very substantial uptake and a very large fraction of those are small providers. We were essentially approving loans in a matter of hours. There are only two platforms on the market. This committee has been very concerned about consolidation inhealthcare marketplace. They are both owned by fortune top 10 Country Companies big data is big business as a country have a Significant Interest in avoiding one or two points of failure in Healthcare Delivery system. How has united changed help a compass that goal . Works thank you very much for the question. I would make the point change and its business is no different in terms of its footprint of the day before the attack compared to the day before we acquired them. This risk united has a Financial Capacity to resolve this issue. I do believe existed when change was a small independent business. A Public Company this attack occurred in the early days as a problem i had in the state governor is a state center and a physician provider in a rural community. What pbn optimum beam when does when it comes to step therapy they do well. The ultimate risk and cost having to revert back to less extensive medication youve finally gotten compliance from the medication and a patient leading to increased hospitalization. Increased er visits back to the same medication that an Insurance Company changed pbm change when a doctor and he prescribed a medication for which they were successful. We work with us and what youre doing on step therapy drug substitutions changing formulas which is a tremendous problem is a great cost to the Healthcare System. Being made by insurance but executives rather than providers request within pbm i Therapeutic Committee advice. I also recognize the situations you describe do occur. Im very happy to commit to us working for ways we ought to be able to do better. The judgment yields back sorry i dont reckon its a gentle lady from florida for five minutes of questioning. Leave it to a gator to beat a dog. [laughter] sorry, thats College Football stuff we have a rivalry going. Thank you, mr. Chairman for holding this very important hearing. As it would eat . Okay just want to make sure he said that rate for appearing before us here today. The april 2024 wall street article my colleague represented duncan submitted for the record some have taken loans from the company, United Health to help ongoing revenue shortfall say they have felt pressured by unitedhealth to make upbeat Public Statements about the support. Do you know if anyone at United Health or change healthcare communicated to smaller providers seeking Financial Assistance they should make positive or upbeat Public Statements about the company . My understanding is people from that company spoke to folks who received loans and asked if they would help spread the word because we are very keen to get other small providers aware of the program. We knew that was an issue. My understanding is following the newspaper article folks listen to whatever was there the information associated. Im not convinced that accurately represents a situation. Specifically to what you were saying there had been some encouragement going on do you know specifically who or what department would communicate that . I do not. Could you find out and submit back to us for the record . Im sure he could find that precut you aware if unitedhealth made receiving financial loan on a provider making a positive Public Statement about unitedhealth . Ive never heard anything like that. That should not happen i will be very disappointed if that ever happened. Thats not part of any approval criteria. Is there any formal investigation or looking into it you will do to ensure that is not the case . I will aptly undertake to double check that. Could you give us a timeline of when you will report back to us on that . I will double check that next week. Okay. Did you know or authors anyone at unitedhealth or its affiliate to encourage smaller providers seeking a loan assistance to making positive statements about the company were talking about smaller. Quick something really additional to what of already said he. All right. I was trying to gauge the bigger guys versus the little guys. Let me see, can you confirm if this public reporting is true. Speaking about you did not think it was accurate. Talk about that particular article. Another cyber criminal group splintered off from black cat and is starting to release patient data from the february 21 incident, is that true . I am aware of a Splinter Group like that. Which was making statements i would sit up until the last couple of weeks. I am not aware of them still making statements. Okay and aside from black cap has there been any other cyber criminal that is threatened unitedhealth or asked you to pay a ransom related to the data from the february 21 attack . Not further than what ive just said. Okay, all right with that mrr questions. Appreciate your testimony here today to yield to pick a gentle lady yields a not recognize the gentleman from georgia the resident pharmacist of the subcommittee or this committee for fragments of questioning. Thank you and allow me to a bunch of this committee. Our practice pharmacy independent Retail Pharmacy for over 40 years. Ive had my own business for over 32 years. One of the main focuses i have a set is my goal as a member of congress when i started 10 years ago it was to address the vertical integration that exists in healthcare specifically in drug pricing or the Insurance Company owns the pbm pig owns a Group Purchasing organization owns the pharmacy and owns a doctor. And your case youre the largest forprofit domestic help in the country as has been pointed out with over 10,000 physicians and owning your own pharmacy or the largest pbms in the country. Can you explain how your company can justify clear conflicts of interest . Quick source of all, sir thank you for the question and the challenge. I appreciate that. We operate our organization with very clear firewalls between the organization. We are guided around a mission of trying to align ands incentives in the system to try to eliminate waste and abuse. How we based care to individuals we know when that happens clinical outcomes and proof we believe the cost goes down for people involved in that process possessively focus on to the organization. As we look at the components of Unitedhealth Group we have a presence in many different areas and shoot very rightly say it we are not present in many other areas. How do you define anticompetitive practice . Do you consider any of these to be anticompetitive . No i do not too. Of pbm owns a pharmacy the anticompetitive . Do you have plans to incentivize or require patients to use your pharmacy or over independent pharmacy . Whats not to incentivize and we offer alternatives very quick to offer alternatives quester. Mail order pharmacy. Are you aware theyre over three and a pharmacys independent retail pharmacies that went out of business last year . Are you aware also and im sure he wont be. Earlier this afternoon i had a call with a pharmacist from pennsylvania who told me 70 pharmacies have closed the first four months of this year in pennsylvania alone. Seventy independent pharmacies. Is reimbursement the same for independent Retail Pharmacy as it is for your work pharmacy for your mail order pharmacy . Is that yes or no. Is a very different structures. Is the reimbursement the same . Very different structures i dont think i can give you a direct answer today. If you would get me that information i would certainly appreciate it. Are you aware and im sure you are federal trade commission after asking them since the time i got up here to look at the conflict of interest that they have launched an inquiry into the egregious practices of the largest six pbms and the impact theyre having on independent retail pharmacies . I believe the pbms offer Strong Service request so you aware of the study question what that is what im asking for. Im aware of the study yes. Have you been cooperating have you responded and complied with the request for information . We do not as a matter of practice and policy we do not comment on our engagement with those programs. But you will comply . You will cooperate with them question our cooks always aim to comply with any appropriate government body. Will me ask you something. This cyber attack and certainly this is had an impact. I believe it was a member of your team at the carcass of a couple of weeks ago. And made the comment they responded quickly to the pharmacies and got them back up and running. I asked them to define quickly they said that was two weeks. Two weeks going without medicine is a very long time. I think we all agree with that. Look, everyone you come at me, democrats, republicans, independents will want the same thing. We want accessible, affordable, quality healthcare. Accessibility is been impacted by the what exists in the drug pricing and each healthcare in general. You can see with the chart right here you are the largest of all of them. Thats fine, i get it i know its a capitalistic society. But this to me as a direct conflict of interest. I want to ask you one other thing but since the start of the cyber attack how many medical practices and pharmacies have you acquired . We have acquired just a one medical practice in oregon for. Just one since the start of the cyber attack . Whats the correct phrase that was agreed the transaction agreed before the attack. So if we look at the records we are going to find out what you are saying its you have not acquired any during the time of the cyber progress we have acquired in or get into ipas to our network. As far as im aware those are the only additions that have occurred. I want to reassure you any valuations or assessments of those businesses are based on economics before the attack took place but we never try to take advantage. I hope and i have no other reason but to believe youre telling the truth. But at the same time you can tell obviously very passionate about this. Im very passionate about healthcare in general but i didpractice for 40 years. I want to make sure patients have accessibility and pharmacists are most successful Healthcare Professionals in america but we are going out of business. And perhaps so please let me offer and i would genuinely like to have worked alongside pharmacist my whole career. I very much want to make the offer to work with you on how we can Work Together to strengthen Retail Pharmacy. Particularly in the smaller pharmacists. It is an area or often we are trying to move more investment support the small pharmacies. I appreciate your offer but let me assure you im going to continue and this vertical integration that exists in healthcare in general has got to end but thank you, mr. Chairman i yield back remarks thank you appreciate you yielding back. We would love to discussion pbms but thats not todays hearing we do appreciate your openness on that. Saying there are no further members wishing to ask questions i would like to thank our witness again for being here. Unanimous consent to insert in the record the documents included on the stop hearing list without objection that will be the order. Pursuant to Committee Rules are my members have said 10 Business Days to submit additional questions for the record as the witnesses to submit his response within 10 business date of the receipts of those questions. Without objection the subcommittee is adjourned. [background noises] [background noises dangerous schedule three drug