Pharmageddon Unleashed: The Impact of a Cyberattack on the Pharmaceutical Industry – Brace for a Potential Month-Long Standstill
Image Credit: Assay Depot
If you've been following my recent Substack articles, you're aware that I've been monitoring the FDA's Drug Shortage List for several months. I've highlighted the challenges pharmacies & hospitals face in maintaining the supply of crucial medications. However, once again, there is a glaring silence from the United States Government and mainstream media concerning a significant outage. This lack of transparency is motivated by the intention to prevent a rush on pharmacies. Brace yourself – Pharmageddon is imminent. On Wednesday, February 21, 2024, Change Healthcare became a target of a cyberattack.
Change Healthcare, a health care technology company that is part of Optum and owned by UnitedHealth Group, announced Feb. 21 they were hit with a cyberattack that disrupted a number of its systems and services, according to a statement posted on its website. Change Healthcare indicated it had disconnected its systems “in the interest of protecting our partners and patients.” Due to its sector-wide presence and the concentration of mission critical services it provides, the reported interruption could have significant cascading and disruptive effects on the health care field within revenue cycle, pharmacy, certain health care technologies, clinical authorizations and other services. - American Hospital Association
Change Healthcare currently processes one third of all prescriptions in the United States & their system is completely offline potentially for up to four weeks!
As one of the two major insurance switch (clearance) agencies in the United States, Change Healthcare functions as an intermediary between pharmacy orders and insurance payment processing. To safeguard patient identities and medical information, Change Healthcare found it necessary to completely shut down all computer systems. In response, the American Hospital Association has issued a recommendation for all hospitals and medical facilities to temporarily take their computers offline and refrain from initiating the Optum/Change Health and United Health systems.
United Health Group stated in a filing on Thursday that a “suspected nation-state associated cyber security threat actor gained access to some of Change Healthcare’s information technology systems on Wednesday.
Image Credit: X Account
I’m just going to throw this out there:
“U.S. officials are tracking a high-altitude balloon floating over the Rocky Mountains, officials said Friday afternoon, just over a year after U.S. Air Force fighter jets shot down a suspected Chinese spy balloon that drifted over the country, which drew national attention and sparked fears of a major Chinese surveillance operation.” Forbes
But an ABC article states:
A balloon intercepted by fighter aircraft over Utah on Friday was a "likely hobby balloon" and has since left United States airspace, the North American Aerospace Defense Command (NORAD) said Saturday.
The "small balloon" was allowed to continue to fly above the U.S. after being intercepted Friday morning at an altitude of 43,000 to 45,000 feet because it has been determined not to pose a national security threat, NORAD said.
I’m not going to say the cyberattack on Change Healthcare is related to the presence of a random balloon discovered on Friday, February 23rd. Nor am I going to say it’s related to the massive AT&T “software glitch” that was experienced on Thursday, February 22nd. Purely coincidence…anyway, back to United Health Care.
Potentially, a significant portion of the American population—roughly one third—may face challenges obtaining prescribed medications. This issue arises not only from pharmacists lacking the capability to process prescriptions through insurance carriers but also poses a risk of compromising their identity and personal medical information. 201 of the 761 major insurance plans are effected to include:
99% of all Blue-Cross Blue-Shield Insurance
Medicare Part B Claims
Sentry Data Services
ScriptSave Retailer
Costco
Priority Health
Health Prime Therapeutics
Triple Fin
GoodRx
Tri-care, the U.S. military’s healthcare provider for active-duty personnel [dependents & retirees], said all military pharmacies, clinics, and hospitals worldwide were affected by the Change healthcare’s systems going offline. The pharmacies are filling prescriptions manually. Landstuhl Regional Medical Center in Germany, the largest military hospital outside the U.S., said on social media it was experiencing delays and warned patients to expect longer wait times as a result.
Change Healthcare has not provided a specific time frame for which recovery of the impacted applications is expected. The provider does not want to turn on their systems & further risk patient data so it is trying to recreate its entire system virtually.
In addition, open-source statements and press reports have identified exploitation of the ConnectWise vulnerability as a factor in this cyberattack. The U.S. government had previously recommended that all organizations immediately patch this vulnerability.
When I delved into the link provided, it appears the government recommendation was initially issued 2/21/24 at 11:15 a.m., the same day as the attack on Change Healthcare. I wouldn’t say that was much time to heed the warning.
Some testimony from healthcare insiders:
Change Healthcare Employee Testimony from Reddit User Intrepid_Advice4411:
I work for CHC & we’ve been given zero info aside what has been made available to the public. It’s incredibly frustrating since I have friends & family asking me wtf is going on because they can’t get meds or the hospital system they work for has been effected.
Last official update was Friday afternoon (February 23rd). Recorded message staying systems are still down, do not power on computers, you will be paid for this time. They have stopped giving us etas. Prior to Friday they would say “24 hours” with each update.
We could be up by Monday? We could be down for weeks? No one fucking knows. Fingers crossed we get a real update Monday. It’s not fair to our clients to be left in the dark. I understand IT & their partners have to figure out what exactly happened before they give out repair estimates but we’re in day four now, with nothing. That’s scary.
Testimony from Reddit User TheySaylmZack:
I work in the healthcare sector for one of the major pharmacy providers at a non-retail (hospital) level. If we continue to be unable to verify benefits & unable to adjudicate claims, it’s going to get ugly. We have emergency policies in place for this event but it can’t go on for too much longer without a major impact on personal health. I have been told as recently as Friday, that it could be a sustained outage of potentially 4 weeks.”
Testimony from YouTube Comment:
I deliver meds for a pharmacy in the midwest that primarily serves care facilities and group homes in a 30 mile radius. Yesterday was a seemingly normal day for me as a delivery driver. I came in today and expected the same, I was wrong... The pharmacist let me know the internal computers were down in addition to the greater insurance network and that she could only process a hundful of orders for the different facilities we deliver to... She said she couldn't even "bill to cash"... This is going to be catastrophic for the chronically ill in this country...
Where is the U.S. Department of Health and Human Services Response?
While touring New England alongside Dr. Jill Biden to highlight the "Biden-Harris Administration's efforts to lower prescription drug costs," the United States Government, including Health and Human Services Secretary Xavier Becerra, seemed too preoccupied. The potential cost, however, could be much higher – not just in monetary terms but also in the lives of many Americans if a cyberattack disrupts the supply of critical medications. Despite a cyberattack warning prompting the need for immediate attention, the government appears sluggish in addressing the impending pharmageddon. It's becoming increasingly clear that relying on the government for even the most fundamental protections may be an uncertain at best prospect.
Things to Consider
Americans Taking at least one prescription in the past month: Based on data from the Centers for Disease Control and Prevention (CDC) for 2021, approximately 60% of U.S. adults aged 18 and over reported taking at least one prescription medication in the past month. (Source: NCHS Data Brief, Number 470, June 2023: https://www.cdc.gov/nchs/data/databriefs/db470.pdf)
Americans Taking prescription medication daily: A 2021 Statista survey found that over 33% of respondents reported taking prescribed medicine daily, and one in five took it several times a day. This figure increases significantly for older age groups, with 83% of people 70+ taking medication at least once per day.
According to the Centers for Disease Control and Prevention (CDC), between 2015 and 2018, 13.2% of adults aged 18 and over reported taking antidepressant medication in the past 30 days.
Change Healthcare also handles medical and dental claims, not just pharmacy. Many Healthcare organizations also rely on Change Healthcare for eligibility and authorization for many procedures. Change Healthcare can also be used as an intermediary for insurance payment files coming to the Healthcare organizations. This is having massive impact on the Healthcare system as a whole.
This is precisely why I assert that the term "Pharmageddon" is not an exaggeration. With a potential 60% of U.S. adults, including a conservative estimate of 13.2% on antidepressants, facing the risk of being without medications if the alternative switching company fails to compensate & the entire system collapses. Even if the system is swiftly restored, a substantial backlog of prescriptions had already accumulated before the outage. Consider the magnitude of the challenge when the system finally resumes normal operations.
Image Credit: 6ABC
Actions to Take:
What can my fellow Warriors do about the situation?
If you or someone you love will require a refill of prescription medication over the next month,
Start making phone calls to the doctor to determine if the prescription can be re-routed to a mail-order service or pharmacies that don’t use the Change system. Ask the doctor if he/she might have samples in the office they are willing to provide you as a temporary solution.
If you can afford it, pay “cash” for the medication & submit the receipt to your insurance company for reimbursement.
Consider rationing medications (consult with your doctor first & only use as a must-do option)
Start researching natural herbs/supplements which may be used instead of a prescription to mitigate the health condition
“If you use GoodRx and they are part of it, you may want to look into SingleCare. They supply different pharmacy's but they are free and very reasonable. You can take your current prescription and just have it moved to a different pharmacy by just taking your bottle to them and they make a phone call to transfer it and they can fill it with your single care price.”
If a prescription has been submitted within the past several days, you may need to call the pharmacy in case the prescription needs to be re-submitted by phone/fax/hard copy. Many electronic copies were lost in the attack.
Until next time my fellow Warriors, stay informed, stay vigilant, Ever Forward!