What happened?

  • On February 21, Change Healthcare (CHC) (owned by parent company Optum) experienced a cyberattack, which has taken the company’s systems offline.
  • CHC provides pharmacy point-of-sale services, including eligibility lookup, prior authorization, and billing.
  • While CHC is working to bring systems back online, they have not provided an estimated time of restoration.

     

Who is affected?

  • The outage primarily affects pharmacy services for Iowa Medicaid members who are enrolled in fee-for-service programs rather than assigned to a managed care organization (MCO).
  • Some providers use a medical claims clearinghouse that is also affected by this outage. 

 

What is Iowa Medicaid doing to respond to this?

  • Iowa Medicaid’s top priority is ensuring that Iowans who rely on Medicaid services have access to health care and prescriptions while Change Healthcare’s systems are offline.
  • When Iowa Medicaid learned of the outage, we took swift action to ensure Iowa pharmacies were aware of the impacts and provided them with instructions on how to continue filling prescriptions, so no member goes without prescription medications as a result of this outage.
  • On February 21, as soon as we learned of the outage, we alerted Medicaid providers, pharmacies, retailers, and pharmacy trade associations representing nearly all Iowa pharmacies of the outage.
  • We directed pharmacies to fill prescriptions as written with assurances of reimbursement once systems are functioning.
  • Waived pharmacy prior authorization requirements for impacted members.

     

How can providers obtain assistance?

  • Providers who need assistance changing their clearinghouse can go to Help - Registration & Management - EDISS Connect (edissweb.com)
    • On that page is a link to the provider user guide which lists the steps necessary to change clearinghouses. Page 27-34 has ‘manage transactions’ which details how to add a vendor. Providers can keep their current CHC clearinghouse and add a new vendor unless they already have two, then they will have to remove one.
    • Once they add a new vendor, the usual time for verification and approval of a new vendor is 7 business days, but EDISS is actively monitoring these to have 2-4 business days turnaround.
    • Providers can also access video tutorials at the link above which detail the steps necessary to change clearinghouses. 
    • Providers can call EDISS at 800-967-7902 if they need additional assistance.
  • Providers experiencing financial difficulties related to this outage can obtain information about temporary funding assistance at Optum Pay.
  • Providers experiencing other challenges related to this outage can contact Iowa Medicaid Provider Services at 800-338-7909 (toll-free) or 515-256-4609 (Des Moines area), or via fax at 515-725-1155. Assistance is available Monday through Friday, 8 a.m. to 5 p.m.

 

What are the long-term effects of this outage if it continues?

  • A long-term outage could destabilize other parts of the health care delivery system by disrupting payments to safety-net providers -- many of which already serve populations with the greatest need and operate on thin financial margins that make payment disruptions particularly difficult to navigate.
  • Medicaid programs remain committed to supporting members through this crisis, and ensuring those served by the program have access to the prescriptions and health care services they need.

 

Has my personal information been leaked?

  • It is important to note that Iowa Medicaid information systems were not accessed as a result of the cyberattack affecting Change Healthcare.
  • Change Healthcare’s privacy office and security information teams are actively engaged and working to understand the impact to members, patients and customers.

 

Where can I get more information?

Members experiencing challenges obtaining prescriptions or services related to this outage should contact Iowa Medicaid Member Services at 1-800-338-8366 (toll free) or 515-256-4606 (Des Moines Area) Monday through Friday from 8 a.m. to 5 p.m.) for assistance.

CMS Materials

Iowa Medicaid Informational Letters

Iowa Medicaid Pharmacy Information

 

Updates from Iowa’s Managed Care Organizations

 

Updates on the outage are being provided by Optum and by the Cybersecurity Infrastructure Security Agency:

 

How can providers protect their systems and information?

  • Providers should be vigilant for threat actors who may attempt to access their systems, or attempt to make changes to payment, banking, or other financial systems in an attempt to divert funds.