An Arm and a Leg: The hack

Transcript: The Hack

Note: "An Arm and a Leg" uses speech-recognition software to generate transcripts, which may contain errors. Please use the transcript as a tool but check the corresponding audio before quoting the podcast.

Dan: Hey there. 

Brittany Trang is a reporter at STAT News– that's a health care news outlet. We talked with Brittany's colleague Bob Herman in our last episode. Like Bob, she’s been covering the business of health care. 

And for Brittany, this story starts with Bob flagging a story to their team. He… 

Brittany Trang: Dropped a link in the chat that said like, hey guys, I think we should write about this, question mark, and nobody replied, 

Dan: The story was about a cyber-attack against a company called Change Healthcare. 

Brittany Trang: I was like that sounds like a startup and I was like who cares about some sort of health tech startup 

Dan: But Bob kept bringing it up. 

Brittany Trang: And I finally clicked on the link, and I was like, oh no, this is a big deal. This touches most of the American healthcare system. 

Dan: Yeah, and it’s no joke. Change Healthcare is what’s called a data clearinghouse. And it’s a big one. It’s an important part of health care’s financial plumbing. Someone had gone in and basically hijacked their computer system and said, Unless we get $22 million dollars, we’re not giving it back. So Change went offline, and a huge chunk of the country’s Pharmacists, doctors, therapists, hospitals just stopped getting paid. And Change Healthcare stayed offline for weeks and weeks. As we record this, seven weeks in, big parts of it remain offline. And here’s this other thing: Change Healthcare is not a startup. It’s been around for like 20 years. And in late 2022, Change got purchased by another company– a company that’s starting to become a real recurring character on this show: UnitedHealth Group.

You may remember: They’re the country’s biggest insurance company AND they’ve got their hands in just about every other part of health care, in a big way. For instance, they’re the very biggest employer of physicians in the country, by a huge margin. They’ve got their own bank, which– among other things– offers payday loans to doctors. And they have a huge collection of companies that do back-end services. In our last episode we heard about Navi Health— and how, under United's ownership, insurance companies have been using NaviHealth’s algorithm to cut off care for people in nursing homes. [Boy, yeah– that was a fun story…] And as we’ve been learning: When one company like this gets so big, their problems– like this cyber-attack– become everybody’s problem. And in this case, everybody’s problem seems to create an opportunity for United. We'll break down how THAT could possibly work, but obviously it doesn't seem like the way a lot of us would WANT things to work.. And we’ll end up talking about what we can maybe do about it. Not “we” as in a bunch of individuals trying to tackle an opponent this big. Good luck with that. But “we” as in the “We the people” of the United States Constitution. We may already be on the case. 

This is An Arm and a Leg– a show about why health care costs so freaking much, and what we can maybe do about it. I’m Dan Weissmann. I’m a reporter, and I like a challenge. So our job on this show is to take one of the most enraging, terrifying, depressing parts of American life, and bring you a show that’s entertaining, empowering, and useful. 

We’ll start with an attempt to answer what you’d think would be a simple question: What does Change Healthcare do?

Here’s Brittany Trang from STAT News again. 

Brittany Trang: It’s kind of like Visa or Mastercard or something. Like, when you go to the grocery store and you pay with a credit card, you are not putting your money directly into the pockets of the grocery store. There’s a middleman in there and change is that middleman, but for a ton of different things.

Dan: Like insurance claims. Brittany says hospitals and doctors offices often don’t submit claims directly to insurance companies. They send the claim to a middleman like Change. And then Change figures out where that claim needs to go next. Like: I'm sending a bunch of mail– I put it all in one mailbox, and the post office figures out how to get it where it goes. Except of course, there's no paper here, no envelopes, no physical packages: All those claims are basically data. Which is why a company like Change is called a data clearinghouse. And even if a given provider uses some other clearinghouse– and of course there are others– Change may still be involved. Because INSURANCE companies like Aetna also use Change as a place to COLLECT claims from providers. On that side, Change is kind of like a post-office box. But claims are just one of the types of data that Change handles. For instance… 

Brittany Trang: when you went to the pharmacy counter or when you would check in at the doctor’s office and they take your insurance information and figure out like what you’re going to pay for this visit. Both of those processes were messed up. 

Dan: Yeah, and there’s more! Prior authorizations– like when your doctor checks in advance to make sure your insurance company is OK with paying for whatever. Those all go through companies like Change. So, if change is offline, do they do your MRI, or your surgery– and just hope it doesn’t get denied when Change comes back? And once claims get approved, data for payments goes through Change too. So payments– a lot of payments– just stopped going out. Here’s Brittany Trang. 

Brittany Trang: it’s just kind of flabbergasting how big this is. This collapsed most of healthcare in some way or another. 

Dan: Overall, the numbers are wild: Change reportedly processes 1.5 trillion dollars a year in claims. Maybe a third of everything that happens in healthcare. According to the American Hospital Association, 94 percent of hospitals said they were affected. Some more than others. Not all providers use Change as their primary clearinghouse. But lots do. And for them, everything just stopped. 

Brittany Trang: I talked to one provider she’s like, Oh, I can, I can talk. I’m, here today and tomorrow before we close. And I was like, before we close for spring break. And she said, no, we have 3 and 13 cents left in our bank account. Brittany says that provider got a last minute reprieve– an emergency loan from United. There have been two or three rounds of these loans so far, plus some advance payments from Medicare. But as the outage has dragged on– it started in February, and we're recording this seven weeks later– it’s hard to know if those are going to be enough. At the end of March, I talked with Emily Benson. She runs a therapy practice in a Minneapolis suburb. Eight clinicians, mostly treating kids. She says the practice does maybe 70 or 80 thousand dollars worth of business a month. But then in February… Emily Benson: essentially everything went dark for us. 

Dan: United publicly acknowledged the Change hack on February 21st. But Emily Benson says she didn’t actually get a heads-up until almost a week later. 

Emily Benson: a lot of alarm bells went off, that was the end of the month. And so a lot of payments came due 

Dan: Her rent. Paychecks for her colleagues, and herself. 

Emily Benson: I mean, I was in a panic. Y’know, I didn’t know where I was going to go. 

Dan: She says she usually gets two payments a week from insurance, with everything passing through Change. But it’s not just the payments from insurance. Change also provides the documents that say how much an insurance company is GOING to pay for any given claim. 

Emily Benson: That’s a critical document because that tells me what does the family owe us. And then the beneficiary is also going to get that information. So they’re not surprised by what we charge them. So now every week we’re stacking up and stacking up these amounts that the family’s going to owe us. 

Dan: By the time we talked, Emily Benson had gotten two loans from United. About 40,000 each: maybe a month's worth of billing for her, between the two loans. 

Emily Benson: That first one was wiped out. Pretty quickly because now we’re on week five I’m working on the second, um, installment that I got from united. But, you know, that’s half gone now too. So I don’t know what the next step is. We’re nowhere near. Getting claims processing yet and so. I’m kind of panicking Yeah. 

Emily Benson: it looks like the terms are within 45 days. You have to pay back that temporary loan. How am I going to do that if I don’t have claims coming? 

Dan: God. 

Emily Benson: I’m still panicking. 

Dan: I’ll bet. Oh my God. You’re very, you’re very calm for somebody in this situation. 

Emily Benson: Well, you know, I’ve had a lot of therapy of my own. That’s how you become a therapist. So panicking doesn’t help anyone. 

Dan: I guess that’s, I’ll take that under advisement. 

Dan: So, to pay back those loans– which are supposed to be repaid within 45 days– Emily Benson is gonna have to start getting paid again. As we spoke, she'd had been living without systems for filing claims and getting paid for five weeks. And even when those systems get moving again, she's not gonna see all that money right away.

Emily Benson: Imagine the backlog and the clog. Five weeks worth of insurance claims I mean, we’re looking at a major traffic jam.

Dan: Oh myGod.Andif everybody were to work double time for the next five weeks, then it would be 10 weeks. But people can’t really work double time. 

Emily Benson: When you say that out loud, 

Dan: Sorry. 

Emily Benson: I don't feel as grounded, 

Dan: I’m so sorry. 

Emily Benson: but, but, but it’s probably realistic. 

Dan: Other news outlets are talking to providers like Emily Benson all over the country. We’re recording this in mid-April. United hasn't responded to our questions on this story, but their website says "We're determined to make this right." It says they've put out 4 point 7 billion dollars in emergency loans to providers so far. And it says that for the vast majority of Change Healthcare's services, a restoration date is "still pending." We have no idea what’s going to happen. What it’ll mean for our doctors, our therapists, our local hospitals. And look, there are elements of this story that go beyond health care. How many of us have personal health information– maybe financial information– that got seized by who the heck knows who in this? And yes, United’s getting some heat. They got a list of pointed questions from U.S. Representative Jamie Raskin. Their CEO is supposed to testify in a Senate hearing at the end of April. But as we'll get into in a minute, this disaster– United's disaster– could turn out to have a silver lining– for United: An opportunity to keep on growing. And that opportunity arises precisely because they’re so big, and doing so much business in so many parts of the medical-industrial complex. Which doesn't sound great. It raises questions about the, uh, potential downsides for a lot of people, when individual companies get this freaking big. And it raises questions about what we can maybe do about it. And the answer is: Maybe more than we think. That’s all coming right up. 

This episode of An Arm and a Leg is produced in partnership with KFF Health News. That’s a nonprofit newsroom covering health care in America. Their reporters do amazing work, and we’re honored to be in cahoots with them. So, as we’ve seen, a company like United is so big that their problems become everybody’s problem. And at least in one case that I’ve seen so far, everybody’s problem can become United’s opportunity. That’s what happened in Oregon, and a reporter from Washington, DC, was in a position to make it a national story. 

Maureen Tkacik: My name is Maureen Tkacik, but you can call me Mo and I am the Investigations Editor at the American Prospect, and a Senior Fellow at the American Economic Liberties Project. 

Dan: The Prospect is a politically-progressive news magazine, and the Economic Liberties Project is a non-profit that pushes an anti-monopoly agenda. A lot of Mo’s reporting looks at how financial behemoths are looking like monopolists– especially in health care. So… 

Maureen Tkacik: have come to know United Healthcare, pretty well, over past, year or so, 

Dan: Looking at, for instance, how they gobble up medical practices. And as we mentioned, that kind of gobbling has made United the biggest employer of physicians in the country– by huge margins– in just the last few years. About one doc in ten now works for them, as employees or "affiliates." As we've reported before, big players– like United, like big hospital systems, and like private equity groups– have been gobbling up medical practices for years. And: that kind of consolidation often leads to us paying more– and often for lousier healthcare. Moe Tkacik has been reporting on that kind of gobbling– and recently, she’d been looking at how the state of Oregon had been trying to slow it down. Then, in January 2024, a good-size medical group in Corvallis, Oregon said they were ready for United to gobble them up. The group is called the Corvallis Clinic, and it’s got more than a hundred docs. But United and the Clinic would have to go through a whole process to get approval from state regulators. That process includes: regulators asking the public for comments on the transaction. And in this case… 

Maureen Tkacik: they were. inundated with comments. 

Dan: Like 378 of them in just a few weeks. And the comments were overwhelmingly AGAINST the sale. In February, the regulators sent United and Corvallis a 5-page list of conditions under which they might approve a deal. A source of Moe’s sent me the document, which he got through a public-records request. The conditions are like, to not reduce service levels in the community for at least 10 years. To keep accepting non-United insurance. And to submit to a lot of monitoring. Then, as negotiations were starting, Change Healthcare went offline. And in early March, Moe got a tip: The clinic and United were gonna make an end run around this process. She talked with an anonymous insider at the clinic. Who told her: It turns out that all of the clinic’s billing had been connected to Change. 

Maureen Tkacik: So we’re talking about just a calamitous cash crunch. Their revenue came to a standstill 

Dan: And by the time Moe’s insider source learned what was up– this had been going on for two weeks. 

Maureen Tkacik: this source said that , Thursday, they all had a meeting and they were not sure they were going to be able to open their doors the following Monday. 

Dan: That was Thursday March 7. The next day, March 8th, lawyers for Corvallis Clinic filed an application for an emergency exemption from the normal review process. A week later, they got that exemption. And this time regulators had not demanded any conditions. As Moe's story laid out, United’s problem– the Change Healthcare hack– became everybody’s problem, including Corvallis. And their problem seemed to have become United’s opportunity. To gobble up the practice without having to agree to any conditions from pesky regulators. And a postscript to the Corvallis Clinic story: Shortly after regulators approved that deal, United sent notices to thousands of patients at another clinic it had taken over in nearby Eugene, saying basically: We don't have a doctor for you anymore. Goodbye and good luck. News reports said that clinic had lost more than 30 doctors since United took over. And among the public comments urging regulators to kibosh the Corvallis clinic, a bunch of people cited lousy experiences at that Eugene clinic under United's ownership. This is the kind of thing that Moe Tkacik and her colleagues at the American Economic Liberties Project– and what’s become a kind of anti-monopoly movement– want to change. And here’s where this episode becomes maybe just a little less of a horror story, and maybe a little more of an action movie. Because the anti-monopoly movement has gotten a big backer in the last three years: The Biden Administration. In 2017, a woman named Lina Khan made a name for herself in legal circles when she published a paper arguing that Amazon had become the kind of super-dominant company that antitrust laws were designed to constrain. Lina Khan was a law student when she published that paper. In 2021, Joe Biden appointed her to lead the Federal Trade Commission. The FTC and the Department of Justice split the job of antitrust enforcement, and they’ve both become super-aggressive. They’ve filed big lawsuits against Google, Amazon, and– in March of this year– Apple. And gotten a fair amount of attention. As we were writing up this episode, Jon Stewart interviewed Lina Khan on "The Daily Show." And here's how she described her approach in that conversation. 

LK: We’ve really focused on how companies are behaving. Are they behaving in ways that suggest they can harm their customers, harm their suppliers, harm their workers, and get away with it? And that type of too big to care type approach is really what ends up signaling that a company has monopoly power because they can start mistreating you, but they know you’re stuck. 

Dan: Earlier this year, the Wall Street Journal reported that Lina Khan's allies– antitrust folks at the Department of Justice are investigating United. Neither the Justice Department nor United has commented on that report. Meaning: Nobody’s denied it. So far, some of the Biden administration's antitrust lawsuits have pan out, and some haven't. Actually, in 2021, the Justice Department sued to prevent UnitedHealth Group from buying Change Healthcare. That one, they lost. But when the sued to block Penguin Random House from buying another giant publisher, Simon and Schuster, they won. And as Lina Khan told Jon Stewart, she and her colleagues aren’t just suing to prevent mergers. They sued to get infamous Pharma Bro Martin Skhreli banned for life from the pharma trade. And they won. And they’re looking at other ways big companies, especially in health care, screw people. 

LK: Just to give you one example, inhalers. They’ve been around for decades, but they still cost hundreds of dollars. So our staff took a close look and we’ve realized the, some of the patents that had been listed for these inhalers were improper. There were bogus. And so we sent hundreds of warning letters around these patents. And in the last few weeks, we’ve seen companies deal list these patents and three out of the four major manufacturers have now said, Within a couple of months, they’re going to cap how much Americans pay to just 35. 

Dan: I think we should start paying a lot more attention to what Lina Khan and her colleagues are up to– and what their chances are. I’ve started reading up, and getting in touch with folks who are in this fight, and who are watching it closely. Because this is looking like the kind of action movie I kind of like. Meanwhile, I’m posting a link to Jon Stewart’s interview with Lina Khan wherever you’re listening to this. I’ll have a few other links for you in our newsletter– you can sign up for that at arm and a leg show dot com, slash, newsletter. And I’ll catch you in a few weeks. Till then, take care of yourself. 

This episode of an arm and a leg was produced by me, Dan Weissmann, with help from Emily Pisacreta, and edited by Ellen Weiss. Big thanks this time to the novelist, journalist and activist Cory Doctorow, who has been writing about the antitrust revival for years, breaking down complex, technical stories in clear, accessible ways. Thanks to professor Spencer Waller from the Loyola University Chicago law school for talking about antitrust with me. And thanks to Dr. John Santa in Oregon– for sharing material he got via a public-records request to the state, and for his observations. Adam Raymonda is our audio wizard. Our music is by Dave Weiner and blue dot sessions. Extra music in this episode from Epidemic Sound. Gabrielle Healy is our managing editor for audience. She edits the first aid kit newsletter. Bea Bosco is our consulting director of operations. Sarah Ballama is our operations manager. And Armand a Leg is produced in partnership with KFF Health News. That’s a national newsroom producing in depth journalism about healthcare in America and a core program at KFF, an independent source of health policy research, polling and journalism. Zach Dyer is senior audio producer at KFF Health News. He’s editorial liaison to this show. And thanks to the Institute for Nonprofit News for serving as our fiscal sponsor, allowing us to accept tax exempt donations. You can learn more about INN at INN. org. Finally, thanks to everybody who supports this show financially– you can join in any time at arm and a leg show dot com, slash, support– and thanks for listening.