April 17, 2024
OLYMPIA — Washington state Insurance Commissioner Mike Kreidler’s office has issued a Technical Assistance Advisory (TAA) (PDF, 326.04 KB) to all state health insurers as part of its ongoing response to the recent Change Healthcare cybersecurity event.
The TAA advises health insurers and health care benefit managers that any health care benefit managers they use must be registered with the Office of the Insurance Commissioner (OIC) to conduct business in Washington state. The legislature passed a law in 2020 requiring health care benefit managers to be registered with the state because these companies make decisions that impact whether consumers can access needed care and whether health care providers will be paid for their services. Additionally, health insurers must submit direct and indirect contracts for health care benefit management services performed by these organizations.
“We have laws in place to protect consumers from harm,” said Kreidler. “This includes laws that prohibit unregulated entities from operating in Washington and making critical decisions impacting a patient's access to needed care. Companies that do business here must register with my office and health insurers must provide the contracts for their services.”
The OIC has been informed that Change Healthcare, and other health care benefit manager business entities, are processing claims and reviewing consumers’ need for health services for several health insurers in Washington state. However, not all of these entities are registered with the OIC or have filed their contracts with the OIC.
Change Healthcare, a subsidiary of United Health Group that also operates Optum Solutions, encountered a cybersecurity event on Feb. 21, 2024, that compromised systems widely used by providers and insurers to fill prescriptions, approve medical services, and submit costs for reimbursement. The result has been delays for some patients in getting necessary medication and prior approvals for care. For some hospitals, independent health care providers, outpatient facilities and pharmacies across Washington, there have been delays and uncertainty in receiving payments.
The OIC subsequently issued three letters to health insurers operating in Washington requesting they provide copies of all executed and active health care benefit manager contracts with Change Healthcare, Inc.
In the TAA, the OIC identified multiple entities as contracting to provide health care benefit management services as corporate partners or affiliates of Change Healthcare. These include EquiClaim, RelayHealth, Emdeon, Optum Rx, OptumInsight, and McKesson.