Days of cash on hand was the resilience metric that mattered in the Change Healthcare outage

The week

By early March 2024, a large number of American health care providers had gone two weeks without a single insurance payment landing in their bank accounts. Patients kept arriving, staff kept working, and rent and payroll kept falling due. Nothing had gone wrong inside their own offices. A company many had barely thought about had been hit by criminals, and the pipe that carried their bills out and their money in had gone dry.

The Change Healthcare outage, which began on February 21, had stopped or slowed claims and payments across the country. Change ran one of the largest clearinghouses in US health care, the middleman that passes bills from providers to insurers and payments back again. With it offline, many providers simply could not get paid.

Change had become part of UnitedHealth in October 2022, after a federal judge rejected the Justice Department’s attempt to block the acquisition. UnitedHealth later said Change’s payment processing handled about 6 percent of all US health care payments. Its claims network reached further still, because many practice management and billing systems sent their claims through it by default, often without the provider ever signing a contract with Change directly.

On the morning of February 21, ransomware encrypted Change’s systems, and UnitedHealth cut connectivity to Change’s data centers to stop it spreading. That decision contained the attack and stopped the claims at the same moment. Testimony two months later showed the intruders had been inside since February 12, using stolen credentials on a remote access portal without multifactor authentication. By the end of February the company had attributed the attack to the ransomware group known as ALPHV or BlackCat.

The response that week was about money. On March 1, Optum, the UnitedHealth Group business that owns Change, announced a temporary funding assistance program for affected providers: in effect, short-term advances to help them keep going.

The program drew complaints almost at once. Physician groups said the amounts offered were small compared with the payments their members normally received. UnitedHealth later acknowledged to Congress that some early estimates of providers’ gaps had not matched their full need, because it lacked visibility into their claims flow, and said it adjusted.

On March 5, the Department of Health and Human Services (HHS) announced steps to help. It urged Medicare Advantage plans (private insurers that run Medicare coverage for many older Americans) and other payers to relax prior authorization and other utilization management rules. Prior authorization is the requirement to get an insurer’s approval before certain treatments; utilization management is the wider set of checks insurers use to control what they pay for. HHS also urged payers to offer advance funding and to make it easier for providers to switch clearinghouses.

The Centers for Medicare & Medicaid Services (CMS), the agency that runs Medicare, said providers could quickly request new electronic data interchange enrollments. Electronic data interchange, or EDI, is the standard way computers exchange bills and payments; a new enrollment lets a provider send claims through a different route.

On March 9, CMS went further, announcing accelerated payments for Medicare Part A providers (mostly hospitals) and advance payments for Part B suppliers (such as physicians and other outpatient services) affected by the outage.

The criminal side of the story moved in the same days. Researchers tracking ALPHV’s bitcoin wallets reported a payment of about $22 million on March 1. Within days the group’s leak site went offline behind what appeared to be a staged law enforcement seizure notice, and an affiliate complained publicly that the group had kept the money. UnitedHealth did not confirm a ransom payment that week. Its chief executive later told Congress that the decision to pay had been his.

Restoration began in stages. On March 7, UnitedHealth said nearly all pharmacies that used its network before the attack could again process claims. It said it expected its electronic payments platform back around mid-March and would begin restoring the medical claims network the week after. For providers who had not switched clearinghouses, that meant at least two more weeks of waiting, followed by a backlog.

Meanwhile, physician groups and hospital associations reported that many practices were struggling to meet payroll.

The American Hospital Association surveyed hospitals from March 9 to 12. About 1,000 responded, and 94 percent reported a financial impact. More than 80 percent said the attack had affected their cash flow. Of those, nearly 60 percent put the revenue impact at $1 million a day or more.

Most cyber incidents are measured in records exposed or days of downtime. For most providers affected by Change Healthcare, the damage was measured in days of cash. A practice or small hospital that could not submit claims stopped receiving payments, while payroll, rent and supplier invoices kept coming. A security incident at a vendor became a liquidity crisis for organizations that had not been attacked.

These organizations did nothing wrong in security terms. Their own computers were fine. Their exposure came entirely from depending on someone else, and the harm arrived not as stolen data but as an empty bank account.

Seen as a financial event, the outage posed three questions in sequence: how long a provider could last on its own resources, who would bridge the gap and on what terms, and who would bear the loss in the end.

Each question belongs to a different discipline. The first is treasury: forecasting cash and setting reserves. The second is financing and payer relations: knowing who can lend, on what terms, and how fast. The third is legal and risk transfer: contracts, litigation and insurance. In most provider organizations these sit with different people who rarely plan together, which is part of why so many were caught short.

Why a technology failure became a cash crisis

The outage hit cash so hard because of how money moves in American health care.

When a patient is seen, the provider does not usually get paid on the spot. Instead, the visit is turned into a claim: a standardized electronic bill, with codes describing the diagnosis and treatment. The claim goes to the patient’s insurer, often by way of a clearinghouse, which checks it for errors, reformats it and forwards it. Days or weeks later, the insurer sends back payment along with a remittance, a statement explaining what was paid and why. The whole chain, from booking the appointment to collecting the last dollar, is called the revenue cycle.

The cycle runs continuously. On a normal day, claims from last week are turning into cash this week, while today’s visits become next week’s claims. Providers plan around that steady flow. Payroll is timed to it. Supplier payments are timed to it.

Now stop the flow. Visits continue, so costs continue. But nothing new reaches insurers, so nothing new comes back. For a while, money already in the pipeline may still trickle in. Then it stops. The provider is, in effect, working for free and financing the gap out of its own pocket.

The position resembles that of an employee whose employer’s payroll provider has gone down, with no word on when the next paycheck will arrive. The mortgage, car payment and grocery bills do not wait. How long the employee could manage would depend on savings, on whether they could borrow, and on whether anyone would cover the loss. Providers faced exactly those three questions, at scale.

What a clearinghouse actually carries

A clearinghouse moves more than claims. HIPAA sets standard electronic formats for the main administrative transactions. The claim itself is one. The remittance that explains a payment is another. A third is the eligibility check a front desk runs to confirm a patient’s coverage before a visit. Prior authorization requests and claim status inquiries travel the same way. When a clearinghouse goes dark, all of these can stop together.

The effects compound. Without eligibility checks, staff cannot confirm coverage, so they either see patients at risk of non-payment or ask for payment up front. Without remittances, billing staff cannot post the payments that do arrive, so they cannot tell which claims were paid, denied or never received. Even cash that reaches the bank can be hard to match to the right accounts.

Why switching was slower than it sounds

The obvious fix was to move to another clearinghouse, and many providers did. It was not instant. A new clearinghouse needs enrollment with each payer, and some payers send electronic remittances to only one destination per provider, so moving them is a formal change with its own processing time. The practice management system must be connected and tested. Payer identifiers must be mapped. A group billing dozens of payers could spend weeks on the work, with staff already stretched by manual workarounds.

Paper was a poor fallback. Medicare generally requires claims to be submitted electronically, with narrow exceptions, and many commercial payers process paper slowly. Large health systems often had a second clearinghouse relationship for some payers, or the staff to stand one up quickly. Small practices usually had neither.

Why the gap widened after the first week

The cash gap grows in a predictable shape. In the first days, payments for claims submitted before the outage continue to arrive, so the bank balance looks normal. As that pipeline empties, receipts fall toward zero while expenses stay flat. The deepest point comes weeks in, not on day one. A provider that judged its position by the first week’s balance could badly underestimate what lay ahead.

How long you can last: the cash runway

Hospitals and physician groups track days cash on hand as a measure of financial health. It is a simple idea: the number of days the organization could keep paying its normal expenses from the cash it holds if all income stopped tomorrow. Few link it to cyber resilience. The outage made the link direct.

An organization with large reserves or a committed credit line could keep operating for weeks while claims backed up. A practice with thin reserves faced trouble within its first missed billing cycle.

The useful measure is narrower than days cash on hand. It is the number of days the organization can meet payroll and essential payables with no claims revenue at all. Call it the cash runway, borrowing the term start-ups use for how long they can operate before money runs out.

That runway depends on payer mix and on the timing of receipts. Payer mix is the share of revenue from each source: Medicare, Medicaid, each commercial insurer, and patients themselves. A practice that receives most of its revenue from one or two payers through one channel has a shorter runway than its balance sheet suggests. So does one whose payroll falls just after its largest weekly remittance.

How the runway differs by type of provider

• Hospitals with public debt. Many bond agreements include a days-cash-on-hand covenant, and rating agencies watch the figure closely. A hospital can have ample cash and still worry about a dip that brings it near a covenant floor or a rating review.
• Physician-owned groups. Many distribute most of their surplus to partners, so reserves are thin by design. Their runway may be a few payroll cycles regardless of how profitable the practice is.
• Groups owned by investors. These often carry significant debt and depend on a revolving credit facility. Their runway is mostly a question of how much of that facility is undrawn, and whether a revenue drop threatens a covenant.
• Community health centers and rural hospitals. Federal grants and cost-based payments provide some income that does not depend on claims, but margins are thin. UnitedHealth told Congress that about a third of its loans went to safety-net hospitals and federally qualified health centers.
• Independent pharmacies. Pharmacy claims are approved in real time at the counter. When the network stopped, pharmacists could not confirm coverage or copays, and either filled prescriptions at risk or asked patients to pay. Pharmacy service came back first, which limited the damage.

How to calculate it

Most finance teams already have the tool: a thirteen-week cash flow forecast, built week by week from expected receipts and payments. The stress case sets claims receipts to zero from a chosen date while keeping patient payments and grant income, then shows the week in which cash falls below the minimum operating balance. Running it by payer and by clearinghouse shows which single failure hurts most.

The answer will be uncomfortable for some. It should be recalculated at least yearly and after any change in payer mix, clearinghouse or payroll calendar. The calculation is cheap. The insight it gives is expensive to learn any other way.

How a month of cash shrinks to two payrolls

Take a twelve-physician group that, on paper, holds enough cash to cover about a month of total expenses, which sounds comfortable. But its finance director runs the narrower calculation. Payroll is due every two weeks. Nearly all of its insurance revenue flows through a single clearinghouse. Its largest insurer pays on Thursdays, and payroll goes out the following Monday. If the clearinghouse goes dark on a Wednesday, the practice misses that Thursday payment and faces a full payroll four days later with nothing new coming in.

The real runway, once payroll timing and essential bills are mapped, turns out to be closer to two payrolls than a month of comfort. That is a very different conversation to have with the board.

Finance teams can calculate this runway and set a floor for it, just as they set floors for liquidity ratios. The CFO and CIO should agree on it together, because it defines how long technology has to restore revenue before the business is at risk.

It also sets the recovery time objective for revenue cycle systems on a financial basis, rather than by convention. A recovery time objective, or RTO, is the target for how quickly a system must be back after it fails. Too often it is set by IT habit (“critical systems: 24 hours”) rather than by asking how long the business can actually survive without it. The cash runway gives a real answer.

That answer also shapes the technical plan. If the runway is three weeks, the revenue cycle team needs a pre-tested route to a second clearinghouse that can be activated in days, with payer enrollments already in place. If the runway is three months, a slower switch may be acceptable. Either choice is defensible. The indefensible position is having neither a figure nor a plan.

Who bridges the gap: emergency financing

Three sources of bridge funding appeared in the first weeks. Optum’s temporary funding assistance program advanced money to affected providers. CMS offered accelerated and advance Medicare payments. Some commercial payers advanced funds or relaxed rules.

Each came with conditions. The Optum and CMS funds were advances, to be repaid or recouped later. Recoupment means the payer takes the money back by withholding it from future payments. Early on, physician groups complained that the Optum amounts were small relative to normal receipts.

Emergency relief is a backstop. A provider’s own bridge options decide whether it can wait for relief to arrive. Government and vendor programs take time to announce, apply for and pay out, and the terms may not match a particular provider’s needs.

The most valuable option is a committed, undrawn line of credit sized to the runway gap, arranged in normal times when lenders are willing. “Committed” means the bank has agreed in advance to lend up to a set amount on request; “undrawn” means the money has not been borrowed yet. The key is arranging it before the crisis, because a lender asked for credit by a provider whose revenue has just stopped will be far more cautious.

Other options include agreements with major payers on interim payments if claims cannot be submitted, and a documented process for applying quickly to government programs, with the required data ready. In the Change outage, providers that could quickly show their normal monthly receipts by payer were better placed to request appropriate advances.

The fine print on each lifeline

Each source of relief had its own terms. UnitedHealthcare, the insurance arm, accelerated more than $1 billion in claims payments to providers in its own network, according to UnitedHealth’s testimony. For claims involving other payers, Optum offered loans it described as no-cost and no-interest. CMS required providers to apply through their Medicare administrative contractor and to attest that the outage had affected them. Its payments were based on past Medicare payments and were recovered from later claims.

The differences matter for planning. Relief from an insurer depends on that insurer’s share of your revenue. Relief from Medicare depends on your Medicare share. Relief from the vendor depends on the vendor’s willingness and balance sheet. A practice whose revenue came mostly from a commercial insurer with no advance program could find that none of the three fit.

Bank credit and its traps

Not all credit lines behave the same in a crisis. An uncommitted line can be withdrawn at the bank’s discretion. A committed line may still include a material adverse change clause or covenants that a sudden revenue drop could trip. An asset-based line, secured on receivables, has a subtler problem. Lenders usually lend only against receivables up to a certain age. As claims sit unsubmitted, receivables age past that limit and the amount the provider can borrow shrinks, exactly when it is needed most.

Health systems with investment portfolios face a different trade-off. Selling investments to raise cash in a falling market locks in losses. Drawing a credit line first and selling later may be cheaper, but only if the line exists and the treasurer has authority to use it quickly. Writing that authority into the treasury policy ahead of time removes a decision from the crisis.

The case against preparing, and why it fails

A sceptic could argue that the system rescued providers this time: the vendor and the government both advanced money. Preparation looks like an expense with no payoff. That argument depends on the failed vendor being very large, very solvent and under intense political pressure to help. A smaller clearinghouse, or a billing company hit by the same attack, would have had neither the money nor the motive to advance billions. The next outage may come from such a firm.

There is a trade-off. Committed credit lines carry fees, and a small practice may balk at paying for a facility it hopes never to use. The outage gave CFOs a concrete case against which to price that cost.

Repayment terms matter too. An advance that must be repaid quickly after restoration can create a second cash squeeze just as claims resume, because back-billed claims take weeks to convert into cash. Back-billing is the work of submitting all the claims that piled up during the outage. It is slow, labor-intensive and often produces more errors and denials than normal billing. A provider can find itself repaying an advance at the very moment its cash is still recovering.

Timely filing limits add a further risk. Payers set deadlines for submitting claims, and Medicare’s is generally one year from the date of service. Commercial deadlines are often much shorter. A claim that misses the deadline can be denied outright, which turns delayed revenue into lost revenue. Providers should know each major payer’s limit, and should ask for written extensions early in any long outage.

Who bears the loss: contracts and insurance

The third question is who pays in the end. Clearinghouse and revenue cycle contracts, especially those signed by smaller providers, often limited the vendor’s liability to fees paid and excluded consequential losses such as delayed revenue.

A “limitation of liability to fees paid” means that if the vendor fails, the most it owes you is roughly what you paid it, which for a clearinghouse may be a small monthly fee. “Consequential losses” are the knock-on effects of the failure, such as lost or delayed revenue. Excluding them means the vendor is not responsible for the very harm that hurt providers most.

Many contracts said nothing about restoration commitments, notification timelines or help moving to another provider in a long outage. That left providers with little contractual remedy and put the cost on the party least able to absorb it.

The contract you may not have

Many small providers did not contract with Change at all. Their practice management or billing vendor did, and routed claims through it as a subcontractor. Any remedy then runs through that intermediary, whose own contract may cap its liability in the same way. The first step is mapping the chain: which vendor submits claims, through which clearinghouse, under which agreement.

HIPAA paperwork does not fill the gap. Business associate agreements govern how a vendor protects health information. They do not promise that a service will keep running. Clearinghouses are themselves HIPAA covered entities, which shapes their duties after a breach of data, but those duties concern notification and safeguards, not compensation for lost cash flow.

Litigation is the slow alternative. Lawsuits by patients and providers over the Change attack were consolidated into multidistrict litigation in federal court in Minnesota in 2024. Courts take years, and liability caps and exclusions in the underlying contracts will shape what providers can recover. No practice can meet payroll with a lawsuit.

Better terms are possible, though bargaining power varies widely. Useful provisions include:

• Defined incident notification timelines, so you hear quickly and formally when something goes wrong.
• Restoration commitments with service credits, meaning a reduction in fees if the vendor misses agreed recovery targets.
• Transition assistance if service is not restored within a set period, so the vendor must help you move elsewhere.
• Clarity on how the vendor will support reprocessing of claims afterward.

Large health systems can negotiate these. Small practices often benefit from negotiating through a group purchasing organization, a management services organization or a state medical society, all of which pool the buying power of many small providers.

What to ask for, and what is realistic

Vendors price risk, and a clearinghouse serving thousands of small practices for a modest monthly fee will not accept unlimited liability. Asking for it wastes negotiating capital. More realistic requests target the specific harm of a long outage. One is a separate, higher liability cap for outages that run past an agreed number of days. Another is a fee waiver for the outage period and the months of reprocessing that follow. A third is transition assistance at no charge, including a clean export of claim history and configuration so a new vendor can start quickly.

Large health systems can ask for more. They can seek a named recovery time for the services they use, rights to join the vendor’s recovery exercises, and the right to terminate without penalty after a defined outage. Some will also ask the vendor to maintain a tested route to another clearinghouse on their behalf. Each request has a price, often in higher fees. The trade-off is worth making explicit: a few points on an annual contract against weeks of payroll at risk.

The insurance gap

Insurance is the other half. Many cyber policies covered business interruption from incidents affecting the insured’s own systems, with narrower cover, or none, for a vendor’s outage. Business interruption cover pays for income lost while operations are disrupted. The trap is that the standard version usually assumes the disruption happened to you.

Contingent business interruption cover addresses that gap: it pays when a supplier’s problem disrupts your business. It often comes with sublimits (a lower cap than the main policy) and waiting periods (a number of hours or days before cover starts).

Organizations should review the wording with their broker and counsel, and test it against a scenario like this one: no breach of their own systems, weeks without claims revenue, and recovery costs for reprocessing. If the policy would not respond to that scenario, it is better to find out on an ordinary afternoon than in the middle of a crisis.

Delayed revenue is not always lost revenue

One feature of this event complicates insurance claims. Business interruption cover typically pays for lost net income and extra expense during a defined period of restoration. Most claims revenue during the Change outage was delayed, not lost: once systems returned, the claims could be billed and paid. An insurer may therefore argue that the covered loss is smaller than the provider’s cash shortfall.

What remains is real but narrower. It includes interest on bridge financing, overtime and temporary staff for manual work and back-billing, the cost of switching clearinghouses, and claims denied for late filing. Providers making a claim need records that separate these costs from normal operations. A finance team that tags outage-related expenses from day one will present a far stronger claim than one reconstructing them months later.

Policy wording matters in detail. Some forms distinguish between a security failure at a dependent business and a non-malicious system failure. Some limit cover to named providers, others to any IT provider. The definition of when the waiting period starts also varies. A broker can show how each element would apply to a clearinghouse outage before renewal, not after a loss.

Putting the three questions together

The three questions interact. A longer runway reduces the need for bridge financing. Committed financing makes contractual remedies less urgent. Strong contracts and insurance reduce the reserves needed.

Each provider will balance them differently. A large system with deep reserves may rely mainly on its balance sheet. A small practice with thin reserves may need a credit line and careful insurance. A practice in a purchasing group may get better contract terms than it could alone.

What matters is that the CFO, CIO and general counsel make that balance explicit together, instead of leaving it to defaults set years earlier by separate teams. In many organizations, the cash reserve policy was set by finance, the clearinghouse contract by the revenue cycle team, the insurance by risk management and the recovery targets by IT, with nobody looking at all four at once.

The few numbers worth reporting

A finance or audit committee does not need a long dashboard on this risk. A handful of figures will do. The first is the runway in days, against the floor the board set. The second is the share of claims revenue that depends on a single clearinghouse or billing vendor. The third is the share of major payers already enrolled on a backup route. The fourth is undrawn committed credit, expressed as weeks of payroll. The last is the insurance sublimit for a vendor outage, compared with the estimated cost of a thirty-day outage.

Each figure has a natural owner: the CFO for runway and credit, the revenue cycle leader for concentration and backup routes, the risk manager for insurance. Reported together twice a year, they show whether the organization is more or less exposed than last time, and why.

One exercise, four owners

A practical way to force that joint view is a single annual exercise built on a scenario like this one. Finance runs the cash forecast with claims at zero. The revenue cycle team walks through switching clearinghouses and works out how long payer enrollments would take. Legal pulls the contracts in the claims chain and lists the actual remedies. Risk management takes the scenario to the broker and asks for a written view on coverage. IT confirms which systems would need to change.

The output is a short list of gaps with owners and dates, presented to the finance or audit committee. A large health system might run it over several sessions with dozens of people. A ten-physician practice can do it in an afternoon with its office manager, accountant, billing company and broker. The scale differs. The questions are the same.

The exercise also reveals concentration the organization did not know it had. A health system may find that its main clearinghouse, its secondary claims scrubber and its patient payment portal all depend on the same parent company. That finding does not require immediate action, but it should be recorded, owned and revisited.

Payroll, patients and lenders: who else feels it

When a vendor outage stops the claims, the first bill a provider may struggle to pay is its own payroll. The strain then spreads to patients, suppliers, lenders and the board.

Staff. Payroll is usually the largest and least flexible expense. When physician groups reported that practices were struggling to meet payroll, the people at risk were nurses, receptionists, billing staff and clinicians. A missed or delayed payroll damages trust quickly, and in a tight labor market, good staff have options.

The options for closing a payroll gap are few and unattractive. Owners of physician practices can defer their own pay or lend personal money to the practice. Managers can delay payments to suppliers and landlords, renegotiate due dates, or cut hours. Each choice moves the loss somewhere else: onto the partners, the suppliers or the staff. A practice that has thought this through in advance can choose deliberately instead of in a panic on a Friday afternoon.

Patients. A practice short of cash may delay buying supplies, limit appointments or, in the worst case, close its doors temporarily. Rural and small practices are often the only nearby option for their patients, so their financial fragility becomes a question of access to care.

Where eligibility checks and pharmacy claims failed, some patients were asked to pay up front and seek reimbursement later. That shifts the cash problem from the provider to the patient, and it falls hardest on those least able to carry it.

Suppliers and lenders. Late payments to suppliers and landlords ripple outward. Lenders watch covenants, the financial conditions written into loan agreements, and a sudden drop in revenue can push an organization close to breaching them even if the cause is outside its control.

Hospitals with publicly held bonds had one more audience. Municipal bond issuers have continuing disclosure obligations, and a sudden, sustained drop in cash could raise questions about what to tell bondholders. Those decisions involve bond counsel and should not wait until a covenant test date.

Regulators and boards. Directors and, for some organizations, regulators reasonably ask whether management understood the organization’s dependence on a single vendor. An honest answer of “we had not thought about it” is uncomfortable. A prepared answer, with a runway figure, a credit line and reviewed contracts, is reassuring.

Strategy. Finally, an organization that has to spend weeks in survival mode is not investing, recruiting or growing. Even a provider that comes through intact may lose months of momentum.

Seen this way, the cash runway is a whole-organization resilience measure rather than a finance metric that happens to involve technology, and it belongs on the same dashboard as clinical quality and staff turnover.

Runway, credit, contracts and cover on a single page

A well-prepared provider can answer, on a single page, how many days it can meet payroll without claims revenue, what credit it can draw on and how fast, what its key vendor contracts promise after an outage, and what its insurance would pay if a vendor failed.

The usual failures:

• Confusing days cash on hand with runway. The headline number hides payroll timing and dependence on a single channel.
• Setting recovery targets by habit. IT’s standard RTO may bear no relation to how long the business can survive.
• Waiting for rescue. Relying on vendor or government programs that may be slow, small or expensive to repay.
• Signing vendor paper unread. Accepting liability caps and exclusions that leave the provider holding the entire loss.
• Assuming cyber insurance covers vendor outages. Many policies only respond to attacks on your own systems.
• Forgetting the repayment hump. Planning for the outage but not for the squeeze when advances fall due during the backlog.

Two objections worth answering

Concentration is a policy problem, so provider preparation is a distraction. Concentration does need a policy answer. Any structural fix would take years, though, and in the meantime each provider carries its own exposure. Preparing for a vendor failure is what any business does when it cannot control its supplier.

Small practices cannot afford any of this. Some of it costs money: a committed credit line, broader insurance, a second clearinghouse. Much of it costs only time. A runway figure, a map of the claims chain and a reading of the policy wording are within reach of any practice with an accountant and a broker. Purchasing groups and medical societies can share the cost of model contract language and standing arrangements with a backup clearinghouse.

Where a provider’s cash runway is decided

1. If every insurance payment stopped tomorrow, how many days could we meet payroll and essential bills? Who calculated that, and when?
2. Is our recovery target for billing systems based on that cash runway, or on IT convention?
3. Do we have a committed credit line we could draw on within days? What does it cost, and is it big enough?
4. Would our cyber insurance pay if a vendor, not us, were attacked? What is the waiting period and the cap?
5. If we took an emergency advance, when would it have to be repaid, and could we afford that while working through a backlog?

With hindsight

Most providers recovered their claims flow within weeks to a few months, as Change restored services and others moved to different clearinghouses. For many, those weeks were among the most financially stressful in their history.

By late April 2024, UnitedHealth said it had advanced more than $6.5 billion in accelerated payments and interest-free loans. That is a large number, and it kept many practices afloat. But loans are still loans. They fall due once claims resume, which is exactly when a practice is still converting its backlog into cash. The repayment period is a second hurdle, less dramatic than the outage but real for organizations with thin margins.

UnitedHealth’s testimony to the Senate Finance Committee on May 1, 2024 filled in the background. The intruders had entered on February 12 using compromised credentials on a remote access portal that lacked multifactor authentication, and ransomware followed nine days later. The chief executive said the decision to pay a ransom had been his. He also said that early estimates of providers’ funding needs had fallen short because the company could not see their claims flow. Relief sized by a vendor will not always match a provider’s actual gap.

The scale of the incident kept growing. UnitedHealth later put the number of people whose data was affected at about 190 million, the largest health data breach reported to federal regulators. The company reported costs from the attack well above $2 billion in 2024. Lawsuits from patients and providers were consolidated in federal court in Minnesota and proceeded slowly, as such cases do.

Medicare’s advances were recovered from later claims, as the program intended. For many providers the repayment therefore arrived as smaller Medicare remittances in the months after restoration, rather than as a single bill. The effect was easy to miss in a cash forecast that assumed normal receipts had resumed.

Policy proposals followed. In March 2024, Senator Mark Warner introduced a bill that would have linked accelerated and advance payments after future cyber incidents to minimum cybersecurity standards for providers and their vendors. It did not become law. HHS also proposed a broad update to the HIPAA Security Rule at the end of 2024, aimed at safeguards rather than at the financial exposure this article describes.

Contingent business interruption cover drew more attention from insurance buyers and brokers. For many organizations, the outage was the first time they had read that part of their policy closely, and some found it did not cover a scenario like this one.

Others found a second problem: even where contingent cover applied, the claim was smaller than they had hoped, because much of the revenue was delayed rather than lost. The costs that remained, such as financing, overtime and late-filing denials, needed careful documentation. That experience made the argument for tagging incident costs from the first day.

Hospital associations, medical societies and members of Congress pressed for action on concentration in health care infrastructure, the fact that so much of the system depends on a handful of companies. No structural remedy has been enacted.

The financial framing has held up. Resilience for providers is partly a balance sheet question, and smaller and rural practices with the thinnest reserves remain the most exposed to the next shared-vendor outage.

Cyber risk can arrive through your bank account as well as your own network, by way of someone else’s failure. Preparing for it is less about technology than about finance: knowing your runway, arranging credit in calm times, reading contracts and insurance with a realistic scenario in mind, and getting the CFO, CIO and general counsel to look at the whole picture together. Each of those steps can be taken now, without waiting for the next outage or for Washington to act.