Change Healthcare Cyberattack Information for Iowa Medicaid Members and Providers

What happened?

On February 21, Change Healthcare (CHC) (owned by parent company Optum, a subsidiary of United Health Group) experienced a cyberattack, which took the company’s systems offline.
CHC provides pharmacy point-of-sale services, including eligibility lookup, prior authorization, and billing for Iowa Medicaid members who receive care through a fee-for-service arrangement.
CHC systems came back online March 28, 2024 and are processing pharmacy claims for Iowa fee-for-Service members. However, Iowa’s preferred drug list website, Iowa’s Drug Utilization Review, and Pharmacy and Therapeutics web sites remain down. More information can be found at HHS’ Medicaid Pharmacy page.

The outage primarily affected pharmacy services for Iowa Medicaid members who are enrolled in fee-for-service Medicaid coverage. This outage did not affect those who receive care through a managed care organization (MCO).
Some providers use a medical claims clearinghouse that was also affected by this outage.
Members experiencing challenges obtaining prescriptions or other services related to this outage should contact Iowa Medicaid Member Services at 1-800-338-8366 (toll free) or 515-256-4606 (Des Moines Area) Monday through Friday from 8 a.m. to 5 p.m.) for assistance.

Change Healthcare’s privacy office and security information teams are actively engaged and working to understand the impact to members, patients, and customers. It may take several months to determine the full extent of the attack.
United Health Group is providing support for those who are concerned about their personal data. UHG is also offering free credit monitoring and identity theft protection services to those impacted. More information is available at Change Healthcare Cyberattack Support.
Iowa Medicaid information systems were not accessed as a result of the cyberattack affecting Change Healthcare.

Iowa Medicaid’s top priority is ensuring that Iowans who rely on Medicaid services have access to health care and prescriptions.
When Iowa Medicaid learned of the outage, we took swift action to ensure Iowa pharmacies were aware of the impacts and provided them with instructions on how to continue filling prescriptions so no member goes without prescription medications as a result of this outage.
On February 21, as soon as we learned of the outage, we alerted Medicaid providers, pharmacies, retailers, and pharmacy trade associations representing nearly all Iowa pharmacies of the outage.
We directed pharmacies to fill prescriptions as written with assurances of reimbursement once systems are functioning.
We waived pharmacy prior authorization requirements for impacted members.

Providers who need assistance changing their clearinghouse can go to Help - Registration & Management - EDISS Connect (edissweb.com).
- On that page is a link to the provider user guide which lists the steps necessary to change clearinghouses. Page 27-34 has ‘manage transactions’ which details how to add a vendor. Providers can keep their current CHC clearinghouse and add a new vendor unless they already have two, then they will have to remove one.
- Once they add a new vendor, the usual time for verification and approval of a new vendor is 7 business days, but EDISS is actively monitoring these to have 2-4 business days turnaround.
- Providers can also access video tutorials at the link above which detail the steps necessary to change clearinghouses.
- Providers can call EDISS at 800-967-7902 if they need additional assistance.
Providers experiencing financial difficulties related to this outage can obtain information about temporary funding assistance at Optum Pay.
Providers experiencing other challenges related to this outage can contact Iowa Medicaid Provider Services at 800-338-7909 (toll-free) or 515-256-4609 (Des Moines area), or via fax at 515-725-1155. Assistance is available Monday through Friday, 8 a.m. to 5 p.m.

Additional updates on the situation can be found at the following links:

Cybersecurity & Infrastructure Security Agency – CISA
U.S. Department of Health and Human Services FAQ on the Change Healthcare Cybersecurity Incident: Change Healthcare Cybersecurity Incident Frequently Asked Questions