Information for WellSky Clients on the Change Healthcare Cybersecurity Event

In response to the Change Healthcare cybersecurity event that began on February 21, 2024, WellSky is working diligently to keep our clients informed of the latest updates from Change. Check this site frequently as we continue to share updates and information.

Change has shared the following information with WellSky and other partners:

  • Change became aware of the cybersecurity event in the early morning hours of February 21, 2024.
  • Change severed access to a broad range of its systems following its cybersecurity processes.
  • Change has identified the threat actor as AlphV (Blackcat). Law enforcement and cyber incident response partners are involved.
  • Some Change systems have already been restored or were not disconnected at all. For details on which Change systems are operating, visit https://status.changehealthcare.com.
  • Change indicated that safely restoring their systems is their priority.
  • Change is currently offering three temporary funding assistance programs through Optum Pay. Details are available at https://www.optum.com/temporaryfunding.
  • Updates related to the cyber event can be found at https://www.unitedhealthgroup.com/changehealthcarecyberresponse.

WellSky is following its security protocols and maintains a robust incident response program. We began our investigation immediately upon becoming aware of this incident and will provide updates as circumstances change. We encourage you to visit the Change status page for updates at https://www.unitedhealthgroup.com/changehealthcarecyberresponse. If you have further questions, please contact the WellSky support team.

Current status: WellSky sent Optum documentation to opt in to reconnecting with Change on April 25. If you have further questions or did not receive the documentation, please contact our support team.

Update: April 23, 2024

On April 22, 2024, UnitedHealth Group (UHG) distributed a press release that included an update on the ongoing review of impacted patient data and support options available. Below is a summary of the UHG press release:

  • UGH is conducting an ongoing investigation and review of the data involved in the cyberattack on Change.
  • UHG anticipates it will take several months of continued data review and analysis before enough information will be available to identify and notify impacted customers and individuals.
  • UHG has offered to make notifications and undertake related administrative requirements on behalf of any provider or customer.
  • In addition, UHG is offering support through a dedicated website at changecybersupport.com. UHG has also established a call center (1-866-262-5342) to assist in offering free credit monitoring and identity theft protections for two years to anyone impacted.
  • UHG and external industry experts continue to monitor the internet and dark web to determine if data has been published.

Update: April 22, 2024

WellSky and Change are in the initial stage of establishing a new connection for E-Claims restoration. This initial phase will include claims submission from the WellSky Personal Care platform to Change. The electronic remittance advisor (ERA) functionality and integration is targeted to be restored in a future phase. Change has published a list of supported payers which can be found under the RPA (Revenue Performance Advisor) Claims & Remittance Payer List​. Change continues to add payers to the list daily.

As part of the new connection process, WellSky will send opt-in documentation the week of April 22. If you have further questions, please contact our support team at [email protected].

Update: April 8, 2024

E-Claims functionality for WellSky Personal Care remains unavailable. Change has shared an updated restoration timeline. Change reports they expect to begin restoration the week of April 15, 2024, with restoration occurring in phases. Change has not shared a timeline for completing all phases; however, we will provide an update once we receive more information about next steps. For further information from Change, please visit their status page at https://www.unitedhealthgroup.com/changehealthcarecyberresponse.

Update: March 14, 2024

The Change outage is currently affecting CommonWell, as noted on Change’s status page https://status.changehealthcare.com. CommonWell is one of the national information exchanges used to retrieve Continuity of Care Documents (CCDs). Currently, clients are unable to access CCDs through CommonWell. Change reports they are making progress, and they anticipate having CommonWell restored imminently.

Update: March 8, 2024

The Change outage is currently affecting CommonWell, as noted on Change’s status page https://status.changehealthcare.com. CommonWell is one of the national information exchanges used to retrieve Continuity of Care Documents (CCDs). Currently, clients are unable to access CCDs through CommonWell. CommonWell is unaware of Change’s timeline for restoring individual systems.

Current status: WellSky clients are able to select whether to reconnect with Change or continue using Relay

Update: April 23, 2024

On April 22, 2024, UnitedHealth Group (UHG) distributed a press release that included an update on the ongoing review of impacted patient data and support options available. Below is a summary of the UHG press release:

  • UGH is conducting an ongoing investigation and review of the data involved in the cyberattack on Change.
  • UHG anticipates it will take several months of continued data review and analysis before enough information will be available to identify and notify impacted customers and individuals.
  • UHG has offered to make notifications and undertake related administrative requirements on behalf of any provider or customer.
  • In addition, UHG is offering support through a dedicated website at changecybersupport.com. UHG has also established a call center (1-866-262-5342) to assist in offering free credit monitoring and identity theft protections for two years to anyone impacted.
  • UHG and external industry experts continue to monitor the internet and dark web to determine if data has been published.

Update: March 14, 2024

Today Change provided the following timeline for system restoration:

  • Pharmacy services: As of March 14, 2024, WellSky is able to reinstate our connections with Change to our CPR+ and CareTend applications. Visit the Client Resource Center to submit a request to reconnect to Change.
  • Payments platform: Change reports electronic payment functionality will be available for connection beginning March 15, 2024.
  • Medical claims: Change expects to reestablish connectivity to its claims network and software in a phased manner beginning the week of March 18, 2024. Because the system will be restored using a phased approach, Change recommends using its iEDI claim submission system. Full restoration will take place once testing has been successfully completed.
  • CommonWell: The Change outage is currently affecting CommonWell, as noted on Change’s status page https://status.changehealthcare.com. CommonWell is one of the national information exchanges used to retrieve Continuity of Care Documents (CCDs). Currently, clients are unable to access CCDs through CommonWell. Change reports they are making progress, and they anticipate having CommonWell restored imminently.

Update: March 13, 2024

Today Change briefed WellSky and other partners regarding the status of their cybersecurity event. In that briefing, Change provided the following timeline for system restoration:

  • Pharmacy services: Electronic prescribing is live as of March 1, 2024. The claim submission and transmission functionality is also available as of March 8, 2024, although not all connection types have been restored, including the connection type used for some infusion services. The pharmacy network is also back online.
  • Payments platform: Change reports electronic payment functionality will be available for connection beginning March 15, 2024.
  • Medical claims: Change expects to reestablish connectivity to its claims network and software in a phased manner beginning the week of March 18, 2024. Because the system will be restored using a phased approach, Change recommends using its iEDI claim submission system. Full restoration will take place once testing has been successfully completed.
  • CommonWell: The Change outage is currently affecting CommonWell, as noted on Change’s status page https://status.changehealthcare.com. CommonWell is one of the national information exchanges used to retrieve Continuity of Care Documents (CCDs). Currently, clients are unable to access CCDs through CommonWell. Change reports they are making progress, and they anticipate having CommonWell restored imminently.

Update: March 8, 2024

Today Change briefed WellSky and other partners regarding the status of their cybersecurity event. In that briefing, Change provided the following timeline for system restoration:

  • Pharmacy services: Electronic prescribing is live as of March 1, 2024. The claim submission and transmission functionality is also available as of March 7, 2024, although not all connection types have been restored, including the connection type used for some infusion services. The pharmacy network is also back online.
  • Payments platform: Change believes electronic payment functionality will be available for connection beginning March 15, 2024.
  • Medical claims: Changes expects to reestablish connectivity to its claims network and software the week of March 18, 2024. For payers exclusive to the Change clearinghouse, Change recommends using its iEDI claim submission system. As of March 8, 2024, Change states that more than 100 payers are implementing the iEDI solution.
  • CommonWell: The Change outage is currently affecting CommonWell, as noted on Change’s status page https://status.changehealthcare.com. CommonWell is one of the national information exchanges used to retrieve Continuity of Care Documents (CCDs). Currently, clients are unable to access CCDs through CommonWell. CommonWell is unaware of Change’s timeline for restoring individual systems.

Update: March 8, 2024

On March 7, 2024, Change announced that all major pharmacy claims and payment systems are back up and functioning. However, Change offers multiple options to connect to their pharmacy systems. While Change has restored some connection types, the type used by CareTend and CPR+ has not been restored as of the morning of March 8, 2024. Change reports they are nearing completion of restoring our connection type. WellSky will provide an update once we have more information regarding the timeline.

WellSky continues to offer RelayHealth (Relay) as an option for pharmacy claims submission. Visit the WellSky Client Resource Center for more information.

We will continue to monitor the situation and are actively working on technical alternatives, including other suppliers, for some of these services.

Update: March 6, 2024

Change Healthcare briefed WellSky and other partners on Tuesday, March 5, 2024, regarding the status of their cybersecurity event. In that briefing, Change provided the following information:

  • The threat actor has identified themselves as AlphV (Blackcat). Law enforcement and cyber incident response partners are involved.
  • Some Change systems have already been restored or were not disconnected at all. For details on which Change systems are operating, visit https://status.changehealthcare.com.
  • The e-prescribing functionality has been enabled and is live as of Friday, March 1, 2024. Change has processed more than 3 million transactions, with volume increasing daily as more system vendors reconnect.
  • The pharmacy network, which connects pharmacies and PBMs, is in final end-to-end testing with Change’s partners. Change anticipates that its Healthcare Pharmacy network will be back online for the majority of submitters as soon as Thursday.
  • For impacted infusion pharmacies, more pharmacy claims are flowing due to WellSky enabling infusion pharmacies to reroute their business. When the Change network comes back online, any infusion pharmacy unable to leverage the software will once again be able to submit claims.
  • Change believes full recovery of the medical network will take longer than the pharmacy network.
  • For payers exclusive to the Change clearinghouse, Change is now working on a new solution to move the Change gateway claims connection to an Optum electronic data interchange (EDI) claims connection.

Update: March 1, 2024

Change Healthcare briefed WellSky and other partners on Friday, March 1, 2024, regarding the status of their cybersecurity event. In that briefing, Change provided the following information:

  • Change confirmed that they have access to their backup systems.
  • Change indicated that safely restoring their systems is their priority.
  • The e-prescribing functionality has been enabled and is live as of Friday, March 1, 2024.
  • The full pharmacy network is the next area of focus, and Change expects to provide further details on the progress they are making on the restoration of that network next week.
  • Change is working on a temporary funding assistance program through Optum Pay. Details are available at https://www.optum.com/temporaryfunding.
  • Updates related to the cyber event can be found at https://www.unitedhealthgroup.com/changehealthcarecyberresponse.

Update: February 27, 2024

Change Healthcare briefed WellSky and other partners on Tuesday, February 27, 2024, regarding the status of their cybersecurity event. In that briefing, Change provided the following information:

  • Change became aware of the cybersecurity event in the early morning hours of February 21, 2024.
  • Change severed access to a broad range of its systems following its cybersecurity protocols. A down system does not indicate that the system was compromised.
  • Change has identified the threat actor as AlphV (Blackcat). Law enforcement and cyber incident response partners are involved.
  • Some Change systems have already been restored or were not disconnected at all. For details on which Change systems are operating, visit https://status.changehealthcare.com.
  • Change gave no estimates of when systems will be restored.
  • Change gave no indication whether patient data was compromised.
  • Change indicated that safely restoring their systems is their priority.
  • The Pharmacy Network (e-prescribing) is currently in testing, and Change expects it will return to functionality in the next few days.
  • Change is working on a temporary funding assistance program for certain providers through Optum Pay and will provide more details regarding that program on Friday.

WellSky is following its security protocols and has no reason to believe that any WellSky solution was impacted by the event. We will continue to monitor the situation and are actively working on technical alternatives including other suppliers of these services.

WellSky maintains a robust incident response program and began its investigation immediately upon becoming aware of this incident and will provide updates as circumstances change. For further information from Change, please visit their status page at https://status.changehealthcare.com/incidents/hqpjz25fn3n7.

Update: March 14, 2024

  • Payments platform: Change reports electronic payment functionality will be available for connection beginning March 15, 2024.
  • Medical claims: Change expects to reestablish connectivity to its claims network and software in a phased manner beginning the week of March 18, 2024. Because the system will be restored using a phased approach, Change recommends using its iEDI claim submission system. Full restoration will take place once testing has been successfully completed.

Update: March 8, 2024

  • Payments platform: Change believes electronic payment functionality will be available for connection beginning March 15, 2024.
  • Medical claims: Changes expects to reestablish connectivity to its claims network and software the week of March 18, 2024. For payers exclusive to the Change clearinghouse, Change recommends using its iEDI claim submission system. As of March 8, 2024, Change states that more than 100 payers are implementing the iEDI solution.

Update: March 5, 2024

Comprehensive A/R, powered by WellSky, has rerouted the majority of payers for all facilities that were billed on Change Healthcare (Change). There are still some payers that have not been rerouted. We are utilizing paper claims for these facilities. We are also testing the ability to manually submit claims directly to the payers that have a website and the ability to accept claims electronically.

Some payers use Change as their exclusive clearinghouse. For those payers, even when WellSky bills through an alternate clearinghouse, the claims are routed through Change, which is unable to process those claims. We will send paper claims to these payers while we wait for additional guidance from these payers.

Please note, Optum Financial Services established a temporary funding assistance program at https://www.optum.com/en/business/providers/health-systems/payments-lending-solutions/optum-pay/temporary-funding-assistance.html to help with short-term cash flow needs for providers who receive payments from payers that were processed by Change. Once normal payment operations resume, the funds will simply need to be repaid, with no fees, interest, or other associated costs.

Update: February 27, 2024

Change Healthcare (Change) publicly announced it is experiencing a cybersecurity event that began on February 21, 2024. The majority of Comprehensive A/R, powered by WellSky, clients work with Inovalon, although we do have a few payers working through Change. We are monitoring and working around the clock to safeguard your cash flow against potential disruptions caused by the Change incident. If we foresee any potential impact on a specific facility, we will promptly contact that facility directly.

Change has not provided a timeline for when they expect all of their integrations to be restored. For further information from Change, please visit their status page at https://status.changehealthcare.com/incidents/hqpjz25fn3n7.