NJ doctors still unpaid, prescriptions disrupted for weeks after attack

⚫ Cyber attack puts healthcare industry in crisis

⚫ Company hit is involved in one in every three patient records, feds say

⚫ Recovery from ransomware can be slow

Susan Martinez is facing perhaps her biggest crisis since she got into private practice as a psychotherapist nearly seven years ago.

"I'm worried I'm going to be on the street," the Hillsborough-based professional said.

Martinez is among an untold number of health care providers around the country waiting on weeks' worth of income since a Feb. 21 cyberattack on a health care technology company that processes insurance claims and payments.

Change Healthcare, a property of UnitedHealth Group, was hit by ransomware.

Change Healthcare processes 15 billion health care transactions annually and is involved in 1 in 3 patient records, according to the U.S. Department of Homeland Security.

Federal officials believe the attack was carried out by a notorious cybercrime "gang," grinding the company's operations to a halt and impacting hospitals, physicians, pharmacists and other providers.

That has left patients and medical providers in a lurch, with unfilled prescriptions stacking up and, as in Martinez's case, no revenue to keep offices open.

"We are not allowed to abandon our clients," Martinez said last week. "I'm just trying to keep my doors open ... I'm trying to give my best to my clients."

The frozen system means insurance claims cannot be processed, impacting pharmacies, private doctors' offices and hospitals that depend on Change Healthcare, according to New Jersey Cybersecurity officials.

Prescriptions quickly stacked up, with pharmacists scrambling to connect patients with crucial medications, which in some cases has meant charging full price until claims can be processed.

As no automated billing could move forward, that also meant no paychecks for medical staff at providers, both big and small, the New York Times reported.

Read More: Assault weapons ban legal battle: NJ joins DE in upholding laws

ChangeHealthcare uses a cloud-based network to support 14 billion transactions a year, making it one of the country’s largest healthcare technology companies.

Pharmacies began using "workarounds" to continue to serve patients, according to state cybersecurity officials, although that has meant some patients were being charged full price for medications until insurance claims can be processed.

Those who carried out the attack stole sensitive personal health information of patients and customers, threatening to make it public if they were not paid the ransom demand, New Jersey officials said in an online briefing.

On March 5, a payment of $22 million was made to ALPHV/BlackCat operators, believed to be the cyber attackers.

New Jersey officials said it is "assumed that Change Healthcare initiated this transaction."

Before the UnitedHealth system attack, federal officials shared there was a reward of up to $15 million for information leading to individuals behind the transnational organized crime group behind the ALPHV/Blackcat ransomware.

Before UnitedHealth acquired Change Healthcare for $13 billion in 2022, federal prosecutors had unsuccessfully challenged the merger.