CMS Responds to Change Healthcare Cyberattack
On March 15, 2024, The Center for Medicaid & CHIP Services (CMCS) issued a CMCS Informational Bulletin (CIB) to states in response to the Change Healthcare cybersecurity incident that began in late February 2024. In it, parent agency Centers for Medicare & Medicaid Services (CMS) recognized the impact of the incident on health care operations, stating they are taking action to minimize service disruptions for beneficiaries through various enforcement suspensions effective through June 30, 2024.
These actions will “…enable critical Medicaid funds to continue to flow to providers and to prevent disruption of access to Medicaid services, prevent associated negative health outcomes, and avoid solvency issues for providers.”
Enforcement Action Suspended
The CIB outlines state-level activities for which enforcement action will be suspended. The allowances come with a limited set of circumstances and require states to submit a State Plan Amendment (SPA) by March 31, 2024, or explain the delay for the SPA submission by April 10, 2024.
In addition to the interim payments described below, other notable flexibilities involve the SPA public notice and process timelines. States may also suspend beneficiary cost-sharing to minimize service disruptions.
HCP notes that this alert does not contain an all-inclusive list of CMS flexibilities, but is representative of items of interest to our home care providers. The entire list can be reviewed in the CIB.
It’s important to understand that this CIB describes flexibilities for states. There has not been any notification from the NYS Department of Health (DOH/the Department) indicating which, if any, flexibilities it will seek in a SPA. HCP has reached out to DOH and will share relevant details when they are available.
Interim Payments Under FFS
Perhaps most important to providers is CMS’ guidance to states for making interim payments with final reconciliation after service data access is restored. Similar to the financial assistance provided by United Health Care, the interim payments must be limited to a recent prior payment cycle (generally a two-week period) on a provider-specific basis. These payments will only be available to affected providers.
The states abiding by the SPA requirements noted above will be able to draw federal financial participation (FFP) monies to help fund the interim payments. Additionally, the SPA must clearly state that the interim payment methodology is “…not an advanced payment or prepayment prior to services furnished by providers…” but rather is a payment for furnished services which is subject to final reconciliation.
The interim payments by states may be applied retroactively to the first date of Change Health Care’s disruption and could extend to June 30, 2024, at the latest. The payment periods are generally in two-week increments, and all final reconciliations must commence on July 1, 2024, with providers being notified of overpayments by July 15, 2024.
CMS Advises Medicaid Managed Care Plans
HCP notes that under normal circumstances, advance payments in the Medicaid fee-for-service program are not permitted. CMS reminded states that Medicaid Managed Care plans do have broad flexibility to make interim payments and “leverage other flexibilities” without any additional authority.
Included in the CIB is language directly urging Medicaid Managed Care Plans to make prospective payments to providers affected by the Change Health Care incident, noting again that CMS authorization is not required for such arrangements.
CMS also reminded plans that they can suspend/modify prior authorization requirements and extend existing authorizations. Plans may suspend out-of-network requirements as well.
Lastly, CMS states that plans may modify or update cost-sharing requirements, but they must be consistent with any changes that are made in the SPA.
HCP Support
HCP’s Public Policy team will continue to monitor and report on the impact of this wide-reaching cyberattack, including relief measures and actions providers can take to protect themselves. Members are encouraged to visit the Health and Public Health (HPH) HPH Cyber Performance Goals website for details on steps to stay protected.
Visit United Health Care’s incident page for the latest information. As of March 18, 2024, over $2 billion has been advanced to providers. Pharmacy systems are up and running, and other systems are being brought up as quickly as possible.
HCP will be in communication with the Department and will disseminate any SPA specifics if and when NYS seeks any or all the CMS-offered flexibilities.