HHS must act immediately to institute public health emergency-like flexibilities to ensure access to critical Medicaid services for millions following massive cyberattack

Millions of Americans across the age continuum who have complex medical needs, serious mental illness and substance use disorder will likely face barriers to receiving critical services such as prescription drugs, home health services, and doctors’ visits if HHS and CMS do not act immediately to provide state and territory Medicaid programs with needed flexibilities following the massive Change Healthcare cyberattack. On behalf of state Medicaid leaders, NAMD calls on HHS/CMS to act.

The recent February 21 cyberattack on Change Healthcare – a unit of UnitedHealth Group – and its resulting need to pull down systems that process claims and prescription drug authorization for thousands of pharmacies, hospitals, and other health care providers have had severe and reverberating effects for Medicaid members, providers of health services, and the Medicaid programs that are paying for those services.

The most immediate and urgent of these effects was and continues to be ensuring that members have smooth and uninterrupted access to prescription drugs and other health services covered by the program. Troublingly, however, because of the shut-down of Change systems, providers across the country are facing interruption in the payments on which they rely to operate and serve Medicaid members. Of particular concern is the safety-net providers (federally qualified health centers and critical access hospitals) and providers of behavioral health and community-based long-term services and supports that serve large numbers of Medicaid members and are at particular risk for having to stand down on providing service because of their thin operating margins. These provider constraints threaten access to care and risk exacerbating longstanding disparities, particularly for people of color, people with disabilities and people in rural areas.

This situation is also causing concern for Medicaid programs related to their stewardship responsibilities. Specifically, programs are worried about their inability to document payment for services for which they are financially accountable to the federal government and taxpayers. And while states are doing everything they can to respond – including standing down on prior authorization requirements and directing pharmacies to provide emergency refills and 30-day supplies of medication; connecting at-risk members to one-on-one care management support; in states that use these arrangements, requesting that their managed care organizations make advance payments to providers; and supporting providers in moving to different payment clearinghouses – states do not have the financial capacity to pay providers exclusively out of state funds for any length of time. This is especially urgent for the states that have managed fee-for-service structures and cannot channel payments through MCOs.

These issues are widespread, systemic, and continue to radiate out to additional types of providers beyond pharmacies – including, but not limited to, federally qualified health centers, hospitals, nursing homes, home care providers, and others – on a daily basis.

For this reason, while we understand that the federal statutory definition of public health emergency does not contemplate a cyberattack, on behalf of its members NAMD is calling on the U.S. Department of Health and Human Services and the Centers for Medicare and Medicaid Services (CMS) to immediately institute public health emergency-like flexibilities for Medicaid programs.  

 Specifically: 

1. Programs need flexible authority from HHS and CMS to make retainer payments that qualify for federal match, can be instituted immediately and are made with recognition of the difficulty of documenting services in the near term.  This approach was used during the COVID-19 public health emergency, and it was a lifesaver.  
2. Programs need flexibility to waive utilization management practices and co-payments that are embedded in their state plans. 
3. Programs need assurances that federal audit agencies will consider the context of this urgent set of circumstances and hold programs harmless from typical documentation requirements. 

NAMD and Medicaid leaders across the country would deeply appreciate HHS and CMS’s immediate attention to this request. It is a certainty that we will see more of these types of attacks in the future. A robust response now will help to build structure and certainty for the future and support states and territories as they move forward on behalf of the millions who count on the Medicaid program for their health care.