Utah patients scrambling after ‘cyber attack’ hits pharmacies

Christine Dolman used to get migraines at least once a week. Now she gets them once or twice a month, and they are “much less severe,” thanks to medication she takes via injection every month.

“It has been a lifesaver,” Dolman said.

She might miss this month’s dose, thanks to a “cyber attack” that has disabled the network many pharmacies, including the University of Utah’s, use to authorize insurance payments. The University of Utah alerted patients via its patient portal Saturday that while its pharmacies were still filling prescriptions, they could not process “most insurance claims.”

Without insurance, Dolma’s medication costs $800 — compared to the $36 she usually pays.

“The pharmacy said I can pay out of pocket and have my insurance reimburse me, but I can’t gamble with that much money right now,” Dolma said.

Change Healthcare, parent company to Optum Health and a division of UnitedHealth, first reported the attack on Feb. 21, and said the “disruption” could last “at least through the day.” UnitedHealth also filed a report with the Securities and Exchange Commission, claiming that a “suspected nation-state associated cyber security threat actor ... gained access to some of the Change Healthcare information technology systems.”

According to the filing and a public update posted later the same day, Change Healthcare disconnected its networks, including its prescription management software Optum, as soon as it detected a threat “in the interest of protecting our partners and patients.”

“We are working on multiple approaches to restore the impacted environment and will not take any shortcuts or take any additional risk as we bring our systems back online,” the company said in an update on its website. A company spokesperson did not respond to a request for comment.

Medicaid patients hit hardest

A week after the initial announcement, patients across the country are left without answers.

Medicaid patients are especially vulnerable. Change Healthcare is Utah Medicaid’s pharmacy vendor, which means patients who pay for prescriptions with Medicaid cannot fill those prescriptions until Change and Optum, its software, is back online.

“[DHHS] does not want any member to have delayed care as a result of this system issue,” the agency said in an announcement last week. “DHHS is doing everything possible to communicate with providers, pharmacies, stakeholders and members to implement work-around options so that emergency prescriptions can be filled.”

The department is taking the “unprecedented step of personally calling” thousands of Medicaid members “who are on high-risk or life-sustaining medication,” it said in an update Saturday. DHHS spokesperson Kolbi Young said the department has attempted to call roughly 20,000 people and reached around 12,600. These are all Medicaid members who were identified as likely needing a refill on critical medications.

“That doesn’t even include members who need new prescriptions,” Young said in an interview. “It’s really hard to quantify how many people this impacts. We know it’s significant, and it needs real, proactive attention.”

There were 362,932 Utahns enrolled in Medicaid at the beginning of the year, Young said. Roughly half are children.

DHHS is also authorizing pharmacies to give Medicaid members up to a 30-day supply of medication, for free. It has created an interim reimbursement process for pharmacies who comply.

“We need Medicaid members to get their critical medications,” Utah Medicaid Director Jen Stohecker said in Saturday’s update. “But we also need to make sure pharmacies don’t go out of business.”

Change Healthcare also manages insurance claims for the University of Utah pharmacies and major national pharmacy branches, including Walgreens and CVS. DHHS said Optum handles 1 in 3 U.S. patient records.

A Walgreens pharmacist in Salt Lake City said their store was affected and Medicaid patients have had the most trouble, but the pharmacy can still fill prescriptions — assuming medication is in stock.

A pharmacist at the University of Utah said patients could pay outright and file for reimbursement. Some brand-name medications may not qualify for coverage. A university spokesperson did not immediately respond to a request for comment.

‘A scenario only Americans have to deal with’

None of those options work for Dolman. She cannot get an emergency supply of an injection. Finding a pharmacy that carries her medication and isn’t affected by the security breach might not be possible, she said. Even if she did, she would have to go back to her doctor for prior authorization.

Dolman has some leeway before the last dose of her medication wears off. She said she hopes things resolve before then.

She also knows other people are not as lucky.

“People are waiting on cancer medications or other things that are way more life-threatening,” she said.

On social media, Utah patients and pharmacists said the breach has left them scrambling and afraid.

“I work pharmacy and this has been so bad,” one Salt Lake Reddit user said. “We want you to have medicine, our hands are tied by laws and red tape.”

Another Reddit user said they would have to pay $3,000 to refill their prescriptions, and without them, they will “likely end up in the hospital.”

Dolman said the situation is uniquely American.

“We have an illusion that there are a lot of pharmacy options out there, but they all rely on this billing company, so they are all vulnerable,” Dolman said. “It’s really just a big monopoly you can’t escape. Other countries don’t have for-profit companies standing between them and their health care.”

Shannon Sollitt is a Report for America corps member covering business accountability and sustainability for The Salt Lake Tribune. Your donation to match our RFA grant helps keep her writing stories like this one; please consider making a tax-deductible gift of any amount today by clicking here.