Dillman Clinic & Lab was finally at a point where the one-doctor practice in Lakeville, Minn., could start thinking about hiring another physician.
Then, all of a sudden, the clinic was walloped by the aftermath of a major cyberattack at Change Healthcare, the UnitedHealth Group subsidiary that was hacked in February 2024.
The incident, which affected the data of 1 in 2 Americans, prompted UnitedHealth Group to shut down a widely used computer system “clearinghouse” for processing claims, precipitating a cash flow crisis for health care providers across the country.
“Our growth was stifled,” said practice manager Richard Dillman, whose wife has been the clinic’s sole practitioner since it opened in June 2022. “I remember turning to Megan and just saying, ‘I don’t know how we’re gonna survive.’ ”
Last year, UnitedHealth Group provided $9 billion in interest-free loans to assist health care providers caught up in the financial nightmare. But now, as the company’s Optum division has begun seeking repayment, some are crying foul, saying they can’t pay because they haven’t fully recovered.
Earlier this month, Dillman Clinic and another small health care provider in Minnesota filed for a preliminary injunction in federal court to stop UnitedHealth Group from collecting on their emergency loans.
Last week, the American Medical Association sent a letter to the company’s Optum division, saying the for-profit company should make it easier for doctors to repay loans while many are still economically stressed.
“Physician practices are still suffering severe financial distress as a result of the cyberattack nearly 14 months after the breach was first discovered,” wrote Dr. James Madara, the AMA’s CEO and executive vice president.
“To be clear, physicians and other medical providers did nothing wrong and were compliant with industry standards and regulations; they did not suffer any data breach of their systems but were powerless to prevent the widespread service outage caused by the failure of (Change Healthcare) to secure its data and keep its systems operational.”
Optum responded to the AMA this week, saying the company continues to work with health care providers to find flexible repayment plans based on individual clinic circumstances.
In a statement, the company said it has given health care providers significantly more time to begin repaying loans than the U.S. Department of Health and Human Services did with a parallel financial assistance program last year.
“More than one year post the event and with services restored, we have begun the process of recouping the interest-free funding we provided to providers - as HHS itself did when it began recouping repayments it provided under its own cyberattack lending program in July 2024,” the company said.
“We continue to work with providers on repayment and other options and continue to reach out to those providers that have not been responsive to previous calls or email requests for more information.”
The push by two small clinics for a preliminary injunction comes in the context of two putative class-action lawsuits moving through the U.S. District Court of Minnesota.
In one case, more than 60 patients are plaintiffs seeking monetary damages and other relief for the alleged loss of privacy and other harms. In another, more than two dozen health care providers are seeking damages related to the massive hack, which drew criticism from lawmakers during congressional hearings last year.
“Change Healthcare defendants failed to implement reasonable security procedures and practices and failed to disclose material facts surrounding their deficient security protocols,” plaintiffs argued in a January filing.
“As a result of defendants’ conduct, providers have suffered and will continue to suffer substantial harm,” the complaint says. “The event pushed many providers to the brink of collapse. ... Providers will never see compensation for claims that they were unable to submit during the shutdown. ... Providers are still in a precarious financial situation due to defendants’ conduct and failures.”
UnitedHealth Group has filed motions to dismiss both lawsuits, arguing the patients’ complaint attempts to “manufacture liability where there is none.” It contends the lawsuit from health care providers is flawed for attributing harms such as missed or delayed claim payments to the cyberattack, rather than the temporary system disruption.
“Plaintiffs cannot point to a duty - in contract, at common law, or under statute - to maintain services at all costs and at all times, including during a cyberattack,” the company argued in a motion filed last month.
“Although defendants had no obligation to loan $9 billion to providers during this time, this action obviates plaintiffs’ claims of injury,” the motion says. “Incredibly, plaintiffs attempt to retain these billions of dollars of loans, despite the fact that nearly all the services were restored months ago, in addition to seeking further compensation through this complaint.”
UnitedHealth Group has not yet responded in court to the motion for a preliminary injunction or a separate lawsuit from Eden Prairie-based Odom Sports Medicine P.A., which joined Dillman Clinic in seeking relief from Optum’s push for repayment.
“We believe these lawsuits are baseless and we intend to defend ourselves vigorously,” the company said in a statement to the Star Tribune.
Odom Sports Medicine argues a preliminary injunction is needed because its physical therapy division is still emerging from a $700,000 financial hole created by the Change Healthcare shutdown.
The practice estimates it still has about $235,000 in outstanding claims from February through August 2024 that are still being processed through insurance. In the mix are claims to UnitedHealthcare Insurance Co. (UHIC) and what the medical group describes in a court filing as a “giant web of subsidiary insurers” under UnitedHealth Group.
“UHIC has denied approximately 39 claims totaling approximately $18,095 that were delayed due to the shutdown as ‘untimely,’ ” Odom Sports Medicine said in its request for a preliminary injunction.
In other words, one part of UnitedHealth is allegedly denying payment of funds that could help repay loans from another part of the same company.
“At least 20 of these claims accrued in February 2024. Even though Odom specifically informed UHIC that the claims were late due to the Change defendants’ complete system failure and shutdown caused by its corporate partner, UnitedHealthcare Insurance still denied the claims as untimely.”
In a statement, UnitedHealth Group said it has worked with its UnitedHealthcare insurance division to ensure claims are reviewed in light of the challenges faced by providers, including waivers for timely filing requirements. These accommodations, however, do not extend to other health insurers or to all groups that hire UnitedHealthcare to administer “self-insured” plans, in which employers take on the financial risk for claims and ultimately set rules for payment.
“We have asked the AMA to join us in encouraging flexibility from all payers and plan sponsors,” the company said.
Dillman Clinic said in a court filing it has had nearly $5,000 in claims denied by insurers, including UnitedHealthcare, as untimely.
The clinic received a total loan of $157,600 between April and September 2024. In November, UnitedHealth Group demanded repayment by Jan. 10, according to the filing, before granting an extension to May 5.
The clinic also alleged it has been told that payments on claims submitted to UnitedHealthcare could be withheld going forward.
“If defendants force the entire repayment or start withholding claims, Dillman Clinic will face a substantial threat of bankruptcy or closing its doors,” according to the motion for a preliminary injunction.
On Tuesday, U.S. District Judge Donovan Frank set a briefing schedule for filings related to the motion. UnitedHealth Group must respond by April 25, the judge ordered, with oral arguments to be scheduled at a later date.
