Earlier this month, CSRO included a summary of actions to date regarding the cyberattack on Chang Healthcare – to review those details click here.
Since that publication, as a way to assist providers facing challenges as a result of the Change Healthcare cyberattack, the Centers for Medicare and Medicaid Services (CMS) announced an extension of the 2023 Merit-Based Incentive Payment System (MIPS) data submission period and reopening the 2023 MIPS Extreme and Uncontrollable Circumstances (EUC) exception application due to the Change Healthcare cybersecurity incident. MIPS eligible clinicians now have until April 15, 2024, to submit their data or an exception application. Additional information can be found here.
CMS also issued frequently asked questions (FAQs) for providers on the newly established Change Healthcare/ Optum Payment Disruption (CHOPD) Accelerated and Advance Payment (AAP), as well as guidance to States on providing relief to Medicaid providers following the cyberattack.
Finally, the Office of Civil Rights (OCR) under the Department of Health and Human Services (HHS) announced the launch of an investigation into UnitedHealth Group (UHG) and Change Healthcare with a focus on “whether a breach of protected health information occurred and Change Healthcare’s and UHG’s compliance” with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules. Read more in the open letter from OCR.
CSRO will continue to monitor this situation and provide status updates as appropriate.
|