The Healthcare Breakdown No. 040 - Breaking down a healthcare monopoly’s cyberattack, Taylor’s Version
Brought to you by bad blood, not mad love
What we’re breaking down: The cyberattack on Change Healthcare
Why it matters: Because its bonning healthcare businesses, like, the good ones
Read time: Not long enough for Change to fix the dang problem (9 minutes for real though)
I am sure you have heard the news by now. If you haven’t and happen to be a visiting alien, then welcome! Earth is cool, a little warm at this current century, but we hope for cooler weather in the coming decades.
Also Change Healthcare got hacked. I know that means little, but don’t worry, we’re going to go through why it’s such a BFD. (That one you’re going to have to look up, this is a family publication).
Interruption! Healthcare needs a revolution. It needs you. Don’t let numbers and finance be the thing that stops you.
Healthcare Breakdown - The Finance Course! will show you how to:
Read and understand financials like a pro
Build financial models, and
Go toe-to-toe with any CFO
In an afternoon.
There’s templates, jokes, and all kinds of good stuff in there.
Stop avoiding finance. It’s cool.
First, what even is Change Healthcare?
Today, Chage Healthcare is a part of UnitedHealthcare. It has assimilated to the Borg and it’s primary funcion is as a clearinghouse.
But what is that and how did it get there?
A clearinghouse is the thing that makes submitting claims and getting paid for them possible. See, doctors offices, pharmacies, and hospitals all use very different systems, plus all the different systems on the payor side.
Imagine millions of doctors submitting claims on different systems to health plans, when there are thousands of plans, each with different rules, eligibilities, etc. It would be a nightmare.
In fact, it is a nightmare. So, to get through this kerfuffle, to deal with the artificial complexities we invented in healthcare, and to meet the Portability part of HIPAA, clearinghouses became a thing.
Think of them as the pipes that run information and payments back and forth between people who do healthcare and people who steal money to not pay for healthcare.
Here’s a little ditty of how it works, more or less…
Change comes in becasue while this looks simple (hehe, ya right), not all the systems speak well to each other. So, Change sits over top of a lot of it and is even the go-bewteen for other clearinghouses.
Like-a-dis:
And Change, through a kind of wild history, became the largest of all the clearinghouse. In fact, it has said of itself, “[The] healthcare system, and how payers and providers interact and transact, would not work without Change Healthcare.”
I mean, they kinda got that right. Probably why the DOJ tried to stop United from buying it. Good thing large industries have no power to influence the government. Wait, oh….
Back to the history part of this tour.
Here’s how it went down:
Change Healthcare started in 2007 in Nashville (of course). It’s whole thing was price transparency and patient engagement meant to serve health plans and self funded employers, and presumably, to change healthcare.
A little on the nose, but ok.
I’m still a little fuzzy on the whole mission though, but here is essentially what Change purported to do in its own words:
Helping save money and improve transparency and also helping hospitals collect more. Got it. A middle man selling to both sides. American healthcare. Peachy.
Over the years, it did a lot of things right by startup measure, nabbed investments, went through a series D funding round and got a whole lotta accolades.
To take an unexpected turn, and a little farther back in time, in 2005 WebMD, I know weird, bought two companies, Dakota Imaging and ViPS. Dakota was a claims processor and ViPS a data management and analytics company.
I think you see where this is going. A lot of acquisitions later, the company rebranded as Emdeon, so as not to create confusion and to get out of some anti-kick back work they were doing. Eventually the whole shebang was bought by private equity behemoth, Blackstone for $3B.
Emdeon went on to acquire Change in 2014 for $135M. The whole company rebranded as Change post acquisition.
Jump ahead a couple of years and McKesson and Change created a joint venture, still called Change Healthcare.
To avoid writing a novel and to gloss over way too many details, in 2018 Change went public and in 2021 United bought it for $13B.
Phew.
Now for the fun(?) part.
Change Healthcare was cyberattacked. When that happened, it had to turn off all it’s APIs. An API is an application programming interface. It’s the thing that lets software talk to each other. You know, the thing that makes Change Healthcare work.
And did it tell anyone? Of course not. Gradually, systems just began shutting down. As pharmacies, hospitals, and group practices went to submit claims, get updates, or receive payments, there was just nothing there.
I imagine the conversation went something like this. “Oh ya, well about that… We sort of got hacked and had to turn off all our systems. But don’t worry, I am sure you have enough money to get through this little hiccup.”
In fact, most don’t. Here’s what happens when a business all of the sudden does not get paid.
This is the finance part of the issue.
As you know, because you read every breakdown, revenue and profit do not equal cash. And you cannot pay your staff with revenue and profit.
I know it seems weird but here’s how it works:
A patient comes in and you upcode their visit to a level 4 and throw some antibiotics at their virus. I mean YOU don’t do that, but someone definitely does… ahem urgent care…
Because you (I know not you, the royal you) rendered services you recognize the revenue at time of service. Not time of payment (that’s a cash flow thing).
The revenue that you recognize then goes onto the balance sheet as an asset in Account Receivable (A/R).
When you get the cash, that A/R moves up a couple of lines to cash.
That’s a simplified version and has little to do with actual cash flow. It also is only relevant to accrual based accounting and not cash based. Cash based is only going to record revenue when cash is received. This is fairly normal for smaller businesses. It also only lives in the world of cash flow.
So, in either case, the patient comes in, you do the stuff and then they leave. Maybe they leave you a crisp 20 for their copay but you are now reliant on insurance to hit you back with actual money, or cash flow.
In the meantime, all your staff still worked that day, you had to have lights, someone needed to stock the fridge, and for some reason you insist on paying people and electrical bills. What I am saying is that your cash isn’t coming for probably 30 days but you have to pay people for the work they did.
This is why cash flow is so important. Most of the time we are paying expenses before cash comes in. The goal obviously is to get the cash flow cycle to the point where the cash coming in is greater than expenses going out. Or else you will go out of business.
Or you’re a VC backed startup, in which case, free first class and top shelf tequila margs for everyone!
And since you now know all about Change Healthcare, which processes 15 billion claims a year, $1.5T dollars worth, you can imagine the havoc it’s reigning down on practices everywhere.
To put that into daily context, that’s $4.1B PER DAY of money that is not getting paid out to medical practices and pharmacies.
And while I have little joy for the large health systems (they’ll weather this) it’s still not great. Like they need one more excuse to underpay, overwork, and start ordering Marco’s pizza instead of Papa Johns. It’s a race to the bottom.
And just because this is a breakdown, let’s break it down one more. In 2019, so I imagine it’s grown by now, Change served 900,000 physicians. Based on the daily payouts, that’s $4,600 a day docs aren’t getting paid.
Or, $32K per week.
Or, $128K per month.
And there are practices out there billing $500K per month, with 84 employees, being offered a $4,000 per month LOAN! And probably signing their rights away to take legal action against Change.
Let’s look at some more numbers here and imagine the cash flow issues.
Don’t get mad at me, I am just making things up for illustration purposes.
Say there is a small practice rocking out with $4M in revenue and total operating costs clocking in at about 65% of revenue.
In the simple world of a P&L it looks like this:
And I know this looks pretty rosy, but remember this is a physician owned group. The docs haven’t been paid yet. They get paid out of what’s left after the costs.
They can have salaries, but in this example they don’t. So, let’s say there are 5 doctors in the practice, they are going to each pull around $280K a year.
Just a friednly reminder, I made these numbers up, so chill pill.
Anywiggles, we haven’t talked about the cash flow situation yet. Let’s say this practice, like apparently all of healthcare, was impacted by Change.
Now, the P&L doesn’t change (no pun intended), but like I mentioned up top, the balance sheet does and the cash flow does.
Change has been down for 17 days. That means that this practice, which bills $4M annually is out $186K in claims so far. That impacts cash flow.
The issue is that the expenses don’t stop. Credit card companies ain’t got time for you and banks are as bad as the insurance companies. As in, SOL, so long, don’t care.
Here’s what a cash flow might have looked like and what it does after the money stopped flowing:
It’s oversimplified I know, but the point is, while all that A/R is racking up, no real cash is coming in. And without negotiating some terms, that cash still needs to be paid out.
Meanwhile, while all this insanity has been happening, here’s what UnitedHealthcare has been up to…
And Change before the acquisition….
All about the cash flow.
Seems like there is enough cash in the bank to float a little more than some table scrap loans to physician practices that are about to completely run out of money. And the loan part… Please.
And just in case you were worried about UHG’s stock performance, don’t.
For the cherry on top, while practice on the brink of bankruptcy are struggling, UHG also went ahead and paid the hackers $22M for their trouble.
I mean, allegedly. But, definitely.
The takeaways here are:
UnitedHealthcare continues to blow and the massive consolidation in the industry is hugely problematic.
Cash flow is the life blood of a business. And since this is a healthcare periodical, practices and pharmacies are bleeding out.
Now, get out there and actually change healthcare.
Like for real.
Good luck out there.