UnitedHealth asks healthcare providers for hack loan repayments

By Amina Niasse and Bhanvi Satija

(Reuters) -UnitedHealth Group is demanding that healthcare providers repay the loans they received from the company after a cyberattack at its tech unit Change Healthcare last year, according to two providers on Friday.

The largest U.S. health insurance company loaned out $9 billion to providers who had been struggling after the massive ransomware attack in February last year shut down payment and processing systems, some of which took months to resume.

Healthcare providers said they have received emails from UnitedHealth's Optum unit in recent months demanding full repayment and threatening to withhold reimbursement.

The Wall Street Journal first reported the news.

UnitedHealth's Change Healthcare unit said in a statement that it planned to "work with providers" on repayment options.

"Now, more than one year post the event and with services restored, we have begun the process of recouping the interest-free funding we provided to providers," a spokesperson for Change Healthcare said.

The initial agreement stipulated failure to repay could result in payments garnished, the two providers said, but they described the terms as having taken advantage of providers desperate after the hack.

Catherine Mazzola, CEO of New Jersey Pediatric Neuroscience Institute based in Morristown, New Jersey, said her practice had been docked reimbursement totaling $68,000 from February 19 through March 29.

The funds withheld were reimbursements from New Jersey Medicaid plans, Mazzola said. Her practice took out two loans of $35,000 and $500,000, she said.

"The amount payable on this statement has been used to repay amounts owed under your agreement," a statement sent to Mazzola and viewed by Reuters said.

Mazzola added that her practice had already paid $40,000 since the hack.

Another provider, Christine Myer, said she received a letter on April 1 asking for full payment of her loan within five business days. Her primary care practice had taken out a total of $756,000 after struggling to stay afloat following the hack, she said.

UnitedHealth previously released a notice saying $3.2 billion of loans given to providers had been repaid as of October 15.

The breach at Change was the largest healthcare data breach in the U.S., affecting the personal information of nearly 200 million people. It caused widespread disruptions in claims processing, impacting patients and providers across the country.

(Reporting by Bhanvi Satija in Bengaluru and Amina Niasse in New York; Editing by Mohammed Safi Shamsi, Caroline Humer and Marguerita Choy)