Change Healthcare breach already impacting healthcare M&A

Add mergers and acquisitions to the list of things the Change Healthcare cyberattack has disarrayed.

Healthcare deals are on the rise. But the ransomware attack against the UnitedHealth Group division has already caused dealmakers to more intensely scrutinize cybersecurity vulnerabilities and to consider the financial damage potential targets have endured, according to attorneys who specialize in M&A.

Related: UnitedHealth urges Change customers to reconnect to restored systems

Hospitals, pharmacies, nursing homes and other providers are still dealing with kludgy workarounds and delayed reimbursements that have disturbed balance sheets and increased uncertainty around transactions. Cybersecurity and data risk assessments are likely to be emphasized more greatly during due diligence and antitrust reviews, the attorneys said.

Complicating deals in progress

The ongoing financial harm is posing challenges for mergers and acquisitions currently in the works, said Robert Miller, a partner at Hooper Lundy & Bookman who specializes in healthcare corporate and regulatory issues. And these companies are accumulating unpaid claims and borrowing to cover short-term needs in the meantime.

“We’re going into a transaction with my client carrying multiple times what they would typically carry in accounts receivable dollars,” Miller said.

This introduces additional financial risk for sellers and buyers alike, Miller said. When considering a target experiencing cash flow problems, acquirers face a choice between assuming responsibility for the financial situation or renegotiating agreements in process, Miller said.

“[Sellers] are pretty nervous,” Miller said. "They're not getting paid, and now they are being asked to just trust that they will get paid in the future. They’ve got to trust their payers, they’ve got to trust their billing company. And now, they also have to trust the buyer because the buyer is going to be holding the purse strings, and they're going to have a lot of leverage.”

Despite these challenges, so far transactions seem to be advancing without delay, said John Fanburg, chair of the health law group at Brach Eichler.

In the future, however, companies exploring M&A may contemplate clauses that dictate terms when similar breaches occur before transactions are complete, Miller said.

Rethinking due diligence

Dealmakers may feel compelled to incorporate an additional layer of due diligence by conducting more thorough assessments of vulnerabilities and cybersecurity measures before finalizing M&A.

Buyers will likely seek a better understanding of how internal data are safeguarded and assess the operational impacts of security breaches, said Ashraf Shehata, partner at KPMG's Global Healthcare Center of Excellence.

Companies looking to acquire will have to weigh the costs of enhanced cybersecurity infrastructure against the risks posed by acquisition targets, said Frank Carsonie, partner and chair of Benesch Friedlander Coplan & Aronoff’s healthcare practice group.

For sellers, vulnerabilities may decrease their value, and buyers will likely mitigate their own risk by demanding stricter cybersecurity controls, Shehata said.

“We’ve seen a lot of investors look at somebody that wasn't completely up to speed in terms of their compliance obligations and not really think twice about still doing the deal,” Carsonie said. "There might be a little more hesitancy on that now. And there may be more conversations around valuation discounts if there's risk associated that might be untenable.”

In addition, companies aiming to acquire may insist that transaction agreements include playbooks to follow when data breaches roil finances for either party during dealmaking, Miller said. They also may review vendor contracts for vulnerabilities and demand more comprehensive cybersecurity measures and liability insurance in contracts with these third parties, he said.

“We’ve always looked at potential risks on breach, cybersecurity and cyber incidents," said Thomas Shorter, partner at Husch Blackwell. "What Change Healthcare brought, which is unique, is a vulnerability of a potential target in terms of the structural setup, in terms of how they get their work done."

Antitrust enforcement

When UnitedHealth Group announced plans to add Change Healthcare to its Optum portfolio in 2021, the Justice Department almost swiftly initiated an antitrust challenge that it ultimately lost in court. As the American Hospital Association and others warned at the time, the deal had the potential to reduce competition in health information technology services.

Federal antitrust agencies such as the Justice Department and the Federal Trade Commission have taken a relatively more skeptical approach to mergers and acquisitions under President Joe Biden, and some some state attorneys general have done the same in recent years, Shorter said.

This has led to an increase in upfront disclosures and paperwork requirements and an expanded range of transactions subjected to reviews.The Change Healthcare data breach and its ramifications may impel regulators to assess whether they failed to anticipate its vulnerabilities, Carsonie said.

Transactions involving insurance, payment systems, electronic health records and other areas that touch the entire healthcare system are likely to receive greater attention from antitrust authorities from now on, Carsonie said.

“Change went through an antitrust review process when that deal occurred, and the government eventually approved it," Carsonie said. "The reality of it was they're so big and had so many pieces in the healthcare system, that when they had this issue, the effect was probably far beyond what the government could have even foreseen, in terms of the potential to bring our revenue cycle systems to a standstill.”