Change cyberattack prompts CMS to extend dispute process

The Centers for Medicare and Medicaid Services is extending independent dispute filing deadlines through at least mid-October after the Change Healthcare cyberattack threw the process into disarray.

The resolution process, which CMS finalized in 2022, was enacted as part of the No Surprises Act and is meant to help sort out disputes between insurance companies and providers regarding out-of-network bills. Parties usually have 30 days after a payment was made to submit a dispute, but CMS Friday issued a blanket extension for submissions.

Related: CMS offers relief to providers affected by Change Healthcare outage

The February cyberattack on the UnitedHealth Group subsidiary affected millions of patients’ medical records and hamstrung vast swathes of the healthcare system. Providers, facilities and providers of air ambulance services who couldn’t file payment disputes in a timely manner following the incident can opt to open a dispute negotiation through Oct. 12, according to the Friday memo written on behalf of the Departments of Labor, Treasury and Health and Human Services.

The extension applies "regardless of when the payment or notice of denial of payment and disclosures were transmitted," the memo says, since "it may be difficult to determine the date of initial payment or notice of denial of payment for an item or service impacted by the cybersecurity incident."

Parties will need to attest that their ability to open a prompt negotiation was impacted by the cyberattack and send the attestation to the non-initiating party and the third-party processors CMS certifies to manage those negotiations. 

"The Departments recognize that payment for a very large volume of items and services was impacted by the Change Healthcare cybersecurity incident, making individual extension requests burdensome for disputing parties and for the Departments," the memo says. 

The agencies said they will evaluate whether further extensions are necessary. 

The extension is the most recent example of changes to the dispute resolution structure over the last year. For example, CMS in May updated its system for resubmitting disputes that weren’t properly consolidated, which the agency refers to as batching or bundling. 

CMS also proposed a rule in October 2023 that would implement a handful of new parameters for the independent dispute resolution process, including setting limits on the amount of time parties have to file a dispute, notify other involved parties and resolve the dispute. The proposed rule also includes new guidelines for open negotiation, clearer definitions of what can be batched and details on paying administrative fees. 

Loren Adler, associate director of the Brookings Institution’s Center on Health Policy, said extending the deadline through October might allow arbiters to work through existing backlogs. Adler, whose research focus includes the No Surprises Act, said dispute backlogs are caused in part by a higher-than-anticipated number of claims. 

Jack Hoadley, research professor emeritus for Georgetown University’s Health Policy Institute, said the net number of claims filed isn't likely to be substantially higher due to the extension, based on data collected during other stops and starts to the dispute resolutions system.

All in all, progress is gradually being made in working through the backlogs, Hoadley said. 

The American Hospital Association praised the announcement and said CMS' step ensures the independent dispute resolution process won't inadvertently be compromised by the Change cyberattack. Trade groups representing insurance companies did not respond to requests for comment.