Examining impact of federal relief program after major healthcare cyberattack — Research Brief

New research from the University of Minnesota School of Public Health provides the first detailed look at whether funding provided through a federal relief programme reached hospitals affected by a ransomware attack on Change Healthcare, a major processor of health insurance claims.

The 2024 cyberattack exposed the personal health information of more than 190 million people and left many hospitals unable to submit claims or receive payment, triggering an emergency relief programme called the Change Healthcare/Optum Payment Disruption Accelerated and Advance Payment programme.

Using data obtained via a Freedom of Information Act request, the study analysed nearly 4,400 hospitals that had applied for the relief, comparing payments to the hospitals’ actual Medicare revenue disruptions from the attack, and found that payments reached only a fraction of affected hospitals.

The programme provided $3.3 billion in total, including $2.2 billion to hospitals, yet only 11% of hospitals received funds; more than 300 hospitals with significant revenue losses likely related to the cyberattack received no relief.

Among hospitals that did receive funding, incoming Medicare revenue fell by an average of 66% in the first six weeks of the cyberattack compared with the same period a year earlier, though relief funding exceeded losses for most. according to Hannah Neprash, lead author and associate professor in the School of Public Health, the findings show the need to improve real-time data use, align payments with actual losses, and ensure smaller and rural hospitals are not overlooked.