Point32Health, state’s second largest insurer, has yet to restore services following ransomware attack

Point32Health, the state's second-largest insurer, the parent company of Tufts Health Plan and Harvard Pilgrim Health Care, is still facing technical difficulties after it was targeted in a ransomware attack last week.Point32Health

Over a week after it was targeted in a ransomware attack, Point32Health is still facing technical difficulties that have sidelined payments to providers and forced the insurer to use manual workarounds to meet some patient needs.

The state’s second-largest insurer, the parent company of Tufts Health Plan and Harvard Pilgrim Health Care, said last week it identified the cybersecurity incident on April 17, affecting systems used to serve members, accounts, brokers, and providers. In ransomware attacks, criminals breach computer networks and lock up digital information until victims pay for its release.

The outage largely affected systems that serve Harvard Pilgrim’s commercial and New Hampshire Medicare Advantage Stride plans, and did not affect Tufts Health or other plans.

As a result, nearly all Harvard Pilgrim systems were taken offline. As of Wednesday, few services seem to have been restored. The Harvard Pilgrim website still redirected to a landing page for the parent company, which detailed that the insurer is unable to confirm patient eligibility, process approvals for certain medical tests or procedures (called prior authorization requests), or accept claim submissions for Harvard Pilgrim commercial members.

“While we work diligently to restore the impacted systems as quickly and as safely as possible, our team is working around the clock to provide workarounds for members to receive the services they need,” the insurer said in a statement.

The broken systems have prevented hospitals and physicians from being paid for claims they have submitted on behalf of Harvard Pilgrim commercial members. According to a weekend memo sent to physicians by the Massachusetts Medical Society, reimbursement for Harvard Pilgrim commercial members are delayed and would not be available on April 21 or April 28. Further, the insurer had asked doctors to hold off on submitting additional claims for Harvard Pilgrim commercial members, or contacting them regarding the payment delay.

Hospital systems have voiced concern as they wait for payment, including when payments would resume and whether there would be interim payments while technology issues are worked out.

Providers also expect there to be a backlog of claims once Point32 starts accepting them again.

“Massachusetts Health and Hospital Association and our members are coordinating closely with Point32Health to receive updates on this situation with the hope that the impact on patient care will be as minimal as possible,” Karen Granoff, MHA’s senior director of managed care policy, said in a statement. “We will remain especially engaged on concerns around the inability to verify eligibility and coverage, the growing backlog of claims submissions, and the timing of payment to providers.”

A Point32Health spokesman said the insurer was working directly with providers to address any immediate needs or questions.

Despite providers’ uncertainty, brokers who work closely with Point32 said the insurer has worked diligently and thoughtfully to eliminate hurdles for patients and to manually process requests to make sure no one is without care.

To start, the insurer has waived prior authorization requests for Harvard Pilgrim commercial and New Hampshire Stride Medicare Advantage plans for medical and behavioral health services, with few exceptions. That has allowed patients to access nearly all medical and behavioral health care without obtaining administrative approvals, which are in place largely to limit health care spending.

David Shore, executive vice president of Borislow Insurance, said he was receiving daily communications from the company on how to talk to employer clients and what parts of the insurer’s services are still offline.

“I feel very comfortable that they have identified the issue and are doing everything they can to limit the abrasion to employers and employees and family members who have coverage,” Shore said. “They are picking up the phone for us — doesn’t matter what time of day.”

Employers with Harvard Pilgrim commercial plans have also had a hard time adding new employees to coverage since the cyberattack. But Eric Gulko, president of Innovo Benefits Group and vice president and legislative chair of the National Association of Benefits and Insurance Professionals - Massachusetts, said the insurer had received enrollment requests from employers for manual processing.

“The most important thing for our clients is continued access to care. And to give Harvard Pilgrim credit, whatever actions they’ve been taking have allowed the system to continue functioning,” Gulko said.

While payment to providers was on hold, pharmacy benefits for Harvard Pilgrim members have been unaffected. Gulko said that was a massive relief, given that most people receive day-to-day care via the pharmacy.

Unlike medical care, where claims processing is a bit delayed, processing for pharmacy benefits was more immediate, and an inability to confirm a patient’s health insurance details would have meant a patient might not be able to access their prescriptions.

Point32 said in a FAQ it was still determining whether member information had been disclosed as part of the attack. Gulko said if so, he hoped the insurer would provide credit monitoring services to members.

The outage has also necessitated workarounds at the Group Insurance Commission, which administers health insurance and other benefits to state employees and retirees. According to an e-mail sent to state employees, the Point32 outage had come in the middle of the agency’s open enrollment. In the interim, the commission moved information on plans to other websites.

In an e-mail, the Point32 spokesman said the insurer was taking additional steps to facilitate GIC Open Enrollment.