Fairview says it lost more than $7 million from cyberattack at UnitedHealth Group subsidiary

Fairview Health Services contends in a lawsuit that it’s still short $7 million because of the health care billing disruptions stemming from the massive data breach last year at UnitedHealth Group’s Change Healthcare business.

Eden Prairie-based UnitedHealth Group shut down health care billing systems at Change Healthcare in February 2024 to contain the damage from the cyberattack.

Without those computer systems, known as clearinghouses, Minneapolis-based Fairview says it was unable to process claims for its patients’ medical care in a timely fashion, according to its lawsuit. The suit was moved Wednesday to U.S. District Court in Minnesota.

Fairview claims billing was particularly hard hit for the health system’s anesthesia service.

Following the cyberattack, health care providers across the country struggled because they used Change Healthcare to transmit billing data and get paid for services.

“Fairview experienced significant operational and financial harm due to the February 2024 outage at Change Healthcare,” the health system wrote in a statement. “While our teams worked tirelessly to protect patients from further impact and to maintain continuity of care, this event created confusion for patients and raised serious concerns about the potential compromise of patient data, which we view as a critical breach of trust.”

In a statement, UnitedHealth Group said: “We believe this lawsuit is baseless and we intend to defend ourselves vigorously.”

Other health care providers are suing UnitedHealth over the breach, and two clinics in Minnesota have asked a federal judge to temporarily block United from collecting on emergency loans it issued to providers while the Change Healthcare clearinghouse was down.

UnitedHealth has filed a motion to dismiss those lawsuits and those from about two dozen other health care providers across the country.

“In February 2024, [Change Healthcare] was the victim of the cyberattack perpetrated by sophisticated criminal threat actors who focused their resources on going undetected,” the company’s motion says.

“At bottom, plaintiffs’ [complaint] depends on an alternate reality manufactured for this suit — one in which companies victimized by criminal cyberattacks face strict liability for pausing services to customers to contain the attack. Such a fantasy land is inconsistent with common sense and the law."

UnitedHealth Group is one of the nation’s largest companies, with about 19,000 workers in Minnesota and operations that include UnitedHealthcare, the largest U.S. health insurer.

Fairview is one of the largest operators of hospitals and clinics in Minnesota, with about 34,000 employees overall.

In 2021, a UnitedHealthcare official predicted “a much closer alignment” between the insurer and the health system after United acquired from Fairview a nonprofit health plan called PreferredOne.

Last year’s cyberattack affected data for roughly 190 million patients, or 1 in 2 Americans. The financial impacts for health care providers were so significant that UnitedHealth Group provided $9 billion in interest-free loans as bridge financing.

Fairview’s lawsuit doesn’t say whether the health system accessed those funds.

Because of the system shutdown at Change Healthcare, Fairview says it was unable to bill patients for their share of service costs in a timely manner, “resulting in poor patient experience, loss of payment and increased bad debt,” according to the lawsuit.

The health system says it incurred expenses with third-party service providers hired to help post payments during the outage. Plus, Fairview had to pay workers overtime to mitigate the impact as daily cash flow “all but stopped,” the complaint reads.

Fairview alleges Change Healthcare was unable to access and process the health system’s anesthesia services for more than six months.

The lawsuit alleges breach of contract and negligence among other causes of action. It asks Change Healthcare to “make Fairview whole” through restitution and other damages, plus a compensatory award for damages in excess of $75,000.

The lawsuit doesn’t name UnitedHealth Group as a defendant, but it notes the company is “the current parent” of Change Healthcare.

“As a result of [Change Healthcare’s] failure to perform the services it had promised, the interruption in billing for anesthesia services resulted in Fairview having remaining balances from the gap in coverage of over seven million dollars,” according to the complaint, originally filed in Ramsey County District Court.

More broadly, the “disruption has and will cause financial harm to Fairview and carries a substantial risk to the organization including patient outcomes,” the lawsuit says.