8-K: Encompass Health Discloses Cybersecurity Incident at Payment Processor Change Healthcare

Encompass Health reports a cybersecurity incident at Change Healthcare, its payment claims processor, which has temporarily disrupted payment submissions but has not otherwise impacted operations.

Summary

• Encompass Health received notice on February 21, 2024, about a cybersecurity incident at Change Healthcare, a subsidiary of UnitedHealth Group that processes their payment claims.
• In response, Encompass Health severed connections with Change Healthcare and is conducting forensics on its systems.
• The company has not found any evidence of compromise or unauthorized access to its own systems.
• While operations continue normally, the incident has disrupted the submission of payment claims.
• Encompass Health may experience payment collection delays if Change Healthcare's services are not restored quickly.
• Change Healthcare has not provided a timeline for service restoration.
• As of February 27, 2024, Encompass Health does not consider the incident to be material.

Sentiment

Score: 5

Explanation: The sentiment is neutral to slightly negative. While the company's systems were not compromised, the disruption to payment processing and the uncertainty around service restoration are concerning. The company's statement that the incident is not material is a positive, but the potential for payment delays is a negative.

Positives

• Encompass Health's systems have not been compromised or accessed without authorization.
• The company's operations, including patient care, continue without disruption.
• Encompass Health is actively monitoring the situation and taking steps to mitigate the impact.

Negatives

• The cybersecurity incident at Change Healthcare has disrupted Encompass Health's payment claim submissions.
• There is a risk of payment collection delays if Change Healthcare's services are not restored in a timely manner.
• Change Healthcare has not provided a timeline for service restoration, creating uncertainty.

Risks

• The primary risk is the potential for payment collection delays due to the disruption of payment claim submissions.
• The lack of a service restoration timeline from Change Healthcare creates uncertainty about the duration of the disruption.
• While not currently deemed material, the situation could evolve and have a greater impact on Encompass Health.

Future Outlook

The company anticipates potential payment collection delays if Change Healthcare's services are not restored promptly, but the full impact is uncertain.

Management Comments

• Encompass Health is conducting forensics on its systems and has not found any evidence of compromise.
• The company is still receiving referrals and admitting, caring for, and discharging patients in the ordinary course.
• The company does not currently consider the incident to be material.

Industry Context

This incident highlights the interconnectedness and vulnerability of healthcare systems to cybersecurity threats, particularly through third-party service providers. It underscores the importance of robust cybersecurity measures and contingency planning within the healthcare industry.

Comparison to Industry Standards

• The incident at Change Healthcare is similar to other recent cyberattacks on healthcare providers and their service providers, highlighting the industry's vulnerability.
• Other healthcare companies have experienced similar disruptions to payment processing due to cyber incidents, leading to financial and operational challenges.
• The response by Encompass Health, including severing connections and conducting forensics, is consistent with industry best practices for handling such incidents.

Stakeholder Impact

• Shareholders may be concerned about the potential for payment collection delays and the impact on the company's financial performance.
• Employees may experience some disruption in their workflows related to payment processing.
• Customers (patients) are not directly impacted by the incident, as patient care continues as normal.
• Suppliers and creditors may experience delays in payments from Encompass Health.

Next Steps

• Encompass Health will continue to monitor the situation and work with Change Healthcare to restore services.
• The company will continue to conduct forensics on its systems to ensure no compromise has occurred.
• Encompass Health will explore alternative channels for submitting payment claims if necessary.

Key Dates

Keywords

cybersecurity, healthcare, payment claims, data breach, information technology, Encompass Health, Change Healthcare, UnitedHealth Group, payment processing, system compromise