It has been eighteen months since the Change Healthcare cyberattack took down the largest claims clearinghouse in the country. Most independent practices have moved on. Claims are processing again. The immediate cash flow crisis passed. The story dropped off the front page.
But “recovered operationally” is not the same as “fixed.” In practice after practice, the structural vulnerabilities that made the Change Healthcare outage so damaging are still in place. This issue walks through the three that matter most — and the specific steps to close them before the next disruption arrives.
The Single Clearinghouse Problem Is Still Your Problem
When Change Healthcare went dark on February 21, 2024, thousands of independent practices discovered something they hadn’t thought much about: their entire claims submission pipeline ran through one vendor. One integration, one contract, one point of failure. When that vendor went offline for weeks, there was no fallback. No secondary path. No way to submit claims without starting from scratch with a different clearinghouse — a process that itself takes weeks to set up.
The lesson from February 2024 was not “Change Healthcare is risky.” It was “any single clearinghouse dependency is risky.” The attack was sophisticated, but the damage was amplified by concentration — the fact that one vendor processed roughly 40% of all U.S. medical claims. That concentration hasn’t gone away. Change Healthcare, now operating under Optum/UnitedHealth Group, remains dominant. And independent practices, by and large, never actually diversified.
A single clearinghouse dependency means a single point of failure for your revenue cycle. The cost of establishing a secondary clearinghouse relationship is measured in hours and a modest monthly fee. The cost of being caught without one is measured in weeks of delayed cash flow.
- Audit your current clearinghouse setup. Identify every payer connection you have and which clearinghouse routes each one. If more than 80% of your claim volume runs through a single vendor, you have concentration risk.
- Establish a secondary clearinghouse relationship now — before you need it. Availity, Waystar, and Trizetto are the major alternatives. Getting credentialed and tested costs very little and can be done in 2–4 weeks when there’s no emergency driving it.
- Document the switchover process. If your primary clearinghouse goes down tomorrow, does your billing team know exactly what to do? That documentation should exist and be tested annually.
- Review your clearinghouse contract for SLA terms. Most agreements are thin on uptime guarantees. Know what you’re entitled to before the next outage.
Your Business Continuity Plan for Claims Submission Doesn’t Exist
Here is a question worth sitting with: if your clearinghouse went down for 30 days tomorrow, what is the documented plan? Not a general sense of “we’d figure it out” — an actual written plan, with named contacts, decision trees, timelines, and escalation steps. For the vast majority of independent practices, that plan does not exist. It didn’t exist before February 2024, and it still doesn’t exist today.
Business continuity planning for revenue cycle operations is not a health-system-only discipline. The reason it gets skipped is that it feels like overhead. But the framing is wrong. A business continuity plan for claims submission is a 4–6 hour project, not a 6-month enterprise initiative.
The core is simple: what do you do if your EHR goes down? What do you do if your clearinghouse goes down? What do you do if both go down simultaneously? For each scenario, who is responsible, what are the manual fallbacks, which payers have direct submission portals, and at what point do you call a billing service for emergency support?
Answering those four questions, in writing, for your top three failure scenarios is a business continuity plan that will serve you better than most enterprise organizations achieve.
- Start with the three failure scenarios that would most disrupt your cash flow. For most practices: clearinghouse outage, EHR downtime, and loss of your billing lead.
- Map your direct payer portal access. Most major payers have portals where you can submit claims directly. Make sure your billing team has credentials for the top 5–10 payers by volume.
- Identify one billing service you could engage on short notice. A relationship with a backup billing vendor doesn’t require a contract. Know who they are and how quickly they could onboard you.
- Review and exercise the plan annually. A plan that hasn’t been tested is just a document. Walk your billing team through the top failure scenario once a year.
The Unresolved AR From the Outage Period Is Quietly Bleeding You
When claims stopped processing in February and March 2024, most practices went into triage mode. What got deprioritized was the methodical follow-up on claims that were submitted, lost, delayed, or improperly adjudicated during the disruption period. Eighteen months later, a meaningful share of that AR remains unresolved — not because practices gave up, but because some claims fell through the cracks and never got the follow-up they needed.
Unresolved AR from the outage period is a recoverable asset. For many denial types, you have 12–24 months from the date of service or denial to file an appeal. If you haven’t done a structured audit of your 2024 Q1 AR, you are likely sitting on money that can still be recovered — but the window is closing.
This is also a structural problem. The reason outage-period AR went unresolved is that most independent practices don’t have an AR aging review process robust enough to catch complex disruption scenarios. Closing the Change Healthcare AR gap means both cleaning up the specific 2024 exposure and building the monitoring process that catches the next disruption earlier.
- Pull your AR aging report filtered for dates of service February 1 – April 30, 2024. Any balance in that bucket that hasn’t been resolved deserves a second look. Sort by payer and balance size.
- Identify denial patterns in that period. Look for denial codes referencing clearinghouse errors, claims submission issues, or duplicate claim flags from resubmission attempts. Many are appealable.
- Check payer-specific appeal deadlines. For Medicare, timely filing limits on appeals are generous. For commercial payers, many allow 12–24 months for appeals.
- Build a quarterly AR exception review into your billing workflow. Any claim over 90 days with no activity should trigger direct outreach to the payer — not just a rebill.
Your Action Item This Month
- Pull your clearinghouse contracts and confirm whether you have a secondary vendor relationship in place. If not, reach out to Availity or Waystar this week to begin the credentialing process.
- Open a blank document and write down the first three steps your billing team would take if your primary clearinghouse went offline tomorrow. If you can’t write it in 15 minutes, your plan doesn’t exist yet.
- Run an AR aging report filtered to February–April 2024 dates of service. Flag any balance over $500 that has had no activity in 90 days. That’s your recovery target list.
The Change Healthcare outage was a warning shot. The practices that treated it as a one-time crisis have the same exposure today. The ones that treated it as a structural diagnosis are materially better positioned for whatever comes next.
The PMRx Insider Pulse is published monthly. For Knowledge Session playbooks and implementation tools, visit the PMRx Library.
Not subscribed yet?
Monthly Healthcare IT intelligence for independent practice administrators. Free, no spam.
Subscribe to the Insider Pulse →