On February 21, 2024, Change Healthcare took its systems offline after a ransomware attack. For the practices that routed claims through it, the effect was immediate and strange: the schedule was full, the notes were signed, the charges were entered, and nothing went anywhere. No 277 acknowledgements, no 835 remittances, no 271 eligibility responses. Some practices did not realize for several days that their clearinghouse was down, because the practice management system simply showed claims as "submitted".
The outage stretched for weeks for most functions and months for some. UnitedHealth Group, which owns Change through Optum, paid a $22 million ransom, advanced about $9 billion in interest-free funding to providers while payments were stalled, and in January 2025 confirmed that data on about 190 million people had been exposed, the largest healthcare breach on record. An American Hospital Association survey during the outage found that 94% of hospitals reported a financial impact and 74% reported a direct effect on patient care. Practices were hit at least as hard and had fewer reserves.
A year later, we have watched what practices actually did with the lesson. Some built real contingency plans. Many added a second clearinghouse login and stopped. This article is about the difference.
Key takeaways
- A contingency plan is a tested alternate route for every electronic transaction the practice depends on, not a second clearinghouse account that has never carried a live claim.
- ERA and EFT enrollment through the backup route takes two to six weeks per payer; if it is not done before the outage, the backup can send claims but cannot receive remittances.
- Know your days cash on hand. Practices that came through 2024 comfortably tended to hold 45 to 60 days; those that struggled had under 20.
- Vendor concentration is the hidden risk: the same company often sits behind claims, eligibility, statements and the payer's own connections.
- A one-hour tabletop exercise once a year finds the missing password, the orphaned portal login and the vendor overlap before an outage does.
What actually changed in the last year
Three changes are visible across the practices we work with. First, vendor concentration is now a question people ask. Before February 2024, few practice managers could say which clearinghouse sat behind their practice management system, or that the same company also processed their patient statements and their payer's eligibility responses. Now they can, and they ask new vendors the same question. Second, alternate routes exist on paper. Most practices have enrolled with a second clearinghouse or confirmed they can submit directly through the payer portals of their top payers. Third, cash awareness improved. Practices that had never calculated days cash on hand did so in March 2024 and many kept doing it.
What did not change nearly enough: testing. A backup route that has never carried a live claim is a hope, not a plan. ERA enrollment for a second clearinghouse takes weeks per payer and many practices never completed it, which means the backup can send claims but not receive remittances. And the manual fallback (paper CMS-1500 claims, telephone eligibility, portal-by-portal claim status) was written down once and never rehearsed.
What a contingency plan actually contains
Start with an inventory. Every electronic transaction the practice depends on has a vendor, a fallback and a lead time to switch. Write them in one table and keep it current.
| Transaction | Primary route | Fallback | Lead time to activate |
|---|---|---|---|
| 837P claims | Clearinghouse A via PM system | Clearinghouse B (enrolled, tested) or payer portal direct entry for top five payers | Same day if enrollment complete; 2 to 6 weeks if not |
| 835 remittances and EFT | Clearinghouse A | Payer portal download and manual posting; EFT continues to bank regardless | Payer ERA re-enrollment 2 to 6 weeks; manual posting immediate |
| 270/271 eligibility | Integrated real-time check | Payer portals, payer IVR lines, Medicare MAC portal | Immediate but slow; staff time roughly doubles |
| 276/277 claim status | Clearinghouse A | Payer portals | Immediate |
| 278 prior authorization | Payer portals or clearinghouse | Payer portals, fax, telephone | Immediate |
| Patient statements | Statement vendor (often the same company) | In-house print and mail, or patient portal messages | Days |
The inventory does two things. It shows where a single vendor sits behind several rows, which is your concentration risk, and it forces the practice to admit where the fallback column says "none".
One detail that catches people: the 835 row. During the 2024 outage many payers kept paying by EFT, so the money arrived in the bank, but the electronic remittance that explains the money did not. Practices had cash they could not post. The fallback for that row is not "wait"; it is a named person who downloads remittance PDFs from the top payers' portals and posts them by hand, and a decision in advance about whether to post at the claim level or the batch level while the ERA is down.
The cash question
An outage stops the inflow of insurance payments while payroll, rent and supplies continue. The number to know is days cash on hand: unrestricted cash divided by average daily operating expense. Practices that came through 2024 comfortably tended to have 45 to 60 days; those that struggled had under 20. The second number is the payer mix of your top five payers, because that tells you which portals matter most for direct submission. The third is the daily charge volume, because a two-week outage means two weeks of charges that must be submitted in a burst when the route reopens, and some payers apply timely filing without regard to your vendor's problems.
A worked example: a three-provider practice with $2.4 million in annual collections and $190,000 a month in operating expense spends about $6,300 a day. With $150,000 in the operating account it has 24 days of cash. A three-week clearinghouse outage that stops 80% of insurance receipts removes roughly $130,000 of expected inflow over that period, which leaves the practice borrowing against a line of credit in week three. The same practice with 50 days of cash rides it out and submits the backlog when the route reopens. That is the arithmetic behind the reserve target, and it is worth showing the owners.
During the 2024 outage, CMS allowed Medicare Administrative Contractors to grant accelerated and advance payments and encouraged MA plans and Medicaid programs to relax timely filing and prior authorization. That help was real, but it came weeks in. A plan that depends on federal relief is not a plan.
How to test the plan
Once a quarter, pick a payer and run the fallback for real: submit a small batch of live claims through the secondary route or portal, confirm acceptance, and post the remittance from the portal rather than the ERA. Once a year, run a tabletop exercise: the clearinghouse goes dark on a Wednesday, what does each person do on Thursday morning? The tabletop takes an hour and always finds something, usually a password nobody has, a payer portal account tied to a former employee, or a statement vendor nobody realized was the same company as the clearinghouse.
Write the result down as a one-page runbook: who declares the outage, who switches the claim route, who handles eligibility by portal and phone, who posts manual remittances, who calls the bank about the line of credit, and who tells the providers what is happening. Keep it printed. If the outage takes your practice management system's connection down with it, a runbook stored only inside that system is not much use.
The security side
The attack succeeded because a remote access server did not have multifactor authentication. Practices cannot fix their vendors' security, but they can ask about it and they can fix their own. Multifactor authentication on every remote access path and every payer and clearinghouse portal, a current risk analysis (required under the HIPAA Security Rule in any case), tested backups that are separate from the network, and a business associate agreement with every vendor that touches protected health information. Ask each vendor in writing about their own contingency plans and their notification commitments. A vendor that cannot answer in a paragraph is telling you something.
Revelrex maintains more than one clearinghouse route for medical billing clients and reviews transaction routing and vendor concentration as part of the RCM audit. Revelrex is HIPAA compliant and SOC 2 compliant, and we are happy to share what our own contingency plan looks like if that helps you write yours.
Questions we hear
Isn't a second clearinghouse expensive?
It depends on the vendor and the volume. Many charge a per-claim fee with no minimum for a secondary account, and payer portal direct entry costs nothing but staff time. Compare it with two weeks of stalled collections and the question answers itself.
Our practice management vendor says they handle the clearinghouse and we do not need to worry. Is that true?
Ask them which clearinghouse, whether they have a second one integrated, and what happened to their clients in February 2024. The answer will tell you whether you need to worry.
We are a two-physician practice. Is this overkill?
The inventory takes an afternoon and the tabletop takes an hour. Small practices had the least cash to fall back on in 2024, so if anything the plan matters more, not less.
What to do this month
- Build the transaction inventory table above for your practice and identify every row where one vendor appears more than once.
- Complete ERA and EFT enrollment through your secondary route for your top five payers, and confirm each with a test remittance.
- Calculate days cash on hand and agree with the owners on the minimum you want to hold.
- Confirm every payer portal login is tied to a current employee and protected with multifactor authentication.
- Write the one-page runbook and print it.
- Schedule a one-hour tabletop exercise before the end of the quarter.
