����������

AHA Advisories and Actions to Keep Members Informed

• April 29 Letters to the Senate Finance Committee and House Energy and Commerce Subcommittee in advance of May 1 hearings with UnitedHealth Group CEO Andrew Witty regarding the Change Healthcare cyberattack.
• April 23 Special Bulletin highlighting UnitedHealth Group’s offer to “make notifications and undertake related administrative requirements on behalf of any provider or customer” at the appropriate time.
• April 16 Testimony for the House Energy and Commerce Subcommittee on Health from John Riggi, AHA’s national advisor for cybersecurity and risk, on health care cybersecurity vulnerabilities.
• March 26 Special Bulletin highlighting a new national health plan resource guide developed by the Departments of Health and Human Services, Administration for Strategic Preparedness and Response and Centers for Medicare & Medicaid Services.
• March 19 Letter to the U.S. House of Representatives’ Committee on Ways and Means informing them prior to a March 20 hearing of the cyberattack’s impact on hospitals and health systems.
• March 18 Special Bulletin detailing CMS guidance on Medicaid flexibilities and response to Change Healthcare cyberattack.
• March 15 AHA Today article on new CMS guidance to help states make interim Medicaid payments to providers impacted by the Change Healthcare cyberattack.
• March 15 Survey Results on the impact of the Change Healthcare cyberattack on U.S. hospitals.
• March 14 Special Bulletin highlighting the Centers for Medicare & Medicaid Services’ frequently asked questions on their accelerated and advance payment program for hospitals, physicians and others impacted by the Change Healthcare cyberattack.
• March 13 Letter to Senate Finance Committee leadership in advance of their March 14 hearing on the President’s fiscal year 2025 Health and Human Services budget updating them on the impact of the recent Change Healthcare cyberattack and raising concerns regarding the Administration’s proposal to penalize hospitals that don’t meet certain cybersecurity requirements.
• March 11 Special Bulletin on the Department of Health and Human Services and Department of Labor calling on UnitedHealth Group to “take responsibility” for the adverse impacts of the Change Healthcare cyberattack.
• March 9 Special Bulletin on CMS’ formally announcing terms for hospitals, physicians and other providers impacted by the Change Healthcare cyberattack to apply for accelerated and advance payments.
• March 8 Special Bulletin on UnitedHealth Group’s announcement of a series of updates on its response to the unprecedented cyberattack against its subsidiary Change Healthcare.
• March 6 Perspective column from AHA President and CEO Rick Pollack highlights the AHA’s work on this issue to advocate on members’ behalf.
• March 5 Special Bulletin with details of some flexibilities announced by HHS and AHA’s media statement in response to the announcement.
• March 4 Action Alert encouraging AHA members to speak to their members of Congress urging them to take action to support hospitals as they navigate the effects of the ongoing cyberattack.
• March 4 Letter to the Congress urging actions to support hospitals' efforts to care for patients as the entire health care system continues to navigate the effects of the ongoing cyberattack.
• March 4 Letter to UnitedHealth Group expressing concern with the company's Temporary Funding Assistance Program announced March 1. 
• March 1 Special Bulletin includes information on Change Healthcare temporary actions – funding assistance program and e-prescribing service – announced today and additional cybersecurity resources for the field.
• Feb. 29 Perspective column from AHA President and CEO Rick Pollack highlights the AHA’s work on this issue to inform members and advocate on their behalf.
• Feb. 27 Cybersecurity Advisory on an updated #StopRansonware: ALPHV Blackcat joint agency advisory with new indicators of compromise and tactics, techniques and procedures
• Feb. 26 Letter to the Department of Health and Human Services outlining the implications of the cyberattack on patient care.
• Feb. 26 Cybersecurity Advisory with Health-ISAC bulletin details on maintaining network connectivity with UnitedHealth Group systems and indicators of compromise.
• Feb. 25 Cybersecurity Advisory with indicators of compromise to assist with indicator sweeps of network compromise.
• Feb. 24 Cybersecurity Advisory with additional details, recommendations and AHA actions.
• Feb. 23 AHA cybersecurity update member call with representatives from the Department of Health and Human Services, Cybersecurity and Infrastructure Security Agency, and Federal Bureau of Investigation.
• Feb. 22 Cybersecurity Advisory alerting of the attack and recommended steps.
• Feb. 21 Change Healthcare, a health care technology company that is part of Optum and owned by UnitedHealth Group, announced they were hit with a cyberattack that disrupted a number of its systems and services, according to a posted on its website.