Ask a practice manager what happens if the power goes out and you will usually get an answer. Generator, or no generator. Send people home, or keep seeing patients. Somebody knows.

Ask what happens if the clearinghouse goes down for two weeks and the room goes quiet.

That is the gap. Not the building. Someone else's building.

What a clearinghouse actually does

A clearinghouse sits between your practice and the payers. Claims go out through it. Eligibility checks come back through it. Remittance advice comes back through it. So does claim status. In many practices, so do the electronic payments.

It is a single point of failure that most practices have never thought of as a single point of failure, because it usually just works.

What happened in February 2024

Change Healthcare was taken offline by a cyberattack first reported on February 21, 2024. It was one of the largest claims processors in the country.

The American Hospital Association surveyed roughly 1,000 hospitals between March 9 and 12, about three weeks in. What they reported:

  • 74% said the outage affected direct patient care, including delays in authorizations for medically necessary care.
  • 94% reported a financial impact, with more than half calling it significant or serious.
  • More than 80% said their cash flow was affected. Of those, nearly 60% put the revenue impact at $1 million a day or more.
  • 33% said more than half of their revenue was disrupted.

Those are hospital numbers, and we should be honest that a ten-provider practice is not a hospital. The dollar figures do not transfer. The shape of the problem does. Claims stopped going out, money stopped coming in, and the organizations that recovered fastest were the ones that already knew what to do on day one instead of deciding on day four.

Why practices froze

Not because nobody was competent. Because the decisions had never been made, and every one of them had to be made at once, by people who were also seeing patients.

Who calls the clearinghouse. Who calls the payers. Do we submit on paper. Can we submit on paper. Who has the payer portal logins. How long can payroll survive without deposits. Do we tell patients anything. Who decides.

None of those are hard questions. They are only hard when you answer them for the first time in week two.

The questions to answer before it happens

You do not need a thick binder. You need answers to about fifteen questions, written down where someone other than you can find them.

Dependencies

  • Which clearinghouse do we use, and what is our account number?
  • Which payers do we reach directly, without the clearinghouse? Who holds those logins?
  • Does our practice management system submit through anyone else we have forgotten about?

People

  • Who is the one person who decides we are in downtime mode?
  • Who calls the vendor, and what is the after-hours number?
  • Who tells the staff, and what exactly do they say to patients?

Money

  • How many days of operating expenses do we hold?
  • What is our line of credit, and who is authorized to draw on it?
  • At what point do we change how we collect at the desk?

Getting back

  • Where do we record the claims we could not submit?
  • Who reconciles them when the connection returns, and against what?
  • What did this cost us, and where is that documented for the insurer?

What paper mode really means

Practices say "we will just do it on paper" and then discover, in the moment, that paper submission needs enrollment they never completed, forms they do not stock, and addresses nobody has looked up since 2019.

Paper mode is a real option. It is just not a spontaneous one. If it is your fallback, it needs to be set up while everything is working.

How long could you operate without payments

This is the question that changes the conversation, and most practice owners have never put a number on it.

Take your monthly operating cost. Divide by thirty. That is your daily burn. Now look at what you hold in operating cash, and divide. The result is the number of days you can run with nothing coming in.

Whatever that number is, it is the real deadline in any outage, and it is worth knowing before you need it. It is also the figure your cyber insurer is circling from a different direction, which we covered in what your cyber insurance actually asks you to have.

Where to write it down

Not in the practice management system. During an outage, that may be the thing you cannot reach.

One page, printed, in a place the front desk and the administrator can both get to. Digital copies are fine and searchable, and they should exist. If you also want an independent view of what your own systems would do in an outage, that is a separate exercise, and it is what an M365 and SharePoint audit is for. But the one artifact that has to survive the outage is the one that does not depend on anything staying up.

Questions people ask

Is this the same as a disaster recovery plan?

No. Disaster recovery is usually about your own systems and your own data coming back. This is about continuing to operate when a vendor you depend on is down and there is nothing for you to restore. Both matter. Most practices have some version of the first and none of the second.

Our IT provider handles this, don't they?

They handle their scope. Normally that means your network and whatever is attached to it. A clearinghouse outage is not a failure of your network. The decisions in this article are about money and staffing. Those sit with the practice.

How often should this be reviewed?

Once a year is reasonable for most practices, and after any real incident. What goes stale fastest is anything attached to a person. A contact name. An after-hours number. Who still has the portal login. All of it moves when staff move.

Does CMS require this?

CMS Emergency Preparedness requirements apply to certain Medicare and Medicaid certified provider types and include an all-hazards approach, an annual exercise, and communication procedures. Whether they apply to you depends on your provider type. An ordinary private practice may not be subject to them, and may still want this for its own reasons.

What does a cyber insurance carrier want to see?

Carriers commonly ask on applications and renewals whether you maintain a documented incident response or continuity procedure and whether it is tested. Answering yes is easier to support when there is a dated document behind it. Check your own policy and application wording, because carriers differ.

Sources

  • American Hospital Association, "AHA Survey: Change Healthcare Cyberattack Significantly Disrupts Patient Care, Hospitals' Finances," March 15, 2024. Survey of about 1,000 hospitals, fielded March 9 to 12, 2024. aha.org
  • Centers for Medicare & Medicaid Services, Emergency Preparedness Rule, core elements and affected provider types. cms.gov
  • HHS ASPR TRACIE, "Cybersecurity Incident and Healthcare System Downtime Operations Checklist," 2021. Written for hospital-scale operations, and useful here as a reference for the categories a downtime plan should cover. asprtracie.hhs.gov

This article is general information about operating procedures. It is not legal advice, and it is not a determination of what any regulation requires of your organization.