Two independent health practices in Minnesota once wanted to expand, but have struggled to recover from the vast UnitedHealth Group Payment System cyberattacks over the past year.
Odom Health & Wellness, a sports medicine and rehabilitation outfit, and Dillman Clinic & Lab, a family medicine practice, is one of thousands of medical offices that experienced sudden economic disruption last year. Cyberattacks on United's division, Change Healthcare, have paralyzed many of the country's healthcare payment system for months.
billions of dollars have been loaned out to medical practices that are short on cash but are beginning to demand repayment.
Dilman and Odom are suing United in US District Court in Minneapolis, accusing them of negligence related to a cyberattack and claiming they are maintaining excessive costs due to the fallout of the attack.
Additionally, Odom and Dillman alleged in their court filings that their insurance division, UnitedHealthcare, denied claims that the late filing would cover patient care.
Lawmakers saw the disruption caused by cyberattacks as a result of United's insatiable desire to buy businesses like change, along with doctor practices and the pharmacy business. The widespread disruption was a reminder of how United's vast subsidiary was embedded in the country's healthcare system.
“This is yet another indication that the rapid integration of major healthcare companies is doing harm rather than helping,” says Sen. Ron Wyden, Democrat of Oregon, of the financial restraint that cyberattacks have been imposed on practices.
Last month, the American Medical Association wrote to Optom, the United Health Division, which owns the changes, saying it was concerned that many practices are being pressured to pay off loans despite the ongoing financial difficulties from cyberattacks.
Since March 2024, the change has provided $9 billion interest-free loans to more than 10,000 healthcare providers, including $569,680 for Odom and $157,600 for Dilman.
A year later, about $5.5 billion was repaid, United said in a court application. Approximately 3,500 practices, including Odom, Dilman and six other plaintiffs in the suit, had not repaid as of April 1. Several other practices and patients also filed lawsuits against United.
In a statement, Change said it would “work proactively with providers to identify flexible repayment plans based on the provider's individual circumstances and their practices.”
“We have also worked with UnitedHealthCare to ensure that any claims received will be reviewed in light of the challenges we have experienced, including waiving the timely submission requirements for plans under its control.”
The change compared efforts to collect loans from the Centers for Medicare and Medicaid Services. After the cyberattack, CMS provided accelerated payments to practices to cover Medicare bills delayed by the cyberattack. It won Medicare claims to get back the funds.
In court filings, United cited data showing that only a small percentage of Odom and Dilman's healthcare claims were rejected because they were “too early,” but their denials increased after the cyberattacks.
Calling the plaintiff's motion a “group shakedown,” UnitedHealth also requested that the district court reject a request for an injunction to repay the loan, claiming that they have no right to interfere in business with thousands of other loan recipients.
United argued that the injunction could be used by other medical practices to “hold billions of hostages.”
Dr. Megan Dillman, a pediatrics and internal medicine specialist, said he opened Lakeville, Minnesota in 2022 and practiced “to bring joy back to medicine.” She said that the company's healthcare business spent far more time with patients than the 15 minutes increasingly needed by doctors.
“If we didn't exist, there are patients who wouldn't think we'd be here today,” Dr. Dilman said, citing the cancer that was overlooked by a more rushed doctor.
Her husband, Richard Dillman, runs the business side of her practice. He called for United to repay.
“I would rather go through the Special Forces Qualification Courses more than ever before than trying this again,” said former Green Beret Dilman.
At the time of the cyberattack, Change's Medical Building Clearinghouse was processing around 45% of healthcare transactions nationwide, or about $2 trillion per year. The company had to take services offline in February 2024 to reduce the damage caused by the attack, shut down much of the healthcare system's cash flow and unlock the disruption.
Related personal information violations were the largest report in the history of the US medical history. In January, United increased the number of reported people whose personal data was exposed to 100 million to 109 million people.
The U.S. Department of Health and Human Services' Civil Rights Office began investigating ransomware attacks in March 2024. An agency spokesman said he had not commented on the current or public investigation. Some healthcare companies are fined for violations that include patient data.
Company officials say the hackers have infiltrated the system of change by obtaining the compromised login credentials and using the portal for entries that do not require multifactor authentication.
United authorities confirmed they paid a $22 million ransom to a Russian cybercriminal who claimed responsibility. In its revenue report in its January, the company reported that the cyberattack cost $3.1 billion.
Healthcare rebates didn't begin channeling relatively freely throughout the change until June 2024, but United said it took some of its systems to get back online and it wasn't 100% yet.
During a May 2024 Congressional hearing, the senator criticized United CEO Andrew Whitty on how the company handled cyberattacks and caused thousands of providers. Whitty testified that the company “will not seek repayment until the provider determines that the business is back to normal.”
The terms of the loan are stipulated that changes do not require repayment until “the affected billing and/or payment processing services and payments have been processed during the service disruption period.”
The meaning of “to be dealt with” is currently at the heart of the lawsuit.
The change began seeking repayments from Dilman and Odom through what medical practices were characterized in court filings as a series of increasingly offensive letters. Both practices have been changed to prevent repayment and not accepting repayment plans offers. The change then demanded full repayment in January and threatened to withhold future reimbursements for patient health care.
“That's a shame, but it's not surprising that United Health Group has decided to prioritize bottom line profits over family and small businesses,” said Wyden, who led the Senate hearing in the cyberattack.
The AMA asked the company to negotiate each practice with “separate and realistic repayment plans.”
Dr. Katherine Mazzola, who runs pediatric neurology and neurosurgery practices in New Jersey, is among many others who fought United over loans.
“In my opinion, Optum behaves like a loan shark that tries to collect quickly,” Dr. Mazzola, who is not a plaintiff in the case against United, said of the division owning the change.
Dr. Mazzola received a $535,000 loan and she later said she told Change that she couldn't pay it back. She suggested a schedule but there was no response. So she began paying $10,000 a month in January. But without warning, she said United began to adorn her refunds.
A United spokesman said demand for full repayments comes after months of effort to negotiate plans, not without warning.
Today, Dr. Odom employs around 110 people, many of whom provide rehabilitation to seniors in support of living facilities. If his practice had to pay off the change loan immediately, his lawsuit argued that at least 22 staff members must be fired. Dr. Odom said it could encourage aid living, drop his services and cause more economic harm.
“We are facing a difficult battle as such a small company,” said Odom President Dr. Meghan Klein. Speaking to the Gulf Coast between her company's finances and United, she said: “It's a huge impact for us that has little impact on them. These are the lives of many people we are concerned about.”
According to the lawsuit, Dilman Clinic, which derives about a quarter of its income from United Insurance Refunds, would face bankruptcy if forced to pay off the loan in full.
They said Dilman will lose all their assets due to bankruptcy, including their homes, cars and retirement accounts against their practice.
“Part of my goal to be here is to control my schedule,” Dr. Dilman said. However, cyberattack-driven chaos consumes the couple's time, leaving little left for their six-year-old daughter.
“I have an hour to see her,” Dr. Dilman said. “I miss her childhood.”
