Change cyberattack may damage credit at smaller health care providers: Fitch

The weeks-long outage at Change Healthcare, which was hit with a cyberattack, could negatively impact the credit of smaller providers and pharmacies that depend on it for financial services, warns the credit rating agency.

Providers and pharmacies already reeling from the recent cyberattack on Change Healthcare now may face damage to their credit ratings.

“We are assessing the degree to which companies’ cash flows have been disrupted following the cyberattack on Change, the adequacy of existing liquidity sources and the likelihood and sufficiency of other sources, such as shareholder and lender support, and whether and when issuers switched to other service providers,” Fitch Ratings, a leading U.S. credit rating agency, announced on Monday.

Smaller health-care organizations are especially vulnerable. “We believe any credit implications are likely to be limited to smaller companies due to their limited financial flexibility to withstand even temporary cash-flow disruptions,” Fitch said. “These companies tend to be rated in the ‘CCC’ or low-to-mid ‘B’ categories, indicating very low margins of safety. Companies that have borrowed from direct lenders, such as private credit lenders, may be able to negotiate temporary relief in coordination with lenders and shareholders.”

Organizations with higher ratings probably can withstand these challenges, but industry watchers will learn more when they report first-quarter financial results.

“We assume higher-rated companies, which are typically publicly traded, have sufficient flexibility to withstand such disruptions,” Fitch said. “This is supported by most publicly traded issuers not viewing the event as material enough to warrant filing 8-Ks [a filing with the SEC to announce major company events that may have ramifications for shareholders]. However, details on the financial implications for all companies affected by the incident will become clearer after first quarter 2024 results are reported.”

The Fitch report comes as the federal government and fellow credit rating agency Moody’s Ratings have raised concerns about the financial strain on smaller providers caused by the outage.

“We are also considering the temporary liquidity sources provided by UnitedHealth Group and the Change Healthcare/Optum Payment Disruption Accelerated Payments plan announced by the U.S. Department of Health and Human Services and the Centers for Medicare & Medicaid Services on March 9,” Fitch said. “Change has restored access to certain services and has announced additional services that will begin coming online this week.”

Related: UnitedHealth pays out $2B in advances to struggling providers hit by cyberattack

Parent company UnitedHealth Group said it has made progress in restoring Change systems, which have been disrupted since late February. Last week, the company reported that its medical claims preparation software was back online, and it had begun testing and implementation with its first providers and Change’s electronic payment platform was restored.

However, some providers fear longer-term effects from the outage; 44% of hospitals expected the negative revenue impact to last for two to four more months, a survey conducted earlier this month by the American Hospital Association found.