Medical Billing Cybersecurity: What a Clearinghouse Outage Actually Costs Your Practice

The 2024 Change Healthcare Attack Showed What One Point of Failure Can Do to Your Cash Flow, and Most Practices Still Haven't Fixed It

By Team Rcmaxis  ·  November 12, 2026  ·  12 min read

On February 21, 2024, a single ransomware attack on Change Healthcare, then the largest claims clearinghouse in the country, cut off the flow of money to thousands of practices that had never heard of the company by name. They just knew their claims stopped moving. Becker's Hospital Review later reported that Change Healthcare was processing nearly 15 billion transactions a year and touching one in three patient records, which is the actual reason a breach at one vendor turned into a billing crisis for the entire industry. It wasn't a localized IT problem. It was proof that most of American healthcare's claims traffic runs through a small number of chokepoints, and almost nobody had a backup plan tested and ready.

That's the part worth sitting with if you run billing for a practice, a group, or an outsourced RCM operation: this wasn't a freak event that only hits giant health systems. It's a structural risk sitting underneath every practice's cash flow, and two and a half years later, most of the industry still hasn't fixed it. If you've never asked your billing team or vendor what happens to your claims the day your clearinghouse goes dark, this is the week to ask.

What Actually Happened When Change Healthcare Went Dark

The attack, carried out by the BlackCat/ALPHV ransomware group, forced Change Healthcare to take its systems offline almost immediately, and they stayed down for weeks. The Medical Group Management Association reported "substantial" billing and cash-flow disruption among its member practices in the days and weeks that followed, and the pattern repeated everywhere: claims that would normally clear in days sat unsubmitted, electronic remittance advice stopped arriving, and eligibility checks that front-desk staff run before every visit simply failed. Change Healthcare's systems were largely restored by mid-March, roughly three weeks after the attack began, but for a lot of practices the cash-flow hole it left behind took considerably longer to climb out of.

The dollar-figure headlines from that period, hundreds of millions in disrupted claims, frozen payer remittances, delayed provider reimbursement, were real, but the number that should actually worry you is a smaller one: how many weeks of payroll and overhead your own practice could survive with zero incoming claims revenue. For a lot of smaller practices, the honest answer in February 2024 was somewhere between two and four weeks, and at least one facility reported being unable to make payroll and had to close briefly as a direct result. That's not a hypothetical. That's what happened to real practices that had exactly one way to get paid and no second option when it broke.

Why One Vendor's Bad Week Became the Whole Industry's Problem

Here's the uncomfortable structural fact underneath all of this: healthcare's claims infrastructure is concentrated among a handful of large clearinghouses, and most practices, and plenty of billing companies, route 100% of their claims traffic through exactly one of them. That's efficient right up until that one vendor has a bad month. Axios reported that Availity, a competing clearinghouse, absorbed a wave of displaced Change Healthcare clients during the crisis, and its CEO framed the core lesson in blunt terms: network resiliency, not just any single vendor's uptime record, is what actually protects a practice's cash flow.

A year after the attack, retrospectives from outlets like FierceHealthcare found that the industry had learned real lessons, better incident response plans, more cash-reserve planning, more vendor due diligence, but a follow-up piece from Physician's Practice in April 2026 was blunter: in a lot of cases, the industry simply rebuilt the same concentrated structure and kept the same level of risk sitting underneath it. And a MedCity News piece published in September 2026, revisiting the incident two and a half years out, put it as a standing diagnosis rather than a lesson already learned: healthcare still has a clearinghouse redundancy problem, and its core recommendation is that practices and payers stop treating a single clearinghouse connection as their only path to getting paid.

Building Real Clearinghouse Redundancy: What It Actually Looks Like

Most practices that say they have a "backup plan" mean they have a phone number for a second vendor, not an active relationship. That gap is exactly what turned a three-week outage into a months-long cash-flow crisis for a lot of practices in 2024. Real redundancy means your billing team, or your outsourced RCM partner, has already done the boring setup work before there's ever a fire to put out.

Concretely, that means a tested connection to a second clearinghouse that's actually been used to submit at least a handful of real claims, not just configured and left dormant. It means someone on your team, or at your vendor, knows how to manually pull your 837 claim files and resubmit them through an alternate path without waiting on a support ticket. It means your practice has a cash reserve or an accessible line of credit sized to cover payroll and core overhead through a multi-week claims gap, because even a well-executed failover can't make payers process everything instantly once the lights come back on. And it means actually reading the business continuity language in your outsourced billing vendor's contract instead of assuming "we have a disaster recovery plan" covers you specifically.

Questions worth asking your billing team or vendor this quarter

• Which clearinghouse do we use, and do we have an active secondary connection, not just a name on a list?
• How many days of payroll and overhead could we cover with zero incoming claims revenue?
• Who on our team, or at our vendor, actually knows how to manually resubmit an 837 file through a different channel?
• What does our vendor's contract specifically commit to if an outage runs longer than a week?

The Regulatory Backdrop: HIPAA Security Rule Updates Are Coming

This isn't only an operational question anymore, it's becoming a compliance one. In January 2025, HHS's Office for Civil Rights published a notice of proposed rulemaking that would be the first major update to the HIPAA Security Rule in roughly a decade, explicitly framed around the kind of ransomware and hacking incidents the Change Healthcare attack represented. The proposal would eliminate the current distinction between "required" and "addressable" implementation specifications, meaning safeguards that covered entities and business associates, clearinghouses included, could previously treat as optional based on their own risk analysis would become flatly mandatory. As of this writing that rule is still proposed, not final, and the existing Security Rule remains in effect, but the direction regulators are heading is clear even while the exact compliance date isn't.

What to Actually Do Before Your Next Outage, Not During It

None of this requires a massive IT overhaul. It requires treating clearinghouse redundancy the way you'd treat any other single point of failure in a business that depends entirely on cash flow to keep the lights on. Start with an honest inventory: one clearinghouse or two, one tested failover path or zero, a documented reserve or just an assumption that claims will "work out." Then close the gaps in order of how fast they'd hurt you, starting with the cash-reserve question, since that's the one that determines whether a three-week outage is an inconvenience or an existential threat.

If you outsource your billing, this is a conversation to have with your RCM partner directly, not an assumption to leave unexamined. Ask them to walk you through exactly what happens, step by step, if your primary clearinghouse goes dark tomorrow. If the answer is vague, that's your answer.

Frequently Asked Questions About Clearinghouse and Billing Cybersecurity Risk

Could a cyberattack on my clearinghouse really stop my practice from getting paid?

Yes, and it already happened industry-wide. When Change Healthcare, then the nation's largest clearinghouse, was hit by a ransomware attack in February 2024, providers across the country lost the ability to submit claims and receive electronic remittances through their normal channel for weeks. If your practice routes claims through a single clearinghouse connection with no tested backup, an outage at that one vendor is functionally an outage of your entire revenue cycle.

What should I ask my billing vendor about clearinghouse redundancy?

Ask whether they maintain an active, tested connection to a second clearinghouse, not just a backup plan on paper. Ask how quickly they could reroute your claims if your primary clearinghouse went dark, whether they can manually pull and resubmit your 837 claim files, and what their contract actually commits to if an outage drags past a week. A vendor that can't answer these specifically hasn't tested the scenario.

Is HIPAA going to require stronger cybersecurity protections soon?

HHS's Office for Civil Rights published a proposed rule in January 2025 that would meaningfully tighten the HIPAA Security Rule, removing the current required-versus-addressable distinction and adding more specific technical safeguards. As of this writing it remains a proposed rule, not final, so the current Security Rule still applies. Treat the direction of travel as settled even while the exact compliance date isn't.