Days of cash on hand was the resilience metric that mattered in the Change Healthcare outage

The week

By early March 2024, the Change Healthcare outage that began on February 21 had stopped or slowed claims and payments for a large number of providers. On March 1, Optum announced a temporary funding assistance program for affected providers. On March 5, HHS announced steps to help. It urged Medicare Advantage and other payers to relax prior authorization and other utilization management rules, offer advance funding, and make it easier for providers to switch clearinghouses. CMS said Medicare providers could quickly request new electronic data interchange enrollments. On March 9, CMS announced accelerated payments for Medicare Part A providers and advance payments for Part B suppliers affected by the outage. Physician groups and hospital associations reported that many practices were struggling to meet payroll.

Most cyber incidents are measured in records exposed or days of downtime. For most providers affected by Change Healthcare, the damage was measured in days of cash. A practice or small hospital that could not submit claims stopped receiving payments, while payroll, rent and supplier invoices kept coming. A security incident at a vendor became a liquidity crisis for organizations that had not been attacked. Earlier in this series we looked at the connection decisions providers faced in the first days. This article looks at the money. Seen as a financial event, the outage posed three questions in sequence. How long could a provider last on its own resources? Who would bridge the gap, and on what terms? And who would ultimately bear the loss?

How long you can last: the cash runway

Hospitals and physician groups track days cash on hand as a measure of financial health. Few link it to cyber resilience. The outage made the link direct. An organization with large reserves or a committed credit line could keep operating for weeks while claims backed up. A practice with thin reserves faced trouble within its first missed billing cycle.

The useful measure is narrower than days cash on hand. It is the number of days the organization can meet payroll and essential payables with no claims revenue at all. That depends on payer mix and on the timing of receipts. A practice that receives most of its revenue from one or two payers through one channel has a shorter runway than its balance sheet suggests. So does one whose payroll falls just after its largest weekly remittance.

Finance teams can calculate this runway and set a floor for it, just as they set floors for liquidity ratios. The CFO and CIO should agree on it together, because it defines how long technology has to restore revenue before the business is at risk. It also sets the recovery time objective for revenue cycle systems on a financial basis, rather than by convention.

Who bridges the gap: emergency financing

Three sources of bridge funding appeared in the first weeks. Optum’s temporary funding assistance program advanced money to affected providers. CMS offered accelerated and advance Medicare payments. Some commercial payers advanced funds or relaxed rules. Each came with conditions. The Optum and CMS funds were advances, to be repaid or recouped later. Early on, physician groups complained that the Optum amounts were small relative to normal receipts.

Emergency relief is a backstop. A provider’s own bridge options decide whether it can wait for relief to arrive. The most valuable is a committed, undrawn line of credit sized to the runway gap, arranged in normal times when lenders are willing. Others include agreements with major payers on interim payments if claims cannot be submitted, and a documented process for applying quickly to government programs, with the required data ready.

There is a trade-off. Committed credit lines carry fees, and a small practice may balk at paying for a facility it hopes never to use. The outage gave CFOs a concrete case against which to price that cost. Repayment terms matter too. An advance that must be repaid quickly after restoration can create a second cash squeeze just as claims resume, because back-billed claims take weeks to convert into cash.

Who bears the loss: contracts and insurance

The third question is who pays in the end. Clearinghouse and revenue cycle contracts, especially those signed by smaller providers, often limited the vendor’s liability to fees paid and excluded consequential losses such as delayed revenue. Many said nothing about restoration commitments, notification timelines or help moving to another provider in a long outage. That left providers with little contractual remedy and put the cost on the party least able to absorb it.

Better terms are possible, though bargaining power varies widely. Useful provisions include defined incident notification timelines and restoration commitments with service credits. Add transition assistance if service is not restored within a set period, and clarity on how the vendor will support reprocessing of claims afterward. Large health systems can negotiate these. Small practices often benefit from negotiating through a group purchasing organization, a management services organization or a state medical society.

Insurance is the other half. Many cyber policies covered business interruption from incidents affecting the insured’s own systems, with narrower cover, or none, for a vendor’s outage. Contingent business interruption cover addresses that gap, often with sublimits and waiting periods. Organizations should review the wording with their broker and counsel, and test it against a scenario like this one: no breach of their own systems, weeks without claims revenue, and recovery costs for reprocessing.

The three questions interact. A longer runway reduces the need for bridge financing. Committed financing makes contractual remedies less urgent. Strong contracts and insurance reduce the reserves needed. Each provider will balance them differently. What matters is that the CFO, CIO and general counsel make that balance explicit together, instead of leaving it to defaults set years earlier by separate teams.

With hindsight

Most providers recovered their claims flow within weeks to a few months, as Change restored services and others moved to different clearinghouses. UnitedHealth’s interest-free advances to providers totaled about $9 billion. They were loans. In 2025, practices reported repayment demands, and in some cases offsets against payments from UnitedHealth plans, which created a second cash squeeze. Contingent business interruption cover drew more attention from insurance buyers and brokers. Hospital associations, medical societies and members of Congress pressed for action on concentration in health care infrastructure, but no structural remedy has been enacted. The financial framing has held up. Resilience for providers is partly a balance sheet question, and smaller and rural practices with the thinnest reserves remain the most exposed to the next shared-vendor outage.