Incident Response Resources

 

NTCA Benefits Administration Processes Affected by Third-Party Cybersecurity Incident

In late February 2024, Change Healthcare (CHC), a third-party vendor that helps administer Group Health Program benefits, experienced a ransomware attack that disabled access to its IT systems, causing a system-wide outage. We have not been officially notified that any NTCA member data, networks or systems are at risk; however, several of NTCA's processes for administering benefits have been affected. As a result, participants and providers may notice delays in receiving payments, reimbursements or communications related to medical, dental and disability claims. 

 

NTCA will notify members directly and update this page with the latest information as it becomes available.

 

 

FOR PROVIDERS

 

 

 


 

 

Latest Updates

4/25 Update

Dear Group Health Program Member, 

 

Since late February 2024, NTCA has communicated about the effects of a ransomware attack that caused a system-wide outage to Change Healthcare (CHC), a third-party vendor that helps administer some Group Health Program benefits. On April 22, the owner of CHC, UnitedHealth Group, announced that it is offering several free credit monitoring and identity theft protections to people who may be concerned about their personal data potentially being impacted by this incident, including: 

  • Two-Year Single-Bureau Credit Monitoring  

  • CyberScan™ Dark Web Monitoring 

  • $1 Million Identity Theft Insurance 

  • Identity Recovery 

  • Lost Wallet Coverage 

Click here to access the UnitedHealth Group Frequently Asked Questions page for more information. 

What You Should Know 

It is important to note that this UnitedHealth Group announcement is not an official breach notification. The company has engaged industry-leading experts to analyze data involved in the cyberattack and is immediately providing support and robust protections rather than waiting until the conclusion of the data review. Given the nature and complexity of the data review, it will likely take several months of continued analysis before enough information will be available to identify and notify impacted customers and individuals.  

 

Based on initial targeted data sampling, UnitedHealth Group reports that it has found files containing protected health information (PHI) or personally identifiable information (PII), which could cover a substantial proportion of people in America.  

What Participants Should Do 

Although NTCA has not been officially notified of a data breach, we recommend participants utilize the two years of free identity protection services that UnitedHealth Group is offering as a precaution.  

 

UnitedHealth Group has contracted with IDX, A ZeroFox Company, to establish a call center at (888) 846-4705 dedicated to providing this support. Current and former Group Health Program participants—including adults, minors and decedents—are eligible for these identity protections.  

 

To enroll in one or more of these services, participants should call the IDX call center at (888) 846-4705 and have the full name, email address and phone number of each individual enrolling. The services will be activated after the email has been verified and additional data points have been provided. Please note that the call center cannot provide any specific information about individual data impacts at this time. 

 

To help you keep your participants informed, we prepared a sample email that you may use to relay this information. The email explains the situation, the services available to GHP participants and tips for monitoring personal data. Please inform your participants as soon as possible to give them adequate notice of the services that are available to them. 

For More Information 

Thank you for your patience and cooperation as we continue to manage the effects of the cyberattack on Change Healthcare. NTCA remains fully committed to maintaining transparency and minimizing the impact on our members and participants. Please continue to read our emails and visit our Incident Response page for the latest updates. 

 

For information related to UnitedHealth Group's identity protection services, including technical support, please contact the IDX call center at (888) 846-4705. Please remember that the call center cannot provide any specifics on any individual data impacts.  

 

For any other NTCA Benefits questions, contact our benefits resource specialists at (828) 281-9000 or [email protected], Monday to Friday, between 9 a.m. and 7:00 p.m. ET.  

4/19 Update

Dear Group Health Program Member,

In the ongoing aftermath of the recent cyber incident affecting Change Healthcare (CHC), NTCA is making progress in establishing our partnership with the new print vendor for our Group Health Program. The transition has gone smoothly so far, and our teams are working diligently to implement processes and ensure their accuracy as quickly as possible. We are prioritizing restoring processes with the new vendor in the following order: 

  1. Issuing payments and Explanation of Benefits for backlogged dental claims, certain out-of-network medical claims and participants' self-submitted claims. 

  1. Processing payments for Short-Term and Long-Term Disability benefits. NTCA is currently processing these payments manually. 

  1. Processing payments for Section 105 and medical and dependent care Flex reimbursements. NTCA is currently processing these payments manually. 

  1. Restoring access to historical electronic Explanation of Benefits information.  

 

Updates on Claims-Related Processes
 

Benefit Payments and Reimbursements 
Participants will receive Short-Term and Long-Term Disability benefit payments and Section 105 and medical and dependent care Flex reimbursements directly from NTCA through the end of the month. We will evaluate our progress in switching to the new vendor to determine how the next round of payments in May will be distributed. Please note that participants could experience delays in receiving payments for Section 105 and medical and dependent care Flex reimbursements during this transition.  

Enrolling in Electronic Funds Transfers (EFT) remains the best option to help streamline the payment process for the participant and NTCA. The Electronic Transactions Setup form is available in the Quick Links section after logging in to ntca.org/MyGHPClaims

Dental and Out-of-Network Claims Payments
Payments for dental claims, certain out-of-network medical claims and participants' self-submitted claims cannot be issued at this time. However, we are optimistic that our new vendor will soon assume responsibility for this task, as it's our top priority during this transition period. 

Explanations of Benefits
Our vendor is also working to restore access to electronic (PDF) and printed versions of Explanation of Benefits (EOB) documents and making aesthetic improvements in the process. When EOBs become available to participants, they will notice a better-organized layout to help them easily find important information related to their claims. 

In the meantime, most of the claim information on the EOB is available on the GHP Claims Inquiry Site at ntca.org/MyGHPClaims. After logging in to their account, participants can view claim details by clicking on the Claim ID link in the Recent Claims section of the Member Dashboard home screen. 

 

Flex and Section 105 Reimbursement Billing
Companies that offer the Flex and Section 105 programs can expect to receive another invoice in May for the physical check payments NTCA made in April. We anticipate the payment process will be the same as the April billing, but should anything change, we will communicate that to the affected companies directly.  

 

For More Information
Thank you for your continued patience as we move to a new vendor to restore our impacted services. Please visit our Incident Response page for the latest updates on our response to the Change Healthcare cyber incident and contact our benefits specialists with questions. They are available at (828) 281-9000, Monday through Friday, from 9 a.m. to 7:00 p.m. ET.  

 

4/5 Update

Dear Group Health Program Member,

Thank you for your ongoing patience as we enter the second month of managing the recent cyber incident affecting Change Healthcare (CHC), a third-party vendor responsible for managing certain transactions for NTCA. As CHC's services continue to be unavailable, NTCA is partnering with a new clearinghouse vendor for our Group Health Program claim processing needs. As we make this transition, our team will continue using alternative processes we have put in place to minimize the impact of this incident on our members and participants.  

Claim-Related Progress

Benefit Payments and Reimbursements

Participants continue to receive Short-Term and Long-Term Disability benefit payments and Section 105 and medical and dependent care Flex reimbursements within the usual delivery timeframe. We encourage your participants to enroll in Electronic Funds Transfers (EFT) to help streamline their payment process. The Electronic Transactions Setup form is available in the Quick Links section after logging in to ntca.org/MyGHPClaims.

Flex and Section 105 Reimbursement Billing

Companies that offer the Flex and Section 105 programs received an invoice today for the physical check payments NTCA made in March. To view this invoice, log in to your Member Central account at ntca.org, scroll down to the Invoices section of the page and click on the invoice number to view. Please note that due to the processing method of these reimbursements, the invoice must be paid via check.

Dental and Out-of-Network

Delivery of predetermination letters for dental procedures has resumed; however, we still cannot process benefits payments due to participants for out-of-network medical and dental claims and participants' self-submitted claims. We look forward to working with the new clearinghouse vendor to restore this service soon.

Alternative Access to Claim and Explanation of Benefits Information

Our team is working to make Electronic (PDF) and paper versions of Explanation of Benefits (EOB) documents available to GHP participants. Please remember that while the typical formatted EOB document is not currently available, most of the claim information it contains can still be accessed through the GHP Claims Inquiry Site at ntca.org/MyGHPClaims. After logging in to their account, participants can find most of the same claim details by clicking on the Claim ID link in the Recent Claims section of the Member Dashboard home screen.

 

For More Information

We appreciate your continued patience until we fully transition to a new vendor to restore our impacted services. Please visit our Incident Response page for the latest updates on our response to the Change Healthcare cyber incident and contact our benefits specialists with questions. They are available at (828) 281-9000, Monday through Friday, from 9 a.m. to 7:00 p.m. ET.  

3/19 Update

Dear Group Health Program Member,

As we begin another week, we want to keep you informed about our ongoing response to the recent cyber incident that resulted in a system-wide outage for Change Healthcare (CHC), a third-party vendor responsible for managing certain transactions for NTCA. According to Change Healthcare, the company processes 15 billion health care transactions annually, including some of NTCA’s transactions, and touches one in every three patient records in the United States. The American Hospital Association has said that Change Healthcare "was the victim of the most significant and consequential cyberattack on the U.S. health care system in American history.” NTCA remains committed to minimizing the impact of this incident on our members and participants.


Claims Transactions Progress

Our team's quick action to implement alternative processes has resulted in 100 percent of participants continuing to receive Short-Term and Long-Term Disability benefit payments and Section 105 and medical and dependent care Flex reimbursements within the usual delivery timeframe. We will continue with these payment procedures, refining our processes along the way.

Electronic Funds Transfers
Several participants have enrolled in Electronic Funds Transfers (EFT) to streamline their payment process, which has helped reduce the amount of manual labor required for processing and mailing physical checks. We appreciate benefit administrators' efforts to inform employees about this time-saving service, and we trust that new enrollees have transitioned smoothly.

As a reminder, the Electronic Transactions Setup form is available in the Quick Links section after logging in to ntca.org/MyGHPClaims.

Non-UHC (Out-of-Network) Claim Reimbursements
NTCA continues researching solutions for processing benefits due to participants for out-of-network medical and dental claims and participant self-submitted claims. We will notify members when more information is available.


Explanation of Benefits and Predetermination Letter Information

Alternative Access to Claim and Explanation of Benefits Information
The Change Healthcare cybersecurity incident has temporarily affected the availability of both electronic (PDF) and paper versions of Explanation of Benefits (EOB) documents for GHP participants. While the typical formatted EOB document is not currently available, most of the claim information it contains can still be accessed through the GHP Claims Inquiry Site at ntca.org/MyGHPClaims. After logging in to their account, participants can find most of the same claim details by clicking on the Claim ID link in the Recent Claims section of the Member Dashboard home screen.

Following is a comparison of the information that can and cannot be found on the online claim site and on the EOB:

Information that is available online and on the EOB:

  • Patient name 
  • Claim status
  • Service dates
  • Transaction number (claim number/ID)
  • Account number
  • Provider/practitioner name
  • Service description
  • Billed amount
  • Amount paid by NTCA (discount)
  • Amount paid to the provider, if applicable
     

Information that is not available online and on the EOB:

  • Participant birthdate
  • Relationship to participant
  • Claim appeal information


Predetermination Letter Delivery
NTCA is working with our vendor to resume delivering predetermination letters for dental procedures.


Communications Resources for Your Participants

To assist you in keeping your participants updated about the changes that affect them, we developed the following resources:

  • A sample email with details about payment process changes
  • A guide with details about accessing claim details at ntca.org/MyGHPClaims

Please communicate with your affected participants about these alternative processes to give them adequate notice of changes and keep them informed. We also encourage participants to visit ntca.org/IncidentResponse for NTCA’s latest updates.


Flex and Section 105 Claims Reimbursement Billing Reminders

The interim process for administering payments for Section 105 and medical and dependent Flex (Section 125) claims requires that reimbursements paid by physical checks must be paid directly by NTCA. These reimbursement amounts will be shown on the draft register report but will not be deducted from members' bank accounts. Electronic payments will show on the draft register report as a check number beginning with an "E" and will be deducted from member bank accounts. As a result, the total draft amount shown on the report will be inaccurate.

Members can expect to receive an invoice for the reimbursements paid by physical check by the end of the month. NTCA will provide more information about accessing and paying the invoice through Member Central at that time.
 

For More Information

Thank you for your commitment to keeping your participants informed. Please visit our Incident Response page for the latest updates on the impacts of the Change Healthcare cyber incident. As always, our benefits specialists are available to answer your questions at (828) 281-9000, Monday through Friday, from 9 a.m. to 7:00 p.m. ET. 

3/8/24 Update

Dear Group Health Program Member,

As another week ends, we want to provide you with an update on our response to the impacts of the ransomware attack that caused a system-wide outage for Change Healthcare (CHC), a third-party vendor that manages certain transactions for NTCA. Upon learning about the cybersecurity event, NTCA staff reacted quickly to create process alternatives and minimize disruptions to plan participants. Please view the video message from CEO Shirley Bloomfield and read further for an update on the measures we have taken to continue to deliver the high level of service you expect.  

Payment & Reimbursement Process Reminders 

For Participants 

NTCA has implemented alternative processes for the following participant payment and reimbursement services:

  • Short-term disability benefit payments
  • Long-term disability benefit payments
  • Flex (Section 125) reimbursement payments,
    including medical and dependent care
  • Section 105 reimbursement payments

Participants who receive any of these payments via Electronic Funds Transfer (EFT) will continue to receive payments electronically within one or two days of their regular schedule. Participants who receive payment by check will receive physical checks signed by our Chief Financial Officer Mano Koilpillai directly from NTCA. Some delays are possible due to manual processing procedures; however, participants could receive their payment faster by setting up an Electronic Funds Transfer (EFT). The Electronic Transactions Setup form is available in the Quick Links section after logging in to ntca.org/MyGHPClaims

NTCA continues researching solutions for processing reimbursements to participants for out-of-network medical and dental claims, as well as participant self-submitted claims. We will notify members when more information is available.  

For Members 

The interim process for administering payments for Section 105 and medical and dependent Flex (Section 125) claims requires that reimbursements paid by physical checks must be paid directly by NTCA. These reimbursement amounts will be shown on the draft register report but will not be deducted from members' bank accounts. Electronic payments will show on the draft register report as a check number beginning with an "E" and will be deducted from member bank accounts. As a result, the total draft amount shown on the report will be inaccurate. NTCA will invoice members through Member Central for the reimbursements paid by physical check.

Additional Affected Processes 

We are also exploring processing alternatives for the following claims-related processes: 

  • Online access to and delivery of printed Explanation of Benefits (EOB) letters
  • Delivery of dental pre-determination information to participants and providers
  • Coordination of benefits information request letters to participants for non-UHC medical claims
  • Delivery of W-9 request letters to providers
  • Delivery of hearing aid trial period letters to participants
  • Delivery of overpayment letters to providers for dental and non-UHC (out-of-network) claims
  • Delivery of provider remittance advice and payment for dental and some non-UHC (out-of-network) medical claims

Communications Resources for Your Participants 

We know you want to inform your participants about the changes that affect them. To help, we prepared a sample email with details about payment process changes and other important information. Please share this information with your affected participants to give them adequate notice of changes and encourage them to visit ntca.org/IncidentResponse for NTCA’s latest updates. 

For More Information 

Once again, thank you for your patience. Please continue to read our emails and visit our Incident Response page for the latest updates on the impacts of the Change Healthcare cyberattack. As always, our benefits specialists are available at (828) 281-9000, Monday through Friday, from 9 a.m. to 7:00 p.m. ET, to answer any questions you may have.

3/6/24 Update

Dear Group Health Program Member,

As you may have seen in the news and previous updates from NTCA, healthcare payment processor Change Healthcare (CHC) experienced a ransomware attack that disabled access to its systems, causing a system-wide outage. Over the last few weeks, NTCA has informed you about several participant payment processes affected by the attack on CHC, a third-party vendor that manages certain transactions for NTCA. Today, we are making you aware of some impacts you and your participants may experience in receiving payments and some billing-related procedural changes that are necessary for NTCA to conduct business in this environment.  

To help you keep your participants informed, we prepared a sample email that includes the following details about payment process changes and other important information. Please share this information with affected participants as soon as possible to give them adequate notice of changes. NTCA will also update participants directly in the coming days.  

What Members Participating in Flex and Section 105 Should Know

The interim process for administering payments for Section 105 and medical and dependent Flex (Section 125) claims affects how reimbursements are funded:  

  • Reimbursements paid by physical checks must be paid directly by NTCA instead of being deducted from member companies' bank accounts. 
  • Electronic payments (EFT) will continue to be deducted from members’ bank accounts. 
  • The draft register reports generated for each payment cycle will not show the accurate total amount to be deducted from member bank accounts during this time because they will show the amounts of all reimbursements being paid. On the report, all check numbers beginning with an "E" will be deducted from member bank accounts.  
  • NTCA will send an itemized invoice to the member company for the reimbursements NTCA paid by physical check.  
  • The workaround for this Flex and Section 105 reimbursement process requires us to send invoices for these claims through NTCA Member Central instead of the My NTCA Benefits Administrator Portal.   

What Your Participants Should Know

Participants will notice some differences in their payments or reimbursements for the following processes:  

  • Short-term disability benefit payments  
  • Long-term disability benefit payments  
  • Flex (Section 125) reimbursement payments, including medical and dependent care   
  • Section 105 reimbursement payments  

If the Participant Receives Payment by Check

  • Participants will receive a check directly from NTCA. 
  • This check will look different than previous checks and will be signed by NTCA Chief Financial Officer Mano Koilpillai.  
  • Participants may notice delays in receiving their checks due to manual processing procedures. 
  • Participants are eligible to enroll in Electronic Funds Transfer (EFT), which could expedite their receipt of payment. To enroll, log in to NTCA's Health Claims Inquiry site at ntca.org/MyGHPClaims, then select Electronic Transactions Setup from the Quick Links section on the upper right-hand side of the page to access the form.  

If the Participant Receives Payment by Electronic Funds Transfer (EFT)

  • Payments will continue to be distributed electronically. 
  • Participants may notice a different transaction description for this deposit in their bank account register. 
  • Most EFT payments will be delivered on schedule; however, delays are possible.  

For More Information 

Thank you for your patience and cooperation as we manage the aftermath of the cyberattack on Change Healthcare. We understand that these interim processes are an inconvenience. In addition to our routine email notifications, NTCA will publish the latest updates on our Incident Resource page at ntca.org/IncidentResponse. Our benefits specialists are available to answer questions or provide assistance Monday to Friday, between 9 a.m. and 7:00 p.m. ET, at (828) 281-9000 or [email protected]

3/1/24 Update

On Friday, February 23, 2024, NTCA informed members about a third-party cybersecurity event that affected a vendor that processes certain transactions for NTCA. The third-party, Change Healthcare (CHC), experienced a ransomware attack that disabled access to its IT systems, causing a system-wide outage.  

We have not been notified that any NTCA member data, networks or systems are at risk, and we can confirm that our prescription drug partner, Express Scripts, has not been impacted by this issue. Several of NTCA's processes for administering benefits have been affected, however. As a result, participants and providers may notice delays in receiving payments, reimbursements or communications related to medical, dental and disability claims. Information has yet to be relayed to NTCA about when CHC's services will be restored.  

Affected Participant Processes  

NTCA identified that the following participant payment processes have been affected: 

  • Short-term disability payments 
  • Long-term disability payments 
  • Flex (Section 125) reimbursement payments, including medical and dependent care  
  • Section 105 reimbursement payments 
  • Reimbursements to participants for out-of-network and dental services claims 

We are also monitoring other claims-related processes, including:  

  • Explanation of Benefits documents 
  • Dental pre-determination letters to participants and providers 
  • Coordination of benefits information request letters to participants for non-UHC (out-of-network) medical claims 
  • W-9 request letters to providers 
  • Hearing aid trial period letters to participants 
  • Overpayment letters to providers for dental and non-UHC (out-of-network) claims 
  • Provider remittance advice and payment for dental and some non-UHC (out-of-network) medical claims 

What We Are Doing  

Upon learning about the cybersecurity event, NTCA staff reacted quickly to manually generate Short-Term and Long-Term Disability benefit checks so that recipients could receive payment on the date it was expected. We are prioritizing action on affected payments and exploring processing alternatives to minimize disruptions to participants and providers, while simultaneously adhering to regulatory requirements. Our team is taking all reasonable measures to deliver services as expected, although delays are possible, given the manual procedures required. NTCA staff will contact affected participants directly to make them aware of payment process changes.

Important Considerations 

Participants who have elected to receive payments and reimbursements through Electronic Funds Transfer (EFT) are likely to receive more timely payments than those who receive physical checks. We urge you to relay this information to your participants and encourage them to enroll in EFT through NTCA's Health Claims Inquiry site at ntca.org/MyGHPClaims. Once participants log in, they can select Electronic Transactions Setup from the Quick Links section on the upper right-hand side of the page. 

Although Express Scripts' services have not been affected by the CHC outage, many local pharmacies—particularly small, independent providers —may struggle to fulfill prescriptions because they have less cash to cover drug costs without insurance reimbursements. Participants should consider utilizing Express Scripts' mail-order prescription service if they experience disruptions at their local pharmacy. Enrollment in this service is available at Express-Scripts.com.  

For More Information  

We appreciate your patience and understanding as we navigate the effects of the cyberattack on Change Healthcare, and we remain fully committed to minimizing the impact on our members and participants. In addition to regular email updates, NTCA will post the information shared with members to our Incident Response Resource page at ntca.org/IncidentResponse. If you have any questions, please contact our benefits specialists Monday through Friday from 9 a.m. to 7:00 p.m. ET at (828) 281-9000.  

2/23/24 Notice of Third-Party Cybersecurity Incident

We have recently been made aware of a security incident affecting one of the vendors we work with to administer your company’s Group Health Program benefits. As you might have read in news reports, Change Healthcare (CHC), owned by UnitedHealth Group, is experiencing a cyber security issue that has disabled access to its IT systems. We are providing you with notice of this incident and how NTCA is responding.

What Happened?

Upon learning about the CHC cyber security incident, NTCA conducted a prompt and thorough investigation. We have no evidence that any NTCA member data, networks or systems are at risk, however some processes used to administer benefits have been affected. While we are still assessing the situation, we have identified some processes related to administering Long-Term and Short-Term Disability, medical and dental benefits have been affected, and we are addressing these to minimize impacts on our members and participants.

What We are Doing

NTCA will begin notifying GHP participants enrolled in Long-Term and Short-Term Disability plans that they will receive their benefit payments from NTCA directly, instead of through the standard process, until further notice.  NTCA staff will contact affected disabled participants directly.

We are also monitoring other claims-related processes, including the delivery of payments to medical and dental providers, reimbursements to participants and Explanations of Benefits statements, which may be delayed. We will work with our vendor partners to address this as needed in the coming days and share more information as it becomes available.

For More Information

We remain fully committed to minimizing the impact of this incident on our members and participants. If you have any questions regarding this incident, please contact our Benefits Resource Unit Monday through Friday from 9 a.m. to 7 p.m. ET at (828) 281-9000.