MV TELEGRAPH

UnitedHealth CEO Andrew Witty testifies before the Senate Finance Committee on Capitol Hill in Washington, May 1, 2024.

Kent Nishimura | Getty Images

Following the massive cyberattack on UnitedHealth Group’s Change Healthcare unit last year, the company launched a temporary funding assistance program to help medical practices with their short-term cash flow needs, offering no-interest loans with no added fees.

A little over a year later, UnitedHealth is aggressively going after borrowers, demanding they “immediately repay” their outstanding balances, according to documents viewed by CNBC and providers who received funding. Some groups have been asked to repay hundreds of thousands of dollars in a matter of days. 

Optum, UnitedHealth’s financial, pharmacy and care services arm, is telling borrowers that it reserves the right to “begin offsetting claims payable” to the practices, meaning the company will withhold separate funds until it recoups the loan.

It’s a significant change in posture for the company, which suffered a cyberattack in February 2024 that compromised data from around 190 million Americans, the largest reported health-care breach in U.S. history. The ensuing disruption caused severe fallout across the health-care system, leaving many providers temporarily unable to get paid for their services. Some dipped into their personal savings to keep their practices afloat.

During a Senate hearing about the attack in May, UnitedHealth CEO Andrew Witty said providers would only be required to repay the loans when “they, not me, but they confirm that their cash flow is normalized.”

Several doctors who took advantage of the financing told CNBC that they can’t meet the company’s new demands. Dr. Christine Meyer, an internist who started a practice in Exton, Pennsylvania, received a letter from Optum earlier this month telling her to immediately submit her organization’s payment. 

“We are not in any position to start repaying this loan,” Meyer, who started her practice about 20 years ago, told CNBC. She has been a vocal critic of UnitedHealth following the breach.

“I’m just looking at all my legal options at this point,” Meyer said. “But repaying them $750,000 in five days is obviously not going to happen.”

UnitedHealth didn’t comment on specific cases, but a spokesperson for Change Healthcare confirmed that the company has started recouping the loans.

“Now, more than one year post the event and with services restored, we have begun the process of recouping the interest-free funding we provided to providers,” the spokesperson said in a statement.

The company said the U.S. Department of Health and Human Services took the same approach last year “under its own cyber-attack lending program.” HHS launched a separate funding assistance program through the Centers for Medicare & Medicaid Services last March. CMS said it would automatically recoup payments from Medicare claims, and providers could accrue interest, according to a release.

“We continue to work with providers on repayment and other options, and continue to reach out to those providers that have not been responsive to previous calls or email requests for more information,” the Change Healthcare spokesperson said.

Providers were told that UnitedHealth reserved the right to withhold future payments when they signed up for the funding assistance program, the company added. CNBC independently reviewed a copy of a loan agreement for the program and confirmed this statement.

Change Healthcare, which offers payment and revenue cycle management tools, was acquired by Optum in 2022.

After discovering the breach last year, UnitedHealth said it isolated and disconnected the impacted systems. The company paid out more than $9 billion to providers in 2024, and more than $4.5 billion has already been repaid, according to the company’s fourth-quarter earnings report in January. UnitedHealth said providers would receive an invoice once standard payment operations resumed, and that they would be subject to a repayment period of 45 business days. 

“Change Healthcare will notify the recipient that the funding amount is due after claims processing or payment processing services have resumed and payments impacted during the service disruption period are processed,” the website says. 

Dwindling deposits, lost revenue

While the vast majority of Change Healthcare’s services have been restored over the course of the last year, three products are still listed as “partial service available,” according to UnitedHealth’s cyberattack response website.

And doctors are still reeling. 

Meyer said that when the breach took place, she watched her practice’s daily deposits shrivel from the range of $60,000 to $80,000 to about $150 “overnight.” She applied for Optum’s temporary funding assistance program, and after some difficulty and back and forth with the company, she ultimately received a total of $756,900 in financial assistance.

Former Senator Bob Casey Jr., D-Pa., shared Meyer’s story during the congressional hearing in May. He asked Witty about the company’s approach to the repayment process. 

“I’d like to absolutely confirm to you and Dr. Meyer that we have no intention of asking for loan repayment until after she determines that her business is back to normal,” Witty told lawmakers. “Even then, we would not look for repayment until 45 business days – 60 calendar days – after that and there would be no interest and no fee associated with that loan.”

“So it would be a determination she makes?” Casey asked.

“That’s absolutely right,” Witty said. 

Meyer said that’s not what happened. 

UnitedHealth Group Inc. headquarters stands in Minnetonka, Minnesota, U.S.

Mike Bradley | Bloomberg | Getty Images

She received a notice from Optum on Jan. 24, which was viewed by CNBC, that requested repayment since “the service disruption has ended for most clients.” Meyer said she called and told the company she was “not in any position to pay.” 

Meyer claims that her practice lost more than $1 million in revenue due to the Change Healthcare cyberattack. She told CNBC the figure was based on a forensic financial analysis her practice carried out by comparing its charges against payments over recent years. The $1.2 million figure accounts for losses across all its insurers, not just UnitedHealthcare, Meyer said.

On April 1, Meyer received another notice requesting immediate repayment within five business days. The letter was addressed to Meyer. But the name of the practice on the letter, Insight Counseling, as well as the total amount due, $925,200, were incorrect. 

Meyer said she called Optum again and was told the company made a mistake, but that she had five days to repay her actual total of $750,000. At that point, the company would start withholding her UnitedHealthcare payments, which she described as a “shakedown.”

Meyer said her practice typically receives annual claims payments of about $150,000 to $200,000 from UnitedHealthcare.

“I guess I’ll just let them take those payments back for the next three years until they get their money back,” she told CNBC.

In a post on LinkedIn on Thursday, Meyer wrote that she and her team “made a plan to leave the least amount of money in the account set up to receive payments from UnitedHealthcare. If it isn’t there, they can’t get it.”

‘Very frustrating experience’

Dr. Purvi Parikh, an allergist and immunologist with a private practice in New York, shared a similar story.

Parikh’s practice received about $440,000 in funding assistance after the breach. She said she started getting repayment notices late last year, and that Optum was threatening to offset claims payable to the practice.

“We were already hit very hard by the Change Healthcare hack,” Parikh said in an interview. “Now on top of that, they’re asking for all of this money back or they’re going to hold future payments ransom. It’s just been a very frustrating experience dealing with Optum.”

Parikh’s practice requested a one-month extension on its final payment of $101,650 in January to try and keep UnitedHealth from withholding other payments. In the email request, Parikh’s colleague wrote that “it has been quite difficult to recover financially.”

Optum granted Parikh’s practice the extension.

“People don’t just have that amount of money just sitting around,” Parikh said. “We’ve paid everything back, but it wasn’t without hardship.” 

On Friday, the American Medical Association sent a letter to Optum urging the company not to use a “one-size-fits-all” approach to loan repayment. The AMA also asked Optum to honor its commitment to allow physicians to decide when to begin the repayment process.

“Each practice will have distinct levels of patient volumes, revenue generation, and cost pressures and needs a repayment plan that does not recreate the same dire financial straits experienced during the cyberattack when CHC’s systems were non-functional,” AMA CEO Dr. James Madara wrote.

A physician who runs a pediatric practice in New Jersey said UnitedHealth has already started withholding payments from the organization. The practice received more than $500,000 in funding assistance following the Change Healthcare breach. 

The doctor, who asked not to be named due to the sensitive nature of the situation, said the practice began receiving phone calls and emails from Optum requesting repayment beginning late last year. The group indicated that it didn’t have the money, but would set up a payment plan and had begun the process.

But the doctor said its billing department noticed that UnitedHealth had already started holding back claims payments. In its explanation of benefits, which details what an insurer will cover, there’s a line that reads: “The amount payable on this statement has been used to repay amounts owed under your agreement with Change Healthcare Operations, LLC.”

WATCH: Health and Human Services Department opens probe into hack at UnitedHealth’s Change Healthcare

An aerial of the Centers for Medicare & Medicaid Services building on March 19, 2025 in Woodlawn, Maryland. 

Kayla Bartkowski | Getty Images

The Centers for Medicare & Medicaid Services has slashed jobs from its minority health office and other divisions, CNBC has learned, as Robert F. Kennedy Jr. upends the U.S. health department. 

During a virtual all-hands meeting with employees on Friday, CMS acting Administrator Stephanie Carlton detailed some of the specific offices at the agency impacted by cuts under Kennedy’s broader plan to restructure the Department of Health and Human Services, or HHS.

CNBC viewed a transcript of the internal meeting, which was the first at CMS since HHS employees began to receive notifications Tuesday about whether they had lost their jobs as part of the cuts.

Kennedy’s plan involves slashing 10,000 jobs at HHS, including just 300 at CMS but far greater numbers at other agencies. CMS oversees health insurance programs for 160 million Americans, along with other vital healthcare functions — and the Trump administration has tried to downplay the effects its cuts to government spending will have on the popular Medicare program.

But Kennedy said Thursday that some personnel and programs at different federal agencies affected by his sweeping reductions will be reinstated “because we’ll make mistakes.”

Carlton on Friday did not indicate whether any CMS employees will get reinstated, but said “we do think that painful part of [the cuts] that affects people we care about is finished.” 

“I don’t want to make promises that nothing will ever happen, but these are definitely the ones I’m aware of,” she told workers, referring to the cuts at the agency. She said the layoffs were not easy, but emphasized that CMS leadership had to balance the agency’s mission with achieving efficiency across HHS. 

She added that Dr. Mehmet Oz’s paperwork should be completed later on Friday, a day after he was confirmed by the Senate to run CMS. Oz, a celebrity TV host and former U.S. Senate candidate, would like to hold another all-hands call on Monday, Carlton said. Once called “America’s Doctor,” Oz is now more known for dubious promotion of supplements and hormones unsupported by scientific evidence.

The job cuts across HHS are in addition to about 10,000 employees who opted to leave the department since President Donald Trump took office, through voluntary separation offers. Combined, they will lead to the federal health department shedding about a quarter of its workforce, shrinking it to 62,000 employees.

Kennedy’s restructuring comes as the U.S. grapples with one of the worst measles outbreaks in more than two decades, and as bird flu spreads in wild birds worldwide and is causing outbreaks in poultry and U.S. dairy cows, with several recent human cases. The U.S. Food and Drug Administration is suspending efforts to improve its bird flu testing of milk, cheese and pet food due to massive staff cuts at the agency, Reuters reported on Thursday.

CMS did not immediately respond to a request for comment.

The programs cut at CMS

She said the office of minority health was affected by the cuts. The segment works with local and federal partners to eliminate health disparities and improve health outcomes for people from all minority populations, according to the CMS website. It conducts research and analyses to develop new solutions for lowering costs, preventing diseases and reducing the incidence and severity of chronic diseases in the U.S. 

The office was authorized by the Affordable Care Act more than a decade ago, so shuttering it entirely may be against the law. It appears to be among the victims of the Trump administration’s ideological campaign against diversity, equity and inclusion, or DEI, initiatives.

CMS understands that it needs to continue fulfilling the responsibilities of that office under statutory law, Carlton noted. She said CMS will appoint a new office of minority health director.

But she did not explicitly say whether the current director of the office, Dr. Martin Mendoza, had stepped down or was impacted by the cuts. Mendoza has not resigned from his role, an HHS employee, who requested anonymity to speak freely about the matter, told CNBC.

But “probably the biggest group that was affected” was the Office of Program Operations & Local Engagement, Carlton said. That office is responsible for implementing and overseeing Medicare and Medicaid programs and engaging with stakeholders at the local level. Carlton said the cuts there tried to target areas where there were several divisions with a “similar mission.”

An office responsible for managing the agency’s grants and contracts was impacted, and so was the Medicare-Medicaid Coordination Office, Carlton added. The latter serves people dually eligible for Medicare and Medicaid, developing models to improve the coordination of care for them.

Some of that work will be picked up by others in CMS or from outside the agency, Carlton said. 

She noted that CMS will retain in-house teams that handle communication, human resources and information technology. The agency’s IT team was not affected at all “because of the sensitivity of many of our data sets,” Carlton said.