The Change Healthcare Cyberattack: How Affected Practices Bridge the Cash-Flow Gap

The Change Healthcare cyberattack — the February 2024 ransomware breach of UnitedHealth Group's Optum/Change Healthcare clearinghouse — cut off claims submission, eligibility checks, and payment posting for a huge share of U.S. medical providers overnight, and the fastest way most affected practices covered the resulting cash-flow gap was short-term, revenue-based working capital repaid as receivables came back online. If your remittances stalled and you still had to make payroll, cover rent, and buy supplies, the core problem was never profitability — it was timing. This page explains what broke, why it hit provider bank accounts so hard, and how to bridge a claims-processing blackout using funding that approves on your deposit history rather than your credit score.

What the Change Healthcare cyberattack actually did to provider cash flow

Change Healthcare is one of the largest clearinghouses in U.S. healthcare — the plumbing that carries claims from a provider to a payer and carries the payment back. When the ALPHV/BlackCat ransomware group compromised its systems in February 2024, that pipe effectively closed for weeks. The direct clinical work never stopped; the money movement did.

For a typical practice, three things happened at once:

• Claims couldn't be submitted. Work you performed simply never entered the billing cycle, so there was nothing to get paid for later.
• Payments in flight stopped posting. Remittances (ERAs/EFTs) already owed to you were delayed or invisible.
• Eligibility and prior-auth checks stalled, slowing new visits and adding administrative drag.

The result was a receivables freeze. A practice can be perfectly healthy on paper — booked solid, collecting normally in a good month — and still be unable to make payroll because the deposits it counts on every week didn't land. That gap between work performed and cash received is exactly the gap short-term funding is built to close.

Why credit-first lenders were the wrong tool for this crisis

When a practice owner first hit this wall, the instinct was to call the bank. But a traditional term loan or SBA product is underwritten on tax returns, credit history, and a multi-week (sometimes multi-month) review. During a payment blackout, providers didn't have weeks — payroll was due Friday, not next quarter.

There's a second mismatch. Bank underwriting reads a snapshot of profitability. The Change Healthcare problem wasn't a profitability problem; it was a liquidity timing problem caused by an external system failure. A practice with strong, consistent bank deposits over the prior months had all the evidence it needed — just not in the format a credit-score-driven lender prioritizes.

That's why revenue-based funding fit the moment: it approves on the strength and consistency of your business bank deposits and overall revenue rather than leaning on your FICO. For a practice whose only weakness was a temporary, externally-caused receivables freeze, that underwriting logic matched the actual risk.

How revenue-based / MCA marketplace funding bridges a claims blackout

A revenue-based advance (often structured as a merchant cash advance, or MCA) is not a loan against your credit — it's funding advanced against your forward revenue, repaid as a small, agreed portion of your ongoing deposits. Through a marketplace, one application is shopped to multiple funders so you see competing offers instead of a single take-it-or-leave-it answer.

The fit for a payment-processing crisis is specific:

• Approval on bank deposits and revenue, not credit. Typical qualification starts around a 500+ FICO floor, with the real decision driven by your last several months of deposits.
• Speed measured in hours. Funding commonly lands in 24-48 hours after approval — the timeframe that actually matches a Friday payroll.
• Cash-flow-based repayment. Because repayment tracks a share of revenue, slower weeks pull smaller amounts. When your claims pipeline reopened and deposits normalized, the advance paid down naturally alongside recovering cash flow.
• Meaningful size. Advances generally start around $10,000 and scale with revenue, enough to cover real payroll cycles rather than a token amount.

No responsible funder should ever call approval "guaranteed" — offers depend on your actual deposit history. But for a solvent practice caught in a blackout, this is usually the fastest legitimate path to liquidity. See our MCA marketplace guide for how competing offers are structured, and our working capital for medical practices pillar for provider-specific considerations.

Decision framework: when a revenue-based advance fits — and when to avoid it

Fast money is not free money. Use this the way an underwriter would — as a fit test, not a reflex.

Works best when:

• Your practice was cash-flow healthy before the disruption and the gap is clearly timing-driven (delayed remittances, frozen claims), not a structural decline in patient volume.
• You have consistent business bank deposits over the last 3-6 months that demonstrate real, recurring revenue.
• You need funds inside a few days to protect payroll, rent, or supplier relationships that can't wait for a bank timeline.
• You have a credible line of sight to receivables recovering — claims resuming, backlog clearing, payers catching up.

Avoid or pause when:

• Your revenue was already declining before the attack — an advance would paper over a deeper problem and add a repayment obligation on top of it.
• You're tempted to stack multiple advances at once; layering obligations against the same deposits is how a timing fix turns into a debt trap.
• You qualify for and can wait on cheaper capital (an existing line of credit, a relief/advance program from your payer or clearinghouse) that covers the same gap.
• You can't articulate how and when deposits recover — if the bridge has no far bank, don't build it.

Example scenario: bridging a provider's payroll gap

The figures below are illustrative only — for example values to show mechanics, not quotes. Real offers depend entirely on your deposit history.

Notice what's absent: no exact payback total, no multiplier math. That's deliberate. The right question during a blackout isn't "what's the sticker total" in isolation — it's "can my recovering cash flow comfortably carry this repayment share while I get back to normal." A good funder walks you through that fit before you sign.

Steps to take now if your practice was hit

1. Quantify the gap, not the loss. Add up the specific obligations at risk in the next 2-4 weeks (payroll, rent, key suppliers). Fund the gap — resist over-borrowing.
2. Pull 3-6 months of business bank statements. This is the core of a revenue-based approval and the fastest thing you can have ready.
3. Exhaust cheaper bridges first. Check any payer/clearinghouse relief or advance program, existing lines of credit, and temporary payer accommodations before taking on new funding.
4. Apply to a marketplace, not a single funder. One application shopped to multiple funders gives you competing offers and better terms than a one-shot pitch.
5. Match repayment to recovery. Confirm the repayment share is one your normalizing deposits can carry, and get the terms in writing.
6. Plan the exit. Know the point at which claims and deposits are back to normal — that's when the advance should be resolved, not extended or stacked.