On February 21, 2024, Change Healthcare, a UnitedHealth Group company that processes a large share of U.S. health care claims, disclosed a cyberattack that disrupted claims, payments, eligibility checks and other services for weeks. HHS's Office for Civil Rights opened an investigation, and UnitedHealth later said about 190 million people were affected by the data breach. For physical therapy practices, it showed how dependent cash flow and data were on third-party vendors, and why resilience planning belongs in practice strategy.
Most physical therapy practices never think about claims clearinghouses. Claims go out, payments come in and the billing team or vendor handles the details. The systems in the middle are invisible until they stop working.
In February 2024, they stopped working. Change Healthcare, a UnitedHealth Group company that handles a large share of health care transactions in the United States, disclosed a cyberattack. Claims, payments, eligibility checks and related services were disrupted for weeks, and the effects reached practices that did not even know they used Change Healthcare.
This retrospective covers what happened, why it hit physical therapy practices hard and what resilience looks like for marketing and operations today. This is marketing guidance, not legal advice. It is not financial advice either. For our broader approach, see physical therapy marketing.
What actually happened in 2024
The attack. On February 21, 2024, Change Healthcare disclosed a cyberattack and disconnected many of its systems. Change Healthcare processes medical claims, payments and other transactions for a large share of U.S. providers and payers.
The disruption. Providers that relied on Change Healthcare, directly or through billing vendors and practice management systems, faced delays in submitting claims, verifying eligibility and receiving payments. Some practices went weeks without normal reimbursement while they switched clearinghouses or waited for systems to return.
The response. HHS’s Office for Civil Rights opened an investigation in March 2024 and published a frequently asked questions page about the incident and breach notification responsibilities. CMS announced temporary flexibilities, including accelerated and advance payments for some Medicare providers, and UnitedHealth offered temporary funding assistance to affected providers.
The scale. UnitedHealth later said the breach affected about 190 million people, according to its Change Healthcare updates and public reporting. That made it one of the largest health data breaches reported in the United States.
The lesson for the industry. The attack showed how concentrated parts of health care infrastructure had become. A problem at one company affected hospitals, pharmacies, physician offices and therapy practices nationwide.
Why it mattered for physical therapy practices
Physical therapy practices often operate on narrow margins. Reimbursement rates are under pressure, visits are frequent and payroll is a large share of costs. A few weeks of delayed payments can strain even a well-run practice. Some owners used personal funds, lines of credit or emergency assistance to cover payroll while claims were stuck.
That strain reached marketing quickly. When cash is tight, marketing budgets are often the first thing cut. Practices that paused advertising, search work or patient outreach during the disruption sometimes lost momentum that took months to rebuild. The cut made sense in the moment, but it shows why financial resilience and marketing are connected.
The breach also raised trust questions. Patients heard about a massive health data breach in the news. Some asked whether their own information was involved. Practices needed to answer clearly and accurately, without speculating, which required knowing which vendors handled their data.
What typical agencies did
Most marketing agencies treated the attack as a billing problem, not their concern. When clients cut budgets, agencies paused campaigns without a plan for restarting or for protecting the most valuable channels.
Few agencies helped practices communicate with patients about the news, and almost none helped practices think about how a more diverse revenue mix, including cash-pay services, could reduce exposure to future disruptions.
Very few agencies reviewed their own role as a vendor handling practice data, such as patient contact lists and form submissions.
What it means for a physical therapy practice today
Resilience is a growth strategy. Here is how we think about it with practices.
1. Know your critical vendors
List the systems that handle claims, payments, scheduling, records and patient communication. Know who to call and what the backup plan is for each.
2. Protect the core marketing channels
If budgets must shrink, keep the channels that bring ready-to-book patients, such as local search and referral relationships, rather than cutting everything evenly.
3. Build a cash reserve plan
Work with your financial advisors on reserves or credit options that could cover a payment disruption without halting operations.
4. Diversify revenue thoughtfully
Consider cash-pay services such as wellness programs, performance training or specialty care where they fit your practice and rules. See our notes on cash-pay physical therapy.
5. Prepare patient communication
Have a calm, accurate template ready for questions about breaches or disruptions, reviewed by qualified advisors.
6. Review data shared with marketing
Make sure marketing tools and agencies receive only the data they need, with appropriate agreements and security.
Why marketing should not stop in a crisis
When a practice faces a cash crunch, cutting marketing feels responsible. Sometimes it is necessary. But marketing that drives new patient visits is not optional spending in the same way as, say, a new office decoration. If it stops completely, the patient pipeline empties, and when the crisis passes the practice has fewer patients and less momentum.
A better approach is to prioritize. Keep the activities that bring patients who are ready to book, such as a well-maintained Google Business Profile, steady review requests, physician and community referral relationships and a website that converts. Pause or reduce experimental campaigns and brand awareness efforts. That preserves the core while saving money.
It also helps to know which channels actually produce patients. A practice that tracks new patient sources can make these decisions with confidence. A practice that does not is guessing.
The trust question
Large breaches make patients nervous. In 2024, many patients heard about Change Healthcare and wondered whether their information was exposed. Physical therapy practices, which see patients frequently and build close relationships, were often the first place patients asked.
The right response is honest and specific. If the practice knows whether its patients were affected, it can say so, following notification obligations and advice. If it does not know, it can explain what it is doing to find out and where patients can get official information. Speculating or downplaying the issue can damage trust more than the breach itself.
Over time, a practice’s own data habits become part of its reputation. Secure forms, careful handling of contact information and clear privacy practices all signal that the practice takes patient information seriously.
Revenue mix and independence
The Change Healthcare disruption was one of several pressures on insurance-based physical therapy in recent years. Reimbursement changes, prior authorization requirements and administrative costs have pushed many practice owners to think about how much of their revenue depends on payers and the systems that connect to them.
Some practices responded by adding cash-pay services that fit their expertise, such as sports performance programs, post-rehab strength training, pelvic health programs or wellness memberships. Others focused on improving retention and plan-of-care completion. Either path changes the marketing mix. Cash-pay services need clear value, transparent pricing and different messaging than insurance-based care.
Any shift should be planned with qualified financial and legal advice, especially where payer contracts and state rules are involved.
Referral relationships as a steady channel
For many physical therapy practices, physician and community referrals are the most reliable source of new patients. They also tend to hold up during disruptions, because they rest on relationships rather than ad budgets. A practice that keeps in regular contact with referring physicians, athletic trainers, chiropractors and fitness professionals has a steady flow of patients even when other channels are paused.
Maintaining those relationships does not have to be expensive. Prompt progress updates, easy referral processes, clear information about specialties and occasional educational sessions keep a practice top of mind. During 2024, practices with strong referral networks often weathered the payment disruption with fewer gaps in their schedules.
Patient retention matters more in a squeeze
When new patient acquisition slows, the patients already on the schedule become even more important. Plan-of-care completion, reliable reminders and a good experience at every visit reduce drop-off. A patient who completes care is more likely to recover well, leave a positive review and refer others.
Simple steps help: clear explanations of the plan at the first visit, reminder messages, easy rescheduling and check-ins when a patient misses an appointment. These steps cost little and protect revenue that would otherwise slip away quietly.
Questions to ask every vendor
Vendor reviews do not need to be complicated. For each system that touches patient data or payments, ask a few questions. What happens if this vendor goes offline for a week? Is there a backup option, and how long would it take to switch? What data does the vendor hold, and how is it protected? Who at the practice is responsible for the relationship?
Write the answers down and keep them with your emergency plans. When a disruption happens, the team will know where to start instead of searching through contracts and passwords under pressure.
Running a tabletop exercise
Once a year, gather the owner, office manager and billing lead for an hour and walk through a scenario: the clearinghouse is down for three weeks. Who notices first? How does the team find out which claims are stuck? Which payments are delayed, and how long can payroll be covered? Which marketing activities continue and which pause? What do front desk staff tell patients who ask?
The exercise usually reveals small gaps, such as a missing vendor contact, an outdated password list or no clear owner for patient communication. Fixing those gaps takes little time and makes the next real disruption far less stressful.
What 2024 does not tell us
We do not have reliable public data on how many physical therapy practices were affected by the disruption or how much revenue they lost. Investigations, lawsuits and notifications continued after 2024, and some details may have changed as more information was released. Check official sources for the latest. What 2024 does show is that a single vendor failure can affect cash flow, operations and patient trust across the entire health system.
The premium practice advantage
A premium physical therapy practice is resilient. It knows where its patients come from, protects the channels that matter, handles data carefully and communicates honestly when something goes wrong.
That is how we build marketing for physical therapy: steady patient flow from Google Maps and AI search visibility, clear tracking of new patient sources and careful data handling. See our services and who we help, including physical therapy practices. Our team works from Austin with practices nationwide.
The bottom line
The February 2024 Change Healthcare cyberattack disrupted claims and payments nationwide and became one of the largest health data breaches on record. For physical therapy practices, it exposed how dependent cash flow and data were on vendors. Resilient practices know their vendors, protect core marketing channels, diversify thoughtfully and communicate honestly. This is marketing guidance, not legal advice. Please work with qualified financial advisors on reserves and revenue decisions.
Check if your market is open. We take one practice per specialty per market. Request a market check or call (716) 400-0084.
Frequently asked questions
What happened to Change Healthcare in 2024?
Change Healthcare, part of UnitedHealth Group, disclosed on February 21, 2024 that it had experienced a cyberattack. Many of its systems were taken offline, disrupting claims processing, payments and related services for health care providers across the country.
How did it affect physical therapy practices?
Many practices that relied on Change Healthcare, directly or through a billing vendor, could not submit claims or receive payments normally for weeks. That created cash flow pressure, especially for smaller practices with thin margins.
How many people were affected by the breach?
UnitedHealth later said the breach affected about 190 million people, making it one of the largest health data breaches reported in the United States.
Did the government respond?
Yes. HHS's Office for Civil Rights opened an investigation and published guidance for covered entities. CMS announced temporary payment flexibilities for affected Medicare providers, and UnitedHealth offered temporary funding assistance.
What does this have to do with marketing?
Marketing depends on cash flow, patient trust and data. A disruption that freezes payments can force a practice to cut marketing at the worst time, and a breach involving a vendor can affect patient trust. Resilience protects growth.
Should a practice shift toward cash-pay services?
Many physical therapy practices consider a mix of insurance and cash-pay services for several reasons. Diversifying revenue can reduce dependence on any single payer or vendor, but it should be planned carefully. This is marketing guidance, not legal or financial advice.