When Change Healthcare went dark, a huge share of the country’s medical claims stopped moving overnight. If that happened again tomorrow, how many days of cash could your practice run on?
In early 2024, a cyberattack took down Change Healthcare, the clearinghouse that a large part of the industry’s claims and payments flow through. For weeks, practices could not submit claims or get paid through their usual pipeline. Many had no plan for it, because the pipeline had always just worked. When it stopped, their cash stopped with it. Some borrowed. Some struggled to make payroll. The outage did not care how good their billing was. It cut the line everyone depended on, all at once.
What the practice that survived had
One practice stayed cash-positive through the whole outage. It stayed up for a plain reason. It was not running on a single point of failure with no buffer. It already knew its cash position day to day. It already collected upfront where it could. It already was not financing its operations on the float of payer payments. So when the float disappeared, the practice did not fall over, because it was never leaning on the float in the first place.
None of that was built in anticipation of a cyberattack. It was simply how the practice ran. The resilience was a byproduct of operating tightly, which is what made it work against a threat nobody specifically saw coming.
Why most practices were exposed
The outage hurt so much because most practices run with no slack. Cash comes in on a delay, expenses go out on schedule, and the gap gets bridged by the quiet assumption that the payments will keep flowing. That assumption is invisible until the day it breaks. Change Healthcare was the day it broke, and it sorted practices into the ones that had a buffer and the ones that were running on a wing and a payer’s float.
The exposure was always there. The outage just made it visible. A practice that runs with thirty days of cash and one that runs with three look identical on a good month. They look very different the week the payments stop, and by then it is too late to build the buffer you needed.
The one number that tells you where you stand
There is a single figure that captures this, and most practices cannot say it off the top of their head: days of cash on hand. How many days could you cover payroll and fixed costs if no new money came in starting today. A practice that knows this number, and keeps it healthy, can ride out an interruption that puts a practice living check-to-check on the edge. The number is not hard to calculate. It is just rarely watched, because in normal months it feels academic. It stops feeling academic the moment the pipeline breaks.
Where resilience actually comes from
The practice that stayed up did not have a Change Healthcare plan. Nobody saw that specific attack coming. What it had was a way of operating that made the source of the crisis irrelevant. Daily cash visibility. Upfront collection. No dependence on payer float to cover payroll. None of that was built for a cyberattack. It was simply how the practice ran, and running that way meant it could absorb a shock it never specifically planned for. The resilience came from the daily discipline, not from a binder on a shelf.
This is why you cannot buy your way to resilience after the fact. By the time the crisis hits, the buffer either exists or it does not. The practices that did fine in 2024 were not smarter about that one attack. They were better run in the ordinary months before it, and the ordinary months are where the protection gets built.
What you build in the calm months
You cannot create a buffer during a crisis, but you can build one steadily when nothing is wrong. It comes from a few ordinary habits. Collect what you can upfront, at or before the visit, so less of your revenue depends on the payer pipeline clearing. Hold a cash reserve sized to your fixed costs, so a pause in payments is survivable rather than fatal. And watch your days of cash on hand the way you watch any other number, so you always know how much runway you have. None of these are dramatic. They are the quiet discipline that, on the worst day, turns out to have been the whole defense.
How operations that cannot stop are built
Every operation that cannot afford to stop builds in redundancy and reserves. Hospitals have backup generators. Factories hold safety stock. Airlines keep reserve aircraft. The principle is old: if a single failure can stop you, you build so that single failure cannot. Practices rarely apply it to their cash, because the cash always flowed, right up until it did not. Resilience is just this principle applied to the revenue cycle, holding enough buffer and enough visibility that no single broken link can take the whole thing down.
Found, fixed, and held
Found: the practices that survived had a buffer and daily visibility; the ones that struggled were running on float.
Fixed: knowing your cash position daily and collecting upfront, so you are not dependent on the pipeline staying perfect.
Held: the resilience is structural, so the next outage, whatever its source, is an inconvenience instead of a crisis.
What this means for you
You can stress-test yourself with one question. If your payer payments stopped for 30 days starting tomorrow, what would you do? If the honest answer is “borrow” or “I do not know,” you have found your exposure, and you found it on a calm day instead of a crisis one. The fix starts with knowing your days of cash on hand, and it builds from there.
Grab 30 minutes with us. Prep nothing. We will look at how many days your practice could run if the pipeline stopped, on your own numbers, and you will see where your exposure actually is.