Cyberattack on Universal Health Services in September cost $67M last year

 Universal Health Services ended the last year with a $308.7 million profit in the fourth quarter of 2020, it reported in its latest quarterly earnings.

The King of Prussia, Pennsylvania-based health system giant reported earnings of $3.06 per diluted share were up from $254.2 million, or $2.79 a share, during the fourth quarter of 2019. That income was on revenue of $3.1 billion in the fourth quarter of 2020, up 6.6% from $2.9 billion in the fourth quarter of 2019.

The health system's fourth-quarter results included a favorable impact from about $151.4 million, or $1.76 per diluted share, from an approximately $200 million federal relief grant. 

However, they also included a hit of $42.1 million, or 49 cents per diluted share, in the fourth quarter resulting from costs associated with a massive IT breach in September. The attack forced UHS to suspend access to all IT applications related to its operations in the U.S. as it realized on backup processes including offline documentation. Certain patient activity, including ambulance traffic and elective procedures at acute care hospitals, were diverted to competitor facilities, officials said.

They also incurred a "significant incremental labor expense, both internal and external, to restore information technology operations" as quickly as possible. Certain administrative functions such as coding and billing were delayed into December 2020, which had a negative impact on operating cash flows during the fourth quarter of 2020.

In all, the health system said the breach cost an estimated $67 million in pretax dollars in 2020, largely in the form of lost operating income from the related decrease in patient activity as well as increased revenue reserves associated with billing delays.

"Immediately after the incident, we worked diligently with our information technology security partners to restore our information technology infrastructure and business operations as quickly as possible," officials said in a statement. "In parallel, we began investigating the nature and potential impact of the security incident and engaged third-party information technology and forensic vendors to assist. No evidence of unauthorized access, copying or misuse of any patient or employee data has been identified to date."

UHS officials said they believe they are entitled to recover the majority of the financial impact resulting from the cyberattack through their commercial insurance coverage. 

UHS posted a $944 million profit, or $10.99 per diluted share, for the year ending Dec. 31, up from $814.9 million, or $9.13 per share, in 2019. That was on revenues of $11.6 billion in 2020, up 1.6% from $11.4 billion for full-year 2019.

The health system held its fourth-quarter and year-end earnings call Friday at 9 a.m. ET.

https://www.fiercehealthcare.com/hospitals/universal-health-services-tops-308m-profit-q4