Taking on Goliath: Brain surgeon’s clash with UnitedHealthcare shows insurer’s hardball tactics

Dr. Catherine Mazzola, a pediatric neurosurgeon, runs a practice in New Jersey that treats low-income children on Medicaid. Since 2008, she has cared for boys and girls with cerebral palsy, spina bifida and other neurological disorders. 

But now, her practice is in serious jeopardy, she says, because of recent moves by the insurance and health care giant UnitedHealth Group.

The story begins in February 2024, when a unit of UnitedHealth experienced a massive hack. The unit, Change Healthcare, shuttered its systems and halted all reimbursements owed to hospitals and doctors like Mazzola. 

To help providers stay afloat, Optum, another UnitedHealth subsidiary that includes a bank, began offering “temporary,” no-interest loans. Mazzola’s practice was among those tapping into the program — it received $535,000, documents show.

The practice began repaying the loans, but in January Optum demanded that it repay the money in full and within five business days.

“Our practice is doing the BEST we can,” Mazzola wrote in an email to Optum on Jan. 20. “Please ask the loan collection people to STOP. We are already in repayment at the maximum possible amount monthly.”

The situation soon got worse. In mid-February, she stopped receiving reimbursements from UnitedHealthcare. By April, her practice was out $78,000, her accountant’s records show, and was struggling to make payroll. 

Mazzola dug into the UnitedHealthcare claims and was shocked to find the insurer had drawn up reimbursement checks payable to her practice and then deposited those checks into its own bank account, records shared with NBC News show.

“They are trying to bankrupt our practice,” Mazzola said. “Now, we’re going to do brain surgery and instead of paying us, they’re going to take the money themselves.” 

Bryan Fisher, a spokesman for UnitedHealth Group, the conglomerate that owns the insurer, declined to comment on its actions related to Mazzola’s practice, New Jersey Pediatric Neuroscience Institute.  

Her case sheds light on something few patients know about: the behind-the-scenes battles doctors say they must wage with insurers over reimbursements and the increasingly aggressive tactics taken by huge payers like UnitedHealthcare. 

Her experience also gives credence, antitrust experts say, to concerns that UnitedHealth Group’s acquisitions of an array of health care operations in recent years have given it too much power over patients and the doctors treating them.

“You’ve got physicians looking out for hundreds and thousands of families, and you’ve got this big corporate entity exerting as much financial power as it can, just because it can,” said Josh Bengal, staff counsel at the Medical Society of New Jersey. “It’s upsetting.”

The hack in February 2024 affected 190 million patients, making it the largest ever involving medical data. UnitedHealth Group ultimately paid a $22 million ransom to the cybercriminals.

After the pause in reimbursements, many providers took out loans through Optum — over $9 billion was borrowed, according to company filings. 

Repayment terms on the loans were vague, with Mazzola’s contract noting only that her practice would have to repay the loan within 30 business days of receiving notice from UnitedHealth Group. 

But Mazzola and other doctors said they were assured by the congressional testimony of Andrew Witty, UnitedHealth Group’s former chief executive, who said in May 2024 that the company would seek repayment only when borrowers’ businesses were back to normal.

Even though Change Healthcare said it restarted claims processing about a month after the breach, doctors who spoke with NBC News said their operations continued to struggle long after, with some saying they are out millions as a result. Others were forced to close after being crippled by the loss of income. 

When Optum began demanding repayment of loans in January, it gave borrowers five business days, according to letters reviewed by NBC News. Those who didn’t meet the demands could have their UnitedHealthcare reimbursements withheld as repayment, the letters say.

Mazzola’s practice had promised to submit $10,000 a month until her $535,000 loan was repaid. It was all she could afford, she told Optum in emails reviewed by NBC News. 

Mazzola said an Optum executive told her by phone that her repayments weren’t enough. And in mid-February, UnitedHealthcare began intercepting reimbursements owed to Mazzola’s practice “to repay amounts owed under your agreement with Change Healthcare Operations LLC,” documents show.  

Upon further investigation, Mazzola learned the puzzling way UnitedHealthcare diverted the money — drawing up checks payable to Mazzola’s practice and then depositing them into a UnitedHealthcare bank account, the documents show.

“How can United Healthcare claw back money that we are due for surgeries and office visits?” Mazzola wrote to an Optum executive she had been dealing with. 

She received no response, but in April the company stopped seizing reimbursements from her practice after she complained to the American Medical Association.

It waded into the fight on April 11, when Dr. James Madara, the AMA’s chief executive, wrote to Roger Connor, the chief executive of Optum Insight, asking that the company stop its payment demands. 

“Physician practices are still suffering severe financial distress as a result of the cyberattack nearly 14 months after the breach was first discovered,” Madara wrote. “We want Optum to honor its commitment to wait to recover repayment for any loans until the physician determines that it is the appropriate time, because the physicians have relied on Optum’s statements.” 

In a statement, Optum said it is working with providers “to identify flexible repayment plans based on the individual circumstances of providers and their practices.”

“We have also worked with UnitedHealthcare to ensure the claims it receives are reviewed in light of the challenges providers experienced, including waiving timely filing requirements for the plans under its control,” it added.

Multiple lawyers interviewed by NBC News reviewed the loan agreement Mazzola’s practice signed and characterized it as a contract of adhesion — in which one party calls the shots and the other has little choice but to agree. The financial ruin Mazzola and other doctors faced because of the hack, an event caused by inadequate security at Change Healthcare, made the loans even more one-sided, some lawyers said. As a result, doctors may have legal recourse after the aggressive actions UnitedHealth Group took to extract loan repayments. 

The central question surrounding UnitedHealth Group’s reimbursement actions is “whether they abused their use of this remedy by insisting on repayment before it was appropriate for them to do so given the damages that they caused,” Daniel Schwarcz, a professor at the University of Minnesota law school, said in an email. 

Amid its clashes with doctors, UnitedHealth Group announced earnings of $9 billion from operations in the first quarter of 2025, a 15% jump from the same period last year. Revenue for the three months was $110 billion.

Even after Change Healthcare restarted claims processing, doctors who spoke with NBC News said they were never reimbursed for many claims because the disruption meant they couldn’t submit them within insurers’ required time periods. The doctors also said their costs increased after the hack because they had to pay staff members to chase reimbursements.

Mazzola, who estimates that her practice lost $1 million because of the hack, has asked Optum to reimburse her for costs her practice incurred as a result of the breach. But the terms Optum offered would have barred her from being able to sue it because of the hack. So she declined to accept it.

“I really believed that Optum, who was orchestrating these loans, would give physicians and physician groups a reasonable amount of time to repay the loans with the understanding that this financial crisis almost bankrupted us,” Mazzola said. “I mean literally, you’re talking about $0 in your bank account, and you have 70 employees to pay.” 

Doctors say they weren’t the only ones hurt by the hack. Patients, too, were harmed when providers didn’t have the reimbursement revenue needed to buy medicine, for example.

“There were a lot of delays of patient care as a result of it,” said Dr. Pruvi Parikh, an allergist and immunologist in New York City who is medical director of a practice with six locations in New York and 15 in New Jersey.

Parikh’s group borrowed $400,000 from Optum to survive the hack. By the end of 2024, it had repaid all but $102,000 of it, documents show.

On Jan. 7, Optum threatened to withhold reimbursements to Parikh’s practice if the rest of the loan wasn’t repaid in days, an email shows. 

“Coming up with that amount of money in five business days is not possible for the majority of private practices,” Parikh said in an interview. “Not only did they not give us time to get back on our feet, they were like, ‘Pay it now.'”

While the practice met Optum’s demand, she estimated it is out $2 million because of the hack.

In a statement, Change Healthcare said it started clawing back funding it had provided “more than one year post the event and with services restored.” The company said it is reaching out to those “that have not been responsive to previous calls or email requests for more information.”

The main reason doctors like Parikh and Mazzola are in this crucible, antitrust experts and physicians say, is that UnitedHealth Group operates so many cogs in the nation’s health care machinery. By acquiring an array of health care operations in recent years—including physician practices and pharmacy benefits management, technology, claims processing and financial services — UnitedHealth Group can exert market muscle over weaker participants like doctors and patients. 

Federal antitrust lawyers concerned about possible monopolistic activities have sued health care companies in recent years. In 2022, two years before the Change Healthcare hack, the Justice Department and the states of New York and Minnesota sued to stop UnitedHealth Group’s acquisition of the claims processor, saying it would reduce competition in health care insurance markets. 

Because Change Healthcare dominates the claims clearinghouse business, the government argued, its purchase by UnitedHealth Group would give the conglomerate information about how rivals’ insurance plans work, a competitive advantage. 

UnitedHealth disagreed, saying it had strong “firewalls” between units that would prevent sensitive data from being shared throughout the company. Optum, the subsidiary that now houses Change Healthcare, would protect external customers’ data from being shared with UnitedHealthcare or its affiliates if the deal went through, the company said.

That argument seemed to persuade the federal judge hearing the case in Washington, D.C., a Trump appointee. In his October 2022 decision greenlighting the $13 billion Change acquisition, U.S. District Judge Carl J. Nichols cited the company’s data-sharing firewalls as weighing “strongly against the government’s position.” 

Now, doctors say UnitedHealthcare’s diverting reimbursements to repay Optum loans shows the kind of data-sharing the government was concerned about.

Hayden Rooke-Ley is senior fellow for health care at the American Economic Liberties Project, a nonprofit, nonpartisan organization that works to curb monopolies. He said UnitedHealth Group’s seizure of doctors’ reimbursements is an example of what happens when a company coordinates among its different subsidiaries for its own purposes.

“These are the sorts of conflicts of interest we worry about when an insurance company also owns the payment pipes and a bank,” Rooke-Ley said in an interview.

Asked to respond to the criticism, Fisher of UnitedHealth Group declined. 

When it added Change Healthcare to its operations in late 2022, Optum said the combined companies would “benefit the entire health system, resulting in lower costs and a better experience for all stakeholders.” 

Parikh, the New York City allergist and immunologist, begs to differ. 

“It was a complete disaster, and to this day it’s not corrected,” she said of the hack. “But there hasn’t been any accountability to this goliath Optum.”