Following the massive cyberattack on UnitedHealth Group’s Change Healthcare unit last year, the company launched a temporary funding assistance program to help medical practices with their short-term cash flow needs, offering no-interest loans with no added fees.

A little over a year later, UnitedHealth is aggressively going after borrowers, demanding they “immediately repay” their outstanding balances, according to documents viewed by CNBC and providers who received funding. Some groups have been asked to repay hundreds of thousands of dollars in a matter of days. 

Optum, UnitedHealth’s financial, pharmacy and care services arm, is telling borrowers that it reserves the right to “begin offsetting claims payable” to the practices, meaning the company will withhold separate funds until it recoups the loan.

It’s a significant change in posture for the company, which suffered a cyberattack in February 2024 that compromised data from around 190 million Americans, the largest reported health-care breach in U.S. history. The ensuing disruption caused severe fallout across the health-care system, leaving many providers temporarily unable to get paid for their services. Some dipped into their personal savings to keep their practices afloat.

During a Senate hearing about the attack in May, UnitedHealth CEO Andrew Witty said providers would only be required to repay the loans when “they, not me, but they confirm that their cash flow is normalized.”

Several doctors who took advantage of the financing told CNBC that they can’t meet the company’s new demands. Dr. Christine Meyer, an internist who started a practice in Exton, Pennsylvania, received a letter from Optum earlier this month telling her to immediately submit her organization’s payment. 

“We are not in any position to start repaying this loan,” Meyer, who started her practice about 20 years ago, told CNBC. She has been a vocal critic of UnitedHealth following the breach.

“I’m just looking at all my legal options at this point,” Meyer said. “But repaying them $750,000 in five days is obviously not going to happen.”

UnitedHealth didn’t comment on specific cases, but a spokesperson for Change Healthcare confirmed that the company has started recouping the loans.

“Now, more than one year post the event and with services restored, we have begun the process of recouping the interest-free funding we provided to providers,” the spokesperson said in a statement.

The company said the U.S. Department of Health and Human Services took the same approach last year “under its own cyber-attack lending program.” HHS launched a separate funding assistance program through the Centers for Medicare & Medicaid Services last March. CMS said it would automatically recoup payments from Medicare claims, and providers could accrue interest, according to a release.

“We continue to work with providers on repayment and other options, and continue to reach out to those providers that have not been responsive to previous calls or email requests for more information,” the Change Healthcare spokesperson said.

Providers were told that UnitedHealth reserved the right to withhold future payments when they signed up for the funding assistance program, the company added. CNBC independently reviewed a copy of a loan agreement for the program and confirmed this statement.

Change Healthcare, which offers payment and revenue cycle management tools, was acquired by Optum in 2022.

After discovering the breach last year, UnitedHealth said it isolated and disconnected the impacted systems. The company paid out more than $9 billion to providers in 2024, and more than $4.5 billion has already been repaid, according to the company’s fourth-quarter earnings report in January. UnitedHealth said providers would receive an invoice once standard payment operations resumed, and that they would be subject to a repayment period of 45 business days. 

“Change Healthcare will notify the recipient that the funding amount is due after claims processing or payment processing services have resumed and payments impacted during the service disruption period are processed,” the website says. 

While the vast majority of Change Healthcare’s services have been restored over the course of the last year, three products are still listed as “partial service available,” according to UnitedHealth’s cyberattack response website.

And doctors are still reeling. 

Meyer said that when the breach took place, she watched her practice’s daily deposits shrivel from the range of $60,000 to $80,000 to about $150 “overnight.” She applied for Optum’s temporary funding assistance program, and after some difficulty and back and forth with the company, she ultimately received a total of $756,900 in financial assistance.

Former Senator Bob Casey Jr., D-Pa., shared Meyer’s story during the congressional hearing in May. He asked Witty about the company’s approach to the repayment process. 

“I’d like to absolutely confirm to you and Dr. Meyer that we have no intention of asking for loan repayment until after she determines that her business is back to normal,” Witty told lawmakers. “Even then, we would not look for repayment until 45 business days – 60 calendar days – after that and there would be no interest and no fee associated with that loan.”

“So it would be a determination she makes?” Casey asked.

“That’s absolutely right,” Witty said. 

Meyer said that’s not what happened. 

She received a notice from Optum on Jan. 24, which was viewed by CNBC, that requested repayment since “the service disruption has ended for most clients.” Meyer said she called and told the company she was “not in any position to pay.” 

Meyer claims that her practice lost more than $1 million in revenue due to the Change Healthcare cyberattack. She told CNBC the figure was based on a forensic financial analysis her practice carried out by comparing its charges against payments over recent years. The $1.2 million figure accounts for losses across all its insurers, not just UnitedHealthcare, Meyer said.

On April 1, Meyer received another notice requesting immediate repayment within five business days. The letter was addressed to Meyer. But the name of the practice on the letter, Insight Counseling, as well as the total amount due, $925,200, were incorrect. 

Meyer said she called Optum again and was told the company made a mistake, but that she had five days to repay her actual total of $750,000. At that point, the company would start withholding her UnitedHealthcare payments, which she described as a “shakedown.”

Meyer said her practice typically receives annual claims payments of about $150,000 to $200,000 from UnitedHealthcare.

“I guess I’ll just let them take those payments back for the next three years until they get their money back,” she told CNBC.

In a post on LinkedIn on Thursday, Meyer wrote that she and her team “made a plan to leave the least amount of money in the account set up to receive payments from UnitedHealthcare. If it isn’t there, they can’t get it.”

WATCH: Health and Human Services Department opens probe into hack at UnitedHealth’s Change Healthcare

Technology stocks were on pace for a winning week Friday on the heels of a volatile stretch spurred by ongoing tariff uncertainty and economic fears.

The Nasdaq Composite has jumped nearly 6% this week despite a wild few sessions and is on pace for its best week since November. The index was up nearly 2% Friday.

Megacap technology stocks have bounced this week despite the recent turbulence.

Nvidia has led the way with a more than 16% gain so far and is headed for its best week since September. Amazon is up more than 5%, while Alphabet, Microsoft and Meta Platforms have jumped more than 6%. Tesla shares are up 3% and notched their best session since 2013 Wednesday. Apple is up more than 7% and notched its best day since 1998 during Wednesday’s session.

Other technology stocks have also joined in on the week-to-date rally. Palantir is up more than 17%, while Fortinet and Applovin have jumped at least 11%. Oracle and Salesforce have added about 2% and 4%, respectively.