Change Healthcare Notification

What happens now?

UnitedHealth Group recently revealed that its Change Healthcare unit experienced a significant data breach in February, exposing personal information for around one-third of the U.S. population. This breach occurred due to a ransomware attack by the Russian cybercriminal group BlackCat.

The compromised data includes sensitive details such as health insurance member IDs, patient diagnoses, treatment information, social security numbers, and billing codes. UnitedHealth discovered the breach when they noticed irregular activity on Change Healthcare's servers.

In response to the attack, UnitedHealth has decided to notify affected individuals starting in late July and will provide free credit monitoring services for two years to those impacted. The breach highlights the growing threat of cyberattacks on healthcare organizations, which store vast amounts of sensitive data.

UnitedHealth’s response involved working closely with cybersecurity experts to mitigate the damage and prevent further breaches. They also collaborated with law enforcement agencies to track down the perpetrators. Despite these efforts, the cybercriminals demanded a ransom of $22 million in Bitcoin, which UnitedHealth paid to recover the stolen data.

This incident underscores the critical need for robust cybersecurity measures in the healthcare sector. As healthcare organizations increasingly rely on digital systems, they must invest in advanced security protocols to protect patient information from sophisticated cyber threats. Regular security audits, employee training, and rapid incident response plans are essential to a comprehensive cybersecurity strategy.

What’s Next?

The American Medical Association has been deciding its next move. During its House of Delegates meeting this week, it weighed a resolution to explore a class action lawsuit against Change parent Optum, part of UnitedHealth Group. Another proposed resolution called for Congress to establish a “Cyber Security Relief Fund,” financed by insurers, to prevent future payment disruptions

Last month, UnitedHealth increased provider assistance to more than $6.5 billion to help physicians and other medical care providers through no-cost loans based on providers’ claims volume.

It will be interesting to see how healthcare provider organizations decide on their following actions.