The Change Healthcare security breach is a clear indicator of some of the current vulnerabilities in a healthcare system that is increasingly reliant on Internet-based technology.
The widespread impacts of the security breach have led policymakers on both sides of the aisle to call for greater transparency and partnership with the federal government in helping mitigate the harm to patients and providers.
While UnitedHealth Group and Change Healthcare are in the spotlight, all healthcare companies should be prepared for increased scrutiny from policymakers and stakeholders as to their own preparedness, their responsibility in the aftermath of these types of incidents, and whether current consolidation within the industry poses too much risk.

On February 21, Change Healthcare, a company crucial to US healthcare billing and payment operations, suffered a severe cyberattack. The company's systems were shut down for an extended period, causing significant disruptions in patient care services nationwide. This incident affected the processing of provider claims and resulted in limited access to essential healthcare services, leaving many patients and their families distressed.

As the healthcare industry continues to evolve, it must adapt to new cybersecurity challenges by embracing innovation, collaboration, and resilience as critical pillars of a secure and reliable healthcare ecosystem. This cyberattack is a clear indicator of some of our current vulnerabilities. Policymakers and healthcare stakeholders must prioritize the development of public and corporate security policies to strengthen online security. Furthermore, it is critical to invest in creating better safeguards to prevent such attacks in the future.

UnitedHealth Group announced that eligibility processing, benefits verification capabilities, and pharmacy claims submission software would be restored last week, with additional products being restored over the next two weeks. Change Healthcare was expected to begin processing $14 billion in medical claims by the end of last week.

How can an attack on one company do so much damage?

The recent outage has raised serious concerns for the healthcare industry beyond the need for improved cybersecurity measures. It's alarming to think how a 35-day outage of a relatively unknown healthcare company can cause widespread disruption and put many patients at risk.

To put things into perspective, Change Healthcare processes around 50% of all medical claims and manages prior authorization requests and reimbursement processes. The impact of the outage cannot be overstated. According to Rep. Jamie Raskin's (D-Md.) office, Change Healthcare is connected to 90% of hospitals, 80% of health insurers, and over 67,000 pharmacies across the United States.

In fact, Change Healthcare handles $1.5 trillion in healthcare payments annually and is a central access point for a significant portion of the nation's healthcare dollars. The attack affected everything from hospital staff payrolls in California to physician reimbursements in Louisiana and medical labs and treatment centers in Massachusetts.

According to Modern Healthcare, this single piece of software from Change is linked to 17% of the American economy. For many healthcare providers across the country, the outage meant a complete stoppage in the flow of payments. The 15 billion healthcare transactions that Change processes annually directly affect over a third of all patient records.

Most health systems have between 60-100 days of operating cash, so even a delay in transactions for 30 to 60 days can have a catastrophic effect that may severely damage larger systems and force smaller ones to close.

How will policymakers respond?

Several healthcare trade associations, patient groups, and constituents have contacted members of Congress to express their concerns about how the recent outage affects patient care. The American Hospital Association and the American Medical Association have written letters to Congress requesting greater financial assistance from both the Federal Government and UnitedHealthcare as they continue to deal with the aftermath of the attack.

Rep. Raskin, the top Democrat on the House Oversight and Accountability Committee, has written a letter to UnitedHealthcare CEO Andrew Witty. In his letter, he asks for specific details of the attack, such as the systems impacted, the types of data affected, UnitedHealthcare's communication strategy with those affected, and how well it is coordinating its efforts with federal agencies.

Raskin has expressed concern that UnitedHealth Group is not providing enough information and is attempting to prevent the public from learning the true extent of the fallout from the attack. The letter states, “The committee is concerned that UnitedHealth Group is restricting the ability of federal agencies to provide applicable assistance to Change Healthcare.” Additionally, the Cybersecurity and Infrastructure Security Agency has reported to the committee that it is “handcuffed in this instance because of the lack of transparency and lack of information flowing into us.”

On Friday, Senate Intelligence Committee Chair Mark Warner (D-Va.), who also sits on the Finance Committee, introduced the first bill related to the Change Healthcare breach. Warner is calling for federal aid to be provided to providers affected by cyberattacks as long as they meet the cybersecurity standards set by the U.S. Department of Health and Human Services (HHS).

Senate Finance Committee Chair Ron Wyden has announced that he plans to call Witty as a witness for a hearing scheduled for April 30. Rep. Brett Guthrie (R-Ky.), who chairs the House Energy and Commerce Committee's health subcommittee, is also considering holding hearings and introducing legislation.

On March 13, the HHS Office of Civil Rights (OCR) launched its own investigation into the Change outage for potential HIPAA violations. “Given the unprecedented magnitude of this cyberattack, and in the best interest of patients and healthcare providers, OCR is investigating this incident. OCR's investigation of Change Healthcare and UHG will focus on whether a breach of protected health information occurred and Change Healthcare's and UHG's compliance with the HIPAA Rules.”

What healthcare companies should be bracing for in the months ahead.

As the aftermath of the Change Healthcare outage is investigated and debated, UnitedHealthcare will be in the spotlight. However, all healthcare data and payment companies should be ready to answer questions from policymakers and other stakeholders about their preparedness in handling a similar situation. For instance:

How secure are your company's cybersecurity systems? It's not just about having secure systems but also being prepared in case of a breach. No system is completely hack-proof, and how a company responds to a breach is just as important as how it prevents one.
In a catastrophic cyberattack, what responsibility does your company bear? It's not enough to just work on getting the system back online quickly. Companies must be transparent and work with government agencies, setting expectations and providing financial assistance protocols before legislators and regulators do it for them.
Should we allow a couple of healthcare companies to become so large that they become choke points that could severely damage our nation's healthcare system with one cyberattack? This is a question that policymakers and healthcare stakeholders will be asking, and it's one that larger healthcare companies should consider how they may answer. Building trust will be more critical than ever for these companies—and not just in the areas of high-quality service and state-of-the-art cyber security. Stakeholders will need to be able to trust that when outages occur like the one that happened last month, healthcare companies will be willing and transparent partners in assisting providers and patients while they fix the problem.

Policymaker Questions Persist as the Change Healthcare Outage Continues