Please enable JavaScript.

Coggle requires JavaScript to display documents.

Change Healthcare Handles insurance and billing claims across the…

- - - - “Anyone with some decent critical thinking will understand what damage can be done with such intimate data on the affected clients of UnitedHealth/UnitedHealth solutions as well, beyond simple scamming/spamming,” the group said.
      - ALPHV/BlackCat said it exfiltrated the personal data and records of millions of individuals, to include:
      - Active US military/navy personnel PII
      - Patients PII including Phone numbers/addresses/SSN/emails/etc.
      - Medical and dental records
      - Financial payment information
      - Insurance records and claims information
      - The cartel also claims to have stolen 3000+ source code files for Change Health solutions.
- - - - As part of the December operation, the FBI released a decrypter tool to help at least 500 victims restore their previously encrypted networks, saving them tens of millions in ransom payments.
      - Afterward, ALPHV threatened it would retaliate for the temporary takedown by extorting critical infrastructure providers and hospitals.
      - Although the FBI's short-lived tussle with the FBI put a dent in ALPHV’s operations, by January, the group appeared to have returned to “business as usual,” claiming numerous victims per day on its dark blog, including Canada's Trans-Northern Pipelines earlier this month.
- - - - “It is Exhibit A … that tough cybersecurity standards are necessary to protect critical infrastructure — and patients — in this country,” he said in opening remarks.
        
        “We are making a huge mistake by not having federal rules of the road on data privacy, data breach and how these enterprises have to really work on it,” said Sen. Tom Tillis, R-N.D.,
        who presented the committee with a copy of the
        Hacking for Dummies
        book to stress his point that UnitedHealth failed basic cybersecurity hygiene.
  - - - The attack and UnitedHealth’s snail’s-pace response prompted several actions by regulatory and compliance authorities.
      - HHS
      - The federal U.S. Department of Health and Human Services (HHS) responded first by publishing short-term steps to help care providers continue to serve patients amidst the claims processing disruptions. These included expediting changes in clearinghouse operations for Medicare and encouraging private insurers to remove or relax prior authorization requirements temporarily to ease the operational burden on providers. In its public communications, HHS outlined the interconnectedness of the health care ecosystem that the attack had laid bare and expressed the urgent need for better cyber resilience across the industry, i.e., the ability to both defend against cyberattacks and to recovery swiftly from ones that do succeed, as specified by President Biden’s 2023 National Cybersecurity Strategy.
      - Medicare and Medicaid
      - The federal U.S. Centers for Medicare and Medicaid (CMS) responded by implementing specific flexibilities for the duration of the outage, allowing Medicare providers to use alternate clearinghouses for claims processing, and asking Medicare Advantage and Part D sponsors to relax preauthorization requirements for claims.
      - Federal executive branch
      - Biden administration officials met with UnitedHealth CEO Andrew Witty in March 2024, urging him to address the disruptions caused by the attack and to provide emergency financial support for providers affected by the ongoing outage.
      - Federal lawmakers
      - The U.S. House of Representatives’ Energy and Commerce Committee summoned Witty to testify before its Subcommittee on Oversight and Investigation in May 2024. On the same day, Witty faced similar scrutiny from the U.S. Senate’s Finance Committee. In testimony, Witty conceded that lack of multifactor authentication may have contributed to the success of the attack, publicly apologized to affected providers and patients, and admitted that his company still didn’t know how much and what kind of data had been compromised. Some senators suggested that UnitedHealth’s massive size had contributed to its poor response to the attack and that perhaps it should be forced to divest some of its subsidiaries. UnitedHealth was already under investigation by the federal U.S. Justice Department over anti-trust concerns.
      - HIPAA regulators
      - Because the attack compromised PII and PHI, UnitedHealth is facing penalties under the Health Insurance Portability and Accountability Act (HIPAA). HIPAA requires entities to safeguard medical information, and violations can result in significant fines depending on the severity and extent of the breach.
      - FTC
      - The federal U.S. Federal Trade Commission may take action if it finds that UnitedHealth failed to adequately protect consumer data. The FTC often issues fines and demands corrective actions from companies that fail to protect consumer privacy.
      - State-level regulator
      - Several U.S. states may also impose their own penalties, notably under the California Consumer Privacy Act (CCPA), which levies hefty fines for privacy violations of California residents’ personal information.
      - Beyond these actions, UnitedHealth also faces other consequences, including private lawsuits and potential class-action lawsuits from affected individuals and groups that could result in costly settlements or court-ordered damages. Damage to its reputation could affect customer and partner trust, causing some of its many affiliates to switch to competitors. Regulators are likely to respond with more stringent oversight, imposing costly requirements for mandatory audits, increased reporting and enhanced security measures. The value of the company’s publicly-traded stock initially fell by 15% following news of the attack but has since rebounded somewhat.