“Given the unprecedented scale of this cyberattack and in the best interests of patients and healthcare providers, OCR has begun an investigation into this incident,” the HHS Office for Civil Rights said in a statement.
The federal government has investigated and penalized medical institutions for data breaches. Anthem paid a $16 million settlement in 2020 following a data breach in 2015 that exposed the protected health information of 79 million people. Industry leaders said the Feb. 21 attack on Change Healthcare, the nation's largest medical claims processing company, was the most significant incident of its kind in the history of the U.S. health care system. Hackers stole data about patients, encrypted company files, and demanded money to unlock them.
UnitedHealth said it would cooperate with the investigation.
“Our immediate focus is to restore our systems, protect our data, and support those whose data may have been affected,” the company said in a statement. “We are working with law enforcement to investigate the scope of the affected data.”
Medical organizations praised the federal investigation.
HHS is “doing the right thing by investigating the root cause and location of the impact of this significant hack, while healthcare providers can focus on getting back on track and ensuring patient care is not compromised.” said Chip Kahn, CEO of the National Federation. The hospital said in a statement:
Three weeks after the cyberattack, hospitals and doctors continue to warn that they are struggling to make payroll as many medical payments remain frozen, with lawmakers demanding more from UnitedHealth. We are requesting that measures be taken. The White House met with UnitedHealth CEO Andrew Whitty and other health care industry leaders on Tuesday to urge them to expedite payments to affected providers.
Sen. Maggie Hassan (D.N.H.) will help President Biden address the payments crisis during his visit to New Hampshire on Monday, according to three people familiar with the matter, who asked not to be identified discussing private conversations. He appealed. Hassan's office confirmed that the senator had spoken to the president about the issue, but did not provide further details.
In a letter his office shared with The Washington Post on Tuesday, Hassan told UnitedHealth that the state's rural hospitals have been hit hard by Change Healthcare's outages and that the company's financial situation has been affected. He said that the response continued to be insufficient.
“The Change Healthcare hack has wiped out nearly all of these hospitals' billings and cash flow, 98 percent, in the past few weeks,” Hassan wrote, adding that in order for the hospitals to continue providing patient care, ” “Urgent financial support is needed,” he added.
In the face of continued criticism, the insurance industry has defended its response. UnitedHealth last week laid out a timeline for bringing services back online, saying it plans to begin testing and rebuilding its claims network on March 18.
AHIP, the insurance industry's lobbying arm, said in a statement Tuesday that “health plans must take immediate and comprehensive measures to support health care providers and ensure continuity of patient care in response to cyberattacks.” “I took the necessary steps.”
But lawmakers and health care provider groups say the effort is not enough.
Despite UnitedHealth's assurances, “in a time when every minute counts, health care providers across the state have yet to report meaningful relief,” Connecticut's congressional delegation said Wednesday. A letter was sent to the Secretary of Health and Human Services. “We urge UHG to be held accountable and ensure that its response is appropriate.”
