Hacking at UnitedHealth Unit Cripples a Swath of the US Health System: What to Know

Once your private medical information is entered into a computer, anyone who says they can keep it private it lying to you ...

KFF HEALTH NEWS – Early in the morning of Feb. 21, Change Healthcare, a company unknown to most Americans that plays a huge role in the U.S. health system, issued a brief statement saying some of its applications were “currently unavailable.”

By the afternoon, the company described the situation as a “cyber security” problem.

Since then, it has rapidly blossomed into a crisis.

The company, recently purchased by insurance giant UnitedHealth Group, reportedly suffered a cyberattack. The impact is wide and expected to grow. Change Healthcare’s business is maintaining health care’s pipelines — payments, requests for insurers to authorize care, and much more.

Those pipes handle a big load: Change says on its website, “Our cloud-based network supports 14 billion clinical, financial, and operational transactions annually.”

...article continued below
- Advertisement -

Initial media reports have focused on the impact on pharmacies, but techies say that’s understating the issue. The American Hospital Association says many of its members aren’t getting paid and that doctors can’t check whether patients have coverage for care.

But even that’s just a slice of the emergency: CommonWell, an institution that helps health providers share medical records, information critical to care, also relies on Change technology. The system contained records on 208 million individuals as of July 2023. Courtney Baker, CommonWell marketing manager, said the network “has been disabled out of an abundance of caution.”

“It’s small ripple pools that will get bigger and bigger over time, if it doesn’t get solved,” Saad Chaudhry, chief digital and information officer at Luminis Health, a hospital system in Maryland, told KFF Health News.

Here’s what to know about the hack:

Who Did It?

...article continued below
- Advertisement -

Media reports are fingering ALPHV, a notorious ransomware group also known as Blackcat, which has become the target of numerous law enforcement agencies worldwide. While UnitedHealth Group has said it is a “suspected nation-state associated” attack, some outside analysts dispute the linkage. The gang has previously been blamed for hacking casino companies MGM and Caesars, among many other targets.

The Department of Justice alleged in December, before the Change hack, that the group’s victims had already paid it hundreds of millions of dollars in ransoms.

Is This a New Problem?

Absolutely not. A study published in JAMA Health Forum in December 2022 found that the annual number of ransomware attacks against hospitals and other providers doubled from 2016 to 2021.

“It’s more of the same, man,” said Aaron Miri, the chief digital and information officer at Baptist Health in Jacksonville, Florida.

Because the assaults disable the target’s computer systems, providers have to shift to paper, slowing them down and making them vulnerable to missing information.

Further, a study published in May 2023 in JAMA Network Open examining the effects of an attack on a health system found that waiting times, median length of stay, and incidents of patients leaving against medical advice all increased — at neighboring emergency departments. The results, the authors wrote, mean cyberattacks “should be considered a regional disaster.”

Attacks have devastated rural hospitals, Miri said. And wherever health care providers are hit, patient safety issues follow.

What Does It Mean for Patients?

- Advertisement -
- Advertisement -
- Advertisement -


- Advertisement -
- Advertisement -