Change Healthcare Breach Lessons

In February 2024, a ransomware attack on Change Healthcare, a subsidiary of UnitedHealth Group, disrupted one of the largest healthcare payment processing networks in the United States. The incident affected prescription processing, prior authorizations, claims submission, and eligibility verification for provider offices across the country.

For small clinics, the attack was not a distant enterprise problem. It was a direct operational failure affecting practices that depended on Change Healthcare or its downstream network for daily billing and prior authorization tasks.

What happened

The attack began on February 21, 2024. Change Healthcare took its systems offline in response, causing immediate disruption to services that process an estimated one-third of all US healthcare transactions. Pharmacies could not verify insurance for prescriptions. Provider offices lost the ability to submit claims electronically or receive prior authorization responses.

HHS issued a statement on February 29, 2024 acknowledging the scope of the incident and directing its components, including OCR and the Centers for Medicare and Medicaid Services, to take steps to support affected providers. Post-incident reporting, including testimony before Congress, identified the absence of multi-factor authentication on certain remote access systems as a factor in the initial intrusion.

What HHS and OCR said

OCR published a Dear Colleague letter that was direct about covered entity obligations. The key points:

• Covered entities retain their HIPAA compliance responsibilities even when a business associate is the party that suffered the breach.
• If Change Healthcare could not complete breach notifications to affected individuals within the required timeframes, covered entities should consider whether they needed to send those notifications themselves.
• Covered entities should review their BAAs with Change Healthcare and any substitute vendors brought in during the outage to confirm that HIPAA-required provisions were in place.
• Incident response plans should specifically address what the clinic does when a critical BA goes offline.

OCR also clarified that it would exercise enforcement discretion in certain areas for providers significantly affected by the outage, but did not waive breach notification obligations.

What small clinics should take away

Single-vendor concentration is a compliance risk, not just a business risk. A clinic whose entire claims operation runs through one clearinghouse has no fallback if that clearinghouse is offline for days or weeks. The Change Healthcare outage lasted long enough that many clinics could not submit claims or receive reimbursement for an extended period. Incident response plans that do not address BA outages are incomplete.

BAAs must exist for every BA. Some clinics affected by the outage were using services connected to Change Healthcare indirectly through billing vendors. If a BA subcontracts to another entity that touches PHI, the subcontractor is also a BA and requires a BAA. Tracking this dependency chain is a basic requirement under 45 CFR 164.314.

MFA is not optional. HIPAA’s Security Rule does not mandate MFA by name, but the access control standard at 45 CFR 164.312(a)(2)(ii) requires entities to assign a unique user name to each user and establish controls for emergency access. Risk analysis must evaluate authentication controls. A risk analysis that concludes MFA is not required for remote access to PHI-bearing systems will face scrutiny after an incident.

Notification obligations stay with the covered entity. When a BA is breached, the covered entity does not get to assume the BA will handle notifications. The BA has an obligation to notify the covered entity under 45 CFR 164.410. The covered entity then has its own obligation to notify affected individuals within 60 days of discovery. A clinic that waited for Change Healthcare to complete notifications without independently tracking its obligations may have missed its window.

What a prepared clinic looks like

A clinic that came through the Change Healthcare incident with a defensible posture likely had:

• a current BAA on file for Change Healthcare and every billing vendor
• a vendor dependency list it actually maintained
• a written incident response plan that addressed a BA outage scenario, even at a high level
• at least one backup billing or claims submission path identified before the outage occurred

Most small clinics did not have all four. The incident was a stress test, and the results were public.

Related: the four-factor breach risk assessment and HIPAA breach notification timelines.