The US Department of Health and Human Services said it will investigate the ransomware attack on Change Healthcare that disrupted billing operations at several healthcare providers across the US.
The announcement comes not long after the ALPHV/BlackCat ransomware group’s bitcoin wallet received 350 bitcoins in a single transaction, or close to £18.3 million(US$23.05million) – exactly the amount it demanded from the healthcare solutions giant.
Last month, Change Healthcare, now part of Optum Solutions following a merger, said it experienced enterprise-wide connectivity issues due to which certain applications were not functioning. The company later said the outage occurred due to a “cyber security issue” and that operational disruption could last throughout the day.
Later, in another statement, Change said the impact of the cyber attack was restricted to its internal systems and all other systems across UnitedHealth Group, its parent company, were operational.
In an update published on its website, Change Healthcare said that it is in the process of recovering its systems that were affected by a ransomware attack. In fact, certain systems like Pharmacy services are currently fully functional with claim submission and payment transmission also available.
On February 28, the infamous ALPHV/BlackCat ransomware group claimed responsibility for the cyber attack on Change Healthcare and listed it as a victim on its data leak site. It was also reported that the Bitcoin address connected to the ransomware group received 350 bitcoins in a single transaction, or close to £18.3 million based on exchange rates at the time.
The UnitedHealth Group, however, did not comment on whether it paid a ransom to the Russian hacker group. “We are focused on the investigation and restoring operations at Change,” it said.
In a statement shared with the media, Andrew Witty, CEO of UnitedHealth Group, said, “We are committed to providing relief for people affected by this malicious attack on the U.S. health system.
“All of us at UnitedHealth Group feel a deep sense of responsibility for recovery and are working tirelessly to ensure that providers can care for their patients and run their practices, and that patients can get their medications. We’re determined to make this right as fast as possible,” he added.
On March 13, the Office for Civil Rights (OCR) for HHS issued a notice stating that it is aware of the cyber security incident on Change Healthcare, a unit of UnitedHealth Group(UHG). OCR specified that a cyber security incident of this magnitude is a “direct threat to critically needed patient care and essential operations of the healthcare industry.”
“Given the unprecedented magnitude of this cyber attack, and in the best interest of patients and health care providers, OCR is initiating an investigation into this incident. OCR’s investigation of Change Healthcare and UHG will focus on whether a breach of protected health information occurred and Change Healthcare’s and UHG’s compliance with the HIPAA Rules,” reads the notice.
OCR added that partners of Change Healthcare and UHG are not their immediate priority at the moment. However, partnered organisations should follow their regulatory obligations and responsibilities, including ensuring that business associate agreements are in place and that timely breach notification to HHS and affected individuals occurs as required by the HIPAA Rules.
“OCR is committed to helping health care entities understand health information regulations and to collaboratively working with entities to navigate the serious challenges we face together. OCR encourages all entities to review the cybersecurity measures they have in place with urgency to ensure that critically needed patient care can continue to be provided and that health information is protected,” the agency added.
