Providers Apprehensive at Optum Data Breach Announcement

Sarasota, FL (WorkersCompensation.com) – Providers across the country are apprehensive after the
recent announcement of a possible cyberattack at Change Healthcare, which is owned by healthcare
giants Optum and UnitedHealth Group.

First released on Feb. 21, Change first reported that their systems had been impacted by "enterprise-
wide connectivity issues", and some applications were unavailable. Later in the day, the company
announced that the network interruption was related to a “cyber security issue”, and they were disconnecting their systems to minimize the threat. On the 22nd, the company posted that they believe the incident was isolated to just Change Healthcare, and all other systems across UnitedHealth Group
were operational and safe. While the company released an update every couple of hours, the updates
were primarily a duplicate of the previous announcement, not providing further details.

As of Feb. 24, the last post stated Change was implementing multiple approaches to restore the
impacted system, and stated they would not “take any shortcuts or take any additional risk as we bring
our systems back online. We will continue to be proactive and aggressive with all our systems and if we
suspect any issue with the system, we will immediately take action and disconnect.” The notification
stated that connectivity issues were expected to last at least throughout the day.

According to a recent WSJ report, investigators believe a nation-state is the source of the attack.
Depending on the timeline and extent of the attack, experts are foretelling shortages and delays for
pharmacies, and other providers. Unfortunately, upon request for comment, the UnitedHealth
spokesperson parroted the same repetitious updates posted on the Optum website and provided no
further detail on what patients and providers could expect.

According to the HHS Breach Portal, the Change incident is not officially listed so far. There have been 17 total breach reports submitted this month through the 16th. Of the 17 reports, 11 were from hacking incidents on network servers involving over 2.5 million patients.

The reports with the largest number of patients impacted was Medical Management Resource Group
which provides medical billing and collections services. According to the portal, the breach involved 2.3 million patients.

Prime Healthcare Employee Health Plan also submitted a breach report with 101,135 individuals affected. BlueCross BlueShield of Tennessee submitted a report as well, but only 790 individual records were listed so far.

Change Healthcare is part of the largest healthcare conglomerate in the country. Optum and
UnitedHealth Group provides a multitude of healthcare services including not only health and pharmacy benefits for employers and states, but also provider electronic payment platforms, and claims processing solutions. The organization has access to literally every aspect of healthcare, which in this
case could prove to be a giant vulnerability to healthcare in the age of seamless access.

Share This Article: