US Health Regulators Open Probe in UnitedHealth Cyberattack

US health authorities are investigating whether the cyberattack on UnitedHealth Group Inc.’s Change Healthcare unit involved a breach of personal health information.

The Department of Health and Human Services Office for Civil Rights opened the probe into the company’s compliance with health-privacy rules, according to a letter from the agency posted on its website on Wednesday.

“Given the unprecedented magnitude of this cyberattack, and in the best interest of patients and health care providers, OCR is initiating an investigation into this incident,” the agency said.

Both the White House and the FBI declined to comment on the investigation. The HHS Office for Civil Rights, asked about the incident last month, said at the time it does not comment “on open or potential investigations.”

A UnitedHealth spokesperson said the company will cooperate with the investigation and is working with authorities to learn the extent of the breach. “Our immediate focus is to restore our systems, protect data and support those whose data may have been impacted,” the company said in a statement.

The breach that has halted the flow of billions of dollars in medical payments is entering its fourth week. Neither the company nor the government have said how many patient records might have been exposed in the attack.

Change Healthcare has said its systems process transactions for trillions of dollars of medical claims each year.

Consequences Growing

The wide-ranging consequences of the Change cyberattack are still becoming evident. Three-fourths of hospitals in a survey by the American Hospital Association said the hack directly affected patient care, including delays in authorizations. Of almost 1,000 hospitals responding to the survey, one-third said the attack disrupted more than half their revenue.

The group is worried that hospitals could face payment denials from administrative problems caused by the Change outage, it said in a letter to leaders of the Senate Finance Committee Wednesday. The group asked Congress to give health agencies more power to send medical providers payments and other relief.

Meanwhile, UnitedHealth said disruptions to Change Healthcare’s pharmacy systems are resolved and “more than 99% of pre-incident claim volume is flowing,” according to an update to its response website Wednesday.

As the company works to bring other parts of its system back online as soon as March 15, it’s still telling clients they should seek workarounds. “While we are making progress, we strongly recommend pursuing multiple paths and solutions,” the company said.

News of the HHS investigation was reported earlier by the Washington Post.

Top photo: The breach that has halted the flow of billions of dollars in medical payments is entering its fourth week. Photographer: Bloomberg Creative Photos/Bloomberg Creative Collection.