UnitedHealth's Change Healthcare Faces Class Actions after Data Breach Debacle

Healthcare payment provider Change Healthcare is facing a growing number of proposed class action lawsuits following a major cyberattack that saw systems knocked offline, with ongoing fallout for the healthcare industry, and a massive breach of customers’ data.

At least six proposed class action lawsuits have been filed since the hack three weeks ago, accusing the company of lacking reasonable cybersecurity measures, Healthcare Dive reported.

The company, a subsidiary of UnitedHealth Group that processes 15 billion healthcare transactions annually, has a hand in one in every three patient records, according to a letter from the American Hospital Association.

What happened in the attack?

According to some of the lawsuits and HIPAA Journal, the Blackcat ransomware group was behind the February 21 attack that saw a huge amount of data stolen and encrypted. HIPAA Journal reported that a ransom has been to retrieve the data, but the fallout is ongoing. 

The data included medical records, dental records, payment information, claims information, patients’ information, insurance records, and more, according to one lawsuit. The outage at Change has been felt across the healthcare sector, hamstringing key pharmacy and revenue cycle operations, leaving some hospitals without enough to cover payroll. 

UnitedHealth Group (UHG) hasn’t released many details about the attack, issuing a statement saying the team is focused on the investigation and bringing their systems back online.

What the suits are claiming

As the fallout continues, lawsuits are piling up against the payment providers in Minnesota and Tennessee, where Change and UHG are based. 

One plaintiff said in his proposed class action he has been unable to use his health insurance and has had to pay full price for medications, and another has issues accessing his prescription at all, Healthcare Dive reported.

The companies are accused of breaching the Health Insurance Portability and Accountability Act, negligence, breach of implied contract, unjust enrichment in the legal actions, Kare11 reported, with the proposed class actions all arguing the Change and UHG didn’t have satisfactory protections to safeguard sensitive user information, allowing for the “preventable” breach.

What are the ongoing effects?

According to Healthcare Dive, medical providers have had issues getting payment from patients and insurers, verifying coverage, submitting prior authorization requests, and exchanging records. Meanwhile, patients have reported difficulties accessing prescriptions. Providers have asked for more help from Change and UHG, but Stat News reported the fallout could continue for weeks.

The Washington Post reported that the White House has opened an investigation into UHG following the attack, and met with UnitedHealth CEO Andrew Witty and other health industry leaders, urging them to rush payments to affected providers.

“Given the unprecedented magnitude of this cyberattack, and in the best interest of patients and health care providers, OCR is initiating an investigation into this incident,” the Health and Human Services Office of Civil Rights said in a statement.

Increase in attacks

Healthcare leaders told the Washington Post that the attack on Change Healthcare was “the most significant incident of its kind in the U.S. health system’s history.” Unfortunately, cyberattacks on the healthcare industry are on the rise, and so too are lawsuits trying to recover losses from said attacks, as Bloomberg Law reported.

A Bloomberg Law analysis found the monthly average of new class action lawsuits filed over health data breaches in 2023 was nearly double the rate from the previous year. The National Library of Medicine said in a 2020 report healthcare organizations could employ several strategies to enhance the security of their databases, including having a backup, using firewalls, Firefox technology, and encryption.