Change Healthcare Seeks Consolidation for Dozens of Lawsuits After Major Hack

After being slammed with at least two-dozen lawsuits across the country after a major data hack in February, Change Healthcare has asked a judge to consolidate the suits in one court in Tennessee.

Earlier this month, Change – a subsidiary of UnitedHealth Group – asked a U.S. court panel to designate Nashville as the place to consolidate at least 24 class actions accusing the country’s largest medical claims processor of failing to protect personal data from the cyber attack, Reuters reports.

The attack was carried out by the ransomware hacker group BlackCat. UnitedHealth disclosed the breach on Feb. 21 but did not say how many people were affected.

Lawsuit flurry follows major cyberattack

Since then, thirteen lawsuits have been filed by consumers alleging they now face a heightened risk for identity-theft. 

Eleven other cases were filed by healthcare providers alleging there was a delay in insurance claim payments. Both categories of claims allege that Change was negligent in its data security processes.

Change denies this. In its filing for consolidation, the company told the judge the claims were “based on the incorrect and unfounded theory that, because a cyberattack occurred, Change’s security must have been deficient and plaintiffs must have been harmed.”

Change Healthcare denies negligence

The late February attack against Change Healthcare took the healthcare industry by surprise, halting claims payments and grinding operations at some hospitals and clinics to a stop.

Providers were forced to search for workarounds, Axios reports. But many clinics said they struggled to receive payments while Change’s systems were offline. 

Change is arguing to consolidate the lawsuit against it in order to preserve court resources and avoid duplicative work and inconsistent rulings. 

Lawmakers scrutinize healthcare consolidation

The cyberattack, and impact on insurance claim payments, has put Change in the federal spotlight. On Tuesday, lawmakers held the first congressional hearing on the Change Healthcare hack, with a focus on the risk of consolidating providers in healthcare, Axios reports. 

Some lawmakers agreed that combining smaller healthcare companies like Change into  the umbrella of healthcare giants like UnitedHealth Group has left the system and patients worse off. 

"This is just another thing that's happened with the massive vertical integration in our system that I believe personally is not in the best interest of the American people," said Rep. Larry Bucshon (R-Ind.) during the hearing. 

Data breach lawsuits on the rise in healthcare

Data breach class actions “exploded” in 2023, according to a February report from law firm Duane Morris, as the healthcare industry faces increased breach threats. And those data breaches can lead to serious settlements. 

In February, the U.S. Department for Human Health and Services announced a $4.75 million settlement with Montefiore Medical Center, a non-profit hospital system based in New York City, after data security failures allegedly led to an employee stealing and selling patients’ protected health information over a six-month period.

In 2017, Equifax, one of the largest credit reporting agencies, suffered a massive data breach that exposed the personal information of approximately 147 million people. Equifax agreed to pay up to $425 million to settle with the Federal Trade Commission, the Consumer Financial Protection Bureau and 50 U.S. states and territories.