1.5 minute read
The recent cybersecurity incident affecting Change Healthcare, a unit of UnitedHealth Group, has prompted the U.S. Department of Health and Human Services (HHS) to take action. Due to the significant impact of this cyberattack, HHS' Office for Civil Rights (OCR) is conducting an investigation to determine whether these entities complied with the HIPAA Privacy, Security, and Breach Notification Rules. This includes assessing whether any protected health information (PHI) was compromised.
OCR is encouraging HIPAA-covered entities (health plans, health insurance issuers, and health care providers) and their associates to promptly review their cybersecurity measures “with urgency” to ensure that health information is protected. Employers using third-party vendors like third-party administrators (TPAs) and pharmacy benefit managers (PBMs), should verify their cybersecurity measures and ensure secure business associate agreements for electronic PHI.
On Feb. 21, 2024, Change Healthcare, a major health insurance platform in the U.S., was hit by a significant cyberattack, impacting millions of providers and patients nationwide. The incident, labeled one of the most disruptive attacks in history by cybersecurity experts, highlights the growing threat of ransomware and hacking in healthcare. In the past five years, there has been a 256% increase in hacking-related breaches reported to OCR, with hacking accounting for 79% of large breaches in 2023.
To help covered entities and business associates safeguard PHI and protect their systems from cyberattacks, the OCR has provided some helpful tools and resources.
Download the bulletin for more details.