UnitedHealth Questioned On Potential Patient Data Leaked in Cyberattack

UnitedHealth Group (UHG) is facing questions from a lawmaker over the types of patient data, including Medicare records, that were compromised during the February 21 cyberattack at its Change Healthcare unit.

On March 25, Rep. Jamie Raskin (D-MD), ranking member of the House Oversight Committee, sent a letter to UHG head Andrew Witty asking 12 questions about the breach and its impact on patients and others. This latest move follows others from lawmakers seeking to know more about the breach and the response to it from UHG as well as the Health and Human Services agency.

Noting that Change Healthcare reportedly handles medical records for one in three U.S. patients and provides services to others, Raskin highlights in the letter the "significant and far-reaching" consequences of the unit's prolonged outage. He asked for UHG to respond to the letter by April 8.

Subscribe to Kiplinger’s Personal Finance

Be a smarter, better informed investor.

Save up to 74%

Sign up for Kiplinger’s Free E-Newsletters

Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more - straight to your e-mail.

Profit and prosper with the best of expert advice - straight to your e-mail.

Sign up

Questions asked include ones about the types of information, including types of personally identifiable information and protected health information, that were compromised in the attack.

UHG is also asked to specify the scope of records from Medicare, Medicaid and Tricare beneficiaries that were compromised.

UHG did not immediately respond to a Kiplinger request for comment.

In a recent website update, UnitedHealth said said it has begun to process its claims backlog and that more than $14 billion in claims should “start flowing soon.” The insurer previously said that about 99% of Change Healthcare’s pharmacy network services were restored on March 7 and its electronic payments were restored on March 15.

Even so, the impact of the breach continues to be felt across the healthcare system, according to a number of healthcare professionals and organizations.

Tricare, which provides prescriptions to military clinics and hospitals worldwide, continues to say on its website that military clinics and hospitals are providing ongoing prescriptions through manual procedures until the Change Healthcare issue is resolved. Tricare also continues to direct beneficiaries to reach out to their specific pharmacy, clinic or hospital for local updates.

Growing data breaches in healthcare

As Raskin noted in his letter, about 725 data breaches were reported within the U.S. healthcare system last year. This is a 162% increase in the last decade, he said.

"The rising number of cyberattacks against the U.S. healthcare system, especially against an actor that holds outsized influence on the market, poses a clear and present threat to national security and public health," the lawmaker said in the letter.

Examples of cyberattacks in the last year resulting in massive data breaches include mail order prescription firm Truepill's data breach that exposed data of 2.3 million patients last November, as well as Medicare's data breach in July that exposed the personal information of more than 600,000 Medicare beneficiaries and millions of other healthcare consumers.

For help during this time, Tricare directs users to check its patient portal for outages for updates and information such as how to refill and check the status of your prescriptions at military pharmacies.

Related Content

• Deadline for Medicare Advantage Open Enrollment Is Here
• Truepill Data Breach Exposes Personal Information of Millions
• Data Breach Exposes Personal Information of 612K Medicare Recipients