Dive Brief:
- Change Healthcare was hit by a cyberattack that could cause network disruptions at the healthcare technology firm through at least the end of the day Thursday.
- The company, which is owned by insurer UnitedHealth Group, took its systems offline on Wednesday after it became aware of an “outside threat,” according to a status update page. Change first reported that some applications were offline yesterday afternoon, and later linked the outage to a cybersecurity issue.
- The company currently believes the issue is isolated to Change. Other UnitedHealth systems are operational, according to a Thursday morning update.
Dive Insight:
Cyberattacks have become a critical challenge for the healthcare sector, potentially exposing patient data and delaying care.
Over the past five years, the industry has seen a 256% increase in large data breaches reported to the HHS’ Office for Civil Rights involving hacking. Nearly 80% of the large breaches reported to the agency last year involved a hacking incident.
Regulators have raised the alarm about cybersecurity in the healthcare sector, releasing voluntary guidance on safeguards and signaling aims to eventually propose enforceable standards.
The industry has already seen several recent high-profile attacks. Last month, a children’s hospital in Chicago was forced to take down its phone, email and electronic health record system after being targeted by a “known criminal threat actor.”
Ardent Health Services, which operates hospitals in multiple states, was hit by a ransomware attack on Thanksgiving. The provider fully restored its MyChart patient portal after about six weeks.
The outage at Change, which offers healthcare data analytics and revenue cycle management services, temporarily prevented Michigan-based provider Scheurer Health from processing prescriptions, according to a report from the Huron Daily Tribune. The issue was resolved Wednesday afternoon.
The company is working to address the incident, an Optum spokesperson told Healthcare Dive.
“Once we became aware of the outside threat, in the interest of protecting our partners and patients, we took immediate action to disconnect our systems to prevent further impact,” the spokesperson said in a statement.
Change was acquired by UnitedHealth’s Optum in 2022 after the Department of Justice failed to block the $13 billion deal. Regulators had argued the purchase would allow UnitedHealth to mine data from billions of healthcare claims, including competing insurers.
