Standards in Healthcare Cybersecurity

The Change Healthcare cyberattack was a significant incident with widespread ramifications across the healthcare industry, with effects that are likely to persist for months or even longer. Standards in Healthcare Cybersecurity will change as a result. Since the ransomware attack on UnitedHealth Group’s (UHG) subsidiary, Change Healthcare, providers have faced financial and operational challenges due to disruptions in claims processing and other essential services. Change Healthcare, which processes 15 billion transactions annually and interacts with one in every three patient records in the U.S., is undergoing a complex and lengthy recovery process, with long-term implications for the industry.

The attack was first reported on February 21st when Optum, another UHG subsidiary, alerted customers about the unavailability of some applications due to a cybersecurity issue. It was later confirmed that the BlackCat ransomware gang was responsible for the attack, which led to a $22 million ransom payment by UHG. The scale of the attack caused significant operational disruptions across the healthcare system, affecting entities ranging from large pharmacy chains to small, independently owned practices.

In the weeks following the attack, UHG began restoring services, but the recovery process remains ongoing. UHG CEO Andrew Witty testified before Congress that the cybercriminals had gained access to Change Healthcare systems nine days before deploying the ransomware, using compromised credentials to access a Citrix portal without multi-factor authentication. The decision to pay the ransom was described as one of the hardest Witty has ever had to make.

The incident has highlighted the vulnerabilities in healthcare cybersecurity, particularly for large organizations like UHG that handle vast amounts of sensitive data. It has also fueled the debate over whether ransomware payments should be made illegal, with arguments on both sides regarding the implications for victims and the broader cybersecurity landscape.

The attack has prompted a strong response from industry groups and the federal government. The American Hospital Association (AHA) and the American Medical Association (AMA) have been vocal about the impact on providers, with the AHA calling it “the most significant and consequential cyberattack on the U.S. healthcare system in American history.” The federal government, through the Department of Health and Human Services (HHS), has provided guidance to Medicare providers and launched a formal investigation into the breach.

As the healthcare industry continues to recover, the long-term impacts of the Change Healthcare cyberattack are expected to shape future cybersecurity strategies. The incident has underscored the importance of robust third-party risk management, the implementation of security measures like multi-factor authentication, and the potential need for more stringent regulatory standards in healthcare cybersecurity. The full extent of the breach, including the number of individuals affected, remains to be seen, but it is already clear that this event will have lasting repercussions for the industry.