Hospitals Lobby Feds to Clarify Breach Duties in UHG Attack

The cyberattack on Change Healthcare disrupted thousands of healthcare organizations in the U.S. As hospitals, clinics and doctor practices potentially have to notify millions of patients about the Change Healthcare breach, the American Hospital Association said the IT services firm and parent company, UnitedHealth Group, should be the sole sender of notifications.

See Also: Embracing Digital Risk Protection: Take Your Threat Intelligence to the Next Level

The AHA is asking the Department of Health and Human Services’ Office for Civil Rights for a “unified notification process” if a breach occurred in the Feb. 21 cyberattack on UnitedHealth Group’s Change Healthcare unit.

The AHA’s letter to HHS OCR on March 21 comes about a week after HHS OCR publicly issued a “Dear Colleagues” letter on March 13 to notify UnitedHealth Group – and HIPAA-regulated entities at large – that the agency had launched an investigation into the Change Healthcare cybersecurity incident.

HHS OCR said its investigation of Change Healthcare and UnitedHealth Group is focused on whether a breach of PHI occurred and the companies’ compliance with the HIPAA Rules. The agency said its interest in other entities that have partnered with UnitedHealth Group is “secondary.”

But while HHS OCR said it is not prioritizing investigations of healthcare providers, health plans and business associates that were tied to or affected by the Change Healthcare attack, the agency said it was “reminding” entities that have partnered with Change Healthcare and UnitedHealth Group of their “regulatory obligations and responsibilities.”

Those include ensuring that business associate agreements are in place “and that timely breach notification to HHS and affected individuals occurs as required by the HIPAA Rules,” HHS OCR said.

UnitedHealth Group still maintains that its privacy and security teams are “actively engaged” in understanding whether PHI was compromised in the incident. But since Change Healthcare handles 15 billion transaction annually and touches 1 in 3 patients, experts predict that a PHI compromise could potentially affect tens of millions of individuals.

Threat actors claiming to be BlackCat have taken credit for the attack, and UnitedHealth Group confirmed earlier this month that the Russian-speaking ransomware group, which also goes by Alphv, was to blame. BlackCat claimed on the dark web that it exfiltrated 6 terabytes of “highly selective data” from Change Healthcare pertaining to “all” of the company’s clients (see: BlackCat Ransomware Group ‘Seizure’ Appears to Be Exit Scam).

Breach Notification Duties

Under the HIPAA Breach Notification Rule, covered entities – such as hospitals and medical practices – are ultimately responsible for ensuring that individuals are notified of PHI compromises. In a breach involving a business associate, covered entities may delegate responsibility for individual notices to the business associate, if it is part of a business associate agreement.

The covered entity is also responsible for reporting the PHI breach to HHS OCR.

But AHA in its letter is seeking to have HHS OCR state that UnitedHealth Group and Change Healthcare are solely responsible for any needed individual notification, according to Becker’s Health IT.

“We are seeking additional clarification that hospitals and other providers do not have to make additional notifications if UnitedHealth Group and Change Healthcare are doing so already,” the AHA wrote to HHS OCR Director Melanie Fontes Rainer.

“As a covered entity, Change Healthcare has the duty to notify OCR and the impacted individuals. Even where Change Healthcare acts as a business associate, HIPAA authorizes Change Healthcare to issue these notifications for a more streamlined approach,” the AHA said.

Regulatory attorney Rachel Rose said the likelihood of HHS OCR broadly designating Change Healthcare/UnitedHealth Group as the one and only party responsible for reporting the breach to government entities and notifying affected individuals “is slim to none.”

“The default in a business associate agreement if this is not defined is for the party designated as the covered entity to report. A covered entity can be the business associate of another covered entity and the designation of each party would be defined in the BAA,” she said. “Presuming that is the case, the default under the law is for the covered entity to notify the patients, as ultimate responsibility defaults to the covered entity.”

But, if HHS OCR decides to designate UnitedHealth Group as the sole entity to handle the potential Change Healthcare breach notification, it would lessen financial and other pressures on healthcare providers affected by the incident, she said.

“It would reduce the impact of all providers being named in lawsuits, small healthcare providers and rural hospitals closing, and a more streamlined legal process,” Rose said. “I believe there are more pros than cons to having UnitedHealth Group have sole responsibility.”

Neither AHA nor HHS OCR immediately responded to Information Security Media Group’s requests for comment on AHA’s letter to the agency.

Restoration Is Progressing

Change Healthcare is continuing work to restore the IT systems affected by the attack. UnitedHealth Group said on Friday that Change Healthcare’s medical claims preparation software, Assurance, went back online on March 18 and that healthcare providers are working through testing, reconnecting and processing their respective backlogs of claims files.

“As of March 22, claims with more than $14 billion in charges have been staged for processing through the Assurance software,” UnitedHealth Group said. The company also said it has so far advanced $2.5 billion in short-term help to healthcare providers through a temporary funding assistance program.

Several other Change Healthcare services – including eligibility processing, benefits verification and authorization determination – are expected to begin coming back online this week.

Other services, however – including Clinical Exchange, which enable electronic prescribing, ordering and results to integrate into EHRs – are not expected to come back online until next week. And services such as Risk Manager, which supports clients in managing value-based payment contracts, are not slated for restoration until the week of April 8 or later.