Cybersecurity Policy Report, SENATE NEWS: Two Congressional committees grill UnitedHealth CEO on Change Health cyberattack, (May 1, 2024)

By Sheila Lynch-Afryl, J.D., M.A.

UnitedHealth’s CEO touted its offered free credit monitoring and identity theft protection, but Senate Finance Committee Chair Ron Wyden (D-Ore.) called credit monitoring “the thoughts and prayers of data breaches.”

Andrew Witty, CEO of UnitedHealth Group (UHG), testifying before two Congressional committees on May 1 about the Change Healthcare cyberattack, said he was “deeply sorry” about the attack’s effects on patients and providers and disclosed that the company paid a $22 million ransom. In the Senate Finance Committee hearing, “Hacking America's Health Care: Assessing the Change Healthcare Cyber Attack and What's Next,” and House Energy and Commerce Committee, Oversight and Investigations Subcommittee hearing, “Examining the Change Healthcare Cyberattack,” members of Congress questioned Witty about why multifactor authentication was not used for the hacked server, when UnitedHealth will provide notice to affected consumers, and antitrust concerns.

Multi-factor authentication. In his preliminary remarks, Witty testified that the hackers used compromised credentials to remotely access a Change Healthcare Citrix portal, which did not have multi-factor authentication. On questioning by several senators, Witty explained that while UHG’s policy is to have multi-factor authentication for externally facing systems, when UHG acquired Change 1.5 years ago it had older technology that UHG was in the process of upgrading. Senate Finance Committee Chair Ron Wyden (D-Ore.) called the use of multi-factor authentication “cybersecurity 101” and said that UHG’s failure to use it on the server provided “open door access to protected health information.” Sen. Thom Tillis (R-NC), clutching a “Hacking for Dummies” book, said, “This is some basic stuff that was missed.”

Providers. Most senators and representatives described the woes of particular practitioners and providers, especially those in rural areas. Witty testified that claims processing is “broadly” back to normal and any lag on payment is due to the fact that not all payers make instant payments. He repeatedly emphasized the no-cost, interest-free loans that UHG offers affected providers, with repayment due 45 business days after the provider determines it is back to normal. He also expressed a willingness to work with individual providers.

Affected information. According to Witty, the hackers exfiltrated personally identifiable information and personal health information, which UHG recently said “could cover a substantial proportion of people in America.” When questioned about compensating affected consumers, Witty said that UHG is offering free credit monitoring and identity theft protection for two years. Wyden called credit monitoring “the thoughts and prayers of data breaches.”

Wyden was particularly concerned that the hackers accessed military personnel’s information, a “clear national security threat” that he likened to the 2015 hack of government personnel data from the Office of Personnel Management. Similarly, Rep. Gary Palmer (R-Ala.) sounded the alarm that if the health care records of federal government employees, some of whom have high level national security clearance, were part of the attack, such information will likely be handed over to adversarial nations. He asked, “Do you understand the problems that can create for us from a national security perspective?”.

Sen. Maggie Hassan (D-NH) questioned why HIPAA breach notification, which she said was due April 21, 60 days after the February 21 attack, has not occurred. Witty testified that accessing the hacked data slowed things down and UHG gained access in March. UHG is working with regulators and hopes to do notifications on behalf of physicians, as well. Rep. Paul Tonko (D-NY) also noted UHG’s obligations under the HIPAA Security Rule to protect against anticipated threats and asked whether UHG performed audits or tests of Change pre-acquisition or a risk analysis after acquisition.

Consolidation. Sen. Elizabeth Warren (D-Mass.) said that UHG is involved in “every link in the health care chain” and called it a “monopoly on steroids.” She, like several representatives, questioned whether UHG might use this crisis to expand its monopoly; for example, she said that UHG tried to buy a physician practice in Oregon that was “on the financial brink” because it could not be reimbursed due to the cyberattack. Similarly, Sen. Robert Menendez (D-NJ) asked Witty to commit to not exploiting the “destabilized market,” and Wyden echoed his concern that practices have been providing valuable financial information for UHG’s loans and UHG “gobbles them up.”

Rep. Buddy Carter (R-Ga.), armed with a chart of the UHG organization, said that accessibility is being affected by vertical integration, which he found to be a “direct conflict of interest.” He vowed that he would continue to “work to bust this up.”

Companies: UnitedHealth Group; Change Healthcare

MainStory: NewsStory HouseNews SenateNews ComplianceNews AntitrustNews BillingNews CMSNews DrugBiologicNews EHRNews HIPAANews HITNews IPPSNews PartANews PartBNews PartCNews PartDNews QualityNews CyberPrivacyFeed LegislativeRegulatoryActivity DataPrivacy DataSecurity