The short version
- Attackers used stolen credentials to log in to a Change Healthcare remote access portal that did not have multi-factor authentication. Ransomware followed nine days later.
- Change Healthcare has told HHS that about 192.7 million people were affected, the largest healthcare breach on record.
- For most providers the bigger problem was the outage: claims, eligibility checks, prior authorizations, and pharmacy claims stalled, and cash flow with them.
- A business associate agreement is a contract, not evidence of security. Know which vendors matter most, ask them specific questions, and put them in your risk analysis.
- Plan for a vendor outage the way you plan for your own: how you will bill, get paid, and keep seeing patients if a clearinghouse or EHR is down for weeks.
Before February 2024, most practice managers had never had a reason to think about Change Healthcare. Many were relying on it anyway, sometimes directly and sometimes through a billing company or another vendor. When it went offline, a lot of organizations learned how much of their revenue cycle ran through a company they had never evaluated.
What happened
Change Healthcare, part of UnitedHealth Group's Optum business, is one of the country's largest claims clearinghouses. The American Hospital Association told Congress that it processes 15 billion healthcare transactions a year and touches one in every three patient records.
UnitedHealth Group CEO Andrew Witty laid out the basic sequence in written testimony to Congress on May 1, 2024. On February 12, 2024, criminals used compromised credentials to remotely access a Change Healthcare Citrix portal. In his words, "The portal did not have multi-factor authentication." On the morning of February 21, a group calling itself ALPHV or BlackCat launched ransomware. Witty wrote that the decision to pay a ransom was his, and at a Senate Finance Committee hearing the same day he confirmed a payment of $22 million.
The number of people affected took more than a year to settle. Change first reported it to the HHS Office for Civil Rights in July 2024 with a placeholder of 500. The figure rose to about 100 million in October 2024, and UnitedHealth put it at roughly 190 million in January 2025. According to OCR's Change Healthcare FAQ, Change notified OCR on July 31, 2025 that approximately 192.7 million individuals were affected. The previous record, Anthem's 2015 breach, involved 78.8 million.
What it did to providers
For most practices and hospitals, the data breach was not the immediate crisis. The outage was.
An AHA survey of nearly 1,000 hospitals in mid-March 2024 found that 94% were feeling a financial impact, more than half of them significant or serious. 74% reported a direct impact on patient care, and 67% said switching to another clearinghouse was difficult or very difficult.
Physician practices felt it too. In an informal AMA survey of more than 1,400 respondents, most from practices with 10 or fewer physicians, 80% had lost revenue from unpaid claims, 55% had used personal funds to cover practice expenses, 32% could not submit claims, and 22% could not verify patient eligibility.
Pharmacies were hit too; Witty's testimony said it was March 7 before 99% of "pre-incident pharmacies" could process claims. On March 9, CMS offered accelerated and advance Medicare payments of up to 30 days of claims, to be recouped later. UnitedHealth told Congress it had advanced more than $6.5 billion and offered no-interest loans. It was November 2024 before the company said its clearinghouse services were fully restored.
Loans and advances helped, but they had to be paid back, and a practice that could not bill for weeks still had payroll and rent due.
A business associate agreement is not a security review
Under the HIPAA Security Rule, a covered entity may let a vendor handle ePHI once it obtains "satisfactory assurances" that the vendor will safeguard it, documented in a BAA. HHS has also said covered entities are not required to monitor or oversee how their business associates carry out privacy safeguards.
So a BAA tells you the vendor promised to comply. It does not tell you whether their remote access requires a second factor, whether their backups would survive ransomware, or how soon they would call you.
On that last point: under the breach notification rule, a business associate generally must tell you within 60 calendar days of discovering a breach, and you remain ultimately responsible for notifying patients and HHS, though you can delegate the task (OCR FAQ). And a breach notice is not an outage notice. Your claims can stop on day one, long before anyone has determined whether data was taken.
Start with a vendor list that matches how you actually work
Sort your vendors into two groups; some belong in both:
- Vendors that hold or process your PHI. Your EHR, practice management system, billing company, cloud backup, managed IT provider, transcription service, patient messaging and portal tools.
- Vendors you cannot operate without. Your clearinghouse, payment processor, e-prescribing connection, internet provider, and phone system. Some of these hold very little PHI, but losing them stops work.
For each one, write down what data it holds, what it does for you, who your contact is, and what would happen if it disappeared for a day, a week, or a month. Then ask your EHR vendor and billing company which clearinghouse they use, since your dependence on a company can run through a vendor you do contract with.
What to ask your critical vendors
You do not need a 300-question survey. For the few vendors at the top of your list, these cover most of what matters:
- Multi-factor authentication. Is it required on all remote access and administrative accounts, including your own support staff and any outside contractors who connect to your systems?
- Incident notification. How soon will you tell us about a security incident or an outage that affects us, not just a confirmed breach? Can we put a specific number of hours in the contract?
- Backups and recovery. Are backups kept separate from your production systems so ransomware cannot reach them? When did you last test a full restore, and how long did it take?
- Independent assurance. Do you have a current SOC 2 Type II report or HITRUST certification? Check the date and read what is in scope; a report that covers a different product or data center does not tell you much.
- Subcontractors. Who else handles our data or supports the service, and do they meet the same standards?
Large vendors often point you to a security or trust page instead. That is fine if it answers the questions. If a vendor will not answer, write that down; it is useful information too.
Put critical vendors in your risk analysis
The Security Rule requires an accurate and thorough assessment of risks to your ePHI, and much of your ePHI now lives on vendor systems. A real risk analysis should name your critical vendors, describe the threats (a compromise of their systems, a long outage, a slow notice), rate the likelihood and impact, and record the controls you have in place, whether that is contract terms, an assurance report, or a workaround. Adding or replacing a major vendor is also one of the events that should prompt an update.
In our risk analysis work, vendor dependencies are often the least documented part of an organization's environment, and the place where paperwork and day-to-day reality differ most.
Plan for the outage, not just the breach
HIPAA already requires a contingency plan covering data backup, disaster recovery, and keeping critical operations running in an emergency. A plan built around your own server failing does not cover a clearinghouse or cloud EHR that is down for a month. Yours should cover:
- Cash flow. Know how many weeks of payroll and expenses you can cover with no claims revenue. Arrange a line of credit before you need it; there is no guarantee of federal advance payments next time.
- Manual workflows. Decide in advance how you will check eligibility (payer portals or phone), handle prescriptions, register patients, and document visits if your EHR is unavailable. Keep downtime forms printed.
- An alternate clearinghouse. Two-thirds of hospitals in the AHA survey said switching was difficult or very difficult. Find out now what a move would involve, including payer enrollment, and consider setting up a second clearinghouse for your largest payers ahead of time.
- A practice run. Once a year, sit down with your billing lead, office manager, and IT support and talk through one scenario: our clearinghouse is down for three weeks starting Monday. What do we do?
A short vendor-review routine. Update the vendor list whenever a vendor is added or replaced. Once a year, for your most critical vendors, get a current assurance report or questionnaire and confirm MFA and incident contacts. At each renewal, ask for a specific notification window and disclosure of key subcontractors. Feed the results into your annual risk analysis and run the outage exercise. For most small practices, this is a few hours a year.
What the proposed Security Rule would add
In January 2025, HHS proposed a major update to the Security Rule. According to the HHS fact sheet, it would require business associates to verify for covered entities, at least once every 12 months, that they have put the required technical safeguards in place, through a written analysis by a subject matter expert and a written certification. It would also require business associates to notify covered entities within 24 hours of activating their contingency plans, and it would require multi-factor authentication with limited exceptions.
The rule is not final. HHS's most recent regulatory agenda moved it to long-term actions with a target of July 2027 (Clark Hill), and the details may change. The current Security Rule remains in effect. An organization that already keeps a vendor list, asks these questions, and plans for outages will have little to change either way.
Where to start
If you do nothing else this quarter, write down the five vendors your organization could not run without, and for each one answer two questions: what do we know about their security, and what would we do without them for a month? If either answer is "we are not sure," start there, and make it part of your next risk analysis.
Thomas J. Johnson, Founder, EHR Resources LLC
Thomas founded EHR Resources in 2011 after three years helping more than 1,400 practices adopt electronic health records under the Meaningful Use program. He served on a national HHS working group that developed guidance for covered entities conducting their own security risk analyses, and has spent the years since conducting them. Read his message to prospective clients or browse more articles.