BlogLine

Strengthening data privacy in healthcare: 22 state attorneys general call for action post cyberattack

5/28/24

By: Gaia T. Linehan

On February 21, 2024, Change Healthcare, the leading healthcare payment system in the nation, experienced a ransomware attack that caused its systems to completely shut down. Consequently, approximately 90% of the hospitals in the nation reported some financial impact. The attack resulted in Change Healthcare ‘giving in’ and paying a ransom of $22 million to regain access to its systems. The attack on Change Healthcare did not carry merely financial symptoms but also legal reactions.  

On April 25, 2024, Attorneys General from 22 different states united in a call for action to UnitedHealth Group and its subsidiaries (Change Healthcare included), to implement robust measures to bolster its data privacy and protect it from future attacks. The 22 states included New York, California, and Massachusetts, and specifically demanded the following actions from UnitedHealth and Change Healthcare: (i) creating a hotline to help affected providers, (ii) developing a detailed complaint mechanism for state agency complaint(s), (iii) enhance its financial support for affected providers, and (iv) enhance its notice-of-breach process to notify affected providers. The Attorneys General letter explicitly reserves all rights for future enforcement actions concerning the particular February 21, 2024 breach.  

Additional concerns about relations between cyber attacks and mergers and acquisitions are also voiced in the legal arena, alarmed by the potential connection to antitrust enforcement. It has yet to be determined whether these concerns will turn to legal actions seeking to prevent one merger activity or another, but companies considering near-future M&As would be wise to anticipate and prepare for increased scrutiny of their data privacy protection measures.  

For more information on the topic, contact Gaia T. Linehan at gaia.linehan@fmglaw.com or your local FMG Attorney.