Change Healthcare: how one missing identity control became a national continuity failure

Summary

• Confirmed: Criminals used compromised credentials to enter a legacy Change Healthcare Citrix portal on February 12, 2024. The portal did not have multifactor authentication even though UnitedHealth Group and Change Healthcare policies required it for external-facing applications. The intruders later escalated privileges, reached Active Directory, exfiltrated protected health information, and deployed ransomware across Windows and ESXi systems.
• Confirmed: UnitedHealth Group detected the incident when ransomware was deployed on February 21 and rapidly severed Change Healthcare connectivity. That containment decision helped limit further contamination, but it also removed claims, pharmacy, eligibility, authorization, and payment functions on which much of the US health system depended.
• Assessment: The absent identity control was the preventable entry failure. The national disruption was a separate continuity failure: too much operational dependency sat behind one clearinghouse estate without sufficiently tested, ready-to-use alternatives at the transaction, payer, provider, and public-program levels.
• Accountability: Responsibility should follow practical control. The criminals controlled the attack; UnitedHealth Group and Change Healthcare controlled the exposed access path, post-acquisition security integration, privileged architecture, data environment, restoration process, and customer continuity design. Payers, providers, regulators, and public programs controlled narrower parts of downstream resilience. Those roles overlap, but they are not interchangeable.

The event was larger than an outage

Change Healthcare sits between medical work and medical payment. It moves and edits claims, verifies eligibility, supports prior authorization, routes pharmacy transactions, and carries payment information between providers and payers. When those functions stopped on February 21, 2024, care did not stop uniformly. Instead, the administrative machinery that tells a pharmacy whether a prescription is covered, tells a clinic where to send a claim, and tells a provider when payment is coming became unreliable or unavailable.

That distinction matters. A hospital can continue treating a patient while a claims connection is down, but it must then finance the treatment, preserve enough evidence to bill later, and accept the risk that authorization or timely-filing rules will not be relaxed. A pharmacy can dispense a medicine on a good-faith assumption, but it temporarily assumes the patient's coverage and copayment risk. A small physician practice can keep seeing patients, but payroll and supply purchases still depend on cash arriving from previously delivered care. The disruption therefore migrated from technology into working capital, labor, inventories, and access decisions.

The scale was not an abstract claim made after the event. Before the attack, the American Hospital Association described Change Healthcare as processing 15 billion healthcare transactions annually and touching one in three patient records. In its March 2024 survey, the association also found that 67 percent of responding hospitals considered switching clearinghouses difficult or very difficult. Those figures came from an interested industry association and should not be mistaken for a regulator's market-share finding, but they are consistent with what happened when the platform went dark: workarounds existed, yet many were slow, manual, incomplete, or unavailable at the moment they were needed. (American Hospital Association survey)

The public sector treated the disruption as a continuity problem, not merely a private vendor dispute. The Department of Health and Human Services said the incident threatened critically needed patient care and essential healthcare operations. The Centers for Medicare & Medicaid Services created accelerated and advance payments for affected Medicare providers and suppliers, while also offering Medicaid flexibilities intended to keep funds moving and avoid provider solvency problems. (HHS Office for Civil Rights letter; CMS accelerated-payment fact sheet; CMS Medicaid statement)

This is the central accountability fact. The compromised network belonged to a company. The interrupted function had become infrastructure for thousands of organizations and multiple public programs. The private ownership boundary did not contain the public consequence.

A timeline with confidence boundaries

The sequence is now unusually well documented because UnitedHealth Group answered detailed questions after congressional hearings. The following reconstruction separates what the company has confirmed from what remains an assessment.

October 3, 2022, confirmed: Optum completed its combination with Change Healthcare. UnitedHealth Group therefore had owned the company for about sixteen months when the intrusion began. (UnitedHealth Group completion announcement)

February 12, 2024, confirmed: Criminals used compromised credentials to remotely access a Change Healthcare Citrix portal. Citrix in this account was the remote-access application, not an identified software vulnerability. UnitedHealth Group later said the server was a legacy Change Healthcare system, did not have multifactor authentication enabled, and was still being brought to UnitedHealth Group's security standards. The company also said both organizations' policies required MFA on external-facing applications. (UnitedHealth Group responses to the Senate Finance Committee)

After initial entry, confirmed in part: The threat actor used privilege-escalation techniques and reached a Change Healthcare Active Directory server. UnitedHealth Group confirmed that the later ransomware affected Windows and ESXi systems. The public record does not disclose the full path between the Citrix login, privilege escalation, directory compromise, data staging, hypervisor access, and encryption. It therefore supports a conclusion that identity and privilege boundaries were crossed, but it does not support a complete diagram of the internal network.

February 17 through February 20, confirmed: The actor exfiltrated protected health information. Change Healthcare's breach notice later said the company confirmed on March 7 that a substantial quantity of data had left the environment during this period. The same notice said Change obtained a dataset safe to investigate on March 13. (Change Healthcare breach notice)

February 21, confirmed: A threat actor deployed ransomware that encrypted numerous systems across the Change Healthcare environment. UnitedHealth Group said it detected the ransomware that day and quickly severed connectivity to Change systems to limit further contamination. Pharmacy, claims, eligibility, payment, and related functions became unavailable or degraded. The company's initial Form 8-K described a suspected nation-state-associated actor; its March 8 amendment instead referred to cybercrime threat actors and focused on the affected Change systems. That revision is a useful warning against treating first-day attribution language as a settled forensic finding. (February 22 Form 8-K; March 8 Form 8-K/A)

February 22 onward, confirmed: UnitedHealth Group notified customers, law enforcement, and government agencies. In later congressional answers, it said contact with HHS occurred no later than February 22. The company maintained that the incident had not spread beyond Change Healthcare. That is an important containment result, although it does not reduce the impact within the Change estate.

February 27, sector response: CISA, the FBI, and HHS issued an updated advisory on ALPHV/BlackCat activity after observing that the group had encouraged affiliates to target healthcare organizations. The advisory established the group's operating context, not a criminal conviction identifying the individual affiliate responsible for Change Healthcare. The more direct incident-specific record is UnitedHealth Group's later statement that responsibility was claimed by ALPHV/BlackCat working with an affiliate. Before this incident, the Justice Department had described ALPHV/BlackCat as a ransomware-as-a-service operation that had targeted more than 1,000 victims. (Justice Department description of ALPHV/BlackCat)

March 1, confirmed: Optum launched a temporary funding program for providers whose payments had been processed through Change Healthcare. This was a bridge, not compensation for all interruption losses. Eligibility, enrollment, historical-payment calculations, repayment, and the need to establish new payment connections affected how usable it was for each provider.

March 7, confirmed restoration milestone: UnitedHealth Group said electronic prescribing was functioning and pharmacy claim submission and payment transmission were available. It expected electronic payment functionality to become available for connection from March 15 and medical-claims testing and reconnection to begin March 18. The word "connection" is important: a central service becoming available did not mean every customer had completed technical and operational reconnection. (UnitedHealth Group March 7 update)

March 9 and March 15, confirmed public intervention: CMS made up to thirty days of accelerated or advance Medicare payments available to eligible providers and suppliers, with repayment through claims recoupment. CMS separately outlined routes for states to make interim Medicaid payments under specified conditions. These programs show that ordinary payment routing had failed badly enough to require public cash-flow substitutes. They do not show that every affected provider qualified for, obtained, or found those substitutes sufficient.

March 15 and March 18, confirmed restoration milestones: UnitedHealth Group said it restored the electronic-payments platform on March 15 and was implementing payers. On March 18, it began releasing medical-claims preparation software and said it had advanced more than $2 billion to providers. It also reported that 99 percent of pharmacy network services had been restored. Again, these were platform and network measures, not proof that every pharmacy service, copay program, provider workflow, payer route, or backlog had returned to normal. (UnitedHealth Group March 18 update)

April 10, downstream evidence: An American Medical Association convenience survey conducted from March 26 through April 3 found continuing disruption among more than 1,400 respondents, most from practices with ten or fewer physicians. Thirty-six percent reported suspended claim payments, 32 percent could not submit claims, and 22 percent could not verify benefits. This was not a random national sample, so its percentages should not be generalized to every US practice. It is nevertheless direct evidence that a material group of small practices remained impaired after central restoration announcements. (American Medical Association survey release)

April 22, confirmed partial recovery and data warning: UnitedHealth Group said pharmacy services were near normal, medical claims were flowing at near-normal levels across the health system, Change payment processing had reached about 86 percent of its pre-incident level, and about 80 percent of Change functionality had been restored on major platforms and products. It also disclosed that initial sampling found files containing protected health information or personally identifiable information that could cover a substantial proportion of people in the United States. (UnitedHealth Group April 22 update)

May 1 and later congressional record, confirmed: Chief executive Andrew Witty testified before House and Senate committees. UnitedHealth Group subsequently confirmed in written answers that it paid the demanded $22 million ransom in Bitcoin. The company attributed the attack to ALPHV/BlackCat working with an affiliate, but the public record does not identify a convicted individual responsible for this intrusion. Payment is confirmed; any promise by criminals to delete data, the allocation of payment between an affiliate and the ransomware service, and the ultimate disposition of the stolen material remain outside reliable public verification. (Senate Finance Committee hearing record)

June 20 onward, confirmed notification process: Change Healthcare began notifying affected customers on a rolling basis and posted a substitute notice. It mailed individual notices where it had sufficient addresses and where customers delegated notification. The process continued as customer attribution and instructions were resolved. On July 19, Change filed a breach report with the HHS Office for Civil Rights. (HHS Change Healthcare incident FAQ)

December 31, 2024, financial record: UnitedHealth Group's annual report said it had provided more than $9 billion in interest-free loans to care providers. It reported $2.2 billion in direct response costs and an estimated $867 million in Optum Insight business-disruption impacts for 2024. The company estimated that approximately 190 million people were affected and warned of continuing litigation, regulatory, reputation, and data-related risk. The HHS breach portal was later updated to list 192.7 million affected individuals. The company's 190 million figure should therefore be read as its year-end estimate, not the final portal count. (UnitedHealth Group 2024 Form 10-K; HHS breach portal)

Trigger, root cause, and contributing conditions

Ransomware analysis often collapses several questions into the phrase "the cause." That produces weak accountability because the event had more than one causal layer.

Trigger: ransomware deployment

The immediate operational trigger was the February 21 deployment of ransomware across numerous Change Healthcare systems. Encryption made systems unavailable and forced a containment decision. The criminal actors bear direct responsibility for unauthorized access, data theft, extortion, and service disruption.

The trigger is not the root cause. Ransomware was the payload used after the actor had already been inside for nine days, elevated privilege, reached a directory server, and removed data. A recovery plan that focuses only on decrypting or rebuilding machines would miss the controls that should have prevented the actor from reaching that position.

Confirmed enabling root cause: an unenforced identity requirement

The clearest preventable control failure was not subtle. Compromised credentials worked against an external-facing remote-access service that lacked MFA. UnitedHealth Group said its own policy and Change Healthcare's policy required MFA on external-facing applications. It also said the legacy server had not yet been brought to UnitedHealth Group standards following the 2022 acquisition.

That makes "credential theft" an incomplete explanation. Credentials are stolen routinely. MFA exists because a password should not be sufficient proof for remote entry into a sensitive environment. Here, the control was required on paper but absent in operation. A policy without complete asset coverage, an accountable exception, a deadline, compensating controls, and verification is not an implemented control.

The post-acquisition context sharpens, but does not automatically settle, the governance question. Sixteen months had elapsed between the completed combination and the initial access. It is confirmed that this server remained below the parent's standard. It is probable that acquisition-integration governance contributed because the company itself described the asset as legacy and still in transition. It is unknown from public evidence who owned the migration deadline, whether a formal exception had been granted, what risk rating the portal carried, and whether senior management or the board had been told that an internet-facing route into a critical clearinghouse estate remained without MFA.

Confirmed privilege failure, incomplete architecture evidence

UnitedHealth Group confirmed privilege escalation and access to Active Directory. It also confirmed encryption of Windows and ESXi systems. Those facts show that the initial foothold did not remain confined to one remote-access session. The actor obtained authority and reach sufficient to affect identity infrastructure, server workloads, and virtualization infrastructure.

It is reasonable to infer that privilege boundaries and blast-radius controls did not stop the attack soon enough. It is not reasonable to assert, from the public record alone, that the entire Change network was flat or that a particular segmentation appliance failed. Network diagrams, access-control lists, directory-tier architecture, service-account paths, administrative logs, and hypervisor management routes are not public. The defensible finding is narrower: whatever segmentation and privileged-access controls existed did not prevent the documented escalation and multi-platform impact before February 21.

Contributing condition: data concentration without demonstrated exfiltration interruption

The actor exfiltrated data between February 17 and 20. Change Healthcare later reported a breach affecting an extraordinary number of people. The exposed categories could include contact details, health insurance data, diagnoses, medicines, test results, care information, billing information, claim numbers, and, for some people, additional identifiers. The company said the mix varied by person and that Social Security numbers were not affected for the majority.

The record confirms exfiltration. It does not disclose the total volume moved, the staging method, the egress channel, the alerts produced, or whether any alert was investigated before ransomware appeared. A probable contributing failure was insufficiently effective detection or interruption of abnormal access and outbound movement. A possible further contributor was excessive retention or insufficient partitioning of claims-related data, but the public evidence does not establish how much of the affected data was legally or operationally necessary at the time of compromise. Data-minimization conclusions require retention schedules and dataset-level evidence that are not public.

Contributing condition: transaction concentration and switching friction

The attack compromised one operator; the outage propagated through an ecosystem. Change's large role in claims and pharmacy transactions created common-mode dependency. The Justice Department had described Change's EDI clearinghouse as transmitting claims and payment information between insurers and providers when it challenged UnitedHealth Group's acquisition in 2022. That antitrust case concerned competition and data access, not cyber resilience, and the court allowed the combination. It would be wrong to recast the government's complaint as a judicial finding that the merger caused the attack. It is still relevant evidence that the clearinghouse occupied a central transaction position before the incident. (Justice Department merger challenge)

Concentration alone does not cause ransomware. It magnifies the consequence when prevention and recovery fail. The correct counterfactual is not simply "smaller company, no attack." It is a system in which a compromised clearinghouse can be isolated while customers rapidly reroute critical transaction classes through tested alternatives, with payer acceptance, credentials, mappings, reconciliation rules, and support already in place.

The AHA survey suggests that this counterfactual did not exist for many hospitals. Most respondents used workarounds, but 81 percent described them as only somewhat successful and another 11 percent as unsuccessful. The operational bottleneck was not always a lack of a competing clearinghouse. A replacement route also required contracts, interfaces, testing, payer enrollment, file configuration, staff knowledge, and a way to reconcile transactions accumulated during the outage.

Detection: containment began after the damaging work was done

The public timeline establishes a nine-day interval between the first remote access on February 12 and ransomware deployment on February 21. Within that interval, the actor escalated privilege and exfiltrated protected health information. UnitedHealth Group said it detected the ransomware on February 21. It has not publicly shown that it detected and contained the earlier credential use, privilege escalation, directory access, or data movement before encryption began.

That is a confirmed detection gap in outcome, but the internal cause remains unknown. Several possibilities fit the known facts: the relevant telemetry did not exist; it existed but did not cover the legacy environment; alerts were generated but rated too low; analysts lacked context; malicious actions resembled legitimate administration; or investigators saw signals but could not establish an intrusion in time. The public record does not distinguish among them.

This boundary matters for practical accountability. Saying "monitor better" is not a control. The testable questions are whether every remote-access event reached central analytics; whether a login using a compromised account differed by device, geography, time, or behavior; whether privilege escalation and directory access generated high-priority signals; whether service accounts and hypervisor administration were monitored; whether large or unusual data transfers were blocked or investigated; and whether the acquired environment had equal detection coverage to the parent environment.

The incident also exposes a metric problem. UnitedHealth Group told Congress that it had more than 1,300 people in its information-security program, invested about $300 million annually, and thwarted attempted intrusions at high frequency. Those numbers describe scale and activity. They do not prove that a specific critical access path was covered. Security accountability depends less on the total budget than on whether the mandatory control was present on every consequential route and whether deviations were visible to someone empowered to close them.

Response: decisive containment, destructive dependency

UnitedHealth Group's first major response action appears to have been fast and defensible. It severed connectivity to Change Healthcare systems after detecting ransomware. That action reduced the chance of further contamination and, according to the company, kept the incident from spreading into other UnitedHealth Group systems. The response should therefore not be described as uniformly ineffective.

But successful containment at the enterprise boundary produced severe service loss at the ecosystem boundary. This is not a contradiction. It is the defining feature of a critical intermediary: disconnecting it may protect connected parties from malware while simultaneously denying them the service required to operate.

The company had to choose under uncertainty. Keeping suspect systems online could have enabled more encryption, data theft, or lateral movement. Taking them offline meant that pharmacies and providers lost trusted transaction paths. Isolation was the prudent immediate action. The accountability question is whether the business and its customers had prepared for the predictable service consequence of that action.

Evidence from independent pharmacies shows the gap. On February 28, the National Community Pharmacists Association reported that UnitedHealth Group said 90 percent of the country's roughly 70,000 pharmacies had to adjust claims processing. Pharmacy teams diverted traffic where they had multiple switch vendors or used offline processes where they did not. Those measures transferred coverage and payment uncertainty to the pharmacy. Some could not process manufacturer copay cards, and some patients faced a choice between paying more, waiting, or abandoning a prescription. (NCPA February 28 account)

On March 1, four pharmacy associations said some pharmacies could not process prescription claims, some had gone a week without receiving electronic prescriptions, and many could not process patient-assistance copay cards. Their evidence was advocacy material, not a controlled survey, but it described specific transaction failures and the risk allocation created by offline dispensing. (Joint pharmacy association statement)

UnitedHealth Group took several measures to reduce care impact. It said Optum Rx would reimburse appropriate pharmacy claims filled in good faith. UnitedHealthcare temporarily suspended prior authorization for most Medicare Advantage outpatient services, with stated exceptions, and suspended some inpatient utilization review and Part D formulary exception processes. It offered temporary provider funding and later expanded it. These were substantive response measures.

They were also narrower than the dependency network. UnitedHealth Group did not control every payer, state program, pharmacy benefit manager, or provider contract that used Change infrastructure. HHS and CMS therefore urged other payers to relax utilization management and timely-filing rules, provide advance funding, and execute business-continuity plans. This illustrates distributed responsibility: Change controlled platform recovery, but downstream continuity also depended on payer decisions and public-program flexibility.

Recovery was a sequence, not a switch

The phrase "service restored" concealed several different states. A central platform could be technically available while a payer was not connected. A payer connection could be active while a provider's submission route remained unconfigured. A claim could be transmitted while payment, remittance, eligibility, attachment, or reconciliation functions were still unavailable. A pharmacy switch could process most claims while manufacturer coupons or Medicare Part B billing remained impaired.

The restoration record is therefore best read function by function.

Pharmacy routing recovered first. By March 7, UnitedHealth Group said electronic prescribing and major pharmacy claims and payment systems were functioning. By March 18, it reported 99 percent restoration of pharmacy network services. That was a major reduction in immediate patient-access risk. It did not mean every pharmacy product had recovered. NCPA reported on March 19 that MedRx, used by many pharmacies for Medicare Part B claims, still lacked a restoration forecast and that patients continued to face trouble with manufacturer copay assistance. On March 29, NCPA said MedRx claims functions were back, while eligibility checks were still expected later and payment backlogs remained possible. (NCPA March 19 update; NCPA March 29 update)

Electronic payment availability did not equal complete payment recovery. UnitedHealth Group restored its electronic-payments platform on March 15 and began payer implementations. More than five weeks after the attack, its April 22 update put Change payment processing at about 86 percent of the pre-incident level. Payment lag mattered because providers had already financed care, payroll, medicines, and supplies during the interruption.

Claims restoration required staged releases and customer reconnection. Change began releasing medical-claims preparation software on March 18, with third-party attestations expected before operation. UnitedHealth Group later said claims across the health system were flowing near normal as systems returned or providers moved to other methods. This aggregate statement did not mean each Change product or each provider had recovered. The company itself acknowledged a smaller set of providers remained adversely affected.

Backlog clearance extended beyond platform availability. Transactions generated during the outage had to be submitted, corrected, matched, and paid. Claims could fail timely-filing or authorization rules. Duplicate submissions and parallel clearinghouse routes could create reconciliation work. Staff who had spent weeks on manual workarounds then had to process accumulated claims while resuming ordinary operations. That is why an infrastructure recovery measure should include backlog age, rejection rates, remittance completion, and customer-level reconnection, not only platform uptime.

Data recovery and victim notification followed a different calendar. The company confirmed data exfiltration on March 7, obtained an investigable dataset on March 13, publicly warned of broad PHI and PII exposure on April 22, began rolling customer notices on June 20, and mailed individual notices later. The dataset had to be unpacked, attributed to customers and individuals, and coordinated with regulated entities. That complexity explains part of the duration. It does not erase the privacy consequence of people waiting months to learn whether particular data was involved.

The recovery program was costly even for UnitedHealth Group. Its 2024 Form 10-K separated $2.2 billion in direct response costs from $867 million in estimated Optum Insight business-disruption impacts. It also reported about $640 million in medical costs associated with temporarily suspended care-management activities. These categories should not be added casually to every public estimate of social loss because they describe different company accounting effects, and provider losses or delayed cash are not the same as UnitedHealth Group expense. They do, however, demonstrate that the incident remained economically material even after the company initially told investors on March 8 that it had not determined the incident was reasonably likely to materially affect financial condition or operating results.

The burden moved to hospitals, small practices, and pharmacies

The strongest case for accountability is not the headline size of the breach. It is the direction in which risk moved when central controls failed.

Hospitals financed the interruption

The AHA surveyed nearly 1,000 hospitals between March 9 and March 12. Ninety-four percent reported a financial impact, 82 percent reported cash-flow effects, and more than half described the financial impact as significant or serious. Among hospitals reporting cash-flow effects, nearly 60 percent put the revenue effect at $1 million per day or more. Seventy-four percent reported a direct patient-care impact. Nearly 40 percent reported patient difficulty associated with delays in utilization requirements such as prior authorization.

These results have limits. AHA represents hospitals, the response sample was not necessarily representative of every hospital, and reported impact is not independently audited loss. The figures still establish three mechanisms with high confidence: revenue was delayed, administrative work increased, and care workflows were affected. Hospitals with greater reserves could bridge the gap. Smaller, rural, or already strained institutions had less room.

CMS's response confirms the cash mechanism independently. The agency allowed eligible providers and suppliers to request up to thirty days of Medicare claims payments based on a prior-period average. Those advances were subject to recoupment. This prevented a temporary transaction failure from becoming an immediate funding stop for some organizations, but it converted missing current cash into a repayable advance. CMS later closed the special program on July 12, 2024 after observing that providers could successfully bill Medicare through available claims-processing systems. (CMS program closure)

The public intervention also reveals a policy asymmetry. Providers were expected to keep delivering care even when the private payment rail failed. Public programs could advance money, but taxpayers and providers temporarily carried liquidity risk created by a private infrastructure incident. That does not make public assistance improper; continuity demanded it. It does mean the cost of weak supplier resilience was distributed beyond the supplier and its shareholders.

Small physician practices absorbed working-capital and labor shocks

The AMA's April survey offers the clearest SME evidence. Eighty percent of respondents reported lost revenue from unpaid claims. Eighty-five percent used additional staff time and resources for revenue-cycle work. Fifty-five percent used personal funds for practice expenses, 44 percent said they could not purchase supplies, and 31 percent said they could not make payroll. Only 15 percent reported reducing hours, which suggests many practices tried to preserve care by absorbing the financial and labor burden elsewhere.

The survey was a convenience sample and cannot yield a national loss estimate. Its composition is nevertheless relevant to the controlled topic: 78 percent of respondents came from practices with ten or fewer physicians. These organizations had less capacity to maintain multiple clearinghouse relationships, build emergency interfaces, or carry weeks of receivables. For them, vendor continuity was not an information-technology abstraction. It was the difference between a booked service and cash available to pay staff.

Funding did not reach all respondents. The AMA said 25 percent reported assistance from UnitedHealth Group or Optum, 12 percent from CMS, 4.5 percent from other health plans, and 0.7 percent from state Medicaid plans. Categories may overlap, and the survey did not establish the amount or adequacy of aid. The figures show that emergency finance reached a minority of the sample through each channel while personal funds remained a common bridge.

This is where contract language can diverge from operational dependence. A small provider may formally choose a billing vendor or clearinghouse, yet its real switching options depend on payer enrollment, software support, transaction mappings, and staff capacity. Accountability should not assume that the downstream organization had equal ability to prevent or shorten the outage simply because it signed a vendor contract.

Independent pharmacies took patient-access and audit risk

Pharmacies faced an immediate decision at the counter. If eligibility or claim adjudication was unavailable, they could decline or delay dispensing, charge cash, route through an alternative, or provide medicine in good faith and submit later. Each option moved risk to the patient or pharmacy.

Independent pharmacies had a particular exposure because they purchase inventory before reimbursement and often operate with thin liquidity. The outage also affected copay-card and voucher functions, so even when the underlying medicine was available, the mechanism that reduced a patient's out-of-pocket cost might not be. On May 1, NCPA told Congress that independent pharmacies continued to experience financial and operational disruption and asked plans and pharmacy benefit managers to pause audits and protect claims dispensed in good faith. NCPA is an advocate for its members and used forceful language about vertical integration; its policy conclusions are contested positions. Its account of continuing workflow categories is still useful impact evidence. (NCPA May 1 statement)

Audit relief was part of continuity because improvised records could later be judged under normal documentation rules. NCPA reported that Optum Rx planned to exclude claims filled during the outage from certain audits and to use temporary do-not-audit treatment for some pharmacies. This is an important lesson: recovery is incomplete if an organization restores the transaction rail but later penalizes counterparties for reasonable deviations taken while that rail was unavailable.

Payment and attribution must remain separate

The public debate around the $22 million ransom often merges three claims: who attacked, who received money, and whether the data was deleted. The evidence supports different confidence levels for each.

Confirmed: UnitedHealth Group told the Senate Finance Committee that it paid a demanded $22 million ransom in Bitcoin. This is stronger evidence than the blockchain reporting and criminal-forum claims that circulated in March because it is the payer's own written answer to Congress.

Confirmed as company attribution, not a criminal adjudication: UnitedHealth Group said ALPHV/BlackCat, working with an affiliate, claimed responsibility. The Justice Department's prior description of ALPHV as a ransomware-as-a-service operation explains why the brand and the hands-on attacker may not be the same actor. Affiliates can obtain access and deploy a service operator's malware in exchange for sharing ransom proceeds.

Probable: The payment was intended to reduce data-publication risk and support recovery from extortion. Witty publicly said he made the decision to pay. The company has not published a full negotiation record, sanctions review, insurance treatment, decryption assessment, or decision log.

Unknown: Whether every copy of stolen data was destroyed. A criminal promise is not technically verifiable after exfiltration. Later extortion claims by actors using other names cannot be treated as proof of a second independent intrusion without corroborating forensics. They do, however, show why ransom payment cannot substitute for notification, monitoring, and long-term identity-protection measures.

Disputed as policy: Some argue that payment was necessary to protect patients and accelerate recovery; others argue that paying a ransomware operation funds future attacks and does not guarantee deletion. This article cannot resolve that counterfactual because the evidence needed to compare recovery with and without payment is not public. The accountable minimum is narrower: document who authorized payment, which alternatives were tested, what law-enforcement and sanctions checks were completed, what operational benefit was expected, and what evidence later showed that benefit occurred.

Who controlled what

Accountability should be allocated by capability before the incident, authority during it, and evidence after it.

The criminal actors

The attackers controlled the unauthorized access, privilege escalation, exfiltration, encryption, and extortion. Their conduct was the malicious driver of the event. No corporate-control analysis should dilute that responsibility.

Change Healthcare and UnitedHealth Group

The companies controlled the remote-access service, MFA deployment, identity architecture, server lifecycle, post-acquisition integration, monitoring coverage, data environment, recovery architecture, customer communications, funding program, and restoration sequence. UnitedHealth Group also controlled the decision to sever connectivity and pay the ransom.

The strongest accountability finding is therefore direct and limited: an external-facing legacy server remained without a policy-required control about sixteen months after acquisition, and criminals used compromised credentials against it. The company has not published evidence of an accepted exception, compensating control, or reason that the condition could not have been closed sooner.

UnitedHealth Group deserves credit for rapid containment, extensive restoration work, funding advances, temporary utilization-management relief, and taking on notification for many customers. Those actions reduced harm. They do not retroactively satisfy the missing preventive control or prove that continuity preparation matched the clearinghouse's systemic role.

Payers and pharmacy benefit managers

Payers controlled whether to relax prior authorization, timely-filing, utilization-review, and audit rules. They also controlled whether to advance funds based on claims history while normal transactions were unavailable. HHS and CMS publicly urged action in these areas because provider continuity depended on it.

UnitedHealth Group had broader responsibility than an ordinary parent because its UnitedHealthcare and Optum businesses occupied payer, pharmacy-benefit, care, and technology roles. That vertical structure created both capacity and conflicts. It allowed the group to suspend some requirements and finance advances quickly. It also meant affected providers could be dependent on one corporate family for both the failed transaction service and parts of the relief. This is a governance concern, not proof of unlawful conduct.

Providers and pharmacies

Downstream organizations controlled local business-continuity planning, vendor inventory, cash reserves, offline procedures, alternative clearinghouse or switch relationships, and staff training. Larger systems with tested secondary paths had more ability to reroute. Smaller organizations had less.

Their responsibility is real but bounded. A provider cannot enable MFA on Change Healthcare's portal, segment Change's directory, detect Change's exfiltration, or restore Change's payment platform. Nor can it unilaterally make every payer accept an emergency route. Local redundancy is therefore a compensating control, not a transfer of primary responsibility for the supplier failure.

HHS, CMS, and sector regulators

The federal government controlled public-program flexibilities, sector coordination, investigation, and the baseline regulatory environment. OCR initiated investigations focused on whether unsecured protected health information was breached and on compliance with the HIPAA rules. The existence of an investigation is not a finding of violation.

The event raised a broader regulatory question: should a clearinghouse with national transaction reach face resilience obligations closer to those imposed on other critical intermediaries? The HHS healthcare cybersecurity performance goals already identify high-impact practices such as MFA, incident planning, vulnerability management, and resilient recovery, but the goals are described as voluntary. (HHS healthcare cybersecurity performance goals)

Regulators also faced their own continuity challenge. They had to create payment accommodations after the outage began. A mature sector plan would predefine triggers, data requirements, payer coordination, and repayment terms for a national clearinghouse interruption so that emergency liquidity does not depend on improvisation.

Practical controls that follow from the evidence

The point of a forensic account is not to produce a longer list of generic safeguards. Each proposed control should answer a demonstrated failure and have an observable test.

1. Make external access coverage measurable

Every internet-facing and partner-facing access service should appear in a continuously reconciled inventory with an owner, authentication method, data sensitivity, and last verification date. Phishing-resistant MFA should be mandatory for remote access and privileged administration. A dashboard percentage is insufficient unless the denominator is independently reconciled against network exposure, cloud configuration, acquired assets, and vendor-managed services.

Exceptions should expire. They should name an accountable executive, state the business reason, specify compensating controls, and include a decommission or remediation date. High-consequence services without MFA should trigger isolation, not indefinite acceptance. The Change incident shows why inherited technology cannot remain in a transitional category without a hard end state.

2. Treat acquisition security as a closing obligation

M&A integration should begin with identity and exposure, not branding or administrative consolidation. Before or immediately after close, the buyer should identify remote-access paths, privileged directories, hypervisor management, service accounts, backup systems, data stores, security telemetry, and dependencies that could interrupt critical products.

The board or a delegated risk committee should receive exception-level reporting: which acquired assets remain below standard, what consequence they carry, how long they have been open, and who accepted the risk. A statement that teams are "working to bring" a legacy server to standard is not enough sixteen months after close when that server fronts a national transaction intermediary.

3. Isolate identity tiers and virtualization control

Remote users should not have an ordinary path to domain-wide or hypervisor administration. Privileged access should use separate identities, hardened workstations, just-in-time elevation, strong MFA, session recording, and explicit approval for high-risk actions. Active Directory tiers, ESXi management, backup administration, and security tooling should have independent trust boundaries.

The test is adversarial: starting from a compromised remote-access credential, can a red team reach directory administration, alter security controls, access broad data stores, or encrypt virtualization infrastructure? If it can, the organization has measured its real blast radius instead of assuming segmentation exists because network zones have different names.

4. Detect the pre-ransomware sequence

Detection engineering should focus on the documented chain: unusual remote access, impossible or high-risk authentication, privilege escalation, directory reconnaissance, creation or use of administrative sessions, access to large claims datasets, staging or compression, abnormal egress, security-tool interference, and ESXi administration.

Coverage must include acquired and legacy environments. Alerts need owners and response deadlines. The organization should be able to demonstrate when a simulated compromise is first detected, who receives the alert, what context is available, and whether the analyst can disable the identity and isolate the session before data leaves.

5. Build transaction failover, not only system backup

Backups restore data and software. They do not automatically restore a healthcare transaction network. Clearinghouse resilience requires warm alternate routes for each critical function: pharmacy claim switching, eligibility, medical claims, remittance, electronic payment, prior authorization, attachments, copay support, and Medicare Part B pharmacy billing.

Customers and payers should pre-negotiate emergency acceptance. Credentials, endpoint addresses, companion guides, provider identifiers, payer enrollments, test files, and reconciliation rules should be maintained before an incident. Exercises should prove that a representative small practice, rural hospital, and independent pharmacy can switch, not just that the largest customers can.

Metrics should include customer reconnection time, percentage of pre-event transaction volume by function, oldest unprocessed claim, payment lag, rejection rate, duplicate rate, and unresolved exception count. A platform-wide "percent restored" is too coarse for continuity decisions.

6. Pre-arrange liquidity and rule relief

Critical intermediaries and payers should maintain a standard emergency-advance mechanism based on historical paid claims. Terms should be plain, interest-free during the emergency period, proportionate, and protected against abrupt recoupment. Application requirements should be light enough for small providers already dealing with operational disruption.

Payers should also predefine when prior authorization, timely filing, audit, and documentation rules will be relaxed. Relief should apply to good-faith care delivered during the affected period and continue through backlog clearance. This prevents an outage response from becoming a later denial or audit problem.

Public programs should coordinate with private payers before a crisis. CMS's 2024 intervention was important, but a repeatable mechanism would reduce delay and uneven eligibility in the next event.

7. Reduce and map data consequence

Claims intermediaries need dataset-level retention rules, customer attribution, encryption, access partitioning, and tested notification data. The company should know which organization supplied a record, which individuals are associated with it, what fields are present, and how to contact the responsible covered entity. That is both a privacy control and a recovery control.

The notification process showed how difficult attribution becomes after a large, mixed dataset is stolen. Data minimization can reduce the quantity exposed; data mapping can reduce the time needed to tell people what happened. Neither control prevents ransomware, but both limit the second incident that follows the outage: prolonged uncertainty about personal information.

8. Exercise isolation at full business scale

The decisive containment action was to disconnect Change systems. That scenario should be exercised deliberately: assume the clearinghouse must remain isolated for thirty days, assume credentials are untrusted, and assume restoration must occur in a clean environment. Then measure patient-access exceptions, claims volume, cash needs, customer support, payer rerouting, and notification capacity.

Tabletop exercises that stop at executive decision-making are insufficient. The exercise should process test transactions through alternate routes, fund a simulated small practice, dispense a prescription under an offline rule, reconcile duplicate claims, and restore a representative service from clean infrastructure. Continuity must be demonstrated in the workflow where harm appears.

The controls align with federal ransomware guidance that emphasizes phishing-resistant MFA, network segmentation, offline or protected backups, and recovery planning. They also go beyond it where the incident requires: a clearinghouse needs ecosystem-level transaction continuity, not only enterprise recovery. (CISA StopRansomware guide)

Liability and control are related, but not identical

The public record supports an assessment of exposure channels. It does not support a declaration that UnitedHealth Group or Change Healthcare is legally liable to every affected party.

HIPAA and breach notification

Change Healthcare is a healthcare clearinghouse and also acts as a business associate in many relationships. HHS states that the HIPAA Security Rule requires regulated entities to use administrative, physical, and technical safeguards to protect electronic protected health information. OCR said its investigations would focus on whether a breach of unsecured PHI occurred and on Change Healthcare's and UnitedHealth Group's compliance with the HIPAA rules. (HHS Security Rule summary)

The missing MFA control, privilege escalation, data exfiltration, and notification timeline are relevant facts for such a review. They do not by themselves establish a particular regulatory violation or penalty. HIPAA analysis depends on the entity's role, risk analysis, implemented safeguards, documentation, incident response, business-associate arrangements, and the regulator's findings.

Notification responsibility was unusually complex because Change held data for many covered entities. OCR clarified that covered entities remained responsible for ensuring notification but could delegate the task to Change Healthcare. Change offered to perform notification and related administration for customers. The rolling process reflected both the scale of the dataset and the legal relationships around it.

Contract and service obligations

Providers, pharmacies, payers, and vendors may have contractual claims or defenses concerning availability, security commitments, service levels, fees, indemnities, data handling, and emergency advances. Outcomes will turn on individual agreements, limitations of liability, causation, notice, damages, and governing law. The public record does not provide those contracts.

The fact that providers incurred loss does not prove that every loss is recoverable from Change. Conversely, the criminal origin of the attack does not automatically eliminate supplier responsibility if a contract or applicable law required safeguards or continuity measures. Those are legal questions for specific records and forums.

Private cases were consolidated for coordinated pretrial proceedings in federal multidistrict litigation. The transfer order records common allegations and procedural efficiency; it is not a finding that the defendants breached a duty or caused a compensable loss. (Judicial Panel on Multidistrict Litigation transfer order)

Securities disclosure

UnitedHealth Group filed an initial Form 8-K on February 22 and an amendment on March 8. The amendment said the company had not determined that the incident was reasonably likely to materially affect its financial condition or results. The 2024 Form 10-K later quantified billions in direct response and disruption effects.

That progression does not prove the earlier disclosure was false. Materiality assessments are made with information available at the time, and the March filing acknowledged an unprecedented attack and ongoing restoration. It does identify a legitimate accountability question: what operational and financial evidence existed on each disclosure date, how did management evaluate it, and when did expected costs and lost revenue cross internal thresholds? The SEC correspondence record shows staff asked UnitedHealth Group about its consideration of amended disclosure, but correspondence alone is not an enforcement finding. (UnitedHealth Group response to SEC staff)

Ransom payment and sanctions risk

Ransom payments can create legal and compliance risk depending on the recipient, sanctions status, and transaction circumstances. The public evidence confirms the amount and payment medium but does not disclose the complete diligence process or recipient attribution. No supported conclusion about a sanctions violation can be drawn from the public record cited here.

Corporate and board oversight

UnitedHealth Group told Congress that its Audit and Finance Committee received recurring cybersecurity reports and covered cybersecurity at regularly scheduled quarterly meetings. It later added Mandiant as an adviser to that committee. Board attention is relevant, but meeting frequency is not the same as control effectiveness.

The sharper oversight question is whether reporting exposed the actual exception: an external legacy service below mandatory identity standards in a critical acquired business. If the board was not told, management reporting may have been too aggregated. If it was told, the record would need to show the accepted rationale and remediation schedule. Public materials do not answer that question.

What remains unknown or disputed

A restrained account should end with the evidence it does not have.

Unknown: How the credentials were first compromised; whether the account had been reused elsewhere; whether password monitoring had identified exposure; and whether the login differed from the user's normal behavior.

Unknown: The complete privilege-escalation path, the administrative identities used, the role of service accounts, and the exact route to Active Directory and ESXi management.

Unknown: Which pre-ransomware alerts fired, whether analysts reviewed them, and whether legacy Change systems had the same endpoint, identity, network, and data-loss telemetry as UnitedHealth Group systems.

Unknown: The detailed segmentation design, backup architecture, clean-room capacity, recovery-point performance, and service-by-service recovery objectives in force before the attack.

Unknown: The total stolen-data volume, every storage source, the necessity and age of each retained record, and whether criminals kept or redistributed copies after payment.

Unknown: The total social cost. UnitedHealth Group's expense, provider cash-flow delays, patient out-of-pocket payments, staff time, pharmacy inventory financing, public advances, and privacy harm are different categories. Adding them without eliminating overlap would create a misleading number.

Disputed: How much vertical integration aggravated the event and how much it helped finance response. Critics argue that concentration created a dangerous single point and placed relief within the same corporate family. UnitedHealth Group can point to rapid group-wide resources, billions in advances, and the containment of the incident to Change. Both mechanisms may have operated at once.

Disputed: Whether paying the ransom reduced net harm. The decision may have been made under severe patient and data risk, but deletion cannot be verified and payment can strengthen the ransomware economy. Without the negotiation, decryption, and recovery counterfactuals, categorical judgment would exceed the evidence.

Confirmed and not disputed by the company: Policy required MFA on external-facing applications; the legacy server used for initial access did not have it; the threat actor entered with compromised credentials; and the server had not yet been brought to the parent's standard.

The accountability conclusion

The Change Healthcare incident should not be remembered as proof that any sufficiently determined attacker can defeat any organization. That framing removes decisions from view. The entry path defeated a control that the companies already required. The attacker then had time to escalate privilege and remove data before ransomware made the compromise undeniable.

Nor should the event be reduced to one missing MFA prompt. That control explains preventable entry. It does not by itself explain why pharmacies, hospitals, public programs, and small practices across the country had to improvise claims, payment, authorization, and medication workflows for weeks. The larger failure was that a highly concentrated transaction intermediary could not be disconnected without transferring continuity risk to organizations least able to finance it.

Practical responsibility follows the power to change those conditions. UnitedHealth Group and Change Healthcare had the greatest control over identity, integration, architecture, monitoring, data, and platform recovery. Payers controlled administrative relief and funding. Providers controlled local fallback to the extent the market and their resources allowed. HHS and CMS controlled public-program response and the regulatory baseline. Criminal actors controlled the attack.

The durable test is therefore concrete. An external access route must not remain below policy after acquisition. A compromised remote credential must not lead to directory and hypervisor control. Abnormal access and exfiltration must be detected before encryption. A clearinghouse must be able to isolate its environment while critical transactions continue through tested alternatives. And when those controls still fail, emergency liquidity and rule relief must reach the small practice and local pharmacy before they are forced to choose between continuity of care and continuity of business.