A ransomware attack on Change Healthcare, that processes 15 billion health care transactions annually and deals with 1 in 3 patient records in the United States, is continuing to cause massive disruptions nearly three weeks later.
The hack shut down the system for processing claims, billing and verifying patients’ eligibility for receiving care. Prescriptions were delayed, while discharging patients from hospitals and issuing paychecks for medical workers also were targeted.
The incident, which started on February 21, has been called the “most significant cyberattack on the U.S. health care system” by the American Hospital Association.
Among other consequences are locked health records, which makes it impossible for doctors to see allergies of patients and medicines they take, as well as delayed testing and scanning services.
University of Minnesota School of Public Health experts estimate that ransomware attacks killed 42 to 67 Medicare patients between 2016 and 2021.
Reuters reported that UnitedHealth Group, owner of Change Healthcare, paid $22 million to hackers in a bid to recover access to encrypted data and systems, which both sides declined to comment on.
Even with a payment made, there is no guarantee that the hackers will delete the data. A recent global law enforcement action aimed at disrupting the prolific LockBit ransomware operation found that the cybercrime gang did not always delete the victim’s data as it claimed it would if a ransom was paid. Companies have begun to acknowledge that paying a ransom does not guarantee the return of their files
For those on the front-lines of healthcare cybersecurity, the worst-case scenario is that stolen patient records become public. The patient safety and economic impacts of this are going to be felt for years.
