Navigate the healthcare industry
Healthcare Brew covers pharmaceutical developments, health startups, the latest tech, and how it impacts hospitals and providers to keep administrators and providers informed.
A pharmacy group joined providers in filing a class-action lawsuit on July 19 over February’s cyberattack against Change Healthcare. The plaintiffs claim some providers are still waiting on delayed payments for healthcare services.
The National Community Pharmacists Association (NCPA), which represents more than 19,000 pharmacies nationwide, claimed alongside 30+ providers that UnitedHealth Group and its subsidiaries Optum and Change Healthcare could have done more to prevent the cyberattack, such as using multi-factor authentication on the server that hackers infiltrated.
The suit also criticized the insurance giant’s decision to take the system offline without a backup plan—a decision that cost UnitedHealth Group up to $2.5 billion in 2024, Modern Healthcare reported.
“UnitedHealth Group and its subsidiaries need to be held accountable for their lax security measures and for their failure to provide our members with adequate support and assurances to alleviate the financial losses our members suffered,” NCPA CEO B. Douglas Hoey said in a press release.
What happened? In February, hackers stole six terabytes of patient information, including Social Security numbers and driver’s licenses. In response, UnitedHealth Group took parts of its Change system offline to stop them from taking more, which halted healthcare payments, claims processing, and other services.
Since the attack, UnitedHealth Group has advanced over $3.3 billion in loans to providers and pharmacies struggling with cash flow amid delayed payments. But some providers and pharmacies are struggling to make rent and pay staff salaries after taking care of patients and filling vital prescriptions that they still haven’t been reimbursed for, the suit alleges.
What’s next? In addition to July’s lawsuit, dozens of other providers and patients took UnitedHealth Group to court in June over issues related to February’s breach, Reuters reported.
Reuters also reported that in an April court filing, Change said that the lawsuits are “based on the incorrect and unfounded theory that, because a cyberattack occurred, Change’s security must have been deficient, and plaintiffs must have been harmed.”