Breach Notification , HIPAA/HITECH , Security Operations

100 Groups Urge Feds to Put UHG on Hook for Breach Notices

More than 100 medical associations and industry groups representing tens of thousands of U.S. doctors and healthcare professionals have banded together to urge federal regulators to hold Change Healthcare responsible for breach notifications related to a massive February ransomware attack.

See Also: The Expert Guide to Mitigating Ransomware & Extortion Attacks

The groups in a letter Monday asked the U.S. Department of Health and Human Services to publicly state that its "breach investigation and immediate efforts at remediation" will be focused solely on Change Healthcare - and not the providers affected by the Change Healthcare breach.

Although UnitedHealth Group has stated that it will offer to handle breach notification work for customers "where permitted," the medical associations and industry groups sending the letter to HHS Secretary Xavier Becerra and HHS Office for Civil Rights Director Melanie Fontes Rainer are seeking more clarity about what all this means for organizations whose patients' protected health information was compromised in the incident.

"We are concerned that without further guidance from OCR, clinicians and providers have not received sufficient confirmation from OCR that HIPAA breach reporting and notification requirements related to this incident are the responsibility of UHG/Change Healthcare as the HIPAA covered entity which experienced the breach of unsecured PHI," the letter says.

"In addition, OCR must affirm its position that the breach was perpetrated upon Change Healthcare, whose status as a healthcare clearinghouse makes them a covered entity under HIPAA and thus responsible for the breach of any PHI which it processes or facilitates the processing of.

"Because Change Healthcare experienced impermissible access to unsecured PHI that it processed on behalf of other covered entities, no entity other than Change Healthcare, its parent company, UnitedHealth Group, and their corporate affiliates such as Optum, bears responsibility for this breach and is under any legal reporting or notification obligation as a result of it."

HHS OCR in April issued guidance in the form of "frequently asked questions" reminding HIPAA-covered entities and business associates of their breach reporting and notification duties in the aftermath of the Change Healthcare attack (see: Feds Issue Guide for Change Health Breach Reporting Duties).

In that guidance, HHS OCR said covered entities affected by the Change Healthcare attack are required to file breach reports to HHS and notifications to affected individuals "without unreasonable delay." Business associates affected by the incident also must notify affected covered entities after the discovery of the breach.

"Covered entities have up to 60 calendar days from the date of discovery of a breach of unsecured protected health information to file breach reports to OCR's breach portal for breaches affecting 500 or more individuals," HHS OCR says in the guidance.

The agency earlier issued a statement on March 13, soon after the Feb. 21 Change Healthcare cyberattack, saying that it had launched an investigation into the HIPAA compliance of Change Healthcare and its parent company UnitedHealth Group in anticipation of a forthcoming breach notification stemming from the incident.

HHS OCR said at the time that its interests in the investigation of other entities that partnered with Change Healthcare and UHG are "secondary." This includes the covered entities that have business associate relationships with Change Healthcare and UHG as well as organizations that are business associates with Change Healthcare and UHG.

But OCR should publicly confirm that any affected provider may rely on UHG's statement that it will handle notifications and undertake related administrative requirements on behalf of any provider or customer, since "as UHG bears sole responsibility for the breach, no breach notification requirements apply to any affected medical provider," the groups' letter says.

As of Tuesday, neither UnitedHealth Group nor Change Healthcare has disclosed whether it has yet reported a breach involving the incident.

UnitedHealth Group CEO Andrew Witty testified before two congressional committees earlier this month, saying the incident likely affected about one-third of the U.S. population, which could mean about 100 million or more people (see: Lawmakers Grill UnitedHealth Group CEO on Change Healthcare Attack).

A health data breach of that size would involve a massive notification event, unlike any seen in the healthcare sector previously.

HHS OCR did not respond to Information Security Media Group's request for comment on the groups' letter and instead referred ISMG to the agency's April guidance posted online about HIPAA breach notification duties involving the Change Healthcare attack.

Preemptive Measures

Some experts advise HIPAA-regulated entities that are likely affected by a Change Healthcare breach to take precautionary measures now to prepare for their potential notification duties involving a compromise of their patients' PHI.

"I would counsel covered entities and business associates to first check their business associate agreements about who is required to give notice to government agencies," said regulatory attorney Rachel Rose. "If no one is mentioned, then it defaults to the covered entities," she said.

HIPAA-regulated Change Healthcare customers also have an obligation under HIPAA to perform "reasonable diligence" to investigate and obtain information about the incident to determine whether the incident triggers notice obligations to their patients or members, said attorney Sara Goldstein of law firm BakerHostetler.

Reasonable diligence includes Change Healthcare customers frequently checking UHG and Optum's websites for updates on the restoration and data analysis process, contacting their Change Healthcare account representative on a regular basis to see if there are any updates specific to their organization, and engaging outside privacy counsel to submit a request for information directly to UnitedHealth Group to obtain further information about the incident, Goldstein said.

She also said organizations should document all steps taken to perform reasonable diligence, in case a regulator inquires about what the organization did in response to the incident to investigate.

Organizations affected by the Change Healthcare breach should provide notice of the incident to their cyber insurance carriers so that they can get access to notification mailing and other incident response vendors to assist with the notification process, if needed, Goldstein said.

Finally, in light of the massive disruption the Change Healthcare incident caused to thousands of healthcare sector entities that rely on the company's IT products and services, organizations should reassess their technical, administrative and physical safeguards right now, Rose said.

"One critical component is assessing their enterprise risk management program and updating business continuity and disaster recovery plans. In other words, 'What is our Plan B, and how are we going to manage the revenue cycle if something similar happens again?'"

Peer Pressure

Associations and industry groups that signed the letter sent to HHS include the College of Healthcare Information Management Executives, the American Health Information Management Association, the American Medical Association, state medical associations and societies, and the professional academies of several medical specialties, including the American College of Emergency Physicians.

In March, the American Hospital Association sent its own letter to HHS OCR requesting that the agency declare UnitedHealth Group as the sole sender of HIPAA breach notifications involving the Change Healthcare hack (see: Hospitals Lobby Feds to Clarify Breach Duties in UHG Attack).

The AHA also sent a letter to Witty on May 8 urging UHG to "officially" inform HHS OCR and state regulators that UHG will be "solely responsible" for all breach notifications required under law and to provide a timeline for when those notifications would occur.