Change Healthcare Hack Sparks New Cybersecurity Regulations 

On February 12, 2024, hackers from the ransomware group ALPHV used credentials found on the dark web to log in remotely to the Change Healthcare network servers. Because the company did not require multi-factor authentication, the hackers gained full access to one of its key servers and, after a week, dropped ransomware, shutting down much of the network. 

If that wasn’t bad enough, in April, ALPHV executed a double-extortion attack by hitting Change with a second round of ransomware. They claimed to have 4TB (a huge amount) of the company’s data containing personally identifiable information belonging to active US military personnel and other patients: medical records, payment information, etc. ALPHV warned that they would sell the data to the highest bidder if the ransom was not paid within twelve days. Change admitted to paying the $22M ransom. 

The hacks caused serious cashflow issues for small and medium-size healthcare providers and delays in processing claims. (Change Healthcare, a subsidiary of UnitedHealth Group, is one of the world’s largest health payment processing companies. It is a clearing house for 15 billion claims yearly, accounting for 40% of national claims.) The government stepped in to offer short-term loans until the claims could be processed. 

Although Change reacted quickly to avoid spreading the ransomware to the UnitedHealth network, they failed to notify customers and vendors as required by the Health Insurance Portability and Accountability Act (HIPAA) . In May, more than 100 medical associations banded together to urge federal regulators to hold Change responsible. In June, notifications went out to patients, providers, and vendors. 

Three months later, after two hearings on the matter, the Senate Committee on Finance decided to draft a law called the Health Infrastructure Security and Accountability Act (HISAA) to work in conjunction with HIPAA. According to the FBI, the healthcare sector is the #1 target of ransomware. They claim that the hacks are entirely preventable and are a direct result of lax cybersecurity practices by healthcare providers. They add that healthcare has some of the weakest cybersecurity rules of any federally regulated industry. 

If passed, HISAA will establish newer, stronger, stricter security requirements applicable to HIPAA-covered entities and business associates. That includes large and small organizations alike. The Cybersecurity and Infrastructure Agency will decide minimum requirements; annual risk assessments involving disaster planning, recovery planning, and incident handling must be developed by an independent auditor; organizational leadership will be required to sign a document affirming their compliance. And thanks in large part to Change Healthcare’s lateness in notifying the public of the ALPHV security breach, transparency requirements will also tighten up tremendously. HHS must be notified within 24 hours. Affected individuals must be notified within 48, and if the breach affects more than 500 people, the media must be notified within 72.  

The bill has teeth due to its heavy penalties and fines for non-compliance. HISAA would establish tiered monetary penalties up to $5000 per day for failure to meet the new minimum and enhanced security requirements. 

HISAA has not yet been signed into law. It promises to provide the oversight and enforcement structure that was largely missing from HIPAA. This may cause additional burdens that local healthcare providers will have to bear. They can thank Change Healthcare for the increased scrutiny. If you are a local healthcare provider, you are not alone. Your friendly neighborhood Cyber Guys can help guide you along the path to solid cybersecurity defenses and compliance with any new cyber laws. 

This article was originally published in the Sierra Vista Herald here.