Senator Hassan Calls for Consumer Notifications, Secures Commitment for Improved Contract Terms for Doctors and Hospitals at Senate Hearing
WASHINGTON – U.S. Senator Maggie Hassan (D-NH) called for UnitedHealth Group to immediately notify patients that their data was potentially stolen in the recent cyberattack on Change Healthcare, a subsidiary of UnitedHealth Group, during a Senate Finance Committee hearing today. Senator Hassan also secured a commitment from Andrew Witty, CEO of UnitedHealth Group, to remove or waive “exclusivity” clauses from Change Healthcare’s contracts, which will make it easier for health care providers to make contingency plans and pivot quickly to different payment processors in the event of future cyberattacks.
To watch Senator Hassan’s hearing questions, click here.
UnitedHealth Group recently announced that cybercriminals likely obtained sensitive personal information that could cover “a substantial proportion of people in America.” Senator Hassan, who sent a letter to UnitedHealth Group yesterday outlining steps they should take to protect patients whose data may have been breached, reminded Mr. Witty that UnitedHealth Group is obligated under the Health Insurance Portability and Accountability Act (HIPAA) to inform individuals and the U.S. Secretary of Health and Human Services if their personal information is exposed or “reasonably believed” to be exposed in a hack. “When in doubt, you have to notify people who may have been affected by the breach,” Senator Hassan said at the hearing.
Mr. Witty testified that UnitedHealth Group has not yet met its obligations under HIPAA to notify individuals about the hack, and Senator Hassan pressed Mr. Witty on when UnitedHealth Group will be sending notifications and information about identity protections that UnitedHealth Group set up to help individuals.
“The attack happened on February 21st. The HIPAA deadline for reporting to the agency and to individuals was April 21st. It’s now May 1st,” said Senator Hassan. “Ten weeks is way too long for millions of Americans to not know that their records may be available to criminals on the dark web.”
Next, Senator Hassan highlighted issues with “exclusivity” terms included in Change Healthcare’s contracts that forbid health care providers from concurrently using claims management or payment systems offered by other companies. When Change Healthcare’s claims management system went down, some hospitals did not have alternatives in place because it was explicitly prohibited in their contract with Change Healthcare – compounding the months-long devastating financial impacts of the outage.
“Health care providers want to have contingency plans to be better prepared for system failures,” said Senator Hassan. “Some in New Hampshire have told me that they are no longer comfortable with the risk of relying on a single system for processing their payments.”
Mr. Witty committed to waiving “exclusivity” terms in current contracts and modifying future contracts with Change Healthcare so that health care providers are able to have other management and payment systems in place. This will help prevent single points of failure in the health care sector.
Senator Hassan has been engaged in helping get hospitals and doctors relief from the February 21 cyberattack on Change Healthcare, a UnitedHealth Group company, and continues to work to mitigate the fall-out of this incident as well as ensuring that the lessons from it are shared broadly to help prevent something similar from happening again. Yesterday, Senator Hassan sent a letter urging UnitedHealth Group to take more action and notify people of the potential disclosure of their information as well as other required breach notifications, and for consumers to get access to resources if they were potentially impacted. Soon after the cyberattack first occurred, Senator Hassan raised the issue of the cyberattack and its fallout in conversations with President Joe Biden and Health and Human Services Secretary Xavier Becerra, and pressed UnitedHealth Group on the inadequacy of its initial assistance program for doctors and hospitals, some of whom lost up to 98 percent of their cash flow. Senator Hassan then met with UnitedHealth Group CEO Andrew Witty and secured a commitment for improvements to the financial assistance program for hospitals and doctors. She has since talked to Witty multiple times to ensure the company was following through on its commitments, and several New Hampshire hospitals have enrolled in the updated financial assistance program.
###
