Attorney General Ellison urges UnitedHealth Group to help patients and providers harmed by cyberattack on Change Healthcare

Leads bipartisan coalition of 22 attorneys general to urge UHG take more meaningful action in wake of catastrophic February 2024 attack that disrupted healthcare nationwide

Two years before attack, AG Ellison sued to block acquisition of Change Healthcare by UnitedHealth Group, arguing concentration of market power and data posed dangers

April 25, 2024 (SAINT PAUL) — Minnesota Attorney General Keith Ellison today led a bipartisan, multistate coalition of 22 attorneys general in a letter to UnitedHealth Group, Inc. — the nation’s largest health insurer and the parent company of Change Healthcare — urging the corporation to take more meaningful action to better protect providers, pharmacies, and patients harmed by the recent catastrophic outage of Change Healthcare.

On February 21, 2024, Change Healthcare experienced a cyberattack by ALPHV/Blackcat, which crippled its platform. In the intervening weeks, providers, pharmacies, and facilities have reported catastrophic disruptions to care infrastructure, inability to verify coverage or obtain prior authorization, and inability to process claims or obtain reimbursements. Patients report delayed or denied access to prescription drugs, and difficulty scheduling appointments or procedures. The Change Healthcare outage profoundly disrupted patient care and has put some providers on the precipice of financial ruin.

Change Healthcare runs the nation’s biggest electronic data clearinghouse. Its technological infrastructure is used by tens of thousands of providers, pharmacies, and insurers to verify insurance, confirm pre-authorization of procedures or services, exchange insurance claims data, and perform other administrative tasks essential to the delivery of health care.

UnitedHealth Group acquired Change Healthcare in 2022.

“As Attorney General, it is my job to help Minnesotans afford their lives and live with dignity, safety, and respect,” said Attorney General Ellison. “That includes making sure that patients and providers aren’t left holding the bag when a too-big-to-fail health care conglomerate does indeed fail. It is past time for UnitedHealth Group to use its considerable resources to make providers and patients whole after the catastrophic failure of its system.”

Attorney General Ellison and the bipartisan coalition call upon UnitedHealth Group to act quickly to limit the harm to the states’ care providers and patients. Specifically, the coalition asks UnitedHealth Group to take the following steps:

• Enhance and expand financial assistance, free of onerous terms, to all affected providers, facilities, and pharmacies.
• Ensure your financial assistance programs are not providing more advantageous financial assistance to providers, practices, or facilities that are owned by UnitedHealth Group. 
• Shield the business information of providers and pharmacies from United’s other corporate lines of business.
• Suspend requirements for prior authorizations, contemporaneous notifications of change of status, and other documentation requirements.
• Provide a dedicated help line for providers, facilities, and pharmacies, and state Attorneys General.
• Proactively inform providers, facilities, pharmacies, and industry groups associated with each, of the steps they can take to preserve claims and receive prompt reimbursement.
• Expeditiously resolve the claims backlog and ensure prompt reimbursement of claims.
• Ensure providers, facilities, pharmacies, regulators, affected patients, and the public are informed of what data was compromised and what steps, if any, are needed for providers and patients to mitigate future identity theft or systems risks.

UnitedHealth Group reported $22 billion in profits in 2023. Even with the February cyberattack, in its first quarter UnitedHealth Group reported revenue of $99.8 billion, up $7.9 billion from same period the previous year.

In contrast, many hospitals and clinics are operating under tremendous financial strain, relying upon critical infrastructure such as Change Healthcare or adjacent vendors to maintain the operations that support their patient care. The two months of near collapse of the nation’s biggest claims management system since the cyberattack on Change Healthcare has pushed many entities — particularly small independent medical providers and pharmacies — to make difficult choices, such as seeking financial assistance with disadvantageous terms or delaying payroll.

Two years before attack, AGs Ellison, James, and USDOJ sued to block acquisition of Change by UHG; warned of dangers of concentrating market power and data in one corporation

On February 24, 2022 — almost two years to the day before the random attack on Change Healthcare — Attorney General Ellison and New York Attorney General Letitia James joined the U.S. Department of Justice in suing UnitedHealth Group and Change Healthcare to block the acquisition of Change by UHG. They argued the acquisition would “put too much market power and data in the hands of one corporation at so many levels of the health care industry, and that would raise costs and decrease choice for consumers in an already deeply flawed system.”

Following a two-week trial in federal court in the District of Columbia, on September 21, 2022, the District Court denied the challenge and allowed the merger to proceed.

Joining the letter to UnitedHealth Group that Attorney General Ellison led are a bipartisan group of attorneys general from Arizona, California, Connecticut, the District of Columbia, Hawaii, Maine, Massachusetts, Michigan, Mississippi, Nebraska, Nevada, New Hampshire, New York, North Carolina, Oregon, Pennsylvania, Rhode Island, South Dakota, Utah, Vermont, and Washington in this effort.

Attorney General Ellison encourages Minnesota consumers and businesses who wish to report concerns about anticompetitive business practices to submit a report online via the Antitrust Report Form or a general complaint via a Complaint Form. Individuals can also call the Attorney General’s Office at (651) 296-3353 (Metro area), (800) 657-3787 (Greater Minnesota), or (800) 627-3529 (Minnesota Relay).