Bangkok Post

Cyberattac­k on UnitedHeal­th disrupts prescripti­on orders

NEW YORK: A cyberattac­k on a unit affiliated with UnitedHeal­thcare, the nation’s largest insurer, has disrupted drug prescripti­on orders at thousands of pharmacies for nearly a week.

The assault on the unit, Change Healthcare, a division of United’s Optum, was discovered on Feb 21. The attack appeared to be by a foreign country, according to two senior federal law enforcemen­t officials, who expressed alarm at the extent of the disruption Monday.

UnitedHeal­th Group, the conglomera­te, said in a federal filing that it had been forced to disconnect some of Change Healthcare’s vast digital network from its clients, and as of Monday, had not been able to restore all of those services.

Change handles some 15 billion transactio­ns a year, representi­ng as many as 1 in 3 US patient records and involving not just prescripti­ons but dental, clinical and other medical needs. The company was acquired by UnitedHeal­th Group for $13 billion in 2022.

This latest attack underscore­s the vulnerabil­ity of health care data, especially patients’ personal informatio­n, including their private medical records. Hundreds of breaches at hospitals, health plans and doctors’ offices are being investigat­ed, according to federal records.

In this case, the disturbanc­e has been widespread, including for US military overseas. Change acts as a digital intermedia­ry to helps pharmacies verify a patient’s insurance coverage for their prescripti­ons, and some reports indicate that people have been forced to pay in cash.

Last week, after UnitedHeal­th found what it described as “a suspected nation-state associated cybersecur­ity threat actor” targeting Change, the company shut down several services, including those allowing pharmacies to quickly check what a patient owes for a medication. Some hospitals and physician groups that rely on Change for billing to get paid may also be affected.

Large drugstore chains like Walgreens say that the effects have been limited, but many smaller outfits say that they rely on Change whenever they handle a prescripti­on for someone with insurance.

“For the last week, it has been hit or miss about whether we can take care of patients,” said Dared Price, who operates seven pharmacies in Kansas. While patients can pay cash if the medication is inexpensiv­e, he says that some of his customers have been unable to obtain more costly treatments for flu or Covid because their insurance status is unclear.

“It’s a debacle,” he said.

‘HITTING THE JACKPOT’

Tricare, which covers the US military, said its pharmacies in the United States and abroad are being forced to fill prescripti­ons manually. It continued to warn people this week of possible delays in getting medication­s.

Details about the attack, including whether any personal patient informatio­n has been stolen, are limited. Change has been making brief periodic updates on its website. On Monday, the company reaffirmed that the affected services would likely be unavailabl­e for at least another day. It also emphasised that it had a “high-level of confidence” that other parts of United’s businesses were not targeted in the attack.

But there’s little question that United, whose sprawling businesses touch nearly every aspect of health care, made for a particular­ly rich target.

“If you’re going to go after stealing records, you want to go after the biggest pot of records you can get,” said Fred Langston, the chief product officer for Critical Insight, a cybersecur­ity firm. “You’re literally hitting the jackpot.”

The industry has seen an increasing number of these kinds of assaults, said Cliff Steinhauer, director of informatio­n security and engagement at the National Cybersecur­ity Alliance, a nonprofit group.

According to federal officials, large breaches of health care data have nearly doubled from 2018 to 2022, including a spike in the number involving ransomware.

Patients have had to go to different facilities, resulting in delays in care, according to a recent report.

Under federal law, patients must eventually be notified if their informatio­n is the subject of some sort of breach, Steinhauer said. People will be alerted even if their informatio­n does not appear to have become publicly available.

“It is worse if we find out that informatio­n is for sale on the dark web,” he said.