On June 20, MedBen received a Data Notification Update from Change Healthcare (CHC), formally notifying MedBen about the criminal cyberattack on CHC systems involving the protected health information (PHI) of a substantial number of individuals. The cyberattack included the deployment of ransomware on CHC’s systems on February 21, 2024.
CHC retained leading cybersecurity and data analysis experts to assist in the investigation, which began on February 21. On March 7, CHC was able to confirm that a substantial quantity of data had been exfiltrated from its environment between February 17 and February 20. On March 13, CHC obtained a dataset of exfiltrated files that was safe to investigate. On April 22, following analysis, CHC publicly confirmed the impacted data could cover a substantial proportion of people in America.
According to the Notice received at MedBen, CHC has completed a review of over 90% of the impacted files and – to date – has not found the PHI of individuals attributable to MedBen customers in the impacted dataset. However, CHC’s review is ongoing. MedBen will be notified again when the review is complete.
Any individual concerned that their information may have been impacted by this incident can enroll in two years of complimentary credit monitoring and identity theft protection services, paid for by Change Healthcare. CHC has also established a dedicated call center staffed by clinicians to provide additional support services. The call center’s number is 866-262-5342, and is available Monday through Friday, 9 am – 9 pm ET. Additionally, you may visit the Change Healthcare Cyberattack webpage for more information.
CHC plans to send direct notices (written letters), based on data review, to affected individuals for whom CHC has a sufficient address. The mailing process is expected to begin in late July as CHC completes quality assurance procedures.
In addition, at the end of last week Change Healthcare began restoring their Application Programming Interface (API). This means that CHC is again sending electronic member Explanations of Benefits (EOBs) to MedBen allowing us to post them on MedBen Access. While not all EOBs have yet been sent by CHC, MedBen will post all EOBs as soon as received.
Should you have any questions regarding the information above, please do not hesitate to contact us.