NCPA, providers sue UnitedHealth Group over cyberattack 

ALEXANDRIA, Va. – The National Community Pharmacists Association, along with dozens of providers from multiple states, filed a class action lawsuit July 19 against UnitedHealth Group and its subsidiaries Change Healthcare and Optum for losses resulting from their massive cyberattack earlier this year. 

NCPA and the providers say Change Healthcare failed to take reasonable precautions against a catastrophic breach; mislead them about its network security; and caused massive financial losses for health care providers who were never reimbursed for services and who incurred huge expenses trying to work around the downed system. 

“UnitedHealth Group and its subsidiaries need to be held accountable for their lax security measures and for their failure to provide our members with adequate support and assurances to alleviate the financial losses our members suffered,” said NCPA CEO B. Douglas Hoey. “NCPA was against UnitedHealth’s acquisition of Change from the start. This breach proves that bigger is not better and that consolidation often leads to inefficiencies. Companies are so big they cannot protect every entry point and cannot respond quickly due to internal bureaucracy. The fact issues remain unresolved is a testament to this point. This breach has cost our members a significant amount of money and time and it is still not resolved months later.” 

In February, Change Healthcare was hit with a ransomware attack that brought payment and claims processing across the country to a halt. 

Not only did Change Healthcare, Optum, and UnitedHealth fail to adequately protect data for millions of patients, but when they discovered the breach, they shut the entire system down without providing a workable alternative, leaving thousands of pharmacies without any way to process claims, the lawsuit charges. 

“Because defendants disconnected the Change Platform, many health care providers lost their primary (and in some cases their only) source of claims processing for their patients and did not receive payment,” says the complaint. “Health care providers had to absorb these upfront costs. In addition to the losses from not being paid, many pharmacies had to take out loans or deplete their reserves to buy expensive new software.” 

• The cyberattack had a wide-ranging impact on the HME industry 
• In May, the NCPA was one of many stakeholders who appealed to lawmakers ahead of congressional hearings on the cyberattack