UnitedHealth Group Updates on Change Healthcare Cyberattack

Provides update on ongoing review of impacted patient data

Offers support for people potentially impacted

Makes strong progress in restoring Change Healthcare services

--(BUSINESS WIRE)--UnitedHealth Group (NYSE: UNH) is announcing support for people who may be concerned about their personal data potentially being impacted based on preliminary findings from the ongoing investigation and review of the data involved in the malicious criminal cyberattack on Change Healthcare. The company is also providing an update on progress in restoring Change Healthcare’s products and services.

Based on initial targeted data sampling to date, the company has found files containing protected health information (PHI) or personally identifiable information (PII), which could cover a substantial proportion of people in America. To date, the company has not seen evidence of exfiltration of materials such as doctors’ charts or full medical histories among the data.

“We know this attack has caused concern and been disruptive for consumers and providers, and we are committed to doing everything possible to help and provide support to anyone who may need it,” said Andrew Witty, chief executive officer of UnitedHealth Group.

Data Assessment and Support for Impacted Individuals

Given the ongoing nature and complexity of the data review, it is likely to take several months of continued analysis before enough information will be available to identify and notify impacted customers and individuals. As the company continues to work with leading industry experts to analyze data involved in this cyberattack, it is immediately providing support and robust protections, rather than waiting until the conclusion of the data review.

People can visit a dedicated website at changecybersupport.com to get more information and details on these resources. A dedicated call center has been established to offer free credit monitoring and identity theft protections for two years to anyone impacted. The call center will also include trained clinicians to provide support services. Given the ongoing nature and complexity of the data review, the call center will not be able to provide any specifics on individual data impact at this time.

The call center can be reached at 1-866-262-5342 and further details can be found on the website.

The company, along with leading external industry experts, continues to monitor the internet and dark web to determine if data has been published. There were 22 screenshots, allegedly from exfiltrated files, some containing PHI and PII, posted for about a week on the dark web by a malicious threat actor. No further publication of PHI or PII has occurred at this time.

While this comprehensive data analysis is conducted, the company is in communication with law enforcement and regulators and will provide appropriate notifications when the company can confirm the information involved. This is not an official breach notification. The company will reach out to stakeholders when there is sufficient information for notifications and will be transparent with the process.

To help ease reporting obligations on other stakeholders whose data may have been compromised as part of this cyberattack, UnitedHealth Group has offered to make notifications and undertake related administrative requirements on behalf of any provider or customer.

Change Healthcare Service Restoration

Change Healthcare has made continued strong progress restoring services impacted by the event. We have prioritized the restoration of services that impact patient access to care or medication.

• Pharmacy services are now back to near-normal levels, with 99% of pre-incident pharmacies able to process claims.
• Medical claims across the U.S. health system are now flowing at near-normal levels as systems come back online or providers switch to other methods of submission. Change Healthcare realizes there are a small number of providers who continue to be adversely impacted and is working with them to find alternative submission solutions and will continue to provide financial support as needed.
• Payment processing by Change Healthcare, which represents approximately 6% of all payments in the U.S health care system, is at approximately 86% of pre-incident levels and is increasing as additional functionality is restored.
• Other Change Healthcare services, including eligibility software and analytical tools, are being restored on a rolling basis with the active reconnection of our customers now the priority. To date, approximately 80% of Change functionality has been restored on the major platforms and products, and the company expects full restoration of other systems to be completed in the coming weeks.
• For the latest information on service restoration and customer support, please visit www.uhg.com/changehealthcarecyberresponse.

About UnitedHealth Group

UnitedHealth Group (NYSE: UNH) is a health care and well-being company with a mission to help people live healthier lives and help make the health system work better for everyone through two distinct and complementary businesses. Optum delivers care aided by technology and data, empowering people, partners and providers with the guidance and tools they need to achieve better health. UnitedHealthcare offers a full range of health benefits, enabling affordable coverage, simplifying the health care experience and delivering access to high-quality care. Visit UnitedHealth Group at www.unitedhealthgroup.com and follow UnitedHealth Group on LinkedIn.

Forward-Looking Statements

This press release contains “forward-looking statements” which are intended to take advantage of the “safe harbor” provisions of the federal securities law. The words “believe,” “expect,” “intend,” “estimate,” “anticipate,” “forecast,” “outlook,” “plan,” “project,” “should” and similar expressions identify forward-looking statements. These forward-looking statements are based on management’s current expectations and assumptions; however, by their nature, forward-looking statements are subject to risks, uncertainties and assumptions that are difficult to predict or quantify. You should not place undue reliance on forward-looking statements, which speak only as of the date they are made. Certain important factors that could cause actual results to differ, possibly materially, from expectations or estimates reflected in such forward-looking statements can be found in the “Risk Factors” and “Forward-Looking Statements” sections included in UnitedHealth Group’s annual reports on Form 10-K and quarterly reports on Form 10-Q. We do not undertake to update or revise any forward-looking statements, except as required by law.