Change Healthcare cyberattack: VA notifies 15 million veterans about breach

The Department of Veterans Affairs says 15 million veterans may have been affected by the Change Healthcare cyberattack.

VA Secretary Denis McDonough said this week that notices about the Change Healthcare cyberattack were sent to 15 million veterans.

VA Secretary Denis McDonough said notices were sent to 15 million veterans. He discussed the cyberattack Thursday during his monthly press conference, Stars & Stripes reported.

McDonough said “there’s no confirmation yet that veteran data was leaked because of this incident.” But he also noted that Change Healthcare said this week that many Americans may have been affected.

“If we do learn that Veterans’ personal information has been compromised, we’ll move quickly to mitigate the impact and provide full support to Veterans affected,” McDonough said during the press conference. “But to be clear, we’re not waiting for that confirmation to communicate with Veterans about the issue.”

“We’re focused on protecting veteran data,” McDonough said.

• Read more: Change Healthcare cyberattack shows ‘no one is immune’

McDonough said the department sent notices to more than 15 million veterans and their families about the Change Healthcare incident, along with resources to protect themselves against fraud. The department also advised veterans that Change Healthcare is offering free identity theft protection and credit monitoring for two years.

The VA has been pushing Change Healthcare for more information about how many people have been affected. “In fact, we have been pushing CHC for more information for weeks,” McDonough said.

UnitedHealth Group, Change Healthcare’s parent company, said this week that the number of individuals affected “could cover a substantial proportion of people in America.” UnitedHealth said it doesn’t have a precise number on how many are affected.

“It is likely to take several months of continued analysis before enough information will be available to identify and notify impacted customers and individuals,” the company said.

Veterans are receiving care, and most providers are getting paid, the department says.

McDonough said the VA is “fully open for business.”

“We’re not aware of any adverse impacts on Vets’ care or health outcomes because of the breach,” he said.

The Change Healthcare cyberattack affected the VA’s information technology functions and payment processes, but McDonough said many of those functions have been restored.

About 40,000 veterans were temporarily impacted by a disruption in pharmacy orders, but the department says it quickly resolved that issue by deferring billing. The VA says prescriptions were quickly refilled and there have been no reports of patient harm.

The department says most pharmacy billing functions will be restored by May 3, while all claims processing services are expected to be restored by mid-to-late May.

McDonough says the department will notify veterans as it gains more information about the scope of the Change Healthcare attack. The VA is also providing regular updates to Congress, he said.

The Change Healthcare cyberattack has affected hospitals, medical groups and healthcare providers across the country. Change Healthcare provides billing, pharmacy and other administrative services for healthcare organizations. The company has said it touches one in every 3 patient records nationwide.

Greg Garcia, executive director for cybersecurity for the Healthcare Sector Coordinating Council, testified about the impact of the attack at a congressional hearing last week.

“The Change Healthcare attack is of course, the most recent and certainly the most appalling and disruptive to healthcare delivery that we've seen to date,” Garcia said.

UnitedHealth says it has distributed more than $6 billion to assist providers affected by the breach and has restored much of the services and functions that were disrupted.

Hospitals have said they’ve suffered millions of dollars in losses due to delayed payments, and they’ve also struggled to verify insurance eligibility for patients.

Cassie Sauer, president and CEO of the Washington State Hospital Association, discussed the impact of the Change Healthcare attack on hospitals during an online discussion this week.

“The state of Washington's hospital system remains very fragile after experiencing more than two years of significant losses,” Sauer said. “And these losses are now being compounded by delayed payments from insurers and the impact of the cyberattack on Change Healthcare.”

Nearly all hospitals (94%) said they have suffered a financial impact from the Change Healthcare attack, according to a survey by the American Hospital Association. About 3 in 4 hospitals (74%) said the attack has interfered with patient care.

The U.S. Department of Health & Human Services has launched an investigation into the Change Healthcare cyberattack.

UnitedHealth Group has said a ransomware group known as “Blackcat” is behind the Change Healthcare attack. Federal officials have said the group is known to target healthcare organizations.

UnitedHealth told CNBC that the company did pay a ransom “as part of the company’s commitment to do all it could to protect patient data from disclosure.”

Read more: Change Healthcare cyberattack continues to affect doctors: ‘Practices will close’