US healthcare data breaches: Change Healthcare and the HIPAA landscape

The Change Healthcare attack exposed data on 192.7 million people. US health breach numbers, what went wrong and where the HIPAA Security Rule update stands.

2026-10-17

In February 2024, criminals logged into a remote access portal at Change Healthcare, a UnitedHealth Group unit that processes a huge share of US medical claims. The portal did not have multifactor authentication. Nine days later, ransomware hit. What followed became the largest healthcare data breach in US history and a turning point for how Washington thinks about health sector cybersecurity.

The Change Healthcare attack, step by step

February 12, 2024: attackers use compromised credentials to access a Citrix portal without MFA, according to UnitedHealth CEO Andrew Witty's testimony as reported by TechTarget.
February 21, 2024: Change Healthcare discloses network disruptions after ransomware is deployed. The BlackCat/ALPHV group is behind it.
Ransom: UnitedHealth confirmed it paid; a wallet linked to the group received $22 million. BlackCat then shut down, and the affiliate reportedly took the data to RansomHub to demand more.
May 1, 2024: Witty testifies before Congress that about a third of Americans may be affected.
Provider fallout: pharmacies and providers lost access to claims processing; UnitedHealth's temporary loans to affected providers peaked above $8.9 billion.
Cost: UnitedHealth estimated the total 2024 cost of the attack at about $2.87 billion, per BankInfoSecurity.
July 31, 2025: the company updates the HHS Office for Civil Rights: 192.7 million individuals affected, up from 100 million in October 2024.

Exposed data likely included names, Social Security numbers, medical histories, insurance claims and payment details.

The bigger picture: breach numbers

Change Healthcare is an extreme case, but not an outlier in kind. HIPAA Journal's tally of large breaches (500 or more records) reported to OCR shows the scale:

Year	Large breaches reported	Individuals affected
2023	745	record at the time (up 193% vs 2022)
2024	741	more than 289 million
2025	772 (per the text; 805 in its entity table)	about 138.5 million
2026 (Jan–Apr)	252	not yet totaled

Hacking and IT incidents accounted for more than 80% of large breaches in 2025. Other recent mega-breaches include Conduent Business Services (about 62.2 million, 2025), Aflac (about 13.9 million, 2025) and DentaQuest (15 million, 2026).

Why health care is such a target

Valuable data: medical and insurance records combine identity, financial and health information that cannot be changed like a password.
Pressure to pay: outages delay care and prescriptions, raising the stakes of ransomware.
Concentration risk: clearinghouses and business associates sit between thousands of providers and payers. A single failure, as at Change, spreads nationwide.

The business associate problem

HIPAA Journal counts 139 large breaches reported by business associates in 2025 and 79 in the first four months of 2026, and notes these figures understate the problem because covered entities often report vendor breaches themselves. Change Healthcare itself is a clearinghouse serving more than 30,000 pharmacies, which is why its outage reached patients across the country. The initial HHS breach portal entry listed just 500 individuals as a placeholder, a reminder that early breach counts can be wildly off.

The financial toll

UnitedHealth's numbers show how ransomware costs pile up. By the third quarter of 2024 it had booked about $1.7 billion in direct response costs and about $747 million in business disruption costs for the year to date. Providers had repaid about $3.2 billion of the emergency loans at that point. The company told investors it expected to rebuild the business to pre-attack levels during 2025.

The HIPAA landscape

The HIPAA Security Rule, which sets safeguards for electronic protected health information, had not been substantially updated in more than a decade. In January 2025, HHS's Office for Civil Rights published a proposed overhaul. According to Morgan Lewis, the proposal would:

require encryption of ePHI at rest and in transit;
require multifactor authentication;
eliminate the distinction between "required" and "addressable" safeguards, making all specifications mandatory;
add compliance timelines, documentation and more specific risk analysis requirements.

Comments closed on March 7, 2025. The proposal drew strong criticism from providers over cost. As of July 2026, the rule was not final, and the federal regulatory agenda projected a final action date of July 2027, according to Holland & Knight.

What organizations should do now

Enforce MFA everywhere, starting with remote access portals, VPNs and email. Change Healthcare's entry point was a single portal without it.
Map your business associates and their access; require breach notice and security commitments by contract.
Plan for outages: test how you would bill, prescribe and schedule if a clearinghouse went down for weeks.
Encrypt and segment sensitive data, and keep offline, tested backups.
Do not wait for the final rule: the proposed controls already reflect what investigators and insurers expect.

What patients can do

Read breach notices carefully and enroll in any free credit monitoring offered.
Consider a credit freeze if your Social Security number was exposed.
Review insurer explanation-of-benefits statements for services you never received.
Be wary of calls or emails referencing the breach: scammers exploit the news.