The National Community Pharmacists Association (NCPA), along with numerous healthcare providers, has filed a class action lawsuit against UnitedHealth Group (UHG) following a cyberattack on Change Healthcare, which UHG acquired in 2022. The plaintiffs claim that inadequate security measures contributed to significant financial damage to healthcare providers.
NCPA CEO B. Douglas Hoey has emphasized that the consolidation within the healthcare industry has led to inefficiencies and vulnerabilities. “UnitedHealth Group and its subsidiaries need to be held accountable for their lax security measures and for their failure to provide our members with adequate support and assurances to alleviate the financial losses our members suffered,” Hoey said in a statement.
Numerous other lawsuits have already been filed related to this cyberattack, which was perpetrated by the ransomware group Blackcat. The attack, announced in February, led to network outages affecting millions of patients and providers nationwide. Sensitive information, such as social security numbers, health data, and payment information, was compromised. To mitigate further damage, some Change Healthcare systems were taken offline, including its widely used claims processing service.
The complaint highlights that reliance on Change Healthcare’s platform has created a critical “single point of failure” in the U.S. healthcare system. The network outage severely impacted patient access to medications and put providers in a challenging position regarding patient eligibility, claims processing, and billing. Especially hard-hit are small and mid-sized practices, many of which are struggling financially due to delayed reimbursements.
Furthermore, the plaintiffs argue that UHG has not provided adequate guidance to handle the aftermath of the data breach, leaving providers in disarray about notifying patients and reporting to federal authorities. They seek court orders to prohibit the continued recklessness and to secure compensatory damages, with amounts to be determined at trial.
UnitedHealth Group has yet to comment on the lawsuit.