Lawsuit Against Change Healthcare Over Massive Data Breach Will Proceed

A lawsuit filed by Nebraska Attorney General Mike Hilgers over the 2024 Change Healthcare data breach has survived a motion to dismiss. The case will be heard in Lancaster County District Court.

Steve Alder, reporting for the HIPAA Journal, writes that State of Nebraska v. Change Healthcare Inc., UnitedHealth Group, Optum alleges violations of Nebraska’s consumer protection, data privacy, and security laws. It addresses the scope of the breach, the company’s response, and raises questions about accountability and compliance in the management of sensitive health information.

The case centers on a ransomware attack that affected more than 190 million Americans, including nearly 900,000 Nebraskans. The attack disabled critical payment and claims processing systems for approximately two months.

The disruption had tangible consequences for healthcare providers relying on Change Healthcare’s clearinghouse services. It delayed prior authorizations for medical procedures and prescriptions, and impeded access to essential care.

The lawsuit asserts that the breach resulted from inadequate cybersecurity measures, outdated IT systems, and insufficient network segmentation, all of which magnified the impact of the attack.

The complaint also criticizes Change Healthcare’s response, noting that affected Nebraskans were informed of the breach nearly five months after the incident. The delay exposed residents to risks, including identity theft, fraud, and other misuses of personal health information.

Judge Susan Strong rejected Change Healthcare’s motion to dismiss, concluding that the state sufficiently alleged violations of relevant consumer protection and data privacy statutes. She allowed the case to proceed to discovery and potential further litigation.

For lawyers concerned with cybersecurity, the case underscores considerations about liability in large-scale data breaches. These include the adequacy of cybersecurity protocols, timeliness of breach notifications, and the scope of civil remedies under both state and federal law.