Change Healthcare can notify patients whose sensitive health information has been exposed as a result of the massive security breach at the health care payments clearinghouse in February, the Department of Health and Human Services said Friday.
This long-awaited update from the federal agency answers questions from hospitals and doctors around the country, who were worried they would have to track down the roughly 30% of Americans whose data may have been stolen. Federal law requires health care providers to inform patients when their data has been exposed.
Just last week, over 100 provider industry groups sent a letter to HHS secretary Xavier Becerra asking the agency’s Office of Civil Rights, which handles HIPAA data breaches, to clarify that Change Healthcare and its parent company UnitedHealth Group are responsible for finding and notifying affected customers, not individual hospitals, doctors’ offices, and other health care providers.
This article is exclusive to STAT+ subscribers
Unlock this article — plus daily market-moving biopharma analysis — by subscribing to STAT+.
Already have an account? Log in
Already have an account? Log in
About the Author Reprints
To submit a correction request, please visit our Contact Us page.
STAT encourages you to share your voice. We welcome your commentary, criticism, and expertise on our subscriber-only platform, STAT+ Connect