Update on Change Healthcare Cyberattack: Patient Data Compromised, Notifications Underway

Change Healthcare said it has begun notifying people who were impacted by the cyberattack on patient data in February. (press release)

While they cannot confirm what data was compromised, they noted it may include any of the following:
​

• Contact information (first name, last name, date of birth, phone or email);
• Health insurance information (such as primary, secondary, or other health plans/policies, insurance companies, member/group ID numbers, and Medicaid-Medicare-government payor ID numbers);
• Health information (such as medical record numbers, providers, diagnoses, medicines, test results, images, care and treatment);
• Billing, claims, and payment information (such as claim numbers, account numbers, billing codes, payment cards, financial and banking information, payments made, and balance due); and/or
• Other personal information such as Social Security numbers, driver’s licenses or state ID numbers, or passport numbers.

This notice follows CMS' announcement that payments intended to help cash flow disruptions experienced by providers due to the Change Healthcare cyberattack will close on July 12.