Washington D.C. — House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R-WA) and Ranking Member Frank Pallone, Jr., (D-NJ), Subcommittee on Health Chair Brett Guthrie (R-KY) and Ranking Member Anna G. Eshoo (D-CA), and Subcommittee on Oversight and Investigations Chair Morgan Griffith (R-VA) and Ranking Member Kathy Castor (D-FL) wrote to UnitedHealth Group, Inc., CEO Andrew Witty today seeking information about the cyberattack on Change Healthcare. Change Healthcare, which was acquired by UnitedHealth Group’s Optum subsidiary in 2022, is one of the nation’s largest providers of health care payment management systems.

On February 21, UnitedHealth Group reported it had experienced a cyberattack on its platforms, and it had taken all Change Healthcare systems offline to contain the incident. As a result of the outage, critical services affecting patient care—including billing services, claims transmittals, and eligibility verifications—became inoperable. Though UnitedHealth first notified users that it expected the disruption to “last at least through the day,” several of the company’s products have now been inoperable for more than a month.

“Change Healthcare is a central player in the country’s health care system, which has been upended by the recent breach,” the bipartisan Committee leaders wrote to Mr. Witty. “We are interested in your efforts to secure Change Healthcare’s systems since it was acquired by your company and the efforts you are taking to restore system functionality and support patients and providers affected by the attack.”

Change Healthcare’s platforms touch an estimated one in three U.S. patient records. Its systems process roughly 15 billion transactions annually, and are linked to approximately 900,000 physicians, 118,000 dentists, 33,000 pharmacies, and 5,500 hospitals nationwide. The breadth of Change Healthcare’s infrastructure all but ensures that the scope of the current disruption, and any disruption in Change Healthcare services, will be extensive.

“The health care system is rapidly consolidating at virtually every level, creating fewer redundancies and more vulnerability to the entire system if an entity with significant market share at any level of the system is compromised,” the Committee leaders wrote. “In order to understand better the steps UnitedHealth has taken to address this situation, we request information about the impact of the cyberattack, the actions the company is taking to secure its systems, and the outreach to the health care community in the aftermath.”

As a result of the system outage, providers reportedly struggled to make payroll while some patients have been forced to pay out of pocket for crucial medications including cancer therapy drugs and insulin because pharmacies are unable to verify coverage.

The Committee leaders requested answers to a series of detailed questions by April 29, 2024.

CLICK HERE to read the full letter.