Subscriber Benefit
As a subscriber you can listen to articles at work, in the car, or while you work out. Subscribe Now
Indiana University Health has filed a lawsuit against a company that was hit by a ransomware attack two years ago — an event the health system says cost it $66 million and impacted its ability to process payments.
IU Health filed the lawsuit against Change Healthcare on Feb. 19 in the United States District Court for the District of Minnesota.
On Feb. 21, 2024, Change Healthcare experienced a ransomware attack that brought the operation to a standstill. Change Healthcare is the nation’s largest clearinghouse for medical claims, handling 15 billion transactions a year and touching one in three patient records. The company also handles insurance verification, payments, claims and other “revenue cycle” operations for thousands of hospitals and medical practices.
It is owned by UnitedHealth Group, the nation’s largest health insurer, based in suburban Minneapolis.
The attack against Change Healthcare brought many of its customers’ billing and claims operations to a stop, leaving them unable to get reimbursed for billions of dollars’ worth of procedures. That included dozens of health care companies in Indiana.
A ransomware group, Alphv, also known as BlackCat, claimed responsibility for the cyberattack, according to a regulatory filing made by UnitedHealth Group.
Danyll Foix, an attorney with Washington, D.C.-based Baker & Hostetler LLP who is representing IU Health, did not immediately respond to a request for comment from IBJ. Change Healthcare also did not respond before IBJ’s deadline.
IU Health Executive Director of External Communications Lisa Tellus told IBJ in a statement that the health system would not discuss the pending lawsuit.
“We cannot discuss active litigation,” she said, “but I can tell you that ensuring timely payments for healthcare services is crucial for maintaining high-quality healthcare delivery and keeping costs manageable for patients.”
IU Health alleges that Change Healthcare’s systems lacked multifactor authentication and that cybercriminals were able to gain access, move laterally within systems, remove data and deploy ransomware. The health system also alleges Change Healthcare had no backup plan in place for clients like IU Health that rely on its products and services to maintain business operations.
“In response, Change Healthcare chose to take its remaining systems offline, further rendering its products and services useless to its client healthcare providers and systems, including IU Health,” the complaint says.
The complaint says the incident resulted in significant business disruptions for IU Health, which was forced to contract new vendors to provide services and mitigate lost revenue. The health system also installed incident command centers to coordinate and track mitigation efforts. It hired temporary workers to handle initial billing, follow-up and denial response.
IU Health implemented IT routines and training to reduce denials and lost payments. It manually reviewed backlogs created by the shutdown, according to the complaint.
Altogether, the costs and losses for IU Health added up to $66 million, the lawsuit says. On Feb. 2, IU Health requested compensation from Change Healthcare for the costs and losses it sustained. The complaint says Change Healthcare has not agreed to compensate IU Health for its losses.
Numerous health care providers have filed class action lawsuits against Change Healthcare since the data breach and ransomware attack. Many of the cases were consolidated into a single case filed Jan. 15 in Minnesota district court.
In November, a judge allowed a lawsuit filed by Nebraska Attorney General Mike Hilgers against Change Healthcare, UnitedHealth Group and Optum to proceed. Optum, a subsidiary of UnitedHealth Group, combined with Change Healthcare in 2022.
IU Health filed counts of negligence/gross negligence, breach of contract, unjust enrichment and fraud in its lawsuit against Change Healthcare
The health system is seeking a jury trial and asking the court to grant it an award for damages, attorneys fees, prejudgment interest and any other relief the court decides is just and proper.
Please enable JavaScript to view this content.