As UnitedHealth Group (UHG) subsidiary Change Healthcare (CHC) began to notify customers whose patients’ protected health information (PHI) was involved in CHC’s massive February breach, key senators have turned up the heat on both UHG and HHS over this incident and over cybersecurity in the health care sector generally.

CHC said it would begin providing notices to its customers on June 20. However, the company cautioned that its review of the incident was “in its late stages” but not final, and that additional customers may be identified whose data was involved. Notifications to patients whose data was impacted will start to go out in late July, the company said.^[1]

“CHC plans to mail written letters at the conclusion of data review to affected individuals for whom CHC has a sufficient address,” the company said in its notice of data breach. “Please note, we may not have sufficient addresses for all affected individuals. The mailing process is expected to begin in late July as CHC completes quality assurance procedures.”

HHS said May 31 in an update to its FAQ page on the ransomware attack that covered entities (CEs) could delegate breach notice requirements to UHG and CHC.^[2]

“A covered entity may delegate to its business associate the tasks of providing the required HITECH Act and HIPAA Breach Notification Rule breach notifications on the covered entity’s behalf,” HHS wrote. “Only one entity—which could be the covered entity itself or its business associate—needs to complete notifications to affected individuals, the HHS Secretary, and where applicable the media.”

“As such, if covered entities affected by this breach ensure that Change Healthcare performs the required breach notifications in a manner consistent with the HITECH Act and HIPAA Breach Notification Rule, those covered entities would not have additional breach notification obligations,” HHS concluded.

CHC and UHG have not yet provided official breach notification to HHS concerning the breach, although Change said that “the impacted data could cover a substantial proportion of people in America.”