Change Healthcare can notify patients whose sensitive health information has been exposed as a result of the massive security breach at the health care payments clearinghouse in February, the Department of Health and Human Services said Friday.
This long-awaited update from the federal agency answers questions from hospitals and doctors around the country, who were worried they would have to track down the roughly 30% of Americans whose data may have been stolen. Federal law requires health care providers to inform patients when their data has been exposed.
Just last week, over 100 provider industry groups sent a letter to HHS secretary Xavier Becerra asking the agency’s Office of Civil Rights, which handles HIPAA data breaches, to clarify that Change Healthcare and its parent company UnitedHealth Group are responsible for finding and notifying affected customers, not individual hospitals, doctors’ offices, and other health care providers.
