Change Healthcare

Change Healthcare (2007)

Change Healthcare was established in Brentwood, Tennessee in 2007.[8] The company was founded by Christopher Parks and Robert Hendrick[9] with MedBill Manager. In January 2010, the company launched the Change Healthcare Engagement Platform.[10]

In April 2011, Howard McLure,[11] a former president of CVS Caremark, came out of retirement to lead Change Healthcare as chairman and CEO. Doug Ghertner joined the company as president in July 2011.[12]

In December 2011, Change Healthcare closed a round of financing led by Mitsui, Sandbox Industries, Blue Cross Blue Shield Venture Partners, and West Health Investment Fund. In September 2012, Ghertner was promoted to president and CEO, with McLure assuming the role of executive chairman.

In July 2013, Change Healthcare closed on a round of Series D funding led by HLM Investment Partners, including new investor Noro-Moseley Partners, which invested $15 million into the company.[13] In 2013, Modern Healthcare included the company on its annual list of "100 Best Places to Work in Healthcare," which evaluates employee benefits and workplace policies.[14]

Emdeon

In 2004, WebMD Corporation acquired Dakota Imaging, Inc., and ViPS, Inc.[15]

Until August 2005, Emdeon operated under the name WebMD Corporation (NASDAQ: HLTH). The name was changed to Emdeon to avoid confusion with its then-subsidiary WebMD, which began trading publicly under the stock symbol WBMD in September 2005.[16][17]

The company acquired numerous businesses between 2010 and 2014:

In August 2011, Emdeon was taken private for $3 billion by the Blackstone Group.[28] Blackstone's offer of $19 per Emdeon share was backed by committed financing from Bank of America Merrill Lynch, Barclays Capital, and Citigroup.[29] Emdeon shares rose 13.6% the morning after the acquisition. Shares had risen 31 percent over the year prior to the announcement.[30]

In November 2014, Change Healthcare was acquired by Emdeon for $135 million.[31] In November 2015, Emdeon rebranded to Change Healthcare.[2]

In December 2014, the company acquired Admin Source Communication Inc.[32] In August 2015, the company acquired Altegra Health, which was a provider of technology and intervention platforms that combine data aggregation and analytics with member engagement and reporting capabilities.[33][34]

In June 2016, McKesson Corporation and Change Healthcare Holdings Inc. announced the creation of a new healthcare company that combined substantially all of Change Healthcare's business with the majority of McKesson's Information technology unit. McKesson owns approximately 70 percent of the new company, with the remaining equity stake held by Change Healthcare stockholders. The new company retained the Change Healthcare name.[35]

In October 2018, it was reported that Change Healthcare Corporation had hired underwriters and investment banks in preparation for an initial public offering (IPO) planned for the 2018–2019 time frame. On June 27, 2019, Change Healthcare Inc. began trading on the NASDAQ stock exchange under the ticker symbol CHNG, offering up to 49.2 million shares at $13 per share and raising over $640 million through its IPO.[36]

In December 2018, Change Healthcare acquired the intellectual property and other key assets, including employees, of Charleston-based healthcare IT startup PokitDok.[37]

In January 2021, UnitedHealth Group's Optum Insight unit agreed to acquire Change Healthcare in a deal valued at $13billion, including assuming $5billion of the latter's debt.[38] Following delays due to regulatory scrutiny,[39] the acquisition closed on October 3, 2022.[40]

In 2022, Change Healthcare and Luma Health partnered to launch a patient engagement service aimed at improving healthcare communication and access.[41]

• In May 2009, the company acquired The Sentinel Group, a vendor of software and investigational services to combat healthcare fraud.[18]
• In January 2010, the company acquired Future Vision Investment Group, L.L.C. (FVTech), a provider of outsourced services specializing in electronic data conversion and information management solutions.[19]
• In March 2010, the company acquired Healthcare Technology Management Services, Inc. (HTMS), a management consulting company focused primarily on the healthcare payer market.[20]
• In June 2010, the company acquired Chapin Revenue Cycle Management, LLC (Chapin), a technology-enabled provider of accounts receivable denial and recovery services.[21]
• In August 2010, the company acquired Interactive Payer Network (IPN), a technology service provider that acts as an outsourcing partner for Health Insurance Portability and Accountability Act (HIPAA)-compliant healthcare electronic data interchange (EDI).[22]
• In October 2010, the company obtained Chamberlin Edmonds & Associates, Inc. (CEA), a technology-enabled provider of government program eligibility and enrollment services.[23]
• In May 2011, the company acquired EquiClaim, a provider of healthcare audit and recovery services for commercial and government payers, from MultiPlan, Inc.[24]
• In May 2012, the company acquired TC3 Health, a cost containment provider that included payment integrity and out-of-network claims cost management for U.S. healthcare payers.[25]
• In June 2013, the company acquired Gold Health Systems, a healthcare management organization that specializes in providing pharmacy benefits and related services primarily to State Medicaid agencies across the nation.[26]
• In July 2014, the company acquired Capario, a healthcare technology provider.[27]

2024 cyberattack

On February 21, 2024, the company was hit by a cyberattack that prevented payouts to doctors on the platform.[42][43] As a result of the attack, electronic payments and medical claims could not be processed by UnitedHealth Group, leading to widespread disruption.[43][44] Patients were forced to pay for many of their medications out of pocket instead of using medication coupons or copays.[44] Many healthcare providers claimed significant revenue losses as a result of the disruption, up to $100 million per day,[45] putting some in danger of insolvency.[46] As a result of the cyberattack, HHS opened a civil rights investigation regarding patient privacy concerns.[47][48] Because of the large number of patients affected (190 million),[49] researchers have raised concerns about the cybersecurity and national security risks posed by the extreme market concentration in the healthcare payments processing market. [50]

On February 22, 2024, UnitedHealth Group filed a notice to the Securities and Exchange Commission stating that a "suspected nation-state associated cybersecurity threat actor" gained access to Change Healthcare's information technology system. Following UnitedHealth Group's initial filing, CVS Health, Walgreens, Publix, GoodRx, and BlueCross BlueShield of Montana reported disruptions in insurance claims.[51] Other companies affected by the cyberattack include Naval Hospital Camp Pendleton[52] and Athenahealth.[53]

On February 29, 2024, UnitedHealth Group confirmed that the ransomware attack was "perpetrated by a cyber crime threat actor who...represented itself to [the company] as ALPHV/Blackcat." The company stated that it was "working closely with law enforcement and leading third-party consultants, Mandiant and Palo Alto Networks" to address the matter.[54]

On March 4, 2024, Reuters reported that a bitcoin payment equivalent to nearly USD $22 million had been made to a cryptocurrency wallet "associated with ALPHV." United Health did not comment on the payment, instead stating that the organization was "focused on the investigation and the recovery."[55] On the same day, a Wired reporter stated that the transaction looked "very much like a large ransom payment."[56]

As of March 18, 2024, UnitedHealth Group had advanced payments of over $2 billion in assistance to healthcare providers affected by the cybersecurity attack. In addition, some services had been restored, including Change Healthcare's payment processing platform and pharmacy network.[57]

Response

On March 1, 2024, UnitedHealth Group's Optum division launched a Temporary Funding Assistance Program to assist with short-term cash flow needs for providers who received payments that were processed by Change Healthcare.[58][59] The American Hospital Association (AHA) criticized the program due to its terms and conditions, specifically Optum's ability to recoup funds "immediately and without prior notification" and to "change the agreement simply by providing notice."[60]

On March 5, 2024, the U.S. Department of Health and Human Services announced financial flexibilities for hospitals impacted by the attack.[61] The American Hospital Association (AHA) was critical of these measures, stating that the proposed flexibilities were "not an adequate whole of government response."[62]

On March 12, 2024, UnitedHealth CEO Andrew Witty was summoned to a meeting by the Biden administration, which was attended by healthcare providers across the sector. During this meeting, HHS Secretary Xavier Becerra and White House domestic policy chief Neera Tanden urged UnitedHealth Group leadership to increase the amount of funding available to impacted providers.[63][64]

As of April 16, 2024, UnitedHealth Group had advanced payments of over $6 billion in assistance to healthcare providers affected by the cybersecurity attack.[65]

On May 1, 2024, UnitedHealth Group CEO Andrew Witty testified before the Senate Finance Committee, and on May 2, before the House Energy and Commerce Committee, regarding the cyberattack. Witty confirmed that the attackers gained access through a Citrix remote access portal that lacked multi-factor authentication.[66][67] According to Witty's testimony, the attackers first accessed Change Healthcare systems on February 12, 2024, and moved laterally for nine days, exfiltrating approximately six terabytes of data before deploying ransomware on February 21.[68] In December 2024, the Judicial Panel on Multidistrict Litigation consolidated dozens of class action lawsuits arising from the breach into multidistrict litigation (MDL No. 3108) in the United States District Court for the District of Minnesota, proceeding on two tracks: one for individuals whose data was compromised and another for healthcare providers seeking damages related to service disruptions.[69]

On May 13, 2025, an RFI (Request For Information) was issued by the U.S. Department of Health and the U.S. Food and Drug Administration (FDA) following an order from President Donald Trump. The RFI sought to identify regulations implemented prior to Trump's presidency that could be considered unnecessary. This order, also known as a "10-to-1 deregulation order," aimed to modify regulatory frameworks affecting interactions among patients, consumers, healthcare providers, and corporations to maintain and expand public healthcare services.[70]