Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

ADventures in Law

Not to Change the Subject (Line) … but Email Marketers May Want to Take Note of a Recent Washington Supreme Court Ruling

New USCIS Registration Requirement in Effect as of April 11

Phil Eskenazi, JR Lanis Earn 2025 Law Firm Visionary Recognition from LA Times Studios

Don’t Skim(p) on Disclosures

Late on March 27, Change Healthcare (CHC)’s parent company, UnitedHealth Group (UHG), provided an update on its analysis of the extent of “impacted data” involved in the CHC incident.

core/paragraph

Here are the main takeaways from the update:

CHC is still determining the contents of the “data that was taken by the threat actor.” CHC is continuing to analyze “impacted data” and is prioritizing the review of data it believes contains health information, personally identifiable information, and claims and eligibility or financial information.

core/list-item

core/list

A third-party vendor has been engaged to assist with data analysis. To expedite its review of the data, CHC has engaged “a leading vendor” to assist with its analysis.

It could be some time before CHC announces the scope of data involved. CHC stated that because of the impact the incident had on its own systems, it was not able to pull the data involved in the incident until just recently. This indicates it will likely take the company weeks or longer to provide an update on the contents of the information involved in the incident.

CHC data has not been found on the dark web. While this may provide comfort to some, just because CHC has not found data on the dark web does not mean that sensitive data is not in the possession of bad actors. It also does not change any potential notice obligations if protected health or personal information was accessed or acquired as a result of the incident.

CHC will be offering to provide notifications for customers “where permitted.” UHG stated that, “where permitted,” it will handle the notification process for customers whose data was impacted. Depending on the services healthcare providers receive from CHC, CHC may act as a clearinghouse (in and of itself&nbsp;a HIPAA-covered entity) or a business associate of the healthcare entities.&nbsp;The terms of companies’ master agreements and business associate agreements with CHC entities may determine whether UHG will handle the notification process on behalf of the entities.&nbsp;

What does this mean for covered entities?

core/heading

The latest statement from CHC itself does not start any covered entity’s “60-day timeline.”

Until CHC provides a more specific statement about the services involved or provides notice to customers that their PHI was involved in this incident, a HIPAA-covered entity’s date of discovery has not yet occurred, and the “60-day notification deadline” for CHC-covered entity customers has not yet started. The March 27 UHG update does not change this analysis.

Many healthcare systems and providers have already reached out to BakerHostetler about these types of incidents, and we have a team of highly experienced incident response attorneys ready to assist healthcare (and other) clients with responding to vendor and cybersecurity incidents.

Change Healthcare Incident: Update on ‘Impacted Data’ Analysis and Notification Plan

Featured Insights

Related Services

Featured Insights