In a tense Senate hearing on Wednesday, lawmakers sharply criticized UnitedHealth Group’s handling of the cyberattack that paralyzed the U.S. health care system, citing the failure of its security systems and the potential disclosure of sensitive medical information of millions of Americans.
Democratic and Republican senators questioned whether the cyberattack of Change Healthcare, which manages a third of all U.S. patient records and some 15 billion transactions a year, was so vast because UnitedHealth is too deeply embedded in nearly every aspect of the nation’s medical care.
UnitedHealth Group, which reported $372 billion in revenues in 2023 and is one of the nation’s largest corporations, is not only the parent of Change but also the parent of the country’s largest health insurer and a big pharmacy benefit manager (OptumRx). United also oversees nearly one in 10 doctors in the country.
“The Change hack is a dire warning about the consequences of ‘too big to fail’ mega-corporations gobbling up larger and larger shares of the health care system,” said Senator Ron Wyden, the Oregon Democrat who is the chairman of the Finance Committee.
The U.S. health system was thrust into chaos after the Feb. 21 attack on Change, which serves as a digital highway between health insurers and hospitals and doctors. Patients could not fill prescriptions, and hospitals and doctors faced a severe cash crunch because they could not be paid for their care.
Congressional lawmakers have clamored for more information about how the hack happened and what UnitedHealth was doing to address it, and the company declined a request last month to appear before the House health subcommittee. On Wednesday, UnitedHealth’s chief executive, Andrew Witty, was summoned to testify before both the Senate Finance Committee and a panel of the House Energy and Commerce Committee.
