Change Healthcare Notice
In early 2024, Change Healthcare (CHC), a technology services company owned by United Health Group (UHG) and operated by Optum, providing essential services between health insurers and providers, including eligibility checks, medical records, and claims transactions, reported a cybersecurity incident. Due to the cybersecurity event, CareFirst BlueCross BlueShield (CareFirst) severed network connections with CHC to protect our members. CareFirst stopped all business transactions with CHC effective February 21, 2024. Importantly, the cybersecurity incident did not occur within CareFirst's own systems.
CHC has completed its investigation and declared a HIPAA privacy breach, planning to notify individuals whose personal information was compromised. CHC will send written notices to affected individuals on behalf of CFA starting in August, following guidance from the Office of Civil Rights (OCR) to ensure timely and compliant notifications. CareFirst members are encouraged to use UnitedHealthcare Group and Change Healthcare services.