How Change Healthcare’s customers decided whether to pull the plug, and when to plug back in

The week

On Wednesday, February 21, 2024, Change Healthcare noticed something was wrong inside its systems and started pulling them offline. Most Americans had never heard of the company. Yet it sat in the middle of a huge share of the country’s health care transactions. Change, part of UnitedHealth Group’s Optum business, ran one of the largest health care clearinghouses in the United States.

A clearinghouse is the sorting office of American health care finance. When a doctor’s office wants to know whether a patient’s insurance is active, when a hospital sends a bill to an insurer, when an insurer sends back word of what it paid, and when a pharmacy checks what a prescription will cost, those messages often pass through a clearinghouse. It translates each one into the format the other side expects and routes it to the right place. Change handled eligibility checks, claims, remittances (the insurer’s explanation of what it paid and why) and pharmacy transactions for a large share of providers and payers.

The attackers had deployed ransomware: malicious software that scrambles an organization’s files and systems so they cannot be used, followed by a demand for payment to unscramble them. In a filing with the Securities and Exchange Commission, UnitedHealth said it had isolated the affected systems from other connecting parties.

The effects spread within hours. Pharmacies across the country reported trouble processing prescriptions. Hospitals and physician practices lost the ability to submit claims and verify patients’ coverage through Change. For many, that meant no new bills going out, and so no new money coming in.

Then came the question that every connected organization had to answer for itself. On February 22, the American Hospital Association advised its members to consider disconnecting from Change and Optum systems until it was clear they were safe. The worry was simple: if attackers were inside Change, could they travel down the same cables into a hospital’s own network?

On February 29, UnitedHealth attributed the attack to the ALPHV ransomware group, also known as BlackCat. By then, thousands of organizations were already living with the consequences of whatever they had decided in the first few days.

The cash crisis that followed, and what UnitedHealth later told Congress about the cause, drew most of the attention. Less went to the first decision that every connected organization faced: whether to cut its own links to a compromised partner, and what it would take to restore them.

It is a decision that sounds technical but is really a business judgment about risk, cash and patients. It splits into three parts, taken in sequence. First, knowing what connects you to the partner. Second, deciding what to cut and how fast. Third, deciding what evidence is enough to reconnect. The first two can be done in hours with preparation. The third took weeks for many providers, with or without it, and it is where contracts and architecture made the biggest difference.

Clearinghouses, connections and fourth parties

Before the decisions, a few terms, because they shape everything that follows.

Ransomware is a form of digital extortion. Criminals get into a network, often with a stolen password, look around, sometimes copy data out, and then trigger software that locks up computers and files. Modern ransomware groups often add a second threat: pay, or we publish what we copied.

A clearinghouse, as described above, is a middleman for health care paperwork. A typical hospital deals with dozens of insurers, each with its own rules and formats. Rather than build a separate link to each one, the hospital sends everything to a clearinghouse, which checks, reformats and forwards it. That convenience is exactly why clearinghouses become concentration points. When one goes dark, everyone who relied on it goes dark with it.

A connection between two organizations is not one thing. It can be as simple as a file dropped into a secure mailbox once a day, which is like leaving a sealed envelope at a front desk. Or it can be a VPN, a private encrypted tunnel that links one organization’s network directly to another’s, which is more like a corridor joining two buildings. It can be a shared login that lets the vendor’s support staff reach into your systems to fix problems, which is like handing a contractor a key to your office. These differences matter enormously when the partner on the other side has been burgled.

Finally, fourth parties are your vendors’ vendors. Your eligibility checking tool might carry a different brand name on the screen, but behind the scenes it may send its requests through a clearinghouse you never signed a contract with. When that clearinghouse fails, so does your tool.

Knowing what connects you

Most hospitals and practices thought of Change Healthcare as a vendor of a service. Architecturally it was several things at once. It was a network endpoint receiving claims files and sending remittances. It might be a VPN peer or a hosted connection into the provider’s network. It might be the back end for software the provider used under another brand, such as a practice management or revenue cycle tool. It might sit behind the provider’s pharmacy system, its EHR vendor (the company supplying its electronic health record, the digital patient chart), or another clearinghouse that routed transactions through Change.

Many organizations found these paths only when they tried to cut them. Some learned that their eligibility vendor depended on Change. Others found that disconnecting one integration broke another. In the middle of an incident, organizations were learning that their own traffic ran through systems belonging to someone else.

The people who knew how claims really moved were usually in revenue cycle, the department that turns patient visits into bills and bills into cash, not in security. They knew which portal served which payer and which vendor support accounts existed. Organizations that brought revenue cycle staff into the incident room on the first day mapped their exposure fastest. This is a recurring pattern in technology crises: the knowledge you need is often held by operational staff who are not on the security team’s call list.

The durable fix is a transaction flow map for each critical partner. For each transaction type, such as eligibility, claims, remittance, prior authorization and pharmacy, it records the partner, the connection type, the credentials and certificates involved, and any fourth parties in the path. (Credentials are the usernames, passwords and keys that let systems talk to each other; certificates are digital ID cards that prove a system is who it says it is.) The map belongs to the revenue cycle leader and the integration team jointly, and it should be refreshed whenever a vendor contract changes.

Five paths behind one contract

Take a community hospital that, on paper, has one clearinghouse contract. When its team sits down with a whiteboard, they find five paths. Claims files go out nightly through a managed file transfer service. Eligibility checks happen in real time through the patient registration software, which turns out to route through the same clearinghouse under its own branding. The pharmacy uses a separate vendor that, on inspection, also relies on that clearinghouse for some transactions. The clearinghouse’s support team holds a remote access account to troubleshoot the claims software. And an older VPN tunnel, set up years ago for a project nobody remembers, is still live.

That whiteboard session takes an afternoon. Done in calm conditions, it is a planning exercise. Done during an attack, it is a scramble that costs days.

Deciding what to cut

The AHA’s advice to consider disconnecting was sensible given how little was known in the first days. Disconnecting is not free, though. Cutting a clearinghouse stops claims, which stops cash. Cutting a pharmacy connection can stop patients receiving medicines. Each organization had to weigh an uncertain risk that the attacker would move into its environment against a certain operational cost.

Executives make trade-offs of this kind all the time. What made it hard here was the lack of information and the lack of a prepared answer.

Connection types carry very different risk, and that is the basis for a fast decision. An outbound file transfer through a managed gateway gives an attacker little path back in. It is the sealed envelope at the front desk. A persistent network tunnel, a shared directory trust (an arrangement where two organizations’ login systems vouch for each other’s users) or a remote-access account that the partner uses to support your systems gives a great deal. Those are the corridor and the contractor’s key.

A sensible rule cuts the second group immediately on credible news of a partner compromise and pauses the first group pending facts. For the community hospital above, that means the old VPN tunnel and the vendor’s remote access account are shut within the hour. The nightly claims file is held for a day while the team gathers information. Eligibility checks switch to insurer websites and phone lines.

That rule works only if it was agreed in advance. A decision tree signed by the CISO (the chief information security officer), the revenue cycle leader and a clinical leader removes the argument on the day. It should name who can order a disconnect outside business hours and which connections are exempt because patient safety depends on them. Without that, the decision lands on whoever happens to be awake, and people under pressure tend either to cut everything, causing avoidable harm, or to cut nothing, hoping for the best.

Architecture helps here too. Organizations that had routed partner traffic through a small number of managed gateways could pause it with a few changes. A gateway is a single point through which partner traffic passes; close it and nothing gets in. Those with point-to-point links scattered across departments could not. They had to find and close dozens of side doors, often without a list of where they were.

Deciding when to reconnect

Reconnection was harder. Change began restoring services in phases from early March, starting with pharmacy, and each connected organization had to decide what assurance it needed before trusting the link again.

Responses varied. Some asked for written attestations, formal letters stating that systems were clean. Some asked for summaries from third-party forensic firms, the specialist investigators who reconstruct how an attacker got in and what they touched. Some reconnected only through new credentials and new connection paths, on the reasoning that anything the attacker might have seen should be replaced. Many moved transactions to another clearinghouse where they could, which raised its own diligence questions about a partner chosen in a hurry.

The organizations that handled this well had a standard ready. It named the evidence they would ask of a compromised partner: the scope of the intrusion, confirmation that the attacker had been removed, and the indicators of compromise relevant to connected customers. Indicators of compromise are the fingerprints an attacker leaves behind, such as particular internet addresses, file names or patterns of activity, which customers can search for in their own systems.

The standard also named the changes they would make on their own side before reconnecting, such as rotated credentials, reissued certificates, narrowed firewall rules and enhanced monitoring of the restored link for a defined period. Together those steps replace anything the attacker might have seen, shrink the path back in and keep watch on it for a while. Finally, it named who would sign off.

Contracts that turn requests into obligations

The standard is only enforceable if contracts support it. Most clearinghouse agreements said little about what the vendor owed customers after a breach beyond notification. A vendor under siege, with thousands of customers asking for reassurance at once, will naturally prioritize what it is obliged to do.

Clauses that oblige a partner to share forensic findings relevant to customers, to support reconnection testing and to give advance notice of restoration plans turn a request into an obligation. General counsel and procurement teams are the right owners of this work, with the security team supplying the list of what to ask for.

Cash, patients and the board

Each day a provider stays disconnected is a day without claims revenue, and each connection it restores is a door an attacker could use.

Cash. For a hospital or practice, claims are how the money arrives. When they stop, payroll, supplies and debt payments all come under pressure within weeks. A disconnect decision is, in effect, a decision about how long the organization can go without revenue.

Patients. Pharmacy connections and eligibility checks are not abstractions. A patient who cannot fill a prescription, or who is turned away because coverage cannot be confirmed, experiences the cyberattack directly.

Risk. Reconnecting too early to a partner that is still compromised could let an attacker into your own network. Staying disconnected too long can do serious financial damage. Both are real risks, and leadership owns the balance.

Regulators and reputation. Health care organizations hold some of the most sensitive data there is. Boards and regulators will ask, after any incident, what the organization knew about its exposure and what it had prepared. “We did not know that vendor connected to us” is not an answer anyone wants to give.

A few documents and a few rehearsals

Good preparation is unglamorous. It comes down to a short list.

• A current transaction flow map for each critical partner, kept by people who actually understand how claims move.
• A signed decision tree that sorts connections into “cut now” and “pause pending facts,” with named decision makers around the clock.
• A small number of managed gateways through which partner traffic passes, so that a pause is a few changes rather than a hunt.
• A written reconnection standard, backed by contract language.
• A second clearinghouse, contracted, connected and exercised.
• A tabletop exercise, a structured rehearsal around a table, in which leaders walk through a partner breach and discover the gaps before an attacker does.

The failures are the mirror image. Treating a vendor as “a service” rather than a set of connections. Leaving revenue cycle staff out of the security plan. Assuming the vendor will tell you everything you need. Letting old connections linger after projects end. And treating a backup provider as a line in a business continuity plan rather than something that has actually been tested.

Reconnection also exposed a strategic choice. A second clearinghouse, contracted and tested before any incident, turns the reconnect decision from an emergency into a choice. It costs money and integration effort, and it must be exercised periodically or it will not work when needed. For a health system whose cash depends on claims flowing, that cost is small against weeks without a path. Like any standby arrangement, a second clearinghouse is expensive to set up and maintain and irrelevant on most days, until the day the primary one fails.

What the executive team should know before the next outage

These questions are designed to be asked by a chief executive, board member or general counsel who does not need to understand the technology in depth, but does need confident, specific answers.

1. Which three outside partners, if they went dark tomorrow, would stop our cash or our care? How do we know?
2. For each of them, can someone show me on one page every way we connect: files, tunnels, shared logins, and the vendors behind our vendors?
3. If one of those partners is hacked at 2 a.m. on a Saturday, who has the authority to disconnect us, and have they practiced doing it?
4. What evidence would we demand before reconnecting, and do our contracts actually oblige the vendor to provide it?
5. Do we have a second route for claims and eligibility, and when did we last test it with real transactions?

The follow-ups matter as much: which connections would be cut at once and which kept running because patients depend on them, what would change on the organization’s own side, such as passwords, certificates and monitoring, before a restored link is trusted, and whether old connections are still open from projects that ended years ago. Vague answers are useful information in themselves. Every one of these questions has a calm, inexpensive answer in advance and an expensive, stressful one during an attack.

With hindsight

The Change Healthcare attack became the largest health data breach reported to HHS, the federal Department of Health and Human Services. UnitedHealth said in 2025 that the stolen data related to about 190 million people, a number that puts the incident in a category of its own. Its chief executive confirmed to Congress in May 2024 that the company had paid a ransom of US$22 million. Services were restored in stages through the spring of 2024.

The regulatory response is still unfinished. In January 2025, HHS published a proposed update to the HIPAA Security Rule, the federal rule that sets baseline security standards for health information. The proposal would require network maps and technology asset inventories, among many other changes. A network map is exactly the kind of document described above: a picture of what connects to what. An asset inventory is a list of every system and device an organization runs.

No final rule had been published in the Federal Register by October 2026, so the preparation described here remains voluntary. That cuts both ways. There is no legal deadline forcing the work. But there is also no reason to wait for one, and an organization that already has its maps, rules and contracts in order will find any eventual requirement much easier to meet.

The disconnect decision has held up as a planning case. What made the first weeks so painful for many providers was not that the decision was impossible, but that it was being made from scratch, under pressure, with incomplete information about their own connections.

Knowing the connections, agreeing a rule for cutting them and stating what proof is needed to reconnect can all be done before the next partner is hit. The work needs no new technology, only a few hours of the right people in a room, a few signatures, and a few clauses in contracts that are being renewed anyway. That makes it a concrete, affordable step for a board or executive team after reading about a crisis like this one.