Four big questions for DC following massive health care hack

The crippling hack U.S. officials long feared looked nothing like they expected.

The Feb. 21 cybercriminal attack on medical billing processor Change Healthcare didn’t flatten power grids or poison water supplies. But by forcing the $13 billion company offline, it severed one of the few links connecting health care providers to insurance firms — and triggered a cash crunch at hospitals, health clinics and pharmacies nationwide.

U.S. officials, lawmakers and health executives are focused right now on ensuring that health care providers are not forced to close, miss payroll or deny patients access to medical care. UnitedHealth Group, which owns Change, has said its key claims and payments services won’t be fully restored until March 22.

Longer term, eight officials with the government or U.S. hospitals interviewed by POLITICO say the hack underscores major vulnerabilities in the country’s health care system — raising critical questions about whether federal agencies and Congress need to do more to prevent another, potentially more serious, attack in the future.

"If nothing else, it makes us say we really, really have to look at all of our points of vulnerability, systemic points of vulnerability, and really work to secure them," said a senior official at the Health and Human Services Department. The individual, like other current officials in this story, was granted anonymity due to the ongoing nature of the incident.

Here are four big questions percolating through government agencies and Congress in the aftermath of a hack that the American Hospital Association has christened “the most significant cyberattack on the U.S. health care system in American history.”

Is the government doing enough to protect critical companies like Change? 

Health care sector security experts and government officials say there are other little-known health care firms whose disruption would cascade through the sector like the outage at Change has.

But it’s far from clear that anyone in D.C. knows who they all are — let alone has a plan to protect them.

“It is highly unlikely that Change is the only single point of failure in the health care sector,” said Nathan Lesser, the chief information security officer at Children’s National Hospital in D.C. “We need to know what the others are so we can protect them.”

In 2022, industry groups helped sink legislation that would have empowered the government to identify a shortlist of the most critical firms to the U.S. economy and force them to meet baseline digital security standards, such as patching known software bugs in internet-connected devices and using two-factor authentication.

CISA later opted to build its own such list without Congress, though it’s unclear how thorough the effort was.

The agency’s director, Jen Easterly, revealed at a public event Wednesday that CISA had not previously identified Change for its shortlist of key firms — and strongly implied that it should have. The list did include UnitedHealth.

Easterly said the agency would “double down” and work to “better highlight those companies that are much more critical than we actually were expecting” using new authorities CISA expects from a forthcoming White House national security memorandum.

U.S. officials outside CISA also acknowledged that the government has more work to do to identify firms, like Change, that broad swaths of the economy depend on.

“I don't think people understood prior to this incident just how integrated Change was into all facets of the U.S. health care system,” one senior U.S. cybersecurity official said.The White House now believes it affected “the vast majority” of the nation’s 6,000 hospitals and 80,000 pharmacies, they added.

Should health care companies be forced to up their cybersecurity?

For years, some of the same health trade groups now calling for federal financial support have helped scupper calls for stricter health sector cyber standards.

But the incident at Change could give a major boost to acolytes of — well — change.

“We need mandatory minimum standards for the sector, like come on,” said Aaron Miri, the chief digital and information officer of Baptist Health, a nonprofit Florida hospital system.

Three government officials interviewed for this story emphasized steps agencies can take today, like working with smaller hospitals to ensure they back up important data or gameplan how they would respond to a hack.

“How do we make sure that they know they're not alone in this fight?" a senior CISA official said.

But the appetite for more aggressive action is growing. President Joe Biden’s newly released budget blueprint for fiscal year 2025 pitched a plan for HHS to fine hospitals that fail to upkeep minimum cybersecurity standards by 2029 — a rule that could be written to incentivize those practices if hospitals are slow to follow through.

“We have to ask” longer-term questions in the aftermath of this hack, the HHS official said, in an interview before the budget went public. “Are we really holding the sector to a high enough cyber standard? Are we driving accountability in the ways that we want to drive accountability?”

A growing cohort of lawmakers on Capitol Hill appear to be asking just that.

“The Change/UnitedHealth hack is that latest reminder that our approach to securing critical infrastructure needs to evolve,” Rep. Eric Swalwell of California, the top Democrat on the Homeland Security Committee’s cyber subcommittee, said in a statement conveying his willingness to consider new regulation.

Others, including Sens. Mark Warner (D-Va.) and Ron Wyden (D-Ore.), are already there.

"Private-sector opposition to effective cybersecurity rules is the number one reason our critical infrastructure, particularly the health care sector, is so woefully unprepared for even unsophisticated cyberattacks," Wyden argued in a statement to POLITICO.

“What keeps me up at night is the possibility of a similar widespread attack directly affecting patient care and safety,” Warner said in a statement last week.

Is UnitedHealth too big to protect?

The domino-style fallout of the hack is also sparking fresh questions about whether corporate consolidation amplifies the chances that a single breach ripples across the country.

"As these companies have become so large, it is creating a systemic cybersecurity risk," Wyden said Thursday in a hearing of the Senate Finance Committee.

“We're just seeing up close and personal the impact on the nation's health care system, and it does relate to the dominance of UnitedHealth,” said Mary Mayhew, the president and CEO of the Florida Hospital Association.

Change, which has said it handles patient data for a third of Americans, already may have been too big to fail before its 2022 sale to the U.S. insurance giant — an acquisition that is already the subject of an antitrust investigation by the Department of Justice.

But UnitedHealth has repeatedly sought to assure customers that the breach affected only Change’s network. And health sector security experts argue that it would have been far harder to do if the companies’ technology systems were more integrated than they are today, just 16 months into the acquisition.

“We absolutely dodged a bullet there,” said Lesser, the CISO at Children’s National Hospital in D.C.

Another reason for the concerns around consolidation is that many U.S. health care providers opted to disconnect their networks from all UnitedHealth systems — not just Change — when the payments subsidiary first reported its breach in February.

That decision was costly, if understandable, the senior U.S. cybersecurity official said. “We kind of exacerbated some of the impacts there out of a lack of knowledge.”

Joshua Corman, a former CISA employee who specialized in health care and systemic risk at the agency, said the enormous fallout from the hack underscores why big isn’t always better in cybersecurity.

"Market consolidation drives risk concentration and is anti-resilient past a certain point," he said.

Asked about those concerns, Tyler Mason, a spokesperson for UnitedHealth, pointed to a recent statement from the company’s CEO, Andrew Witty, that only obliquely addresses the issue.

“All of us at UnitedHealth Group feel a deep sense of responsibility for recovery and working tirelessly to ensure providers can care for their patients and run their practices, and patients can get their medication,” Witty said Thursday.

Is it time to ban ransom payments? 

ALPHV, the prolific cybercriminal gang that hacked Change, says it stole an enormous trove of sensitive health data from the company.

Asked about rumors UnitedHealth made a $22 million payment to keep the gang from releasing that information, Mason, the UnitedHealth spokesperson, said the insurance giant is focused on investigating and remediating the hack.

But the attack is helping revive another controversial idea that the White House has contemplated for years: banning extortion payments to cybercriminals.

Late last winter, National Security Council staff held a series of one-on-one conversations with external cybersecurity experts to ask about the viability of tapping an anti-money laundering provision tied to Russia from the fiscal year 2021 defense law — Section 9714 — to enact a partial ransom payment ban, according to four people who participated in those discussions.

Those individuals, all granted anonymity due to the sensitivity of the discussions, said the Biden administration appeared to back off the idea — which would have included a waiver exemption process for victims in key sectors, like health care — due to concern it would drive payments underground or prevent U.S. companies from recovering critical data.

But a person close to Anne Neuberger, the National Security Council’s top cyber official, said Neuberger is “still pushing hard for a ransom ban behind closed doors.”

Asked for comment about the status of that policy today, Neuberger sidestepped and said the administration “strongly discourages” companies from paying ransoms.

“Ransomware is driven by criminals who are trying to make money, and each payment only encourages the next attack,” she said in a statement.

Mayhew, the Florida Hospital Association executive, said the hack at Change underscores how vulnerable all U.S. companies — not just health care firms — are to such attacks today.

"Right now, we are all at the mercy of these sophisticated cybercriminals,” she said.