Change Healthcare has begun the process of notifying companies whose confidential information found its way into the hands of cyberattackers four months ago, the unit of UnitedHealth Group subsidiary Optum announced Thursday.
Change Healthcare is limiting its outreach to its direct business partners, starting Thursday, as it continues to parse which individuals were compromised, the company said in a news release. A broader campaign to contact specific people is planned for late July.
Related: Change Healthcare cyberattack: CMS to end relief funding program
The Optum division volunteered to carry out legally required notifications on behalf of its customers, and federal authorities approved that plan last month. Change Healthcare clients may opt to conduct their own notifications instead. The company created an informational webpage to which providers, insurers and others can refer their patients and members.
In April, Change Healthcare disclosed the attack likely exposed the personal information of a “substantial proportion of people in America.” UnitedHealth Group estimates the cybersecurity breach will cost it $1.6 billion this year.
On Thursday, Change Healthcare said the incident exposed information such as names, contact information, Social Security numbers, claims, diagnoses, test results, health insurance member numbers and financial data. The company, which says it has reviewed 90% of affected records, has not found evidence that the hackers accessed physicians' medical charts or patients' full medical histories.
On request, UnitedHealth Group will pay for two years of credit monitoring and identity theft protection for affected individuals.
The ransomware attack had far-reaching effects, as Change Healthcare is involved in about one-third of U.S. healthcare transactions, including billing, payment, prior authorization and insurance verification. The company pulled down its network shortly after learning of the breach, creating logistical and financial headaches for providers, insurers, drugstores and others, and limiting patient access to care.
Change Healthcare "regrets any inconvenience or concern caused by this incident," the news release said.