An in-depth, factual look at Change Healthcare: what it does, its history, its acquisition by Optum/UnitedHealth, and the 2024 ransomware attack that…
Change Healthcare's lineage is unusually layered for a company its size. Its earliest roots go back to 2007, when General Atlantic and Hellman and Friedman acquired the business-services segment of Emdeon (formerly WebMD's transaction-services arm), forming an independent claims-clearinghouse business. That business rebranded as Change Healthcare after acquiring a smaller patient-engagement company of the same name in 2015. In 2016 and 2017, McKesson Corporation combined the majority of its health information technology unit with Change Healthcare Holdings to form a new joint entity that kept the Change Healthcare name, with McKesson holding roughly a 70 percent stake. The combined company filed for an IPO in 2019 and traded publicly for a few years before being acquired.
In January 2021, Optum (UnitedHealth Group's health-services subsidiary) announced a deal to acquire Change Healthcare for approximately 13 billion dollars. The transaction faced a Department of Justice antitrust lawsuit over concerns that combining Optum and Change Healthcare would give UnitedHealth too much visibility into competitors' claims data; a federal judge rejected the DOJ's challenge in September 2022, and the acquisition closed on October 3, 2022. Since then, Change Healthcare has operated inside Optum Insight, UnitedHealth's data-and-analytics division, and its technology has been progressively integrated into Optum's broader platform rather than sold as a standalone, independently branded product.
On February 21, 2024, Change Healthcare confirmed a cyberattack attributed to the ALPHV/BlackCat ransomware group, with initial unauthorized access believed to have occurred around February 12, 2024 via a Citrix remote-access portal that reportedly lacked multi-factor authentication. Because Change Healthcare's clearinghouse handled an outsized share of US claims traffic (commonly cited at around half of all medical claims), taking its systems offline had an immediate, nationwide ripple effect: pharmacies could not run real-time benefit checks, providers could not submit or receive claim status updates, remittance advice stopped flowing, and prior-authorization requests backed up, forcing many practices and pharmacies onto manual, paper-based workarounds for weeks.
UnitedHealth Group's own SEC filings quantify the scale of the disruption. The company disclosed an 872 million dollar direct impact in the first quarter of 2024 alone, with guidance for a full-year impact in the 1.35 to 1.6 billion dollar range, and it extended more than 9 billion dollars in interest-free loans and accelerated funding to providers whose cash flow was disrupted by the outage. The incident also involved a large-scale data breach affecting protected health information, which led to regulatory scrutiny from HHS and the FTC, multiple congressional hearings, and a wave of class-action litigation. This event is one of the most significant healthcare cybersecurity incidents on record and is treated here as established historical fact rather than a current operational concern, since systems were substantially restored later in 2024.
Yes. Change Healthcare continues to operate as part of Optum Insight, the data and analytics division of UnitedHealth Group's Optum business, following the October 2022 acquisition. Its technology has been increasingly integrated into Optum's broader platform.
Change Healthcare is owned by Optum, a subsidiary of UnitedHealth Group. Optum completed its roughly 13 billion dollar acquisition of Change Healthcare on October 3, 2022, after a federal judge rejected a Department of Justice antitrust challenge to the deal.
On February 21, 2024, the ALPHV/BlackCat ransomware group breached Change Healthcare's systems, reportedly via a Citrix remote-access portal lacking multi-factor authentication. The company took systems offline, causing weeks of disruption to claims processing, benefits verification, and payments across the US healthcare system, and exposing protected health information for a large number of people.
UnitedHealth Group disclosed an 872 million dollar impact in Q1 2024 alone, with a full-year 2024 impact estimated between 1.35 billion and 1.6 billion dollars. The company also extended more than 9 billion dollars in interest-free loans and accelerated payments to providers affected by the outage.
No. Change Healthcare is enterprise healthcare infrastructure sold through negotiated contracts with health systems, payers, and pharmacy networks. It does not publish self-serve pricing plans.
Yes. The February 2024 incident involved unauthorized access to protected health information, which led to regulatory investigations, congressional hearings, and multiple lawsuits related to the scope of the data exposure.
Yes. Because Change Healthcare's clearinghouse handled a very large share of US claims and pharmacy transaction traffic, the outage disrupted benefits verification, claims submission, and payment processing at thousands of pharmacies, hospitals, and physician practices across the country for weeks.
Its lineage traces back to Emdeon's business-services segment, spun off in 2007. That business rebranded as Change Healthcare in 2015 and merged with McKesson's health IT unit in 2017 to form the company later acquired by Optum.