How Change Healthcare’s customers decided whether to pull the plug, and when to plug back in
When ransomware hit the largest US claims clearinghouse, every connected provider faced the same call. Cutting the connection was quick. Knowing what to cut, and what proof to demand before reconnecting, depended on preparation few had done.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On February 21, 2024, Change Healthcare, part of UnitedHealth Group’s Optum business, detected a cyberattack and disconnected its systems. In an SEC filing the next day, UnitedHealth said it had isolated the affected systems from other connecting parties. Change ran one of the largest health care clearinghouses in the United States, handling eligibility checks, claims, remittances and pharmacy transactions for a large share of providers and payers. Pharmacies across the country reported trouble processing prescriptions. Hospitals and physician practices lost the ability to submit claims and verify coverage through Change. On February 22, the American Hospital Association advised organizations to consider disconnecting from Change and Optum systems until it was clear they were safe. On February 29, UnitedHealth attributed the attack to the ALPHV, or BlackCat, ransomware group.
Other articles in this series look at the cash crisis that followed and at what UnitedHealth later told Congress about the cause. This one stays with the first decision that every connected organization faced: whether to cut its own links to a compromised partner, and what it would take to restore them. The decision splits into three parts, taken in sequence. First, knowing what connects you to the partner. Second, deciding what to cut and how fast. Third, deciding what evidence is enough to reconnect. The first two can be done in hours with preparation. The third took weeks for many providers, with or without it, and it is where contracts and architecture made the biggest difference.
Knowing what connects you
Most hospitals and practices thought of Change Healthcare as a vendor of a service. Architecturally it was several things at once. It was a network endpoint receiving claims files and sending remittances. It might be a VPN peer or a hosted connection into the provider’s network. It might be the back end for software the provider used under another brand, such as a practice management or revenue cycle tool. It might sit behind the provider’s pharmacy system, its EHR vendor, or another clearinghouse that routed transactions through Change.
Many organizations found these paths only when they tried to cut them. Some learned that their eligibility vendor depended on Change. Others found that disconnecting one integration broke another. The people who knew how claims really moved were usually in revenue cycle, not security. They knew which portal served which payer and which vendor support accounts existed. Organizations that brought revenue cycle staff into the incident room on the first day mapped their exposure fastest.
The durable fix is a transaction flow map for each critical partner. For each transaction type, such as eligibility, claims, remittance, prior authorization and pharmacy, it records the partner, the connection type, the credentials and certificates involved, and any fourth parties in the path. It belongs to the revenue cycle leader and the integration team jointly, and it should be refreshed whenever a vendor contract changes.
Deciding what to cut
The AHA’s advice to consider disconnecting was sensible given how little was known in the first days. Disconnecting is not free, though. Cutting a clearinghouse stops claims, which stops cash. Cutting a pharmacy connection can stop patients receiving medicines. Each organization had to weigh an uncertain risk that the attacker would move into its environment against a certain operational cost.
Connection types carry very different risk, and that is the basis for a fast decision. An outbound file transfer through a managed gateway gives an attacker little path back in. A persistent network tunnel, a shared directory trust or a remote-access account that the partner uses to support your systems gives a great deal. A sensible rule cuts the second group immediately on credible news of a partner compromise and pauses the first group pending facts.
That rule works only if it was agreed in advance. A decision tree signed by the CISO, the revenue cycle leader and a clinical leader removes the argument on the day. It should name who can order a disconnect outside business hours and which connections are exempt because patient safety depends on them. Architecture helps here too. Organizations that had routed partner traffic through a small number of managed gateways could pause it with a few changes. Those with point-to-point links scattered across departments could not.
Deciding when to reconnect
Reconnection was harder. Change began restoring services in phases from early March, starting with pharmacy, and each connected organization had to decide what assurance it needed before trusting the link again. Some asked for written attestations. Some asked for summaries from third-party forensic firms. Some reconnected only through new credentials and new connection paths. Many moved transactions to another clearinghouse where they could, which raised its own diligence questions about a partner chosen in a hurry.
The organizations that handled this well had a standard ready. It named the evidence they would ask of a compromised partner: the scope of the intrusion, confirmation that the attacker had been removed, and the indicators of compromise relevant to connected customers. It also named the changes they would make on their own side before reconnecting, such as rotated credentials, reissued certificates, narrowed firewall rules and enhanced monitoring of the restored link for a defined period. Finally, it named who would sign off.
The standard is only enforceable if contracts support it. Most clearinghouse agreements said little about what the vendor owed customers after a breach beyond notification. Clauses that oblige a partner to share forensic findings relevant to customers, to support reconnection testing and to give advance notice of restoration plans turn a request into an obligation.
Reconnection also exposed a strategic choice. A second clearinghouse, contracted and tested before any incident, turns the reconnect decision from an emergency into a choice. It costs money and integration effort, and it must be exercised periodically or it will not work when needed. For a health system whose cash depends on claims flowing, that cost is small against weeks without a path.
With hindsight
The Change Healthcare attack became the largest health data breach reported to HHS. UnitedHealth said in 2025 that the stolen data related to about 190 million people, and its chief executive confirmed to Congress in May 2024 that the company had paid a ransom of US$22 million. Services were restored in stages through the spring of 2024. In January 2025, HHS published a proposed update to the HIPAA Security Rule that would require network maps and technology asset inventories, among many other changes. It was still a proposal in late 2026, with final action moved on the federal regulatory agenda to 2027, so the preparation described here remains voluntary. The disconnect decision has held up as a planning case. Knowing the connections, agreeing a rule for cutting them and stating what proof is needed to reconnect can all be done before the next partner is hit.