Why Change Healthcare’s missing MFA was a deal-integration failure

The week

On May 1, 2024, UnitedHealth Group chief executive Andrew Witty testified before the Senate Finance Committee and a House Energy and Commerce subcommittee about the February ransomware attack on its Change Healthcare unit. His written testimony said attackers had used compromised credentials to log in to a Change Healthcare Citrix portal used for remote desktop access, and that the portal did not have multi-factor authentication. He confirmed the company had paid a ransom of $22 million. He also said Change Healthcare, acquired in October 2022, was still being brought up to UnitedHealth’s technology and security standards when the attack happened. Senators from both parties pressed him on why such a basic control was missing at a company so central to US health care payments.

Earlier articles in this series covered the outage from the customer side: the decision to disconnect from Change Healthcare and the cash crisis that followed. The testimony answered a different question, about the company itself. Almost every large health care organization already required MFA for remote access on paper. The gap existed because Change Healthcare sat in the window between a deal closing and a security program arriving. Health care keeps consolidating, so that window is a recurring exposure. It has three stages: what a buyer learns before closing, what it controls in the interim, and what it can prove afterward to its board and customers.

Before closing: diligence that counts doors

Security due diligence in health care deals usually takes the form of a questionnaire, policy review, interviews and perhaps a summary of past incidents. Those methods report intent. A target with an MFA policy will answer yes to an MFA question, honestly, while a legacy gateway or vendor support portal sits outside it.

A sharper method is to count the doors. Before signing, or at the latest before closing, the buyer can map the target’s internet-facing footprint from the outside. That covers domains, IP ranges, remote desktop and VPN gateways, file transfer services and vendor support portals. For each exposed login, the buyer asks how it authenticates and who owns it. The output is a list, not a maturity score. It should also record which logins depend on third parties, such as managed service providers, because those contracts will need changing after closing.

That list has deal value. It can feed specific representations in the purchase agreement, a remediation covenant before closing, or a price or escrow adjustment where the exposure is large. Counsel will shape what is practical, and some targets will resist outside scanning before signing. But a buyer that never sees the list cannot negotiate over it.

The interim: a short list with dates

Full integration of a large acquired company takes years. Identity platforms, networks, monitoring and applications move on a schedule driven by cost and business disruption. During that period the acquired entity runs on its own controls while the parent’s policies apply in name.

The answer is to separate a small interim control set from the long migration. Four controls fit on one page. First, MFA on every remote-access path, enforced at the gateway even if identity is not yet merged. Second, a review of privileged and service accounts, with stale ones disabled. Third, the acquired environment’s logs feeding the parent’s security operations center, so someone is watching. Fourth, tested offline backups for systems whose loss would stop revenue.

Each control needs one named owner and a date measured in weeks from closing, not quarters. None requires the acquired company to change its applications. The trade-off is friction. Enforcing MFA on a legacy gateway can break workflows, and vendor support access is often the first casualty. Integration leaders should budget for those exceptions explicitly, with compensating controls such as restricted source addresses and time-limited access, rather than letting them persist by default.

The interim also needs a decision rule for anything that cannot meet the deadline. A portal that cannot support MFA in thirty days should be taken offline, put behind the parent’s gateway or formally accepted as a risk by a named executive. Silent carry-forward is the failure mode the testimony described.

Afterward: proof for boards and customers

The last stage is evidence. Members of Congress asked, in effect, whether leadership knew. Most boards receive security reporting as framework scores and project lists. Few see a direct list of known exceptions to critical controls, by entity.

A useful board report for an acquiring organization is short. It names the critical controls, the entities where each is not yet enforced, the owner and the closing date. Acquired entities appear as separate lines until fully integrated. Coverage figures come from external testing of every exposed login, reconciled against the identity platform’s enforcement reports. The identity dashboard alone cannot see portals that authenticate somewhere else.

Customers need a version of the same proof. Thousands of providers relied on Change Healthcare as a business associate. Their questionnaires asked whether the vendor required MFA for remote access, and a policy-level yes would have satisfied them. For critical vendors, health systems can instead ask how coverage is verified, how often, by whom, and whether the vendor has made acquisitions whose environments are not yet integrated. Contract language can require notice of material acquisitions and a timeline for bringing acquired systems that touch the customer’s data under the vendor’s controls.

This turns the acquisition window from a private integration matter into a disclosed, dated risk. A board that sees the list can ask why a date slipped. A customer that knows about the acquisition can ask which systems hold its data. Organizations should take counsel’s advice on how such terms interact with business associate agreements and deal confidentiality.

With hindsight

The scale of the breach kept growing. In January 2025 UnitedHealth estimated about 190 million people were affected, and in July 2025 it revised the figure to about 192.7 million, the largest health data breach reported to HHS. In late December 2024 HHS proposed an overhaul of the HIPAA Security Rule, published in January 2025. It would make MFA a requirement with limited exceptions and add an asset inventory and network map. By mid-2026 the final rule had not been issued, so organizations should track its status with counsel.

The acquisition angle aged well. Health care consolidation continued, and the gap between closing a deal and securing the acquired estate remained a common route for attackers in sectors well beyond health care. The practices that held up are the ones that produce lists rather than scores: outside-in mapping before closing, a dated interim control set, and board and customer reporting that names exceptions by entity.