Lawsuits have started rolling in against UnitedHealth Group's Change Healthcare over the cyberattack that has crippled hospitals, physician practices and pharmacies around the country.
At least five federal lawsuits have been filed this month against the healthcare claims and payment processing company, court records show. The complaints include three in Tennessee and two in Minnesota from individual patients seeking class-action status.
One of the lawsuits filed in Minnesota, where UnitedHealth is headquartered, alleges the company is responsible for the data breach and "failed to implement reasonable security procedures and practices and failed to disclose material facts surrounding its deficient security protocols."
Similar allegations were brought forth in the Tennessee lawsuits. One of the suits alleges that the plaintiff and proposed class members "have had to spend, and will continue to spend, significant time and money in the future to protect themselves due to [Change's] actions."
The plaintiff in the other Minnesota suit alleges he unsuccessfully attempted to use his health insurance to fill two medication prescriptions. Due to Change's networks being down, he would have had to pay full price for his medication and pursue an insurance claim after the fact. He said that as of March 5, Change has yet to notify him or "provide any information on mitigating the fallout of this data breach."
Lawsuits typically follow healthcare hacks, but since the cyberattack on Change Healthcare is considered the largest to ever hit the industry, the amount of litigation to follow could also be unprecedented. Healthcare organizations often settle after yearslong court battles.
A UnitedHealth Group spokesperson told Becker's that the company is "focused on the investigation and recovery of Change Healthcare's operations."