Iowa Attorney General Brenna Bird has filed a lawsuit against Change Healthcare, alleging the company violated state consumer protection and data security laws in connection with a 2024 data breach that affected nearly 2.2 million Iowa residents.
Filed March 31, the lawsuit claims the breach exposed sensitive personal and medical information and caused widespread disruption across Iowa’s healthcare system, according to a news release from Ms. Bird’s office.
The breach began Feb. 11, 2024, and went undetected for 10 days. During that time, a hacker gained access to Change Healthcare’s systems, created administrator accounts, installed malware and exfiltrated data. The compromised information included Social Security numbers, driver’s license numbers, insurance details, medical records and billing information.
Once the breach was identified, Change Healthcare took its systems offline, triggering operational challenges for providers across the state. Healthcare organizations were forced to continue delivering care without receiving insurance payments while some incurred additional costs to switch claims processors. Patients also experienced delays in medications and treatments, according to the lawsuit.
The company did not notify affected Iowans until five months after discovering the breach — a delay the lawsuit alleges violated state law and limited individuals’ ability to protect themselves from potential fraud.
Ms. Bird called the incident “a preventable debacle,” citing both the scale of the data exposure and the downstream impact on care delivery and hospital finances. She said the lawsuit seeks to hold Change Healthcare accountable and ensure stronger data security protections going forward.
The lawsuit also outlines alleged shortcomings in the company’s systems and response, including outdated IT infrastructure, inadequate breach response, delayed consumer notification and resulting financial and operational strain on healthcare providers.
Ms. Bird’s office is asking the court to require Change Healthcare to strengthen its data security practices, return any ill-gotten gains and pay penalties and damages related to the breach’s impact on Iowa residents and healthcare organizations.
In December 2024, Nebraska Attorney General Mike Hilgers filed a similar lawsuit in Lancaster County District Court, alleging Change Healthcare violated the state’s consumer protection and data security laws.
“We believe this lawsuit is without merit and we intend to defend ourselves vigorously,” a spokesperson for UnitedHealth Group, the parent company of Change Healthcare, wrote to Becker’s in an email statement.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
