Indiana University Health in Indianapolis and Tampa (Fla.) General Hospital have filed separate lawsuits against Change Healthcare and its parent company, UnitedHealth Group, alleging the companies failed to safeguard data and maintain backup systems during the 2024 cyberattack, causing significant financial harm.
Both lawsuits were reviewed by Becker’s. IU Health’s complaint was filed Feb. 19 in the U.S. District Court for the District of Minnesota and demands a jury trial. Tampa General filed its lawsuit Feb. 20 in the U.S. District Court for the Northern District of Georgia, Atlanta Division.
Indiana University Health
IU Health alleges Change Healthcare failed to provide contracted billing and payment clearing services after the February 2024 ransomware attack that disrupted healthcare transactions nationwide.
According to the complaint, a threat actor gained access to Change Healthcare’s environment in February 2024, exfiltrated data and encrypted certain systems, rendering them inaccessible to clients. The company then took its remaining systems offline, further disrupting services for healthcare providers, including IU Health.
The health system alleges its agreements with Change Healthcare required the company to provide billing and payment clearing services consistent with industry standards and implement appropriate safeguards to protect protected health information. The agreements also required compliance with IU Health’s security requirements, including implementing two-factor authentication.
The lawsuit alleges cybercriminals accessed a Change Healthcare Citrix portal Feb. 12, 2024, using compromised credentials and that the portal did not have multifactor authentication. Attackers were able to move within Change Healthcare’s systems and exfiltrate data before the breach was discovered Feb. 21, 2024, according to the complaint.
IU Health alleges the outage disrupted eligibility verification, electronic claim submission and routing, remittance advice and cash posting, claims status and denial management, and automated payer-related billing processes.
To maintain operations, the health system activated incident command operations, contracted with new vendors, hired temporary workers, implemented additional IT routines and manually reviewed a backlog of files, the complaint states.
IU Health claims it incurred more than $66 million in costs and losses, including increased uncollected accounts and temporary coding and cash application resources. The lawsuit brings claims of negligence, gross negligence, breach of contract, unjust enrichment and fraud, and seeks damages to be determined at trial, attorneys’ fees, costs and prejudgment interest.
An IU Health spokesperson said in a statement to Becker’s that the health system cannot comment on pending litigation.
Tampa General Hospital
Tampa General’s complaint names Change Healthcare entities, UnitedHealth Group and affiliated Optum and UnitedHealth entities as defendants.
The hospital alleges the February 2024 cyberattack and resulting shutdown of Change Healthcare’s systems disrupted claims and payment processing.
According to the complaint, Tampa General alleges Change Healthcare failed to implement appropriate cybersecurity safeguards, including multifactor authentication, and failed to maintain adequate backup systems as required under its agreements.
The hospital alleges it incurred costs to research and implement alternative software and systems and manually process payments after the outage.
Like IU Health, Tampa General brings claims including breach of contract and negligence and is seeking monetary damages, attorneys’ fees and other relief.
Tampa General and Change Healthcare did not respond to a request for comment from Becker’s.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
