Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          Enter the terms you wish to search for.
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations Breadcrumb
    Home
                              Blog
                              HHS Office for Civil Rights Creates FAQ Webpage in Response to the Change Healthcare Cyberattack
 Navigate to:
  Categories
    Coronavirus (12)
        Health IT (11)
        Fraud (1)
        Grants and Contracts (1)
        Research (5)
        Prevention and Wellness (20)
        Health Data (6)
        Holidays and Observances (16)
        Global Health (4)
        Public Health and Safety (23)
        HIPAA (3)
        Programs for Families and Children (6)
        Americans with Disabilities Act (1)
        Mental Health and Substance Abuse (1)
        Vaccines (1)
        HHS Administrative (4)
        LGBT (1)
        Emergency Preparedness and Response (1)
        Drug Pricing (1)Text resize icon

                    




HHS Office for Civil Rights Creates FAQ Webpage in Response to the Change Healthcare Cyberattack








  
  
    

  
      
**April 19, 2024**
                |
        By:  HHS    Office for Civil Rights, (OCR)

  
**Summary:**
  





OCR posted a new webpage to answer FAQs concerning the HIPAA Rules and cybersecurity incident impacting Change Healthcare and many other health care entities.


      Today, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) posted a new webpage to share answers to frequently asked questions (FAQs) concerning the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Rules and the cybersecurity incident impacting Change Healthcare, a unit of UnitedHealth Group (UHG), and many other health care entities. The cyberattack is disrupting health care and billing information operations nationwide and poses a direct threat to critically needed patient care and essential operations of the health care industry.

OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which sets forth the requirements that HIPAA covered entities (most health care providers, health plans, and health care clearinghouses) and their business associates must follow to protect the privacy and security of protected health information and the required notifications to HHS and affected individuals following a breach.

The webpage answers questions and provides helpful information on many topics, including:

Why did OCR issue the March 13, 2024, “Dear Colleague Letter”?
	Why is OCR initiating an investigation and what does it cover?
	Has OCR received breach reports from Change Healthcare, UHG, or any affected health care providers?
	Are large breaches (those affecting 500 or more individuals) posted on the HHS Breach Portal on the same day that OCR receives a regulated entity’s breach report?
	Is OCR’s 2016 ransomware guidance applicable to the Change Healthcare cyberattack?
	Are covered entities that are affected by the cyberattack involving Change Healthcare and UHG required to file breach notifications?
	What HIPAA breach notification duties do covered entities have with respect to the Change Healthcare cyberattack?
	What HIPAA breach notification duties do business associates have with respect to the Change Healthcare cyberattack?The new FAQs on the Change Healthcare Cybersecurity Incident may be viewed at: https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html

The HHS Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information may be found at: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf

OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of peoples’ health information. Guidance about the Privacy Rule, Security Rule, and Breach Notification Rules can also be found on OCR’s website.

If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR at https://www.hhs.gov/ocr/complaints/index.html.
  Posted In:
  HIPAASign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases

Sign Up







  Subscribe to RSS
    

      Receive latest updates

                    
  


Related Blog Posts
    

      Reflecting on Cybersecurity Awareness Month
  

Improving the Cybersecurity Posture of Healthcare in 2022 Back to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility Statement
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​