Change Healthcare and Health System Risk

The February 2024 ransomware attack on Change Healthcare has become a case study in market concentration and systemic risk in health care. According to a legal analysis by Axinn, Veltrop & Harkrider LLP, the incident is considered the largest health breach in U.S. history and may have affected about 190 million people.

What did the attack on Change Healthcare expose?

The legal reading centers on the dependence on a single intermediary for critical billing and clinical payment functions. That level of concentration, the analysis argues, pushed the regulatory debate toward the episode’s antitrust implications, because a single attack ended up disrupting core processes for hospitals, providers and patients.

At the same time, a sector cybersecurity analysis cited by Help Net Security estimated total damages from the incident, including operational disruption and reputational losses, at about $2.87 billion. That figure far exceeds the ransom paid and shows the systemic cost a single ransomware attack can impose on the U.S. health care system beyond the extortion amount.

What other cases show this pattern in health care?

The Change Healthcare case joins other campaigns against the health sector in the United States. The investigative angle also includes attacks on hospitals such as the University of Mississippi Medical Center and campaigns against home health agencies, a set of incidents that points to the system’s structural vulnerability to digital extortion and the shutdown of critical services.

In that context, the episode stopped being only a cybersecurity incident and became a reference point for what happens when a central piece of the health care chain goes offline. The discussion is no longer limited to the ransom or the initial intrusion, but to the ripple effect on billing, payments and operational continuity across the network.