UnitedHealth: outages and rulings

UnitedHealth is facing two separate tests at once: the fallout from the Change Healthcare cyberattack and a new federal appeals ruling over a denied surgery claim. (hhs.gov) In the cyberattack, federal health officials said in March 2024 that the Change outage was disrupting health care and billing systems nationwide and posed “a direct threat” to patient care and industry operations. The Office for Civil Rights opened an investigation into Change Healthcare and UnitedHealth Group over possible Health Insurance Portability and Accountability Act violations. (hhs.gov) Congress described Change Healthcare as a clearinghouse that processes about 15 billion medical claims a year, or roughly 40 percent of all claims, before the February 21, 2024 attack knocked it offline. House Energy and Commerce staff said the outage left doctors’ offices and hospitals with unpaid-claims backlogs and cash-flow problems. (energycommerce.house.gov) UnitedHealth said on April 22, 2024 that its data review found files containing protected health information or personally identifiable information that could cover a “substantial proportion” of people in America. The company said it had not seen evidence that doctors’ charts or full medical histories were among the exfiltrated data it had reviewed at that point. (unitedhealthgroup.com) House investigators said UnitedHealth Chief Executive Andrew Witty told lawmakers the attackers got in through a server that did not use multifactor authentication, a standard extra-login check. Witty said Change had older technology that UnitedHealth had been working to upgrade after the 2022 acquisition. (energycommerce.house.gov) The separate court case came down on April 13, 2026, when the United States Court of Appeals for the Ninth Circuit ruled in *Campbell v. UnitedHealthcare Insurance Company*. The panel reversed the denial of benefits and sent the case back with instructions to award attorneys’ fees and impose statutory penalties. (law.justia.com) The dispute involved UnitedHealthcare’s refusal to cover treatment tied to a patient’s prior weight-loss surgery, according to Bloomberg Law’s report on the opinion. A plaintiff-side benefits law summary of the ruling said the court found United used “cookie-cutter” denial letters and failed to turn over requested claim documents for more than three years. (bloomberglaw.com) (robertsdisability.com) Together, the two matters land on different parts of UnitedHealth’s business: Change Healthcare sits inside the payments and data plumbing of the medical system, while UnitedHealthcare makes coverage decisions for insured patients. In one case, the problem was a breakdown in a central transaction network; in the other, a federal court said the insurer handled a member’s claim and records requests improperly. (energycommerce.house.gov) (law.justia.com) Federal officials have kept the cyberattack under review well past the initial outage. The Department of Health and Human Services updated its Change Healthcare incident guidance on March 14, 2025 and said its investigation centered on whether protected health information was breached and whether Change and UnitedHealth complied with federal privacy and security rules. (hhs.gov) The through line is that both episodes turned routine health-care functions into bottlenecks: one for claims and payments across the system, the other for one patient seeking coverage and plan records. UnitedHealth has spent the past two years answering for both kinds of failure in public hearings, regulatory inquiries, and now a fresh appellate ruling. (finance.senate.gov) (law.justia.com)