In a letter sent to UnitedHealth Group CEO Andrew Witty this week, New Hampshire Democratic Sen. Maggie Hassan and Tennessee Republican Sen. Marsha Blackburn demanded that the health care giant 'assume full and immediate responsibility' for giving patients and health providers information on the breach.
One reason for the lengthy notification process, he said, was that files on patients were compromised in the ransomware attack.In the aftermath of the hack, some health care providers were confused whether they or Change Healthcare were responsible for notifying patients that their data had been breached. On May 31, the HHS Office for Civil Rights clarified that health care providers can delegate that obligation to Change Healthcare.