Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show expanded byline information on articles

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

A year after paying off our 2.75% mortgage, we still have no regrets

Home-insurance payouts are shrinking. Here’s how to prevent the worst.

Maxed out on your credit card? Here’s how to dig out.

Want to find hidden gem restaurants? Follow the business crowd to lunch. 

American Airlines fires lawyers after blaming child for being filmed in bathroom

Budget airlines are dropping notorious fees. What changed?

Trevor Williams keeps dealing as Nationals shut down Mariners again

In a throwback loss to the Mariners, the Nats get burned by the bullpen

Nationals loosen up and ride MacKenzie Gore to a win over the Mariners

Carolyn Hax: Parents want nothing to do with their daughter’s cheating husband

Miss Manners: Should graduate send parents a thank-you note?

Ask Amy: I want to be busy in my retirement. My husband resents that.

She graduated from Yale after raising 3 kids. Her son was her classmate.

I was homeless as a kid. Here’s how I survived. 

Kittens or puppies? Animals left at shelter turned out to be foxes — again.

Debunking misinformation failed. Welcome to ‘pre-bunking’

Boeing continues to struggle with spacecraft problems ahead of human flight

Kabosu, side-eyeing Shiba inu who inspired the ‘doge’ meme, dies at 18

12 injured in severe turbulence on Qatar Airways flight

Claudia Sheinbaum is likely to be Mexico’s next president. Who is she?

U.S. lawmakers ignore China’s warning, meet with Taiwan’s new leader

AI will transform sports betting. It will also increase the risks.

Here’s who The Post endorses in D.C. Council primary elections

How (not) to fix the border

Trump told donors he will crush pro-Palestinian protests, deport demonstrators

U.S. and allies move to tap frozen Russian funds despite Kremlin threats

Progressive Democrats aren’t turning activism into election wins

 How Florida is getting its pink back

What you need to know about covid this summer

Trump booed at Libertarian convention

Trump trial live updates: Closing arguments begin in hush money case

Healthy living, including food, fitness, longevity and mental health

See more coverage in your recommendations

See alerts for Health and Wellness developments

Health & wellness

Tips on living better delivered every Thursday

Well+Being newsletter

Health alerts

Health & Science alerts

Matt McClain

Congressional leaders unloaded blistering criticism at UnitedHealth Group in a pair of hearings Wednesday, saying the health-care conglomerate’s handling of a cyberattack had damaged the U.S. health system, threatened the financial stability of hospitals and doctors and put tens of millions of patients’ data at risk.

UnitedHealth’s handling of the situation will probably be “a case study in crisis mismanagement for decades to come,” said Rep. Cathy McMorris Rodgers (R-Wash.), chair of the House Energy and Commerce Committee.

Facing both chambers of Congress, UnitedHealth CEO Andrew Witty repeatedly apologized for the <a href="https://www.washingtonpost.com/business/2024/03/03/change-health-care-hack-hospitals/" target=_blank>hack of subsidiary Change Healthcare</a>, vowed that he and the company will not rest “until we fix this,” and said the company was offering no-interest loans to affected hospitals and doctors and free credit monitoring to affected patients.

Witty said the personal information of about one-third of Americans might be affected by the Change Healthcare hack, which was detected Feb. 21, and that the company was still reviewing the extent of the stolen data.

Witty’s apologies were rejected by lawmakers, who criticized UnitedHealth’s inadequate cybersecurity protocols, asked whether the scope of its operations put Americans at risk and in some cases called for the $450 billion conglomerate to be broken up. Witty admitted that hackers accessed Change Healthcare’s systems through a portal that was not protected by multifactor authentication, a security feature that requires additional information to log in — a point lawmakers repeatedly hammered.

“The Change hack is a dire warning about the consequences of too-big-to-fail megacorporations gobbling up larger and larger shares of the health-care system,” said Sen. Ron Wyden (D-Ore.), the Senate Finance Committee chairman.

Wyden also criticized UnitedHealth’s inadequate cybersecurity protocols, saying the hack “could have been stopped with cybersecurity 101.” He dismissed the credit monitoring offered by UnitedHealth as “the ‘thoughts and prayers’ of data breaches,” Wyden said.

Sen. Thom Tillis (R-N.C.) brandished a copy of “Hacking for Dummies,” questioning how UnitedHealth’s auditors could have missed the lack of multifactor authentication. “This is some basic stuff that was missed,” he said.

Witty committed that UnitedHealth would impose multifactor authentication on its systems across the company within six months. He said the company has advanced more than $6.5 billion in no-interest loans to practices affected by the cyberattack. Witty also confirmed that UnitedHealth, at his direction, paid a $22 million ransom to the hackers in bitcoin — an admission blasted by lawmakers who said it rewarded criminals while failing to keep patient information from being leaked to dark corners of the internet.

Kent Nishimura

Witty faced bipartisan pressure from senators, including Sen. Marsha Blackburn (R-Tenn.), who said the UnitedHealth CEO was painting a “rosy picture” of progress that was “wildly different” from the situation facing providers on the ground in her state, who are still struggling to get paid. She described one provider that had submitted all of its claims but was still waiting on weeks of revenue.

“It is like you all can’t figure this out,” Blackburn added. “When can Tennessee providers and hospitals expect you all to clear the backlog, to catch up and be back to normal?”

Sen. Bill Cassidy (R-La.) suggested UnitedHealth was “almost a too-big-to-fail insurer,” while Sen. Elizabeth Warren (D-Mass.) called it “a monopoly on steroids” that should be broken up. UnitedHealth brought in $371.6 billion in revenue last year, the fourth-highest among all publicly traded U.S. companies.

Witty countered that his company was not too large, noting UnitedHealth does not own hospitals in the United States nor drug manufacturers. He also took issue with estimates that UnitedHealth employs 90,000 physicians, saying the vast majority were contracted or affiliated. “They choose to work with us,” he said.

At times, Witty tried to shift blame to Change Healthcare’s use of outdated technology. “We were in the process of upgrading the technology we’d acquired,” Witty said, adding he was “incredibly frustrated” that the server that was compromised was not protected by multifactor authentication. UnitedHealth’s Optum unit <a href="https://www.optum.com/en/about-us/news/page.hub.optum-and-change-healthcare-complete-combination.html" target=_blank>closed the acquisition</a> of Change Healthcare in October 2022.

That didn’t satisfy Sen. John Barrasso (R-Wyo.), who said he was confused about why Change Healthcare did not deploy multifactor authentication when small, decades-old hospitals in Wyoming use that protection. He dismissed Witty’s arguments that the cybersecurity challenges predated UnitedHealth’s acquisition of Change Healthcare, framing it as “an excuse.”

“I’m unsatisfied,” Barrasso said in a brief interview after he left the hearing.

Witty’s contrite tone from the outset contrasted with the full-throated defense he offered two weeks ago, when he told financial analysts it was “important for the country that we own Change Healthcare.” He also said UnitedHealth resolved the hack “more quickly than I think would ever have been imaginable” if Change Healthcare had been a stand-alone company.

The hack and UnitedHealth’s <a href="https://www.washingtonpost.com/health/2024/04/30/unitedhealth-congress-review-cyberattack/" target=_blank>aggressive growth</a> by buying up such companies as Change Healthcare took center stage at Wednesday’s hearings by the Senate Finance Committee and the House Energy and Commerce Committee. Witty’s appearance marked the first time in 15 years that a UnitedHealth chief executive has testified on Capitol Hill.

After detecting the hack in February, UnitedHealth <a href="https://www.washingtonpost.com/technology/2024/03/01/prescription-drug-hack-alphv/" target=_blank>shut down</a> Change Healthcare’s networks, cutting off pharmacies, hospitals and health-care providers nationally from the <a href="https://www.washingtonpost.com/business/2024/03/03/change-health-care-hack-hospitals/" target=_blank>system on which they relied </a>to submit claims and get paid. Patients experienced delays in care and couldn’t use coupons on which they rely to afford prescription medications.

For many, this was the moment they discovered the existence of Change Healthcare, a kind of superhighway for the traffic of medical claims. Before UnitedHealth took it over in 2022, the smaller firm handled half of all U.S. medical claims, according to the Justice Department, which <a href="https://www.justice.gov/atr/case-document/file/1476901/download" target=_blank>tried to block</a> the $13 billion merger.

Witty was on the defensive as lawmakers, including McMorris Rodgers, pressed him on why so many Americans’ private health information was at risk if, as he said recently, UnitedHealth was a “comparatively small part” of the health system. Witty characterized Change Healthcare as a relatively small company that played an important role by “processing about 40 percent of claims” flowing through the entire health system.

The abrupt outage at Change Healthcare left pharmacists, doctors and hospitals scrambling to find another electronic clearinghouse that could route their claims to insurers. While many were able to switch to rival clearinghouses, some said that technical requirements or contractual agreements with Change Healthcare prevented them from doing so, further delaying their ability to submit medical claims. Federal officials <a href="https://www.washingtonpost.com/health/2024/03/05/change-healthcare-insurance-hack-hhs-plan/" target=_blank>took steps</a> to help tide over stricken providers and facilities.

As of late March and early April, nearly 80 percent of physician practices surveyed by the American Medical Association said they were still <a href="https://www.ama-assn.org/system/files/change-healthcare-survey-results.pdf" target=_blank>feeling the effects</a> of the cyberattack. Christine Meyer, a doctor who owns a primary-care practice outside Philadelphia, expressed outrage in a <a href="https://www.linkedin.com/feed/update/urn:li:activity:7190795309344591872/" target=_blank>LinkedIn post</a> Monday at the notion that the Change Healthcare outage has been resolved.

“We are not ‘post’ anything,” Meyer wrote, adding that a loan from Optum — the United subsidiary that owns Change Healthcare — has helped but that “our full losses will not be recouped.”

Pressed by Sen. Bob Casey (D-Pa.) about Meyer’s case, Witty apologized for a “delay in getting the right level of loan capacity” to Meyer’s practice, and confirmed that “we have no intention of asking for loan repayment until she determines her business is back to normal.”

In prepared testimony, Witty revealed that cybercriminals first accessed Change Healthcare’s systems on Feb. 12 by using compromised credentials. Nine days later, the hackers deployed ransomware, and UnitedHealth realized its systems had been compromised.

“This was one of the hardest decisions I’ve ever had to make,” Witty said of paying the ransom. “And I wouldn’t wish it on anyone.”

Only a few lawmakers offered sympathy to Witty during his testimony. “You were a victim of a crime,” Sen. Ron Johnson (R-Wis.) told Witty, saying cyberattacks are plentiful and that UnitedHealth did not seek out the attention.

Sen. Mike Crapo (R-Idaho), the top Republican on the finance panel and a <a href="https://www.opensecrets.org/members-of-congress/mike-crapo/contributors?cid=N00006267&cycle=CAREER&type=I" target=_blank>longtime recipient</a> of UnitedHealth-linked funds, also framed Witty’s testimony as “a valuable opportunity to learn from United’s experience.”

But for the rest of the day — which stretched across two hearing rooms and more than seven hours, and involved 40 lawmakers — Witty received little relief. About a dozen protesters from <a href="https://peoplesaction.org/campaigns/health-care-for-all/" target=_blank>People’s Action</a>, an advocacy organization that has battled with health insurers over their practice of claims denials, attended the Senate hearing and swarmed Witty once it ended.

“Andrew Witty, you can’t hide. We can see your greedy side,” the protesters chanted. In interviews, protesters shared stories of UnitedHealth denying payment for essential medical procedures.

Rep. Buddy Carter (R-Ga.) — a longtime pharmacist and the final lawmaker to question Witty — ended the day by displaying a chart of UnitedHealth’s sprawling operations, saying its consolidation posed a risk to the health system. “Let me assure you that I’m going to continue to work to bust this up,” Carter said, gesturing to the chart.

Richard J. Pollack, CEO of the American Hospital Association, said in a statement that Wednesday’s hearings “rightly exposed the size and scope of UnitedHealth Group” and its impact on delivering health care. “We believe this examination is long overdue,” he said.

University of Chicago, BA in International Studies

Daniel Gilbert joined The Washington Post in 2022 and writes about the business of medicine. He previously spent seven years as an investigative reporter for the Seattle Times, and before that covered business and energy for the Wall Street Journal.

Daniel Gilbert

George Polk Award, 2020

Goldsmith Prize for Investigative Reporting finalist, 2021

University of Pennsylvania, BA in history

Dan Diamond is a national health reporter for The Washington Post. He joined The Post in 2021 after five years at Politico, where he won a George Polk award for investigating the Trump administration's response to the coronavirus pandemic.

Dan Diamond

UnitedHealth CEO Andrew Witty testifies on Change Healthcare hack in Congress

the-washington-post

Capitol Hill - Washington, DC

The Washington Post

name

washpost

prism://prism.query/site-articles-only,/business&limit=20

Get a curated selection of 10 of our best stories in your inbox every weekend.

Business

The source for business news and analysis. Covering economic policy, business policy, financial news, economic issues, stock market data, local business, technology and more.

prism://prism.query/business-health-care/&limit=20

Health Care

prism://prism.query/site,/us-policy/health-policy&limit=20

Health Policy

prism://prism.query/site,/us-policy&limit=20

U.S. Policy

Policy

News, video and analysis of government, economic, climate, foreign, technology and health policy in the United States.

prism://prism.query/site,/health&limit=20

Health

The Washington Post health section provides coverage and analysis of health, healthcare, nutrition and fitness news.