The attached links contain information from Change Healthcare about notification of the data breach and two articles that take a deeper dive into this situation.
https://www.changehealthcare.com/hipaa-substitute-notice
https://www.axios.com/2024/07/15/change-healthcare-cyberhack-fallout-risk-to-consumers
https://energycommerce.house.gov/posts/what-we-learned-change-healthcare-cyber-attack
The Benefits Trust Committee was notified today that the Guardian Insurance Company was identified as a customer whose members' data was affected by a cyber attack on Change Healthcare, a third party health payment processing company.
Therefore, in order to keep our members as fully informed as possible, we are forwarding a copy of the email (see below) we received from our Guardian Representative.
Please contact us if you have any questions or concerns.
** As a precaution, members should take advantage of the credit monitoring service that is mentioned in the email.
** If you highlight and right click the links in the email, you can open them in a new tab.
In solidarity,
Regina Hendrickson
Chairperson
CTA Benefits Trust Committee
rhendrickson@ccsd.edu
Chris Littlejohn
Manager
CTA Benefits Trust
benefits.cta@gmail.com
Team,
Good afternoon! I hope you all had a wonderful weekend.
I reached out to our legal department to get the items that we discussed at our meeting last week.
Change Healthcare does not know for sure who is impacted, just that Guardian is on the list of impacted clients. Change Healthcare estimates that 1/3 of the US population was impacted. It is possible for a person to be impacted through different channels (medical, dental, pharmacy, etc.).
On 6.25.24, Change Healthcare advised that Guardian has been identified as a customer whose member’s data was involved in the security incident. CHC has not identified nor provided specific customer information. Guardian has opted for CHC to provide all the necessary individual member notifications. CHC has agreed to send direct notice letters to those individuals determined to be affected through data review attributable to specific clients and for whom CHC has sufficient addresses. In situations where individual addresses are not identified, HIPAA requires substitute notice be provided. Guardian has prominently posted the CHC Substitute Notice link on the homepage of our website. That link is https://www.changehealthcare.com/hipaa-substitute-notice. This substitute notice includes a description of personal information which may have been involved in the security incident, a toll-free call center number, and information on complimentary credit monitoring and identity protection services available to individuals. Again, CHC has not identified or provided information as to specific plan holders or members impacted.
I would suggest that Clarkstown share with your members the link for the substitute notice, substitute notice, and members can contact CHC directly for two years of complementary credit monitoring. They can enroll online or they can call 1-888-864-4705.
Please let me know if you have any additional questions.
Have a great day!
Anne
|