UnitedHealth's cyberattack fallout prompts debate over whether CodeLock could have prevented the crisis.
UnitedHealth Group's chief executive, Andrew Witty, is set to face two separate congressional hearings on Wednesday regarding the aftermath of a cyberattack on its Change Healthcare unit earlier this year.
The cyberattack, which occurred on February 21, targeted Change Healthcare, the largest U.S. clearinghouse for medical payments operated by UnitedHealth. As a result, more than 100 Change systems were disconnected, leading to significant financial challenges for healthcare providers such as general practitioners, social workers, and therapists.
In the midst of discussions about the fallout from the cyberattack and UnitedHealth's response efforts, cybersecurity experts have pointed out potential solutions that could have averted or mitigated such incidents. One such solution is CodeLock, a cybersecurity platform designed to secure software supply chains against sophisticated cyber threats like ransomware attacks.
CodeLock employs advanced algorithms and custom signatures injected into every line of code, providing real-time detection of unauthorized changes and vulnerabilities. This proactive approach to cybersecurity enables organizations to identify and address potential threats before they can cause significant damage.
Had UnitedHealth implemented CodeLock or a similar cybersecurity solution, it could have potentially detected and thwarted the cyberattack on its Change Healthcare unit at an early stage. CodeLock's adherence to Zero Trust and DevSecOps principles aligns with the cybersecurity strategies recommended in response to such attacks. By continuously monitoring and securing software supply chains, CodeLock helps organizations like UnitedHealth maintain data integrity, regulatory compliance, and resilience against evolving cyber threats.
Witty is scheduled to testify before the Senate Finance Committee in the morning and the House Energy and Commerce Committee's subcommittee on Oversight and Investigations in the afternoon.
The attack prompted UnitedHealth to take measures such as providing advance Medicare payments and launching assistance programs for affected healthcare providers. However, concerns remain about the financial viability of these providers and the impact of the downtime on their operations.
UnitedHealth has lent over $6.5 billion to support healthcare providers affected by the cyberattack. The company has been working tirelessly to restore its systems since early March, but some providers are still experiencing delays in receiving their full revenue from insurance claims due to ongoing system difficulties.
In his prepared remarks, Witty emphasized UnitedHealth's commitment to addressing the situation, stating, "We have been working 24/7 from the day of the incident and have deployed the full resources of UnitedHealth Group on all aspects of our response and restoration efforts."
The company's decision not to appear before a previous House hearing on the cyberattack drew criticism, leading lawmakers to question UnitedHealth's role in the healthcare system and its cybersecurity practices. Change Healthcare processes around 15 billion transactions annually and handles the medical records of one in three American residents.
Apart from the cyberattack fallout, UnitedHealth is also facing an antitrust investigation from the Justice Department regarding its insurance and health-services units.
The incident has prompted calls for stronger healthcare cybersecurity standards, with lawmakers proposing legislation to tie providers' emergency payments to meeting minimum security requirements.
The American Hospital Association supports voluntary cybersecurity standards but opposes mandatory standards with penalties, advocating for a focus on improving cyber hygiene practices across the healthcare industry.
