Nebraska Attorney General Mike Hilgers took legal action over the 2024 Change Healthcare data breach, which has been permitted to move forward after a motion to dismiss was denied. The litigation registered in Lancaster County District Court in December 2024 referred to Optum, UnitedHealth and Change Healthcare as defendants. The legal action claimed the defendants broke Nebraska’s data privacy, consumer safety, and security regulations.
The lawsuit was filed after the devastating ransomware attack and data breach that impacted over 190 million U.S. citizens, including about 900,000 Nebraskans. After the ransomware attack, claims and payment processing programs were shut down for approximately two months, contributing to substantial financial difficulty for the healthcare companies that counted on Change Healthcare’s clearinghouse services and stalling important healthcare assistance for state residents.
The lawsuit claimed that the cyberattack took place due to Change Healthcare’s inability to employ acceptable and proper cybersecurity steps and observe industry-required cybersecurity strategies. This ought to be addressed in a cybersecurity and/or HIPAA training for employees. The lawsuit likewise alleged cybersecurity breakdowns because of extended use of out-of-date IT systems and inadequate system segmentation, which led to an increase in data breaches and the inability to address the incident for up to two months following the ransomware attack. During this time, authorizations were stopped for medical care and prescription medicines, slowing down care, and patients were without necessary medicines and prescriptions.
Furthermore, the lawsuit complained about Change Healthcare’s reaction to the security breach, with Nebraskans needing to wait for about five months prior to being advised that their sensitive information was stolen during the attack. Because of the cyberattack, state locals were put at considerable risk of harm caused by fraud, identity theft, and other inappropriate uses of their health data. Change Healthcare submitted a motion to dismiss; nonetheless, Lancaster County District Court Judge Susan Strong refused the defendant’s disputes, discovering that the state had adequately claimed all violations of the state’s customer security and data privacy rules and enabling the lawsuit to continue to the subsequent stage.
The state wants civil penalties, economic damages, reimbursement, and to completely stop the defendants from participating in acts and procedures that disobey state rules. The Court’s judgment ensures they can go on to follow accountability and offer stronger defenses for Nebraskans’ health information. Attorney General Hilgers explained that close to 50% of Nebraskans had their most sensitive data compromised as a result of this data breach. Our office is thankful the court granted this action to move forward so we can proceed with their fight to safeguard the privacy and rights of Nebraskans.