The EHR and the Plumbing

Change Healthcare was not a household name, and that was the point. It began in the 2000s as Emdeon, the claims-processing business carved out of WebMD, passed through private-equity ownership, renamed itself Change Healthcare in 2015, combined with most of McKesson's health IT business in a 2017 joint venture and listed on Nasdaq in 2019. By the time UnitedHealth Group agreed to buy it in January 2021, for about $13 billion including debt, it said it processed about 15 billion healthcare transactions a year and touched about one in three US patient records (company statements, reported). Eligibility checks, claims, remittances, prior-authorisation requests and pharmacy claims ran through it. Many practices used it without knowing, because their billing vendor routed through Change.

The Justice Department sued to block the deal in February 2022, arguing that Optum would gain access to rival insurers' claims data. A federal judge ruled for UnitedHealth in September 2022, after it agreed to sell Change's ClaimsXten claims-editing business to TPG for about $2.2 billion, and the deal closed in October. Sixteen months later, on 12 February 2024, attackers used stolen credentials to log into a Change remote-access portal that did not have multi-factor authentication, as UnitedHealth's chief executive, Andrew Witty, later told Congress. On 21 February they deployed ransomware, and Change disconnected its systems. The ALPHV/BlackCat group claimed the attack. UnitedHealth paid a ransom of about $22 million in bitcoin; a second group, RansomHub, then posted stolen data and demanded more. Pharmacy services, payments and the main clearinghouse came back in stages through the spring.

The bill was large and kept growing. UnitedHealth's estimate of the 2024 cost rose from about $1.35–1.6 billion in April to about $2.87 billion in October, with a final figure possibly near $3.1 billion (reported, verify), and it advanced about $9 billion of interest-free funding to providers at the peak. The number of people notified rose to about 192.7 million by July 2025 (HHS), the largest health-data breach in US history. Most of the money owed to providers was delayed rather than lost, but a stylized $330 million hospital that goes 30 days without payer cash loses about $25 million of liquidity, and a small practice with a few weeks of cash can go under. This chapter explains the software and networks underneath healthcare, why they consolidate, and why their failures spread so far.