WV Insurance: Consumer Alert on Change Healthcare Cyberattack Scams

STATE OF WEST VIRGINIA Offices of the Insurance Commissioner Allan L. McVey Insurance Commissioner Legal Division We are an Equal Opportunity Employer Telephone (304) 558-0401 Post Office Box 50540 Charleston, West Virginia 25305-0540 Facsimile (304) 558-1908 www.wvinsurance.gov CONSUMER ALERT CHANGE HEALTHCARE CYBERATTACK Recently, Change Healthcare (Change), a subsidiary of United Health Group (UHG), experienced a widespread cyberattack which impacted healthcare providers, health insurers and policyholders across the country. Change provides many services for healthcare payors in West Virginia, including but not limited to insurance companies, third-party administrators, and pharmacy benefit managers (PBMs). Change is also a licensed PBM in West Virginia. UHG has reported, based on initial sampling of the data involved in the Change cyberattack, that files containing protected health information (PHI) or personally identifiable information (PII) were found, which could cover a substantial proportion of people in America. The Offices of the Insurance Commissioner (OIC) is issuing this Consumer Alert to remind consumers to remain vigilant in protecting themselves from scammers seeking to profit from this event. The OIC has been advised that scammers have purportedly contacted consumers in other states via telephone, text message or email and impersonated representatives of healthcare providers or healthcare payors seeking financial information from consumers due to the Change cyberattack. Scammers may advise consumers that their payment information was lost in the cyberattack and must be resubmitted or advise that the consumer is entitled to a refund due to the cyberattack, but that the consumer must provide a credit card number, bank account or other personal information to receive payment. The OIC is urging West Virginia consumers to be on the lookout for scams that seek to capitalize on the uncertainty caused by the cyberattack. Consumers who receive unexpected communications relating to the Change cyberattack, especially from someone seeking financial information from the consumer via telephone or email, should not provide the requested financial information without independent verification. Any consumer contacted should contact their health insurer directly at the phone number on the back of their health insurance card or contact their provider’s office directly to report or verify the communication. Using a phone number obtained from an independent source, such as a provider billing statement, explanation of benefits, health insurance card, phone directory, or provider directory is the best way to contact your health insurer or provider. Do not use a phone number, email or website provided to you by a suspicious or unidentified caller or emailer. If you need assistance in contacting your health insurer to verify a communication received regarding the Change cyberattack, you may contact the OIC’s Life & Health Consumer Services Division at 1-888-TRY- WVIC or via email at OICConsumerServices@wv.gov. To contact the OIC’s Special Investigations Division to report a possible insurance fraud related to the cyberattack, please call 1-800-372-8392. More information on support services offered by UHG is available at Change Cyber Support. Issued: April 23, 2024