The Change Healthcare Breach Started With a Password. Yours Could Too.
By Michael
In February 2024, the ALPHV/BlackCat ransomware group broke into Change Healthcare, the largest healthcare payment processor in the United States. Change processes roughly 15 billion healthcare transactions per year. It's the backbone that connects providers to insurance companies for claims, payments, eligibility checks, and prior authorizations.
The attackers got in through a Citrix remote access portal. The method was not sophisticated. They used stolen credentials purchased on the dark web and typed them into a login page that did not require multi-factor authentication. A username and a password. That's all it took.
Once inside, they spent nine days moving through the network undetected, exfiltrating data and mapping infrastructure. On February 21, they deployed ransomware, encrypted everything, and brought the entire operation offline.
The result: 192.7 million individuals had their data exposed. Names, Social Security numbers, medical records, billing information, insurance details. Nearly two-thirds of the US population, making it the largest healthcare data breach ever recorded.
The Fallout Hit Practices Hardest
When Change Healthcare went dark, the impact cascaded across the entire US healthcare system. Claims stopped processing. Prior authorizations froze. Pharmacies couldn't verify insurance coverage.
The numbers tell the story:
- 94% of hospitals reported financial impact
- 80% of physician practices lost revenue from unpaid claims
- 74% of hospitals reported delays in patient care
- Pharmacies had to turn patients away or ask them to pay cash for prescriptions
But the hardest hit were small practices. Solo practitioners and small offices don't have the cash reserves of a hospital system. When claims processing froze, revenue stopped. The American Medical Association reported that nearly two-thirds of physicians used personal funds to cover practice expenses during the outage. Some went weeks without any revenue. Some took on personal debt just to keep the lights on and pay their staff.
This wasn't just Change Healthcare's problem. It became every practice's problem, overnight, with no warning and no recourse.
You're Doing the Same Things They Did
Here's the uncomfortable part.
The security failure that brought down a subsidiary of a $400 billion company was a missing MFA checkbox on a remote login page. That's it. Not a zero-day exploit, not a sophisticated supply chain attack. A login page that accepted a username and password with no second factor. The kind of setup that most consumer email accounts stopped allowing years ago.
Now think about your practice.
Does every system your staff accesses have multi-factor authentication enabled? Your EHR, your email, your billing portal, your patient scheduling system? Or are some of them protected by nothing more than a password?
Is your office manager checking patient records through a personal Gmail account? Is your front desk logging into your systems on a shared computer where someone also browses the web, checks social media, and opens email attachments? Are your staff connecting to your patient portal over the WiFi at a coffee shop on a personal laptop?
Every one of these is the same kind of mistake that took down Change Healthcare. A staff member clicks a phishing link in their personal email. Their browser profile has saved passwords to your patient portal, your billing system, your EHR. Those credentials are harvested in seconds. Or someone logs into your systems over an unsecured network, and the traffic is intercepted. Or a reused password from a breached consumer site turns out to be the same one that unlocks your practice's data.
A company processing data for 200 million Americans was brought to its knees by a stolen password and a missing checkbox. The bar for breaching your practice is not higher.
"But We're Too Small to Be a Target"
This is the most dangerous assumption in healthcare IT.
Attackers don't browse a directory of practices and pick ones by size. They run automated scans and mass phishing campaigns that hit thousands of targets at once. They're looking for the easiest way in, not the biggest payoff. A small practice with weak security is a softer target than a hospital system with a security operations center.
And small practices are less likely to detect a breach when it happens. Large organizations have intrusion detection systems, security teams, and audit logs. A solo practitioner might not realize their systems were compromised for months, if ever.
HIPAA doesn't care about your headcount. The regulations apply to every covered entity and business associate regardless of size. The Office for Civil Rights has investigated and fined solo practitioners and small practices. A breach that exposes patient data triggers the same notification requirements, the same investigation process, and the same potential penalties whether you have 50 patients or 50,000.
What HIPAA Compliance Actually Prevents
Most small practices hear "HIPAA compliance" and think paperwork. Policies nobody reads, training checkboxes, binders on a shelf. That's a compliance theater problem, not a HIPAA problem.
The actual controls that HIPAA requires are the same ones that would have prevented the Change Healthcare breach and the same ones that protect your practice from the threats you face every day.
Multi-factor authentication. The single control that would have stopped the Change Healthcare attackers at the door. If every system that touches patient data requires a second factor, a stolen password alone is useless.
Encrypted email and communications. Patient information sent over personal Gmail or unencrypted email is exposed in transit and at rest. HIPAA requires that electronic PHI be protected. Encrypted, HIPAA-compliant communication channels close this gap.
Access controls. Not everyone in your office needs access to everything. Role-based access means a compromised front desk login doesn't expose your entire patient database.
Staff training. Your team needs to recognize phishing emails, understand why they can't use personal devices for patient data, and know what to do if something looks wrong. Most breaches start with a human mistake. Training is the cheapest and most effective control you can implement.
Network security. Patient data should never travel over public WiFi. Systems that handle PHI should be on a secured, segmented network. This doesn't require enterprise hardware. It requires intention.
Incident response planning. If a breach happens, do you know what to do in the first hour? Who to call, what to shut down, how to notify patients? Having a plan is the difference between a contained incident and a catastrophe.
None of these are exotic enterprise requirements. They're the baseline that keeps a stolen password from turning into a breach that ends your practice.
Start With an Audit
If you're not sure where your practice stands, that's normal. Most small practices have never had a formal security assessment. The first step is understanding what you have, where the gaps are, and what to prioritize.
We run HIPAA security audits designed for small and mid-size healthcare practices. No jargon, no checklists for the sake of checklists. Just a clear picture of your current posture and a practical plan to close the gaps before they become problems.