Change Healthcare's Figure Settled Near 192.7 Million People
The July 31 letter is the one to file. About 192.7 million people potentially impacted, with a warning that full deduplication was not possible.
On July 31, 2025, Change Healthcare told state regulators the notification process was complete and that approximately 192.7 million individuals had been potentially impacted. About 1.3 million of that total were attributed solely to entities that did not delegate regulator notification to Change Healthcare. The letter says complete deduplication was not feasible. Reuters reported on August 14, 2025 that the HHS site showed 192.7 million people impacted.
HHS's FAQ matches that timeline: October 22, 2024 for about 100 million notices; January 24, 2025 for about 130 million notices and about 190 million people impacted; July 31, 2025 for about 192.7 million people impacted. If you still have the January number in a policy appendix, replace it.
Final tally, unfinished device work
A final vendor number does not close a clinic's own device risk. Staff computers that cached eligibility files, claim PDFs, or messages are still in drawers and cars. The clearinghouse incident is not a reason to skip wipe capability. It is a reason to be able to say, in the same breath, "we know what the vendor reported" and "we can wipe the laptop we issued."
Use the earlier notes if you need the trail: the October notices and the January estimate. DriveStrike remains the endpoint tool, not a claim about UnitedHealth's network. ePHI on staff devices is the follow-on work.
Start a DriveStrike trial or contact Spearstone to put wipe and lock next to the vendor file you just updated.
Keep reading
- Verizon's 2025 DBIR: Almost Half of Those Infostealer Logins Sat on Unmanaged Devices
- A 2025 Survey Found Device Theft at 76% of the IT Teams Asked
Questions worth answering directly
What is the figure to cite after July 31, 2025?
Change Healthcare's July 31, 2025 notice estimates approximately 192.7 million individuals potentially impacted. The company said full deduplication was not feasible, and that about 1.3 million were tied to entities that did not delegate notification.
Where did Reuters get 192.7 million?
Reuters reported on August 14, 2025 that the U.S. health department's website showed that impact figure for the hack at UnitedHealth's tech unit.