Change Healthcare Had Already Sent About 100 Million Notices
The largest healthcare incident in years was already a nine-figure notification problem before 2025 started. The laptops in the clinic were never the clearinghouse.
HHS keeps a public FAQ on the Change Healthcare cybersecurity incident. It records that on October 22, 2024, Change Healthcare notified the Office for Civil Rights that approximately 100 million individual notices had been sent. The ransomware attack itself was reported earlier. The FAQ is the document to quote, because the number has kept moving.
Change Healthcare is a payments and clinical-data clearinghouse. A breach there is not "a lost laptop at the front desk." It is a vendor that sits between a huge number of care providers and the claims those providers submit. HHS has been explicit that covered entities still have breach-notification duties, and that who sends the notice is a decision those entities make. Delegation to Change Healthcare is allowed. Pretending the incident is someone else's problem is not.
What still sits in the clinic
While the clearinghouse incident ran, staff kept working on whatever devices they had: office PCs, laptops taken home, phones with EHR apps. Those machines can hold exports, eligibility checks, and messages that include the same patients later named in a notice. When one of those devices disappears, you have a second incident with a much smaller blast radius and a much clearer owner. That owner should be able to wipe it.
Spearstone does not claim DriveStrike would have stopped the Change Healthcare attack. The honest use is narrower and still urgent: electronic protected health information on staff devices needs remote wipe, lock, and a locate history. DriveStrike's own feature list is the right place to read what the product actually does.
A briefing you can give this week
- Quote HHS, not a blog, for the notice count you use in front of leadership.
- Ask which of your business associates have told you whether they delegated notification.
- Inventory clinic laptops that can store patient exports, and confirm each can be wiped if it is lost.
See Spearstone's data-security work or contact the team. Healthcare customers can start a DriveStrike trial on the devices they control.
Keep reading
- CISA Told Highly Targeted People to Treat Their Phones as Exposed
- The Change Healthcare Estimate Moved to About 190 Million People
Questions worth answering directly
What figure should I cite for October 2024?
HHS says that on October 22, 2024, Change Healthcare notified OCR that approximately 100 million individual notices had been sent. Later updates raised the estimated number of people impacted. Use the FAQ date that matches the sentence you are saying out loud.
Does a clearinghouse breach remove a clinic's duties?
No. HHS says decisions about who notifies HHS and individuals belong to the affected covered entities. A clinic still has to know what it was told and what its own devices hold.