Connecticut Attorney General William Tong urged residents to enroll in free credit monitoring and identity theft protection following the Change Healthcare cyberattack in February 2024, which exposed sensitive health data. The breach potentially impacted up to one-third of Americans, but Change Healthcare has failed to provide individual notice to affected consumers. The AG joined other attorneys general in April 2024 to demand that UnitedHealth Group take more meaningful action to protect those harmed.
In-house legal teams should immediately review all Business Associate Agreements (BAAs) under HIPAA and vendor contracts with Change Healthcare (or its parent UnitedHealth Group) where health data is processed, stored, or transmitted. Specific clauses to scrutinize include: data breach notification timelines and methods (given the failure to provide individual notice), indemnification provisions for breach-related liabilities, mandatory cybersecurity standards and incident response obligations, audit and oversight rights, and termination clauses for non-compliance. Contracts may need amendments to enforce stricter notification deadlines (e.g., within 72 hours), require provision of free credit monitoring for affected individuals, mandate enhanced security controls like encryption and multi-factor authentication, and clarify liability allocation for breaches involving protected health information.
Entity
Change Healthcare
Industry
Healthcare"Change Healthcare, a unit of UnitedHealth, is the nation’s biggest electronic data clearinghouse."
"Data breaches involving PHI are required to be reported to the U.S. Department of Health & Human Services - Office for Civil Rights (hhs.gov) by HIPAA-covered entities."
"The February cyberattack interrupted operations for thousands of doctors’ offices, hospitals, and pharmacies. It also resulted in Americans’ sensitive health and personal data being leaked onto the dark web - a hidden portion of the Internet where cyber criminals buy, sell, and track personal information."
"However, Change Healthcare has not yet provided individual notice to consumers."
"In April, Attorney General Tong joined other attorneys general in sending a letter to UnitedHealth Group, Inc. — the nation's largest health insurer and the parent company of Change Healthcare — urging the corporation to take more meaningful action to better protect providers, pharmacies, and patients harmed by the recent breach."
Connecticut Attorney General William Tong joined a coalition of states and local governments in filing suit against NHTSA over its rule weakening fuel economy standards for new passenger cars and light trucks. The lawsuit alleges the rule violates the agency’s statutory mandate and the Administrative Procedure Act; no penalty or final remedy is reported.
Connecticut Attorney General William Tong joined a multistate coalition suing the EPA over its repeal of greenhouse gas pollution limits for power plants and separately filed a notice of intent to sue over regulation of existing gas plants. The coalition asks the court to overturn the repeal and restore the protections; the release reports no monetary penalty or final order.
$400.0M
Connecticut Attorney General William Tong announced a $400 million settlement with Sandoz Inc. and Fougera Pharmaceuticals Inc. resolving allegations that the generic drug manufacturers conspired to inflate prices, limit competition, and restrain trade. The settlement includes consumer restitution and injunctive reforms; court approval was being sought.
Connecticut Attorney General William Tong joined a coalition of 21 attorneys general in submitting a comment letter opposing a DHS rule that allows certain affirmative asylum applications to be referred to removal proceedings without an asylum officer interview. The coalition argues the rule violates federal law and harms asylum seekers, including unaccompanied children; this was a policy opposition letter, not a privacy enforcement action.
Connecticut and Massachusetts co-led a coalition protest urging FERC to reject the proposed NextEra Energy-Dominion Energy merger. The coalition argued that the merger could increase market power and threaten energy affordability, reliability, and competition; the release does not report a final enforcement decision or penalty.
Connecticut officials warned residents about potential home improvement scams before an approaching nor’easter, including unlicensed contractors, high-pressure sales tactics, and demands for full payment upfront. The release provides consumer guidance on checking contractors and contract requirements; it does not announce an enforcement action or penalty against a named entity.