Is Change Healthcare’s Clearinghouse HIPAA Compliant? Current Status and What Providers Should Know

As of September 30, 2026, Change Healthcare operates as a health care clearinghouse within Optum/UnitedHealth Group and remains subject to HIPAA’s Privacy, Security, and Breach Notification Rules. A clearinghouse can be both a covered entity and a business associate depending on the services it provides, so compliance hinges on ongoing safeguards, contracts, and oversight rather than a one-time “certification.” ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/160.103?utm_source=openai))

The 2024 ransomware attack on Change Healthcare triggered large-scale operational disruption and a federal investigation that is still active. Providers should continue treating Change Healthcare as a regulated partner, verify assurances, and maintain contingency plans should services degrade again. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html?utm_source=openai))

HIPAA Compliance Overview

HIPAA applies to health care clearinghouses, health plans, and most health care providers that transmit electronic transactions. Clearinghouses translate nonstandard health information into standard electronic transactions, which makes them covered entities under HIPAA and directly responsible for protecting electronic protected health information (ePHI). ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/160.103?utm_source=openai))

Under the HIPAA Security Rule, regulated entities must implement administrative, physical, and technical safeguards, perform risk analysis, manage third-party risk, and maintain policies, workforce training, and contingency plans. NIST SP 800-66 Revision 2 provides a practical crosswalk for implementing these safeguards and mapping them to the NIST Cybersecurity Framework and SP 800-53 controls. ([csrc.nist.gov](https://csrc.nist.gov/pubs/sp/800/66/r2/final?utm_source=openai))

Important context: there is no official government “HIPAA certification.” Compliance is demonstrated through risk management practices, documentation, independent assessments, and—if applicable—successful resolution of OCR investigations. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html?utm_source=openai))

Business Associate Responsibilities

When a clearinghouse performs functions on behalf of a provider or health plan, it also acts as a business associate and must execute a Business Associate Agreement (BAA). A BAA must define permitted uses and disclosures of Protected Health Information, require appropriate safeguards, mandate downstream protections for subcontractors, and set clear Data Breach Notification duties and timelines. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html?utm_source=openai))

Even if a clearinghouse is itself a covered entity, it can simultaneously be a business associate for specific services. In that role, it is directly liable for certain HIPAA requirements, and the covered entity remains responsible for ensuring a compliant BAA is in place. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html?utm_source=openai))

Security Certifications and Standards

Many providers rely on third‑party attestations as evidence of control maturity. Two common examples are HITRUST CSF Certification (often r2) and a SOC 2 Type II Report. These do not equal HIPAA compliance, but they can strengthen due diligence by showing how controls operated over time and how they map to recognized frameworks. ([hitrustalliance.net](https://hitrustalliance.net/advisories/haa-2024-009?utm_source=openai))

Action for providers: request the current HITRUST certificate (confirm the scope includes EDI/clearinghouse systems), the latest SOC 2 Type II Report plus a bridging letter, and evidence of Cybersecurity Incident Response testing. Where available, ask vendors to share HITRUST “Insights” or similar mappings that show how certifications align with HIPAA Security Rule safeguards. ([hitrustalliance.net](https://hitrustalliance.net/assessments-and-certifications/insights-reports?utm_source=openai))

Note that certifications often apply to specific products or environments. For instance, some Change Healthcare/Optum solutions publicly cite HITRUST CSF certification and SOC 2 Type II compliance; always confirm whether such attestations cover the clearinghouse functions you use. ([business.optum.com](https://business.optum.com/en/operations-technology/enterprise-imaging/stratus/change-healthcare-stratus-imaging-viewer.html?utm_source=openai))

2024 Cybersecurity Incident

On February 21, 2024, Change Healthcare suffered a ransomware attack attributed to the ALPHV/BlackCat ecosystem, disrupting pharmacy claims, eligibility, and other transactions nationwide. UnitedHealth Group reported restoring 99% of pharmacy network services by March 7, with broader system restoration phased in throughout spring 2024. ([techcrunch.com](https://techcrunch.com/2025/01/27/how-the-ransomware-attack-at-change-healthcare-went-down-a-timeline/?utm_source=openai))

Clearinghouse services were reported restored by November 18, 2024, enabling providers to resume standard EDI workflows through Change Healthcare/Optum’s platforms. Operational timelines varied by trading partner and connection path. ([beckershospitalreview.com](https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/change-healthcare-restores-clearinghouse-services-5-things-to-know/?utm_source=openai))

UnitedHealth Group later updated the breach count to approximately 192.7 million individuals, making it the largest healthcare data breach reported to federal regulators. ([techtarget.com](https://www.techtarget.com/healthtechsecurity/news/366628716/Change-Healthcare-data-breach-victim-count-rises-to-193-million?utm_source=openai))

OCR Investigation Update

OCR formally opened investigations into Change Healthcare and UnitedHealth Group on March 13, 2024, prioritizing those reviews to assess whether a breach of Protected Health Information occurred and whether the entities complied with HIPAA. On July 19, 2024, Change Healthcare filed a breach report with OCR; OCR subsequently updated public FAQs and guidance materials for impacted entities. ([hhs.gov](https://www.hhs.gov/sites/default/files/cyberattack-change-healthcare.pdf?utm_source=openai))

As of September 30, 2026, OCR’s public list of Resolution Agreements does not include a published resolution specific to Change Healthcare/UnitedHealth Group, indicating the investigation has not resulted in a publicly posted settlement or penalty to date. Providers should continue monitoring OCR communications for any enforcement actions or corrective action plans. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html))

Risk Mitigation Strategies

Contract and governance

• Re-verify your Business Associate Agreement with Change Healthcare: scope of services, data flows, breach reporting intervals, subcontractor management, right-to-audit, and termination assistance. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html?utm_source=openai))
• Document “minimum necessary” uses for Payment and Operations, data retention limits, and data deletion/return on termination.
• Ask for current assurances: HITRUST CSF Certification details, SOC 2 Type II Report with a bridging letter, most recent pen test summary, vulnerability management cadence, and Cybersecurity Incident Response tabletop results. ([soc2auditors.org](https://soc2auditors.org/insights/soc-2-for-healthcare-companies/?utm_source=openai))

Security and resilience

• Validate alignment to HIPAA Security Rule safeguards using NIST SP 800‑66r2 as an implementation guide; emphasize identity and access management, network segmentation, encryption, monitoring, and tested recovery objectives (RPO/RTO). ([csrc.nist.gov](https://csrc.nist.gov/pubs/sp/800/66/r2/final?utm_source=openai))
• Strengthen vendor access controls for EDI connections (e.g., SFTP with MFA, IP allowlisting, least privilege, and immutable logging).
• Track and test Data Breach Notification playbooks that integrate vendor reporting with your own patient and HHS notifications. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html?utm_source=openai))

Operational safeguards

• Maintain enrollment and connectivity with a secondary clearinghouse for rapid failover; pre-stage payer enrollments to avoid delays during outages.
• Build “downtime billing” workflows: store-and-forward 837 claims, offline eligibility checks, and manual posting plans for 835/ERA backlogs.
• Reconcile cash flows with contingency deposit procedures and reserve policies to bridge delayed remittances during incidents.

Contingency Planning for Providers

Design and test a practical continuity plan that assumes temporary loss of clearinghouse services. Focus on patient access to medications and care, claims submission continuity, and timely communications to staff and patients. ([unitedhealthgroup.com](https://www.unitedhealthgroup.com/newsroom/2024/2024-03-18-uhg-cyberattack-status-update.html?utm_source=openai))

• Connectivity redundancy: maintain credentials and payer enrollments with an alternate clearinghouse; draft quick‑switch runbooks and contacts.
• Clinical operations: align pharmacy and eligibility workarounds; pre-authorize limited manual dispensing and eligibility verification when systems are down.
• Revenue cycle: queue claims for later submission, capture documentation to support rework, and stage workforce to resolve remittance backlogs rapidly once services resume.
• Communications: pre‑approve internal and external messages, including scripts for patients and trading partners, and templates for Data Breach Notification if vendor incidents implicate your PHI. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html?utm_source=openai))

FAQs.

What makes Change Healthcare’s clearinghouse HIPAA compliant?

Compliance requires the clearinghouse to implement HIPAA Security Rule safeguards; honor Privacy Rule limits on PHI use and disclosure; execute and follow a Business Associate Agreement when acting for providers or plans; and meet Breach Notification obligations. Evidence may include current risk analyses, policies, testing, and independent attestations (e.g., HITRUST CSF Certification, SOC 2 Type II Report), but no private certification can replace regulatory compliance. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/160.103?utm_source=openai))

How does the 2024 cybersecurity incident affect compliance?

A breach does not automatically mean an entity is “non‑compliant,” but it triggers legal obligations (investigation, containment, and required notifications) and can reveal control weaknesses that factor into OCR’s enforcement analysis. In this case, Change Healthcare filed a breach report with OCR on July 19, 2024; OCR prioritized investigations into Change Healthcare and UnitedHealth Group and continues to assess HIPAA compliance. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html?form=MG0AV3&utm_source=openai))

What steps is OCR taking in its investigation?

OCR opened investigations on March 13, 2024, focused on whether PHI was breached and whether HIPAA Rules were followed. OCR has issued public FAQs and guidance and, as of September 30, 2026, has not posted a Resolution Agreement specific to Change Healthcare/UnitedHealth Group on its enforcement page. ([hhs.gov](https://www.hhs.gov/sites/default/files/cyberattack-change-healthcare.pdf?utm_source=openai))

How should providers prepare for potential service disruptions?

Maintain a secondary clearinghouse relationship, pre‑complete payer enrollments, and keep tested downtime workflows for eligibility, claims, and remittances. Require up‑to‑date SOC 2 Type II and HITRUST documentation, validate Cybersecurity Incident Response plans via tabletop exercises, and map safeguards to NIST SP 800‑66r2 to ensure your contingency and breach notification plans are executable under stress. ([soc2auditors.org](https://soc2auditors.org/insights/soc-2-for-healthcare-companies/?utm_source=openai))

Conclusion

Today’s “current status” is that Change Healthcare’s clearinghouse remains a HIPAA-regulated entity under active OCR investigation stemming from the 2024 ransomware attack—the largest healthcare breach on record. Providers should continue exchanging data with contractual and technical safeguards in place, verify third‑party assurances specific to the clearinghouse environment, and keep a ready contingency plan to protect patients, revenue, and compliance if disruptions recur. ([techtarget.com](https://www.techtarget.com/healthtechsecurity/news/366628716/Change-Healthcare-data-breach-victim-count-rises-to-193-million?utm_source=openai))