Identity Management in Healthcare: What the $3 Billion Change Healthcare Breach Teaches CFOs

Key Takeaways

• One remote-access login without multi-factor authentication (MFA) led to $3.09 billion in costs for UnitedHealth Group.
• The cost estimate nearly doubled from the first projection, while the number of affected people rose to 192.7 million.
• Paying a ransom did not end the extortion or the expense.
• Five common identity flaws, from legacy systems to vendor access, carry similar hidden costs across healthcare.
• Identity management in healthcare is a financial control. CFOs should ask where a password alone still grants access.

In February 2024, attackers logged in to a single remote-access portal at Change Healthcare using stolen credentials. The portal had no MFA. What followed became the largest healthcare data breach ever reported to U.S. regulators, and a costly lesson in identity management in healthcare.

The Change Healthcare breach cost UnitedHealth Group $3.09 billion, by its latest estimate. It exposed data on 192.7 million people and disrupted claims processing across the U.S. for weeks.

For CFOs, the lesson is not technical. It is about identity: who can log in, and what proof they need. A missing control worth a fraction of that sum created a multibillion-dollar liability. This post breaks down where the money went, the identity flaws that keep healthcare exposed, and what finance leaders should ask their security teams now.

What happened in the Change Healthcare breach?

Attackers used stolen credentials on a remote-access portal that had no MFA, stayed inside for nine days, then deployed ransomware that took a core piece of U.S. healthcare infrastructure offline.

Change Healthcare, part of UnitedHealth Group, processes about 15 billion healthcare transactions a year, including insurance claims, payments, and prescriptions. That central role is why one compromised login reached so far.

• February 12, 2024. Attackers logged in to a Citrix remote-access portal using stolen credentials.
• No MFA. UnitedHealth's then-CEO, Andrew Witty, testified that the portal "did not have multifactor authentication."
• Policy existed; enforcement didn't. Company policy required MFA on all external-facing systems, yet this portal was missed.
• February 21, 2024. Ransomware was deployed, and Change shut down its network.

Three details matter most for finance leaders:

• No MFA. Witty testified that the portal "did not have multifactor authentication."
• Policy existed; enforcement didn't. Company policy required MFA on all external-facing systems, yet this portal was missed.
• The entry point was a login, not a software flaw. UnitedHealth has not said how the credentials were stolen, but valid credentials were enough to get in.

How much did the Change Healthcare breach cost?

UnitedHealth Group's latest estimate is $3.09 billion, nearly double its first projection, and the bill kept growing long after the attack ended.

Source: HIPAA Journal, HC Innovation Group, HIPAA Guide

• The ransom was the smallest line item. UnitedHealth paid $22 million, but the attackers kept a copy of the data, and a second group, RansomHub, demanded another payment.
• The scope kept expanding. The affected count rose from about 100 million in October 2024 to 192.7 million, adding notification and support costs.
• Legal and regulatory exposure followed. About 50 lawsuits were consolidated into one federal case, Nebraska's attorney general sued, and HHS opened a HIPAA investigation within three weeks.
• The costs spread to providers. UnitedHealth advanced about $9 billion in interest-free loans to providers who could not get paid, and 94% of hospitals in an AHA survey reported a financial impact.

For finance leaders, the pattern is clear: a breach is not a one-time expense. It is a liability that keeps getting repriced for months or years.

Which healthcare identity and access management flaws create the biggest financial risk?

Change Healthcare's gap was one of several identity weaknesses common across healthcare, and each carries a cost that rarely shows up on the books until a breach.

1. Legacy systems that can't support modern authentication

• The flaw: Older clinical, billing, and imaging systems often cannot enforce MFA on their own.
• The cost: Replacing them is expensive, so the exposure stays open and unpriced.
• The fix: Place legacy applications behind a central authentication layer, so they gain MFA without a full replacement.

2. Shared workstations and logins

• The flaw: The pace of clinical work pushes staff toward shared or generic accounts.
• The cost: No individual accountability, harder investigations, and findings in audits.
• The fix: Fast, individual sign-on, so security does not slow clinicians down.

3. A sprawling vendor ecosystem

• The flaw: Billing firms, IT contractors, and device vendors need remote access, often outside central controls.
• The cost: A vendor's weak account can become your breach, and your liability.
• The fix: Govern third-party identities with a named owner, limited access, an end date, and MFA.

4. High turnover and temporary staff

• The flaw: Rotating clinicians, contractors, and temporary staff leave behind accounts that outlive their roles.
• The cost: Orphaned accounts become unmonitored entry points, and unused licenses keep billing.
• The fix: Automate account creation, changes, and removal, tied to HR records.

5. Manual access reviews

• The flaw: Access is checked by hand, system by system, often in spreadsheets.
• The cost: Recurring staff hours, missed exceptions, and weak evidence for auditors.
• The fix: Automated access certification with a built-in audit trail, a core part of healthcare identity management.

None of these flaws is new. That is what makes them hard to defend to regulators, auditors, and boards after a breach.

What should CFOs ask about identity management in healthcare?

On access management in healthcare, CFOs should ask one core question: where can a password alone still get someone into our systems?

1. Which remote-access tools, VPNs, and portals do not require MFA?
2. Which vendors and third parties can access our network, and how are they authenticated?
3. How many dormant or unowned accounts are still active?
4. If one account is compromised, how far could an attacker move?
5. Who reviews access rights, and how often?

Where OpenIAM fits.

Finance leaders should not have to manage authentication themselves, but they do need to know the exposure is closed and stays closed. OpenIAM supports healthcare identity and access management (IAM) by helping security teams apply the same MFA and access policies across cloud, on-premises, and legacy systems from one place, so a forgotten portal does not become an unpriced liability. Regular access reviews retire accounts no one owns, and privileged access controls limit how far one stolen password can travel. What reaches the CFO is not a technical project but evidence: a clear, auditable answer to each question above, ready for the board and the auditors.

Why do identity gaps belong on the CFO's agenda?

Because one unprotected login can become a multibillion-dollar liability, and the flaws behind it are still common across healthcare.

Closing those gaps is not a project finance can leave to IT alone. It is a risk decision with a measurable downside, and CFOs are well placed to ask for evidence that every login path is protected.

FAQ

Why is identity and access management so important for healthcare organizations that handle patient data?

As the Change Healthcare breach showed, one compromised login can do as much damage as any software flaw. Healthcare identity and access management controls who can reach patient records and how they prove who they are.

What types of sensitive data are at stake when identity management in healthcare fails?

Medical records, diagnoses, insurance details, Social Security numbers, and billing data. Unlike a credit card, a medical history cannot be reissued.

How can a healthcare data breach damage an organization's reputation and the trust of its patients?

Under HIPAA, breaches affecting 500 or more people are reported to HHS and listed publicly. That public record can erode patient and partner trust long after systems recover.

How does weak access management in healthcare create financial risk beyond the breach itself?

It can lead to regulatory investigations, lawsuits, notification costs, and lost revenue while systems are offline.

What role does multi-factor authentication play in a healthcare IAM strategy?

MFA ensures a stolen password alone is not enough to log in, especially on remote access and vendor accounts.

What is healthcare identity management, and how is it different from general IT security?

It controls who can access systems and patient data, and how that access is reviewed. IT security protects networks and devices; identity management protects the doors into them.

Sources

• Change Healthcare, compromised by stolen credentials, did not have MFA turned on (Cybersecurity Dive, April 2024)
• Change Healthcare hackers broke in using stolen credentials — and no MFA, says UHG CEO (TechCrunch, April 2024)
• AHA survey: Change Healthcare cyberattack significantly disrupts patient care, hospitals' finances (American Hospital Association, March 2024)
• Change Healthcare Cybersecurity Incident FAQs (HHS Office for Civil Rights)
• Breach Portal: breaches affecting 500 or more individuals (HHS Office for Civil Rights)
• Change Healthcare cyberattack timeline and updates (HIPAA Journal, updated November 2025)
• Change Healthcare tallies 190 million data breach victims (Healthcare Innovation, January 2025)
• New numbers from the Change Healthcare data breach: 193 million affected (Healthcare IT News, August 2025)
• Change Healthcare Data Breach: 192.7 Million Affected (The HIPAA Guide, August 2025)