Senate Passes Health Care Cybersecurity & Resiliency Act After Change Healthcare Ransomware Breach Exposes 190 Million Records
What Happened – A ransomware attack on Change Healthcare in early 2024 compromised the protected health information of roughly 190 million individuals. In response, the U.S. Senate unanimously passed the Health Care Cybersecurity and Resiliency Act of 2026, mandating minimum security standards (e.g., multifactor authentication) and extending oversight to third‑party vendors handling health data.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate vendor oversight; a continuous‑control‑assurance program would have required documented due‑diligence and real‑time monitoring of third‑party security postures.
- The new law forces organizations to collect and retain evidence of compliance (e.g., MFA deployment, breach‑notification counts), aligning with control‑objective monitoring and audit‑ready documentation.
- Leveraging a third‑party risk management capability enables you to map vendor contracts, assess security controls, and generate defensible evidence for regulators.
Who Is Affected – Health‑care providers, health‑IT vendors (including EHR and claims‑processing platforms), and any private entity that stores, processes, or transmits PHI.
Recommended Actions
- Inventory all third‑party service providers that handle PHI and assess their security controls against the upcoming federal standards.
- Implement continuous monitoring of vendor security posture (e.g., MFA enforcement, patch management) and retain audit‑ready evidence.
- Update breach‑notification procedures to capture total victim counts as required by the new law.
Technical Notes – The Change Healthcare breach was a ransomware intrusion that encrypted claim‑processing systems and exfiltrated patient records. No specific CVE was disclosed; the attack leveraged known ransomware tactics (credential theft, lateral movement). Source: The Record