The sample email below contains details that participants in the Group Health Program should know about services available to them as part of the Change Healthcare cyber attack. To use, please copy the text below, paste it into your email program and replace any highlighted items with your specific company information.
Dear Group Health Program Participants:
As you may know, NTCA Benefits, the administrator for [Company Name]'s Group Health Program benefits, recently notified us about a third-party cybersecurity event that affected a vendor that processes certain transactions for NTCA. The third party, Change Healthcare (CHC), experienced a ransomware attack that disabled access to its IT systems, causing a system-wide outage. Several NTCA processes for administering benefits were affected by the incident.
What You Should Know
On April 22, 2024, UnitedHealth Group (UHG), the owner of Change Healthcare, issued a press release announcing that the ransomed data included files containing protected health information or personally identifiable information that could cover a “substantial proportion of people in America,” although it did not say who may have been impacted. The release specifically stated that CHC was not issuing an official breach notification but that UHG was immediately providing support and robust protection rather than waiting until the conclusion of the data review. This support includes two years of credit monitoring and identity protection services for “anyone impacted.”
What You Should Do
Although CHC has not stated that NTCA Group Health Program participants have been affected, we encourage you to enroll in the credit monitoring and identity protection services offered by UHG. The following services are available to current and former GHP participants through an identity protection company called IDX:
- Two-Year Single-Bureau Credit Monitoring
- CyberScan™ Dark Web Monitoring
- $1 Million Identify Theft Insurance
- Identity Recovery
- Lost Wallet Coverage
Current and former Group Health Program participants—including adults, minors and decedents—are eligible for these identity protections. To enroll in one or more of these services, follow these steps:
- Call the IDX call center at (888) 846-4705.
- Provide the full name, email address and phone number of each individual enrolling.
- Verify the email for each individual enrolling and provide any additional data points requested.
Please note that the call center cannot provide any specific information about individual data impacts. If you have any issues enrolling in these services, please contact the IDX call center at (888) 846-4705.
How You Can Protect Yourself
While CHC is still investigating whether participants' personal information may have been affected, there are some things you can do to protect yourself:
- Be extra mindful of potential email phishing scams.
- Confirm that your medical bills are for the services you received and that you send payments to the correct addresses or websites.
- If you notice any health care services you did not receive listed on an explanation of benefits statement, please contact your health plan or doctor.
- Regularly monitor the explanation of benefits statements from your health plan and statements from your health care providers, as well as your bank and credit card statements, credit reports and tax returns, to check for any unfamiliar activity.
- If you notice any suspicious activity on your bank or credit card statements or tax returns, please immediately contact your financial institution and/or credit card company or relevant agency.
- Review the Federal Trade Commission's information and resources about how you can check your credit report. https://consumer.ftc.gov/articles/free-credit-reports.
If you believe you are the victim of a crime, you can contact your local law enforcement authorities and file a police report.
For More Information
Please visit NTCA’s Incident Response Resource Page at ntca.org/IncidentResponse for the latest updates on this ongoing situation. In addition, NTCA’s benefits resource specialists are available at (828) 281-9000, Monday through Friday, from 9 a.m. to 7:00 p.m. ET, to answer any benefits questions you may have.