HHS said it has not received a breach notification from UnitedHealth's subsidiary Change Healthcare in the wake of the February cyberattack it suffered.
An April 19 news release from HHS regarding the Change hack said the agency has not received a breach report from Change or UnitedHealth.
HHS did say HIPAA-covered entities have at least 60 days to report a breach from the date it was discovered. The Change hack occurred Feb. 21.
Additionally, HHS said any covered entities that have been affected by the breach must report it if protected health information has been compromised.