On 12 February somebody signed in to a Change Healthcare remote access portal with credentials that were not theirs and no second factor, and nine days later the ransomware went off. This is why healthcare IT runs a decade behind, and how much of that lag buys a real reduction in risk to a patient: fifteen-year scanners, validated configurations, a fax that transfers no liability. The part worth being angry about is much narrower, and the login page is in it.
9 May 2024·8 min read·healthcaresecurity
On 12 February somebody signed in to a Change Healthcare remote access portal with a username and password that were not theirs. There was no second factor. They moved around inside for nine days, and on the morning of 21 February the ransomware went off. Both facts are in the written testimony UnitedHealth Group's chief executive gave a House subcommittee on 1 May, eight days ago, which is why this piece argues from a record rather than a guess.
What went down was not a hospital. It was the plumbing: the clearinghouse standing between the people who provide care and the people who pay for it, which the federal government described in March as handling some 15 billion transactions a year and touching one in every three patient records. Pharmacists went back to submitting claims by hand. Practices could not bill and therefore could not be paid, and the testimony names the consequence plainly: a rural family medicine practice struggling to make payroll.
HL7 version 2 was first published in October 1987. It is plain text, delimited with pipes and carets, organized into segments with three-letter names, and it still carries an enormous share of the clinical messaging in American hospitals: admissions, discharges and transfers, orders, lab results, the traffic that makes a hospital's systems behave as though they were one system. It looks, on screen, exactly as old as it is.
It is still there because an HL7 interface is not really an implementation of a standard. Version 2 is permissive by design: segments are optional, fields carry local meanings, and the specification includes an explicit escape hatch for custom ones. So every link between two systems was negotiated once, tested against real traffic, corrected for a month, and then left alone. There is no such thing as "the HL7 interface" at a hospital. There are hundreds of them, each with a counterparty and a set of understood exceptions, and usually one person who remembers why.
Which is the shape of the whole subject, and it is worth stating flatly. A protocol does not survive because it is good. It survives because replacing it requires everyone who ever agreed to it to agree again.
The rest of the lag has causes that are not about software at all, and several are not decisions an IT department gets to make.
The equipment outlives the decade it was bought in. A CT scanner, a linear accelerator, an infusion pump fleet: capital purchases with fifteen to twenty year service lives, financed and depreciated on that assumption. The computer bolted to the side of one is from the year it was installed and will be there until the machine is. Nobody scraps a working imaging system because its console runs an unsupported operating system, and a capital committee that approved it would be misspending money that buys care.
Certification attaches to a configuration, not to a machine. The regulated thing is a validated configuration: this hardware, this software version, these settings, tested as a unit. A patch changes the configuration, so applying it is not an operational decision but a change to a regulated product, which the manufacturer rather than the hospital usually has to authorize. An IT department that patches a device unilaterally has not been diligent; it has taken the device outside the state it was cleared in.
Switching cost is paid in retraining, not in licenses. Replacing a clinical system means every clinician relearns an order-entry workflow they perform under time pressure, error rates rise during the transition, and the errors are clinical rather than commercial. That cost is borne by patients, which is why a system merely bad enough to be infuriating never clears the bar. The bar is not "is there something better". It is "is the gap worth the transition".
The 2009 stimulus paid hospitals and physicians to adopt electronic records, and it worked: the records are electronic now, comprehensively, which is a real achievement and easy to forget. The 2016 Cures Act went after the next problem by making it illegal to block the flow of information, on the theory that the records existed and something was holding them still. Adoption was a thing money could buy, because adoption is a purchase. Exchange is a behavior with a cost at both ends, and the money did not buy it.
The lesson is narrow but durable. A mandate can reliably create a capability, and it cannot reliably create the use of one. Every one of these efforts succeeded at the part that could be bought and stalled at the part that had to be agreed to, which should be sobering to anyone whose plan for a coordination problem is a rule.
The joke writes itself and has been written many times, so here is the part that gets left out. HIPAA never prohibited faxing. Sending protected health information to another provider for treatment, or to a payer for payment, is a permitted disclosure, and the rule asks for reasonable safeguards rather than a particular technology. The machine is not a loophole. It is compliant, and has been for as long as the rule has existed.
The interesting part is why it stays compliant so cheaply. An analog fax between two covered entities puts no third party in possession of the content. The carrier is treated as a conduit, in the same category as the postal service, and a conduit is not a business associate. So there is no business associate agreement to negotiate, no vendor security review, no subcontractor list, and no breach notification chain running through somebody else's infrastructure. The modern replacement stores the message somewhere en route, and storage is exactly what makes that vendor a business associate: a contract, a diligence process, and a party whose incident becomes your incident.
None of which makes it good, and I do not want to leave it looking clever. The cost of a fax is real and it is paid by somebody other than the sender. Data arriving as an image is data nobody can query, so a clerk at the far end retypes it into a chart, and manual transcription is a well-documented route for a wrong number to enter a record. A misdial delivers a whole document to a stranger with no way to recall it. The fax is safe in the sense that has a lawyer and unsafe in the sense that has a patient, and it persists because only one of those two is anybody's job.
A failed change here has a different unit of measurement. In most of the industry a bad deployment costs money and a bad week. If a pharmacy system is unavailable, somebody's dose gets calculated by hand at three in the morning by a person who has been awake for eleven hours. "Move fast and break things" is defensible exactly to the degree that breaking things is cheap. It is a claim about blast radius, not about courage, and it was formulated where the blast radius was a page reload.
Validation is not bureaucracy, it is the memory of specific accidents. Almost every clause in a change control process that looks like paperwork was written after something happened, often something that killed somebody: a radiation machine whose software let two settings coexist that should not have, an alarm suppressed by a configuration nobody reviewed. The process is a list of accidents with the narrative removed. Anyone proposing to drop a step should be able to name which accident will not recur, and that is a fair question rather than an obstructive one.
Part of the lag is the cost of not throwing anything away. Software companies look modern partly because they delete: products retired, customers migrated, formats abandoned, the estate kept roughly the age of the current strategy. A health system cannot retire a patient. Records have to stay legible and legally defensible for decades, across vendors that have been acquired and formats nobody supports, and a decade of visible legacy is what carrying your own history looks like.
The argument is usually framed as speed against safety, and that framing is what protects the failures, because everything slow gets to stand in the safety column for free. The useful axis is not fast against slow. It is whether the slowness is buying anything. Sort the legacy in a health system into two piles: decisions where delay purchases a real reduction in risk to a patient, and decisions where it purchases nothing and has simply never been made by anyone. The first pile is large and defensible. The second is where the damage has come from.
That is the whole argument and it fits in a sentence: healthcare's caution is real and largely earned, and almost none of it is spent where the harm happens.
Which is why the incident that opened this piece is the cleanest example anybody will get. A remote access portal, in front of a clearinghouse carrying a third of the country's patient records, with one factor of authentication, in 2024. Ask what safety that bought. It is not a validated configuration and it is not tied to a device's cleared state. No clinician retrains and no counterparty renegotiates an interface. Turning on a second factor at a Citrix front door is a piece of work with a beginning and an end, and no version of the structural defense I have spent this piece making reaches it.
I want to be careful about the strength of that, because the strong version is not true. Multi-factor authentication would not necessarily have stopped this; credentials get stolen through routes that survive a second factor, and "has MFA" is a weaker property than "resists phishing". The claim is narrower. The control was absent, its absence is the documented way in, and it was absent for none of the reasons this industry has good reasons.
Ask what the slowness is protecting. If the answer names a validated configuration, a cleared indication, a retraining burden or a regulated change process, that is a real answer and the conversation is about sequencing and compensating controls. If the answer is that the vendor has not got to it, or that nobody owns it, that is not conservatism. That is an unmade decision wearing conservatism's coat, and the two are hard to tell apart because they produce the same silence.
Separate the clinical path from the administrative one. The strongest reasons for moving slowly attach to systems that touch a patient directly. Claims routing, remote access, identity and billing are not those systems, and they inherit the excuse by sitting next to them. The most consequential failure of the past year happened in the administrative half of the estate, and every argument available to defend it belongs to the clinical half.
Refuse "we are ten years behind" as a description of anything. It is a mood, and moods have no owners and no budget. Behind on what, measured against whom, at what cost to which patient? Answered honestly, that sentence resolves into three specific items, of which two are load-bearing and defensible and one has been avoided long enough that it now feels structural.
I should be clear about where this is written from. I have never signed the change ticket that takes an imaging system out of service, or explained to a regulator why a configuration differs from the one that was cleared. The people making these tradeoffs are mostly making them carefully, with worse information and far more exposure than I have, and an outsider's confidence about which pile a decision belongs in is worth less than the judgment of whoever gets called at three in the morning. My claim is only that the two piles exist and are routinely treated as one.
Caution is a budget. This industry spends nearly all of it on the machines that touch people, which is where it should go, and the fifteen year scanner and the pipe-delimited message and the fax in the back office are line items in that spending with an argument behind each. What is left over does not cover a login page. That is the picture I am left with: not an industry that cannot work its computers, but one whose care is aimed so heavily at the things that can hurt a patient directly that a single unlocked door stood in front of the country's prescriptions for nine days, and nobody was watching it, because nobody had ever been asked to.