AHA Advertorial: Is UnitedHealth Group ‘Too Big to Fail’?

Rick Pollack
President and CEO
American Hospital Association

On Feb. 21, the American healthcare system was the victim of the most devastating cyberattack in its history. The direct target of the attack was on Change Healthcare. But the effects were felt far beyond Change. As a result of this attack, patients nationwide struggled to obtain prescriptions and faced delays in scheduling care. Hospitals, physicians, and other providers were not paid for weeks, forcing some to take out high-interest loans to make payroll and keep their doors open so they could continue caring for their communities.

If you are asking yourself how a cyberattack on a single company could cause such massive damage, you are asking the right question. The answer, however, is stunningly simple. Over the past several years, Change Healthcare’s corporate owner, UnitedHealth Group, has acquired so many companies and spread its tentacles so far throughout the healthcare system that it has become “too big to fail.”

UnitedHealth Group’s concentration in the healthcare system is unprecedented. Consider some numbers. UnitedHealth Group is the number 5 company on the Fortune 500 list—topped only by household names like Walmart, Amazon, Exxon, and Apple. Last year, UnitedHealth Group took in over $1 billion a day in revenue and reported $22 billion in profit. If it were a country, it would rank 42 in the world in Gross Domestic Product.

UnitedHealth Group is not just an insurance company, as many people think of it. It is America’s largest employer of physicians, responsible for 10% of all doctors in the country. It manages over 22% of prescriptions filled in the United States. Beneath its corporate umbrella are urgent care centers, home health agencies, surgical centers, hospices, and much more. It even owns a bank that has more than $22 billion in assets. UnitedHealth Group has so many subsidiaries that, in 2023, it paid itself $136 billion. More than 25% of UnitedHealth Group’s total revenues come from transfers from one side of its balance sheet to another.

Change Healthcare also has such enormous concentration that it put the entire healthcare system at risk. Change Healthcare is a “clearinghouse”—a middleman that electronically transmits information between providers and insurers. For example, when a hospital submits a claim for an appendectomy, it must travel through a clearinghouse like Change before reaching the insurer. Change is so central to the healthcare infrastructure that it handles 15 billion healthcare transactions annually and touches 1 in every 3 patient records. It processes $2 trillion in health care payments each year—meaning one company has responsibility for more than 44% of all of the dollars flowing through the healthcare system. When the Department of Justice tried to block UnitedHealth Group’s acquisition of Change Healthcare in 2022, it uncovered internal Change Healthcare documents stating: “the healthcare system, and how payers and providers interact and transact, would not work without Change Healthcare.” The past two months have shown just that.

This week, the CEO of UnitedHealth Group will testify before Congress to address this cyberattack. We know from recent public statements that he will insist that only a company of UnitedHealth Group’s vast size and resources could have restored services so quickly. This is like an arsonist claiming credit for putting out the fire. UnitedHealth Group owned Change Healthcare for 15 months before the attack, and yet its profits did not protect Change Healthcare or allow it to plan for this contingency. Change Healthcare’s market power contributed to providers not having business redundancies in the system. UnitedHealth Group’s and Change Healthcare’s concentrated place in the market is exactly what made them such consequential targets in the first place.

Congress and policymakers are rightly providing oversight to fortify the health care infrastructure from cyberattacks, and we welcome those discussions. But this incident has surfaced and shined the light on UnitedHealth Group’s size, scope, and singular place in the healthcare ecosystem. We urge Congress and others to examine the notion of “too big to fail” as it affects the delivery of health care for our nation.