Change Healthcare has responsibility to notify patients data breach, says OCR

​While UnitedHealth has yet to file a data breach report with HHS, covered entities can delegate the job of notifying patients that their healthcare data was exposed in the crippling ransomware attack to the UHG subsidiary.