The Department of Health & Human Services announced this week that it will investigate the recent cyberattack on UnitedHealth Group's (UHG's) Change Healthcare, given "the unprecedented magnitude" of the breach, according to the agency. The investigation is being led by HHS's Office for Civil Rights, which enforces HIPAA rules.

"The cyberattack is disrupting health care and billing information operations nationwide and poses a direct threat to critically needed patient care and essential operations of the health-care industry," the agency said in a letter announcing the probe. The office asked organizations associated with Change or UnitedHealth to notify HHS of any potential breaches as required by health privacy rules.

"In close to 90% of the cases where there has been a civil money penalty or settlement related to HIPAA Security Rule violations, a primary violation involved failure to conduct risk analysis," according to office's latest guidance.