Change Healthcare processes nearly 15 billion transactions annually, interacting with 1 in 3 patient records. The attack sent shockwaves through the health care industry, disrupting care delivery and threatening the operational stability of hospitals, insurers and pharmacies nationwide. In total, the attack exposed the personal and health data of 190 million individuals and is considered the largest in health care history.

Late last year, Nebraska sued Change Healthcare, alleging that the company violated state consumer protection and data security laws because of inadequate security measures. The attack has cost UnitedHealth more than $3 billion, and the company has issued more than $9 billion in loans to affected providers.

Meanwhile, Change Healthcare continues to send out data breach notifications, the Minneapolis Star-Tribune recently reported. A Minnesota resident received a notice in late February that his data was breached in the ransomware attack, while Google searches for Change Healthcare are up across the state, the story said. "Mailings have been ongoing and will continue to go out to help ensure notification," UnitedHealth Group said in a statement to the newspaper.

CareFirst BlueCross BlueShield serves 3.5 million groups and individuals in Maryland and the Washington, D.C., metropolitan area. It has a 75 percent market share in the state and also serves more than 626,000 members in the Federal Employees Health Benefits Program.