Document details

The February 2024 ransomware attack on Change Healthcare halted claims, eligibility, and pharmacy transactions across much of the United States health system. Ninety four percent of surveyed hospitals reported financial impact, 74 percent reported direct effects on patient care, and recovery ran for months. The event was both a cybersecurity failure and a concentration failure, and concentration is what turned one firm's outage into a sector-wide stoppage. Healthcare had routed a critical share of national administrative transaction flow through a single intermediary, a single-sourcing decision that supply chain management has treated as a first-order risk for decades, without importing the risk management apparatus that discipline built around it. This paper develops that diagnosis into a usable instrument.......