iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The UnitedHealth testimony most often described as revealing “fails” was the May 1, 2024 congressional examination of the Change Healthcare cyberattack. Sen. Ron Wyden accused UnitedHealth of inadequate security and recovery planning, including the alleged absence of multifactor authentication on a server that provided access to protected health information. Those remarks were congressional criticism, not a court judgment or an independent technical audit.
A separate January 22, 2026 House hearing examined health-insurance affordability, denials and artificial intelligence. UnitedHealth CEO Stephen Hemsley testified about those issues. The two hearings should not be merged: the first concerned a cyberattack and operational disruption; the second concerned insurance practices and affordability.
Which UnitedHealth congressional hearing does the title refer to?
The wording is ambiguous because two major hearings involved UnitedHealth executives.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Date and committee | Witness | Main subject | What the record shows |
|---|---|---|---|
| May 1, 2024, Senate Finance Committee | Andrew Witty, UnitedHealth Group CEO | Change Healthcare cyberattack | Questions about cybersecurity controls, recovery readiness and disruption to health-care operations |
| May 1, 2024, House Energy and Commerce Oversight and Investigations Subcommittee | Sir Andrew Witty | Change Healthcare cyberattack | Witness statement, summary and later questions for the record |
| January 22, 2026, House Energy and Commerce Committee | Stephen Hemsley, UnitedHealth Group CEO | Health-insurance affordability, denials and AI | Questions about claim decisions, prior authorization, algorithmic tools and company policy proposals |
This article covers both events while keeping their evidence and allegations separate.
What did UnitedHealth tell Congress about the 2024 cyberattack?
The Senate Finance hearing was titled “Hacking America’s Health Care: Assessing the Change Healthcare Cyber Attack and What’s Next.” The official record identifies it as Senate Hearing 118-785. The House held a separate Change Healthcare hearing on the same day. Both records list Andrew Witty as the UnitedHealth witness.
Wyden’s criticism of security controls
In his prepared statement, Finance Committee Chair Ron Wyden characterized the incident as a systemic risk and directed responsibility toward UnitedHealth’s leadership. He wrote: “Accountability for Change Healthcare’s failure starts at the top.”
Wyden also said a server providing access to protected health information lacked multifactor authentication. His prepared statement put the criticism this way: “Mr. Witty owes Americans an explanation for how a company of UHG’s size and importance failed to have multi-factor authentication on a server providing open door access to protected health information, why its recovery plans were so woefully inadequate and how long it will take to finally secure all of its systems.”
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
That language records Wyden’s assessment and demand for an explanation. It does not independently establish why multifactor authentication was absent, whether every system lacked it, or whether a technical investigation later confirmed each allegation.
The reported operational impact
Wyden described weeks of disruption to payment and other health-care operations affecting providers and patients. In the same prepared statement, he cited Change Healthcare as handling roughly 15 billion health-care transactions annually and said about one-third of Americans’ patient records passed through the company. He also cited UnitedHealth revenue of $324 billion in the prior year and 152 million people touched across its business lines.
Those figures belong to Wyden’s statement and are not, on their own, an independently verified breach count or measurement of the number of people whose information was exposed. The hearing records reviewed do not establish a definitive number of affected records.
What did Congress ask UnitedHealth after the cyberattack hearing?
On October 18, 2024, Wyden said responses following Witty’s June testimony had not satisfactorily answered his questions. He requested additional information and audit records, including:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Independent cybersecurity audits from the five years before the attack.
- Whether the server initially compromised by the attackers had been audited.
- How the attackers obtained broader access after the initial intrusion.
- What remediation steps had been taken to prevent a recurrence.
This was an oversight request and Wyden’s assessment of the answers he had received. It is not proof that the requested audits were withheld or that no remediation occurred. The House repository’s hearing materials include Witty’s statement, a one-page summary, additional questions for the record and a transmittal letter; that record was listed as last updated June 21, 2024.
What did the 2026 hearing reveal about AI and claim denials?
The January 22, 2026 House hearing was a different proceeding about health-insurance affordability and included several insurer executives. Rep. Robin Kelly asked Hemsley whether UnitedHealth used AI or algorithmic tools to adjudicate claims or pretreatment estimates, and what governance or independent auditing was intended to prevent inappropriate denials.
Rank #4
Hemsley’s description of AI use
Hemsley answered: “We use AI solely for administrative purposes. We do not use it for clinical applications at all.” When Kelly asked whether AI therefore had nothing to do with denials, Hemsley described administrative uses such as gathering documents.
The exchange records the CEO’s testimony. It is not an independent audit of UnitedHealth’s systems and does not by itself resolve how particular claims, prior-authorization requests or estimates are decided.
A constituent denial raised by Rep. Buddy Carter
Rep. Buddy Carter described a constituent’s alleged medication denials and asked Hemsley about that case. Hemsley replied: “I don’t know that particular circumstances.” The transcript preserves the question and answer but does not independently adjudicate the constituent’s coverage dispute.
What affordability claims did UnitedHealth present in 2026?
UnitedHealth’s own January 2026 hearing summary presented policy positions and company figures. It said the company had negotiated nearly $300 billion in discounts in the prior year and announced a voluntary elimination and rebate of profits for individual Affordable Care Act coverage for that year.
The summary also said hospital prices had risen nearly three times faster than inflation over 25 years, that hospital care represented more than 30% of U.S. health-care spending, and that prescription-drug spending had increased 269% since 2000 and by about 9% annually during the preceding decade. These are company-presented figures; the hearing summary does not turn them into independently validated findings.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the testimony establishes—and what it does not
| Record item | It establishes | It does not establish by itself |
|---|---|---|
| Wyden’s May 2024 prepared statement | Congressional criticism of security controls, recovery planning and the scale of Change Healthcare’s role | A court finding, independent audit result or definitive breach count |
| Witty’s 2024 testimony and hearing materials | That UnitedHealth provided an executive account of the cyberattack and response under congressional questioning | That every technical question was resolved or that all remediation was independently verified |
| Wyden’s October 2024 follow-up | That he considered earlier answers inadequate and sought audits and intrusion details | That the company failed to supply every requested document or made no security improvements |
| Hemsley’s January 2026 testimony | UnitedHealth’s stated position that AI was used for administrative, not clinical, purposes | Independent confirmation of how automated or algorithmic tools affect individual coverage decisions |
| The Carter constituent exchange | That a reported medication-denial case was raised and Hemsley said he did not know its circumstances | A determination that the denial was valid or improper |
| UnitedHealth’s 2026 hearing summary | The company’s affordability claims, figures and proposed policy changes | Neutral validation of those figures |
Why “fails” needs a precise qualification
The hearing records support serious questions about cybersecurity safeguards, recovery readiness, insurance denials and governance of automated tools. They do not, standing alone, prove every allegation implied by the word “fails.” Wyden’s statements are forceful political criticism; Hemsley’s statements are executive testimony; neither substitutes for a regulator’s incident report, a court ruling, an independent technical audit or independent claims data.
Did UnitedHealth answer lawmakers’ questions?
UnitedHealth executives testified in both proceedings, but the records show continuing scrutiny rather than a final resolution. Wyden’s October 2024 letter explicitly said the answers after Witty’s June testimony were not satisfactory to him. In 2026, lawmakers continued probing denials and AI governance, while the transcript records Hemsley’s stated policies and his inability to address one constituent’s specific case.
Quick Recap
Key dates
- May 1, 2024: Senate Finance holds the Change Healthcare cyberattack hearing with Andrew Witty.
- May 1, 2024: House Energy and Commerce holds a separate hearing on the same attack.
- June 21, 2024: The House repository lists its hearing record as last updated on this date.
- October 18, 2024: Wyden requests audit reports and further intrusion and remediation details.
- January 22, 2026: House Energy and Commerce questions Stephen Hemsley about affordability, denials and AI.
- February 17, 2026: The House transcript for the 2026 hearing is published.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
