The Department of Health and Human Services (HHS) has not received HIPAA breach reports from Change Healthcare or parent company UnitedHealth Group (UHG) following their large cyberattack. The companies have up to 60 days from the discovery of the breach to report it. The scope of the attack is under investigation and several factors will determine how notification duties are handled.