Take out the card. Not the credit card. The other one, the wallet-sized rectangle of white plastic with a member number on it, a group number, and two shorter codes printed small, usually labeled BIN and PCN.
Most people have never wondered what those two are. They are not identification. They are an address. They tell a pharmacy’s computer where to send the claim, the way the digits on a check tell a bank where to send the money, and they are the reason a prescription can be priced at a counter in eleven seconds.
This week that address stopped resolving, across the country, and the argument here is that what failed was not a healthcare system or a cybersecurity perimeter. It was a concentration, of a kind that American regulation has no department for.
What sits at the other end of the address
Between a pharmacy and an insurer there is a clearinghouse.
Its job is translation and routing. A pharmacy runs one piece of software and needs to reach several hundred payers, each with its own formats, rules and eligibility files. Rather than every pharmacy connecting to every payer, everybody connects to a clearinghouse, which speaks to both sides.
This is a good design and it is the same design as the interbank payment systems. A hub is enormously more efficient than a mesh. The cost of the efficiency is that the hub is load-bearing, and the more traffic it carries the more load it bears.
The hub in question is Change Healthcare, a subsidiary of UnitedHealth Group. On Wednesday the company disconnected its systems after detecting an intrusion, and pharmacies nationwide found they could not process claims.
The argument, and the first test of it
The thesis is that this outcome was described in advance, in public, by a government that then lost the argument.
In February 2022 the Justice Department, with the attorneys general of New York and Minnesota, sued to block UnitedHealth’s acquisition of Change Healthcare. Its complaint described Change as a critical data highway through which about half of all Americans’ health insurance claims pass each year.
Half. That figure is not a projection or an estimate by a critic. It is the government’s own characterization, filed in court, of what the company was before the deal.
The suit was about competition rather than resilience. The government’s concern was that an insurer owning the highway would see its rivals’ traffic. That is a real concern and it is not this week’s concern, and the distinction matters for the argument, because it means nobody was litigating the thing that actually broke.
The second test: what the court found
A federal judge allowed the deal in September 2022, finding the department’s argument had serious flaws and accepting a divestiture of one business line as sufficient to restore competitive intensity.
Read that ruling for what it did and did not consider. It weighed whether a combined company would suppress innovation or exploit rivals’ data. It was not asked, because nobody asked it, whether concentrating half the nation’s claims traffic behind one operator created an availability risk, and it would have had no framework to apply if it had been.
Antitrust law asks about competition. There is no doctrine within it for the proposition that a facility has become too central to be allowed to stop.
The third test: who owns the risk now
Go looking for the regulator responsible and the search comes up empty.
Health data has a serious federal statute, and it is about privacy and security of information, not about continuity of service. A clearinghouse that keeps every record perfectly confidential while processing nothing for a fortnight is not in violation of it.
Insurance is regulated by the states, which oversee insurers rather than the vendors insurers route through. Pharmacy is regulated by state boards, which license the pharmacy, not the pipe.
Compare banking, where the problem was recognized after 2008 and given machinery: designations for systemically important institutions and utilities, examination, resilience requirements, and a named agency that owns the question. Claims routing has none of that. It carries comparable volume, it has comparable concentration, and it has no equivalent of the designation.
What happened at the counter
With the route unavailable, pharmacies fell back to manual processing: phoning payers, submitting on paper, or telling patients to pay cash and claim reimbursement later.
That is a workable answer for a routine generic that costs a few dollars. It is not an answer for an insulin, an inhaler, a cardiac drug or a course of chemotherapy support, where the cash price is the reason the insurance exists. The people worst affected by a routing failure are precisely the people whose prescriptions are expensive, which is to say the sickest.
The failure also lands unevenly by pharmacy. A national chain has staff, payer relationships and the cash position to dispense first and reconcile later. An independent pharmacy has none of those, and dispensing without an approved claim means carrying the cost with no guarantee of recovery.
There is a smaller point about the intrusion itself that is worth separating out. The company’s response was to disconnect, which by every ordinary standard was correct: isolating a compromised network is what the playbook says, and doing it quickly is how a breach stays a breach instead of becoming a data catastrophe. The national outage was therefore not the attack. It was the correct response to the attack, performed by an operator that half the country’s claims run through.
What the verdict implies
The conclusion is narrow and it is uncomfortable. The concentration was identified, in public, by the government, in a filing, two years ago. The mechanism available for doing something about it was antitrust, antitrust asks a different question, and the answer to that different question was no.
Nothing that has happened this week is evidence that the court was wrong about competition. It is evidence that competition was the wrong question to be the only one asked.
What to watch next
The tell will be what is proposed in the next three months, and specifically whether anybody proposes designating claims infrastructure as critical in the way payment infrastructure was designated after 2008.
That would mean a named agency, mandatory continuity standards, tested failover, and a requirement that pharmacies retain a working second route. It is unglamorous, it is expensive, and it is the only thing on the table that would change the outcome rather than shorten the recovery.
If instead the response is a set of incident reports, a congressional letter and an assurance that systems have been restored, then the lesson taken will have been about one intrusion. The card in the wallet will have the same two codes printed on it, pointing at the same address, and the next time that address stops resolving the country will discover the same thing about itself again.
