Witty told Congress last month that a third of Americans may have had their personal data stolen in the hack and that it would likely take “several months” before the company is able to identify and notify Americans who were affected. One reason for the lengthy notification process, he said, was that files on patients were compromised in the ransomware attack.

Patient data was stolen in a hack. Senators say no one told the patients about it

Update: Healthcare provider is Change Healthcare, a UnitedHealth subsidiary