Humana taps physician executive as new chief medical officer. Healthcare DIVE August 20, 2026 Rebecca Pifer Parduhn Dr. Shantanu Nundy is joining the Kentucky-based insurer from health navigation company Accolade. Name: Dr. Shantanu Nundy Previous title: Executive vice president of care delivery and chief health officer, Accolade New title: Chief medical officer, Humana He's replacing Kate Goodrich, who served as CMO from 2022 to October 2025, when she left for a role in the health services division of Humana's rival insurer UnitedHealth. The CMO post has sat empty since. As CMO, Nundy will help design Humana's products, platforms and use of artificial intelligence with a clinical eye, according to the release. The executive comes to Humana from Accolade, a health navigation and care...

UnitedHealth faces investor lawsuit over security failures. Two groups of institutional investors filed an amended lawsuit against UnitedHealth Group, accusing the company of fraud, earnings manipulation, and years of ignored cybersecurity weaknesses that resulted in the largest healthcare data breach in U.S. history. The suit, filed in federal court on August 7, expands on earlier claims from 2024. It now alleges UnitedHealth rushed its acquisition of Change Healthcare, a claims processing subsidiary, while sidelining internal audits that flagged Medicare billing issues. The plaintiffs, a Rhode Island public pension fund and Länsförsäkringar Fondförvaltning AB, a Swedish asset manager, contend leadership misled investors and repurchased nearly $29 billion in shares while hiding misconduct. Board members accused of "historic" governance failures. The complaint describes systemic breakdowns, with former Change Healthcare executives serving as confidential witnesses. One witness, who worked as the company's director of risk management from 2017 to 2023, stated the post-deal integration was deliberately sped up to make separation "nearly impossible" if regulators blocked the transaction. The Department of Justice had challenged the deal in 2022, arguing it would reduce competition and increase health insurance costs. The challenge failed, and UnitedHealth completed the acquisition later that year. The rushed timeline, the suit claims, left critical cybersecurity gaps, including a weak firewall and missing multifactor authentication on Change's systems. Those oversights enabled the 2024 ransomware attack that exposed data of 190 million people and disrupted claims processing nationwide. The breach cost the company over $2 billion, according to the witness, and caused its stock price and net income to drop. Executives knew about the security weaknesses but took no action, the plaintiffs argue, even as risks grew. Medicare billing practices under scrutiny. The amended complaint also targets the company's Medicare operations. It alleges UnitedHealth submitted at least $200 million in unsupported diagnosis codes to the federal government. The suit claims Stephen Hemsley, the CEO and board chairman, supported eliminating an internal audit program that had uncovered the billing problems. "On their watch, the company built its industry-leading earnings on a foundation of systemic wrongdoing and illegality," the lawsuit states. It accuses UnitedHealth of defrauding Medicare, denying care to vulnerable patients, violating privacy laws, and suppressing competition. Similar allegations have surfaced in other lawsuits and federal investigations in recent years. A related claim alleges the company misrepresented its "firewall" protocol with Optum, another subsidiary, to address antitrust concerns. The initial suit argued data separation claims were misleading, though the amended version focuses on the Change Healthcare acquisition and its consequences. The lawsuit does not specify damages sought. The scale of the alleged misconduct - spanning cybersecurity failures, Medicare fraud, and shareholder deception - could expose the company to major legal and financial risks. A spokesperson declined to comment on the ongoing litigation. If the case proceeds, it may force a review of how UnitedHealth managed its acquisitions and internal controls. The breach at Change Healthcare already led to congressional hearings and demands for stricter oversight of healthcare data security. Insider accounts in the suit could push regulators to examine the company's practices more closely. The legal battle remains in early stages. The plaintiffs' next steps will depend on whether the court allows the case to proceed as a class action, which would let other shareholders join. The outcome could influence how corporate governance failures are litigated in healthcare, especially when acquisitions and cybersecurity overlap. UnitedHealth has not yet responded to the amended complaint. The case is pending in federal court.