Change Healthcare, a health payment processor hit by a crippling cyberattack in February, is under investigation by the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR).

In an open letter intended for hospitals and healthcare offices published Wednesday, OCR Director Melanie Fontes Rainer said the agency was investigating whether Change Healthcare violated Health Insurance Portability and Accountability Act (HIPAA) rules by not following breach notification requirements and properly safeguarding patient information.

Change Healthcare, a unit of Optum, which is owned by insurer UnitedHealth Group (UHG), processes 15 billion financial and other transactions annually for healthcare entities nationwide, from hospitals to pharmacies. The massive attack the company endured on Feb. 21 has meant health entities across the country have not been able to process electronic payments and records.