Medicine doctor hand working with modern computer interface as medical network concept

PocketHealth eases doctor-patient communications with easy image exchange

Medicine doctor hand working with modern computer interface as medical network concept

Image Credits: Busakorn Pongparnit (opens in a new window) / Getty Images

Have you ever needed a copy of your medical imaging to take to your doctor or another healthcare provider and been handed a CD? You’re not alone. Many radiologists still use CDs and similar antiquated tech to share patients’ imaging files.

A startup called PocketHealth has taken issue with that. The company has built a medical image exchange platform to digitize the process for every patient and healthcare provider, no CDs involved. The company, headquartered in Toronto, said on Wednesday that it had secured $33 million ($45 million CAD) in a Series B funding round.

PocketHealth’s journey began after one of its co-founders, Harsh Nayyar (CTO), suffered a tennis injury in 2016. He received the results of his CT scan on a CD, but he could not see them and needed to carry the CD along to whatever practitioner he needed to see next. That experience inspired him and his brother, Rishi Nayyar (CEO), to streamline the way hospitals share patients’ medical imaging.

“When we learned that this was still commonplace across healthcare sites all over North America [in 2014], we knew we could change that,” Rishi told TechCrunch. “Despite technological advancements, access to healthcare data remains hindered by legacy image exchanges, creating delays, unnecessary costs and negative patient experiences.”

For 20 years, legacy image-sharing systems used by healthcare providers have “de-emphasized patient access to their own healthcare data, moving files across a closed network from point A to point B,” Rishi said. PocketHealth wants to change that by giving patients more access to, control over and a deeper understanding of their health records.

The eight-year-old company says more than 1.5 million patients at 775 healthcare sites use its platform in North America. PocketHealth plans to use the new money to improve its AI technology, double its current headcount of 110 over the next two years and expand its operations across North America.

Image Credits: PocketHealth

PocketHealth started by digitizing patients’ imaging reports and giving them access to it, and has now evolved its product by adding a layer of understanding that helps solve data portability problems.

Rishi said the service helps patients understand “what’s happening, showing them what they may have missed, what they can do next, or enabling them to easily return to their provider for follow-up care.”

It also can benefit service providers. The outfit says Valley View Hospital in Colorado, one of its customers, reduced non-labor costs by 95% by moving on from CDs. Another user, Unity Health in Toronto, was able to close its imaging library and save more than $120,000.

PocketHealth isn’t the only company digitizing and enabling the sharing of medical imaging. Ambra Health, based in New York, runs a similar business, and EnvoyAI, based in Massachusetts, is building a medical imaging AI marketplace. Legacy image exchange providers like Nuance PowerShare and Change Healthcare are also among PocketHealth’s peers.

One thing that sets PocketHealth apart from incumbents in this space is that it provides patients access to their medical data, while legacy providers enable healthcare providers to share images with each other and have limited patient access capabilities.

When asked about its user data privacy policy, Rishi told TechCrunch: “Patients are the owners of their own personal health information (PHI). We store PHI permanently for patients, as they need and want ongoing access [to their imaging], but any patient can permanently delete their data from PocketHealth at any point in time. We do not sell or lease PHI to any third party.”

Rishi also said the company encrypts its data to stay compliant with SOC2 Type II, HIPAA and PHIPA standards. “Security is a priority for us. It’s never just a static investment — it’s an ongoing area of focus. Data is stored locally and safeguarded from data breaches. We use Microsoft Azure to host in both Canada and the U.S., with constant security audits and reassessments. Patients have access to their data and can securely share and revoke access to their imaging using an access code, so they’re in control over who sees what and when,” he explained.

Round13 Capital led the Series B round, which brings PocketHealth’s total capital raised to more than $55.5 million in equity. The round also saw participation from Deloitte Ventures and Samsung Next, and existing backers Questa Capital and Radical Ventures.

As the Change Healthcare outage drags on, fears grow that patient data could spill online

How a Romanian medtech startup helped US doctors treat refugee Ukrainian cancer patients

The United HealthCare Group Inc. logo on a laptop computer arranged

Change Healthcare stolen patient data leaked by ransomware gang

The United HealthCare Group Inc. logo on a laptop computer arranged

Image Credits: Tiffany Hagler-Geard / Bloomberg / Getty Images

An extortion group has published a portion of what it says are the private and sensitive patient records on millions of Americans stolen during the ransomware attack on Change Healthcare in February.

On Monday, a new ransomware and extortion gang that calls itself RansomHub published several files on its dark web leak site containing personal information about patients across different documents, including billing files, insurance records and medical information.

Some of the files, which TechCrunch has seen, also contain contracts and agreements between Change Healthcare and its partners.

RansomHub threatened to sell the data to the highest bidder unless Change Healthcare pays a ransom.

It’s the first time that cybercriminals have published evidence that they have in their possession medical and patient records from the cyberattack.

For Change Healthcare, there’s another complication: This is the second group to demand a ransom payment to prevent the release of stolen patient data in as many months.

UnitedHealth Group, the parent company of Change Healthcare, said there was no evidence of a new cyber incident. “We are working with law enforcement and outside experts to investigate claims posted online to understand the extent of potentially impacted data. Our investigation remains active and ongoing,” said Tyler Mason, a spokesperson for UnitedHealth Group.

What’s more likely is that a dispute between members and affiliates of the ransomware gang left the stolen data in limbo and Change Healthcare exposed to further extortion.

A Russia-based ransomware gang called ALPHV took credit for the Change Healthcare data theft. Then, in early March, ALPHV suddenly disappeared along with a $22 million ransom payment that Change Healthcare allegedly paid to prevent the public release of patient data.

An ALPHV affiliate — essentially a contractor who earns a commission on the cyberattacks they launch using the gang’s malware — went public claiming to have carried out the data theft at Change Healthcare, but that the main ALPHV/BlackCat crew stiffed them out of their portion of the ransom payment and vanished with the lot. The contractor said the millions of patients’ data was “still with us.”

Now, RansomHub says “we have the data and not ALPHV.” Wired, which first reported the second group’s extortion effort on Friday, cited RansomHub as saying it was associated with the affiliate that still had the data.

UnitedHealth previously declined to say whether it paid the hackers’ ransom, nor did it say how much data was stolen in the cyberattack.

The healthcare giant said in a statement on March 27 that it obtained a dataset “safe for us to access and analyze,” which the company obtained in exchange for the ransom payment, TechCrunch learned from a source with knowledge of the ongoing incident. UHG said it was “prioritizing the review of data that we believe would likely have health information, personally identifiable information, claims and eligibility or financial information.”

As the Change Healthcare outage drags on, fears grow that patient data could spill online