HCA Healthcare Data Breach Class Action Settlement

Current HCA Healthcare Inc. patients living in the United States whose personal information was compromised in a July 2023 data breach may qualify to claim up to $5,000 from a class action settlement.

HCA Healthcare agreed to resolve a class action lawsuit alleging it failed to adequately protect patient data, resulting in a criminal cyberattack that exposed sensitive information.

Who can file an HCA Healthcare claim?

Class members must meet all of the following criteria:

• They are a current HCA patient.
• They reside in the United States.
• Their personal information was compromised in a data incident that HCA announced on or about July 10, 2023.

How much can class members get?

Eligible class members can claim one or both of the following benefits:

• One year of credit monitoring and insurance services: One-bureau credit monitoring to alert class members to changes to their credit profile. Includes credit monitoring, fraud consultation and identity theft restoration services and provides up to $1 million in identity theft insurance coverage. Class members who already have credit monitoring may defer enrollment for up to 12 months at no extra charge.
• Documented loss payment: Up to $5,000 for documented losses directly resulting from the data incident.

How to claim a class action rebate

Class members can file a claim online or download, print and complete a PDF claim form to mail in. The claim deadline is Sept. 25, 2025.

Settlement administrator's mailing address: In re HCA Healthcare Inc., Data Security Litigation c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391

Is proof or documentation required to submit a claim?

• Class members must provide the class member ID located on their settlement notice.
• For documented loss payments, class members must provide reasonable documentation, such as receipts, bills, bank statements or correspondence showing the loss was more likely than not caused by the data breach. Personal certifications or affidavits alone are not sufficient but may supplement other documentation.

Payout options

• Electronic transfer (online claims only)
• Paper check

Cybersecurity settlement fund breakdown

The settlement fund includes:

• Settlement administration costs: To be determined
• Attorneys' fees and expenses: Up to $3,100,000
• Service awards to class representatives: Up to $5,000 each
• Credit monitoring costs: To be determined
• Payments to eligible class members: Remainder of the fund

Important dates

• Opt-out deadline: Aug. 25, 2025
• Claim deadline: Sept. 25, 2025
• Final approval hearing: Oct. 27, 2025

When is the HCA Healthcare data security litigation payout date?

Payments will be distributed approximately 90 days after the court grants final approval and any appeals are resolved. Credit monitoring enrollment instructions will be provided approximately 30 days after the court grants final approval and any appeals are resolved.

Why did this class action settlement happen?

The class action lawsuit alleged attackers accessed and stole HCA Healthcare patient information from an external storage location. The plaintiffs claimed HCA failed to implement adequate data security measures to protect patient data.

HCA denies any wrongdoing but agreed to settle to avoid the costs and risks of further litigation and appeals.

Sources

1. Class notice
2. Settlement agreement.pdf)
3. Settlement FAQ