HealthEC Data Breach Settlement Approved: $5.48M Fund for Affected Patients On January 20, 2026, a U.S. court granted final approval to a $5.48 million class action settlement resolving claims against HealthEC LLC and four affiliated healthcare organizations Community Health Care Systems Inc., Corewell Health, MD Valuecare LLC, and Oakwood Accountable Care Organization LLC. The settlement stems from a December 2023 data breach that exposed the personal and protected health information of approximately 1.52 million individuals. Eligibility and Compensation Patients whose data was compromised in the breach may qualify for financial compensation or credit monitoring, provided they received a settlement notice by email or mail. The class includes all affected individuals, regardless of whether they experienced identity theft or fraud, with a separate subclass for California residents as of July 14, 2023. Compensation options include: - Reimbursement for out-of-pocket losses (e.g., fraud-related expenses, credit freeze costs, or credit monitoring purchases). - Lost time compensation (up to 10 hours at $25/hour for those with qualifying losses, or up to 4 hours for those without). - Alternative cash payments ($25 for non-California residents, $50 for California residents). - Three years of free Medical Shield Complete, a service offering dark web monitoring, credit monitoring, and $1 million in identity theft insurance. If total claims exceed the settlement fund, payments will be reduced proportionally. Conversely, leftover funds may increase payouts. Claim Process and Deadlines Eligible individuals can file claims online or by mail, with documentation required for out-of-pocket loss and lost time claims. The deadline to submit claims, request exclusions, or object to the settlement is November 18, 2025. Payments will be distributed after final approval and resolution of any appeals, with the first disbursements issued on March 24, 2026. Settlement Fund Allocation The $5.48 million fund covers: - $333,250 for settlement administration costs. - Up to $1.86 million in attorneys’ fees. - Undetermined amounts for attorneys’ expenses and Medical Shield Complete services. - Up to $2,500 each for class representatives. - The remaining balance for eligible claimants. Background The lawsuit alleged that HealthEC and its co-defendants failed to adequately protect sensitive patient data, leading to the breach. While the defendants denied wrongdoing, they agreed to settle to avoid prolonged litigation. The incident underscores ongoing vulnerabilities in healthcare data security.

HealthEC (HEC), a healthcare technology company, revealed a data breach that affected 4.5 million clients of its partners. HEC found out that an unidentified actor had copied some files and accessed several of its systems. Information belonging to a few of HEC's clients was found in the files. The healthcare company started informing affected clients and collaborated with them to inform other people who might be affected. Health EC advises those who may be affected to maintain their vigilance against potential fraud and identity theft.

The Vermont Office of the Attorney General reported that HealthEC experienced a data breach involving East Georgia Healthcare Center, with unauthorized access occurring between July 14, 2023, and July 23, 2023. The breach may have impacted the privacy of certain files, including client information, and affected approximately 451 Rhode Island residents. Notification to potentially impacted individuals began on October 26, 2023, and the incident was reported on May 7, 2024.