Hendrick Health Faces Class Action Lawsuit Over Delayed Data Breach Notification On June 18, 2026, Potts Law Firm filed a class action lawsuit in Taylor County, Texas, against Hendrick Health and its healthcare technology vendor, Xsolis, Inc., on behalf of patient Ada Louise McHenry and others affected by a January 2026 data breach. The lawsuit alleges that a phishing attack on Xsolis a third-party case management provider for Hendrick Health exposed sensitive patient data, including Social Security numbers, medical records, treatment details, and financial information. The breach, discovered on January 22, 2026, went unreported to affected patients until June 2026, exceeding the 60-day notification window required under federal health data protection laws. The lawsuit claims Hendrick Health and Xsolis failed to implement adequate cybersecurity measures and delayed notifying victims, increasing their risk of identity theft, fraud, and medical privacy violations. Plaintiff McHenry, a longtime Hendrick Health patient, alleges her personal and medical data was compromised. The proposed class includes all individuals whose information was exposed in the breach. The lawsuit seeks damages and injunctive relief for alleged negligence in safeguarding patient data and failing to provide timely breach notifications. The case, Ada Louise McHenry v. Hendrick Medical Center and Xsolis, Inc. (Cause No. 52545-A), is pending in Taylor County District Court.

Hendrick Health System detected a security incident that resulted in a data breach that compromised the some identifying information. The compromised information included patient names, Social Security numbers, demographic and other limited information about care provided by Hendrick. "Patient electronic health records were not impacted." Hendrick has established a call center for those patients who were affected, they can contact the call center. The company investigated the incident and restored computer systems, additional security measures also implemented.