HCA Healthcare Settlement Resolves Data Breach Lawsuit Over Cyberattack Announced in July 2023

New to ClassAction.org? Read our Newswire Disclaimer

HCA Healthcare, Inc. has agreed to settle a consolidated class action lawsuit that alleged that the Tennessee-based medical organization failed to protect confidential patient information during a data breach announced in July 2023.

Don’t miss the next class action settlement deadline. Sign up for ClassAction.org’s free weekly newsletter.

The court-approved website for the HCA data breach settlement can be found at HCAHealthcareSettlement.com.

The settlement agreement, which received preliminary approval from the court on May 14, 2025, covers all current HCA patients residing in the United States whose personal information was impacted by the HCA Healthcare data breach announced around July 10, 2023.

According to the official HCA settlement website, eligible class members who submit a timely, valid claim form are entitled to receive credit monitoring services and reimbursement for certain documented losses as part of the deal.

The deadline to file an HCA settlement claim form is September 25, 2025.

Class members can submit a claim form online on this page. Those who prefer to file by mail may download a PDF claim form to print, complete and return to the settlement administrator.

Claim submission requires a unique class member ID, which can be located on the personalized settlement notice consumers were issued via email.

The deal with HCA will provide all class members who file a timely, valid claim with one year of credit monitoring and identity theft protection services, which can be deferred for a period of 12 months at no cost if a consumer already maintains such services, the website explains.

Related Reading: HCA Healthcare Failed to Protect Personal Data of 11M Patients, Class Action Says

In addition, the site says that class members may submit a claim for up to $5,000 in compensation for documented out-of-pocket losses that were incurred as a result of the data breach and have not already been reimbursed.

The court will decide whether to grant final approval to the terms of the HCA class action settlement at a hearing on October 27, 2025. Per the website, HCA settlement payments will be issued to eligible class members only if the deal receives ultimate court approval, and after any appeals are resolved.

The lawsuit against HCA Healthcare claimed that inadequate cybersecurity resulted in the data breach incident, during which cybercriminals reportedly accessed and stole data from an external storage location used for email formatting automation.

According to the data breach suit, the cyberattack exposed the personal information of approximately 11 million patients, including their names, cities, states, zip codes, email addresses, telephone numbers, dates of birth, genders, service dates, appointment locations and the dates of individuals’ next appointments.

Looking for current class action lawsuits to join? Check out ClassAction.org’s class action lawsuit list.