Health Prime International Data Breach: Tebra Platform Incident, No Lawsuit Yet
Reference Guide
Health Prime International is a medical billing company — your records reached it because your doctor's practice outsourced its billing. On September 29, 2026 it posted a notice: on or about August 3, 2026 it learned that an unknown actor claimed to have taken patient data held on Tebra Technologies' platform. As of October 17, 2026 we found no lawsuit filed over it, no settlement and no claim form — only law firms recruiting.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Health Prime Says Happened
Health Prime International (HPI) describes itself as technology-enabled revenue cycle management and analytics for physician groups, hospitals and health systems. In plain terms: it bills insurers on behalf of medical practices, so it handles their patients' identity and insurance records.
According to HPI's own notice dated September 29, 2026, on or about August 3, 2026 HPI learned that an unknown actor claimed to have accessed and acquired protected health information relating to certain patients, held by Tebra Technologies, a third-party platform HPI uses. That is the actor's claim; HPI says its investigation, run with third-party forensic specialists, remains ongoing.
The data types are not yet confirmed. HPI says they vary by person and may include full name, address, Social Security number, date of birth, medical information and health insurance information. HPI says it is unaware of any actual or attempted identity fraud tied to the incident.
Case details
No court case over this breach that we could find. As of October 17, 2026, the pages turning up for the Health Prime International data breach lawsuit are law-firm investigations: a ClassAction.org page published October 14, 2026 says attorneys are looking into “whether a class action lawsuit can be filed,” and a Claim Depot intake page followed on October 15. An investigation is a recruitment step, not a filed case.
A different, earlier case exists. Knoblich et al v. Health Prime International, LLC et al, No. 8:25-cv-01033, was filed in the U.S. District Court for the District of Maryland on March 28, 2025, before Judge Lydia Kay Griggsby. It is listed as a contract class action. It was filed more than a year before the August 2026 incident, so it cannot be about this breach; we could not confirm its subject or current status.
Status: Notice Posted, Individuals Not Yet Identified
The bigger open question is who is affected. HPI's notice does not give a number of affected people, and we found no breach report to a state attorney general or to HHS with a count. HPI says it is still identifying the specific individuals and the information involved, and will mail letters once that review is done. Until those letters go out, nobody — including the law firms advertising — can tell you whether your record was in the files.
Who Could Be Affected
Patients of medical practices that used HPI for billing and whose records sat on Tebra Technologies' platform. HPI's notice is addressed to “HPI clients utilizing Tebra Technologies' platform,” so the link runs through your provider, not through any account you opened yourself.
The practical test is your mail. HPI says it will mail notice letters to identified individuals for whom it has a valid mailing address at the conclusion of its review. The letter may name HPI, your doctor's practice, or both. Keep the letter and envelope — it lists which fields were in your record and is your proof if a class is ever formed.
Is There Money?
Health Prime International Breach Timeline
March 28, 2025 — An Unrelated Contract Case
Knoblich v. Health Prime International (D. Md., No. 8:25-cv-01033) is filed as a contract class action. It predates the 2026 incident.
August 3, 2026 — The Claim Surfaces
On or about this date HPI learns an unknown actor claims to have taken patient data held on Tebra Technologies' platform. A forensic investigation begins.
September 29, 2026 — Website Notice
HPI posts a notice of data privacy event. Possible data: names, addresses, Social Security numbers, dates of birth, medical and insurance information.
October 14–15, 2026 — Law Firms Start Recruiting
ClassAction.org and Claim Depot publish intake pages for attorneys investigating whether a class action can be filed.
As of October 17, 2026 — Letters Pending
No lawsuit found, no settlement. HPI is still identifying affected individuals; notice letters follow once the review ends.
Three Things to Watch For
An incident with no victim count, no letters yet and Social Security numbers in play is easy to exploit:
“Check if you're in the Health Prime breach” forms
HPI has not finished identifying who is affected, so no website can look you up. A form asking for your Social Security number to “confirm” you is collecting it, not checking it.
Calls citing your doctor's billing office
Because HPI bills on behalf of practices, a caller can sound informed by naming your doctor. HPI's notice gives a dedicated line, 301-232-3381, and compliance@hpiinc.com — if in doubt, contact HPI yourself at those.
“Claim your Health Prime settlement”
There is no settlement and no claims administrator. A law firm's intake form is an advertisement for representation, not a claim — read anything before you sign it.
Health Prime International Data Breach — Questions People Ask
Short answers to the questions people ask most about this case.
Is there a Health Prime International data breach lawsuit?
Not that we could find as of October 17, 2026. Law firms published investigation pages on October 14 and 15, 2026, which means they are looking for affected people, not that a case is filed. The only federal case naming HPI we found, Knoblich (No. 8:25-cv-01033, D. Md.), was filed March 28, 2025 as a contract case — before the breach.
What happened in the Health Prime International data breach?
On or about August 3, 2026, HPI learned that an unknown actor claimed to have accessed and acquired patient health information held on Tebra Technologies, a third-party platform HPI uses. HPI posted a notice on September 29, 2026; its investigation was still ongoing.
Who is Health Prime International, and why did it have my information?
HPI provides revenue cycle management — billing and collections — for physician groups, hospitals and health systems. If your provider outsourced billing to HPI, your identity and insurance details passed through it even though you never dealt with HPI directly.
How many people were affected?
Not disclosed. HPI's notice gives no number, and we found no attorney general or HHS breach report with a count as of October 17, 2026. HPI says it is still identifying the specific individuals involved.
How will I know if my data was involved — and is the letter real?
HPI says it will mail letters to identified individuals with a valid mailing address once its review is complete. To check a letter, call HPI's assistance line at 301-232-3381 (Monday to Friday, 8 a.m. to 5 p.m. CST) or email compliance@hpiinc.com — using the contact details from HPI's own notice, not from the letter or a caller.
Is there a class action lawsuit against Change Healthcare for data breach?
That is a separate incident at a different company, and this page does not cover it. See our Change Healthcare data breach lawsuit page for that case.
Do I need to sign up somewhere to be included?
No. There is no case or settlement to join. If a class action is filed and later settles, class members are notified by a court-appointed administrator. Contacting a law firm is optional and creates an attorney relationship, not a claim.
What should I do right now?
Freeze your credit at the three bureaus — under federal law it is free to place and lift. Read your health insurer's explanation-of-benefits statements for care you never received, and report anything odd to your insurer or provider, as HPI's notice advises. An initial fraud alert lasts one year; identity theft victims can get an extended alert lasting seven years.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Change Healthcare Data BreachA separate, much larger health-billing breach and its litigation
- Data Breach Settlement CalculatorEstimate what a data breach settlement might pay per person
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines
- Settlement Payout CalculatorHow fund size and claim rates shape a per-person payment