HealthEC Data Breach Settlement: $5.48 Million, Claims Closed
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
The HealthEC data breach settlement is a $5,482,500 fund resolving the class action over a July 2023 hack of HealthEC, a New Jersey health-data analytics vendor used by Corewell Health, Beaumont ACO and other providers. The claim deadline was November 18, 2025 and has passed. As of October 2026 the settlement is reported as finally approved and paying approved claimants. If you did not file, there is no new form — but free monitoring enrollment may still be open.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the HealthEC Lawsuit Said Happened
HealthEC sells software that helps healthcare organizations find high-risk patients, so it held records for patients of many providers who never dealt with it directly. According to the company's notice letters, an unauthorized party was inside its systems from July 14 to July 23, 2023 and removed files. HealthEC began notifying its provider clients on October 26, 2023 and started mailing patients on December 22, 2023.
Depending on the patient, the files held names plus address, date of birth, Social Security number, medical record number, diagnosis codes, prescription information and Medicaid/Medicare identification numbers. The HealthEC lawsuit alleged that HealthEC and its clients failed to use reasonable security. The defendants deny any wrongdoing and settled to avoid the cost and risk of trial.
Case Details
The suits were consolidated as In re HealthEC LLC Data Breach Litigation, No. 2:24-cv-00026, in the U.S. District Court for the District of New Jersey, before U.S. Magistrate Judge Stacey D. Adams. The first case, Lempinen v. HealthEC, LLC, was filed on January 3, 2024. The settling defendants are HealthEC, Community Health Care Systems, Corewell Health, MD Valuecare and Oakwood Accountable Care Organization (Beaumont ACO). Judge Adams granted preliminary approval on June 6, 2025 and appointed Verita Global as settlement administrator.
Status: Approved, Claim Window Closed
Practically: if you filed on time, your payment should already have been issued or be in progress. If you did not file, you cannot claim cash now.
Who Was in the Settlement Class
People whose personal or health information was compromised in the HealthEC breach announced in December 2023 and who were patients of the settling defendants — about 1.67 million people according to the final approval motion as reported by Bloomberg Law (other trackers cite about 1.52 million). That is smaller than HealthEC's total of 4,786,241 reported to HHS, because patients of HealthEC clients that were not defendants are not in this class.
A California subclass covered people who lived in California on July 14, 2023. Class members were notified by email or mail by July 21, 2025, with a Claim ID and PIN. No notice usually means you were not in this class.
What the HealthEC Settlement Paid
Documented losses: reimbursement of out-of-pocket costs from identity theft or fraud, plus lost time at $25 per hour — up to 10 hours with documented losses, up to four hours without.
Flat cash instead: $25, or $50 for California residents as of July 14, 2023.
Monitoring: at least three years of Medical Shield Complete, with $1 million in identity theft insurance, available to all class members.
Cash amounts were subject to pro rata adjustment up or down. Before approval, fees were expected at around 34% of the fund ($1.8 million). Payment status for an individual claim is a question for the administrator, not for any third party.
How cases like this one end
Our copy of the federal courts’ own case database covers 111,990 other personal injury casesclosed in U.S. federal district courts between 2015 and 2025, 3.6% of them filed as class actions:
- 39.9% ended in a settlement recorded by the court. Another 13.8% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 39.9% and 53.7%.
- 5.7% were decided on a motion before any trial.
- 1 in 106 reached a trial (0.9%), after a median of 23.9 months.
- Median time from filing to the end of the case: 9 months.
- Only 771 of them (0.7%) record a money award at all; the median of those is $500,000.
These are base rates for this type of case (federal other personal injury cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
HealthEC Data Breach Settlement Timeline
- 1
July 14–23, 2023 — The Breach
An unauthorized party accesses HealthEC's systems and removes files containing patient data for many of its provider clients.
- 2
December 22, 2023 — Patient Letters
HealthEC begins mailing breach notices to individuals, months after the intrusion. Total reported to HHS later reaches 4,786,241.
- 3
January 3, 2024 — First Lawsuit
Lempinen v. HealthEC is filed in federal court in New Jersey. Related suits are consolidated as No. 2:24-cv-00026.
- 4
June 6, 2025 — Preliminary Approval
Judge Stacey D. Adams preliminarily approves the $5,482,500 settlement and appoints Verita Global as administrator.
- 5
November 18, 2025 — Claim Deadline
Last day to file a claim or opt out. Nearly 50,000 valid claims were reported in the final approval motion.
- 6
January–March 2026 — Approval and Payments
Final approval is reported for January 20, 2026 and first payments for March 24, 2026 (per ClaimDepot; not confirmed from the court order).
Three Things to Watch For
A closed settlement with millions of breach notices in circulation leaves room for imposters:
“Late HealthEC claim” offers
The claim deadline was November 18, 2025. Anyone offering to file a HealthEC claim for you now, or to “reopen” your share for a fee, is not working for the court.
Payment-release requests
A real administrator does not charge a fee to release a settlement payment and does not need your full Social Security number by phone. Verify contact details against your original notice.
Calls citing your health plan
The stolen files contained diagnosis codes and Medicaid/Medicare numbers, so a caller may sound informed. Do not confirm member IDs to unsolicited callers; call the number on your insurance card instead.
HealthEC Settlement — Questions People Actually Ask
Is there a HealthEC data breach settlement?
Yes. In re HealthEC LLC Data Breach Litigation, No. 2:24-cv-00026 (D.N.J.), settled for $5,482,500. Preliminary approval came on June 6, 2025, and final approval was reported for January 20, 2026.
Can I still file a claim?
No. The claim deadline was November 18, 2025. No court order extending it has been reported. Monitoring enrollment may still be available to class members through the administrator.
When do HealthEC settlement payments arrive?
ClaimDepot reports that the administrator began paying approved claimants on March 24, 2026. If you filed and have not been paid, contact the administrator using the details in your original notice.
How much did people get?
The flat option was $25, or $50 for California residents, with pro rata adjustment. Documented losses and lost time at $25 per hour were reimbursed separately. Final per-person figures have not been published in a source we could verify.
Why was I notified of the breach but not of the settlement?
The class covered only patients of the settling defendants — HealthEC, Community Health Care Systems, Corewell Health, MD Valuecare and Beaumont ACO. Patients of other HealthEC clients were notified of the breach but were not in this settlement class.
Was Corewell Health part of the HealthEC lawsuit?
Yes. Corewell Health, with more than 1 million affected patients per HIPAA Journal, was a settling defendant. A different Corewell matter is covered on our Corewell Health MyChart lawsuit page.
What data was stolen?
It varied by patient: names plus address, date of birth, Social Security number, medical record number, diagnosis codes, prescription information and Medicaid/Medicare identification numbers. Your own notice letter lists your fields.
What is worth doing now?
Freeze your credit at all three bureaus — free and reversible. Check explanation-of-benefits statements for care you never received. If you were a class member, enroll in the free monitoring if you have not already. For settlements still taking claims, see open class action settlements.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements that are still taking claims right now
Data Breach Settlement Calculator
Estimate what a data breach claim tends to pay
Settlement Payout Calculator
How fund size, fees and claim rates shape a payment
Corewell Health MyChart Lawsuit
A separate case involving Corewell Health patients