A Million Banner Health Patients Already Have a Year of Privacy Monitoring Coming, Filed or Not. Only the $20 Needs a Form — and It Closes September 5

Most settlement notices are a single transaction: file a form, maybe get money. The Banner Health notice is structured differently, and the difference is buried in the FAQ where few people look. From the administrator's own text, each class member

will automatically receive a code to redeem one (1) year of CyEx Privacy Shield Pro and may also submit a Claim Form for a cash payment of $20.

Read that carefully. The privacy monitoring is not the reward for filing. It goes to all Settlement Class Members — the FAQ says everyone receives a code allowing enrollment “without additional cost” — whether or not a claim form is ever submitted. The $20 is the only part gated behind the form.

That matters in both directions. If you were notified and did nothing because $20 did not feel worth the paperwork, you still have a benefit arriving, and you should watch for the code rather than delete the email as junk. And if you were going to file anyway, the form takes minutes and the deadline is September 5, 2026.

The case is McCulley, et al. v. Banner Health, Case No. 2026CV30182, in the District Court for Weld County, Colorado. The class, per the official site, is people who

had a Banner Health Patient Account (formerly the MyBanner patient portal) and logged into this account using one of Banner's web properties or applications on or between June 1, 2020 and November 22, 2023.

The administrator puts the class at approximately 1,028,000 individuals. Note the two requirements working together: an account and at least one login inside that window. Simply having been a Banner patient is not enough, and the notice wave that went out in early summer is why searches for this settlement spiked in recent weeks.

The benefit itself, one year of CyEx Privacy Shield Pro, is a privacy-monitoring product rather than the three-bureau credit monitoring common in breach settlements — a reminder that this is a tracking-technology case, not a hacking case.

Search “Banner Health data breach settlement” and you will collide with two entirely different cases, a decade apart. This is the recurring problem we documented with Equifax, where the famous case is closed and the claimable one is small and specific.

The case people remember is the 2016 cyberattack on Banner Health, which affected millions of patients and reimbursed documented expenses. That litigation was resolved and received final approval years ago — HIPAA Journal reported a final figure of $8.9 million, up from the $6 million initially proposed. It is closed. You cannot file a claim in it today. (Those figures come from press coverage of that older case, not from the administrator site for this one.)

The case that is open is the one above: website and app tracking, portal logins from 2020 to 2023, $20 plus automatic monitoring, Weld County, Colorado. If your notice references a patient portal login window, you are in the current case. If you are hunting for compensation over the 2016 hack, that window shut long ago.

Class counsel will ask the court to approve attorneys' fees of up to $3,750,000, plus $2,500 service awards for each of the eight Class Representatives ($20,000 in total). The administrator's FAQ does not state the total settlement fund, so we are not going to publish a fee percentage — without the denominator, any percentage would be invented.

What can be said precisely is the scale. At $20 per claimant, the fee request alone equals the cash payments of 187,500 class members — roughly 18 percent of the 1,028,000-person class. That is not a scandal by the standards of this category; it is simply the arithmetic that explains why per-person figures in tracking settlements land at $20 rather than $200.

Three dates close out the case, and two of them sit uncomfortably close together. Claims, objections and opt-outs are all due September 5, 2026. The Final Approval Hearing is September 10, 2026 at 2:00 p.m. Mountain Time, held via WebEx — just five days after the claim window shuts. As always, payment follows final approval and the resolution of any appeals, not the claim deadline itself.