Highlands Oncology Group Breach Claims Close October 22, 2026 — $50 With No Proof or Up to $4,250 — but the Fee and Final-Approval Motion That Was Due by September 22 Is Still Not on the Settlement Website

If you received a notice about the Highlands Oncology Group data breach, the only thing still open to you is the claim form, and it closes on October 22, 2026. The notice is explicit: “If you are submitting a Claim Form online, you must do so by October 22, 2026. If you are submitting a claim by U.S. mail, the completed and signed Claim Form, including supporting documentation, must be postmarked no later than October 22, 2026.” The other two exits have shut. Requests for exclusion had to be postmarked, and objections filed with the Clerk of Court, by October 7, 2026 — both set by the agreement at 30 days before the hearing, with the claim deadline at 15 days before it.

Doing nothing is not neutral. In the notice’s words, “If you do nothing, you will not receive a benefit from this Settlement,” and you still give up the right to sue Highlands Oncology over the incident. The class is “All individuals residing in the United States whose Private Information was compromised in the Data Breach on or around June 2025.” The files involved, per the notice, held names, dates of birth, Social Security numbers, driver’s license and passport numbers, card and account numbers, medical treatment information, medical record numbers, patient account numbers and health insurance policy information.

How much compensation do you get for a data breach? In this one, the amounts are fixed, not estimates. You pick one cash option. Cash Payment B is “a one-time cash payment of $50.00,” and “You do not have to provide any proof or explanation to claim this payment.” Cash Payment A pays back “up to $4,250.00” for documented out-of-pocket losses from fraud or identity theft that “occurred between June 2, 2025, and October 22, 2026” — credit report and freeze fees, ID replacement, postage to banks — on proof such as bank statements or receipts; your own notes can support that proof but “alone are not enough.” On top of either, every class member may enroll in three years of CyEx Medical Shield Complete, with “$1 million of medical identity theft insurance” and monitoring for health-insurance ID and medical record number exposure.

Nothing here is split pro rata. Section IV of the agreement says “Highlands Oncology has agreed to pay, or cause to be paid” all administration costs, all cash payments and monitoring, and any court-awarded fees and service awards. Class counsel — Mariya Weekes of Milberg and J. Gerard Stranch IV of Stranch, Jennings & Garvey — will ask for $400,000 in fees and costs and $1,500 for each class representative, and the notice says both are paid by Highlands. A large number of claims therefore does not shrink your $50. How many people were notified is a regulator figure, not a court one: HIPAA Journal reported 113,575 individuals to the Maine Attorney General and 111,766 on the HHS breach portal, with letters from August 1, 2025. The preliminary approval order says only that “there are thousands of Class Members.”

Our first report on this settlement was published on September 12, 2026. Since then, two dates in the agreement have passed. The first is the filing deadline for class counsel’s main papers. The agreement says “Plaintiffs shall file their Motion for Final Approval of the Settlement, inclusive of the Application for Attorneys’ Fees, Costs, and Service Awards, no later than 45 days before the initial date set for the Final Approval Hearing”; Judge Martin’s preliminary approval order of June 16, 2026 sets the same 45-day deadline for the fee motion. With the hearing on November 6, that is September 22, 2026 by our count. The agreement also defines the settlement website as giving “hyperlinked access to” the agreement, the notice, the claim form, the “Motion for Final Approval, Application for Attorneys’ Fees, Costs, and Service Awards, and Final Approval Order.”

As of October 19, 2026, the site’s document list, served by the administrator Simpluris, contains four items: the Settlement Agreement, the Preliminary Approval Order, the Claim Form and the Notice. We could not read the state-court docket — Arkansas’ public case portal refused our request — so we cannot say whether the motion was filed on time and simply not posted, or filed late. What it means for you is limited: the fee is paid on top of the claims, not out of them. But class members who wanted to object to the fee request had to do so by October 7 without the request itself on the website.

The second date is the opt-out count. Within 10 days after the October 7 opt-out deadline, Simpluris was to send defense counsel the final exclusion list, and “If more than 1,200 (approximately 2%) Settlement Class Members have timely and validly submitted Requests for Exclusion, Highlands Oncology may, in its sole discretion, void this Settlement Agreement” by written notice within five business days. No such notice has been posted as of October 19, and the opt-out count has not been published. File anyway: the claim deadline does not move for this.

The notice says payments are distributed “if the Court grants final approval, and after any appeals are resolved.” The hearing is November 6, 2026 at 9:00 a.m. Central at the Washington County courthouse, 280 N College Ave, Fayetteville; you do not need to attend. After that, the agreement runs on a clock that starts at the “Effective Date” — the day after the final approval order if there are no objections, otherwise 30 days after the order if no appeal is taken. The administrator invoices Highlands for all valid claims within 30 days, Highlands pays within 30 days of the invoice, and “No later than 60 days after the Effective date, the Settlement Administrator shall: (a) distribute Cash Payments; and (b) ensure Credit Monitoring activation codes are emailed.”

By our arithmetic, approval on November 6 with no objections would put the outside date for distribution at about January 6, 2027; with objections but no appeal, about February 4, 2027. Two details in the agreement matter more than the date. You will get an email asking you to choose electronic payment or a paper check, and you have 90 days to answer it. Paper checks must be cashed within 120 days. And if the administrator cannot pay you because of incorrect or incomplete information, “the funds shall revert to Highlands Oncology, and the Settlement Class Member shall forfeit their right to the funds.” Keep the email address on your claim current.

The official channels are the ones printed in the court-approved notice: the website HighlandsOncologySettlement.com, email info@HighlandsOncologySettlement.com, the toll-free line (833) 421-7336, and Highlands Oncology Data Incident Settlement, c/o Settlement Administrator, P.O. Box 25226, Santa Ana, CA 92799. The claim form is submitted on that website or by mail to that box. The notice also says, in capitals, not to contact the court or the clerk about the settlement.

Use the timeline as a check. Under the notice, payments are distributed only if the Court grants final approval, which cannot come before the November 6 hearing. A message before then that says your money is ready, or asks for bank details to release a payment, does not match the agreement’s steps; check it against the phone number above before you answer. This settlement covers only people whose information was in the Highlands Oncology incident. It is not a settlement with any other hospital or health system.

The incident is the reason the monitoring is medical, not just credit. The agreement says Highlands “first detected unauthorized access on June 2, 2025, but internal investigation revealed that the cybercriminals had accessed the network as early as January 21, 2025.” Highlands is a cancer practice with six locations across Northwest Arkansas, Southwest Missouri and Southeast Oklahoma. Thirteen lawsuits were consolidated into this one. HIPAA Journal reported that this was not the practice’s first ransomware attack, citing an earlier one in November 2023.

Among the data breach settlements we track, the structure is generous: no fund, no cap, and fees paid separately. The weak point is the record. As of October 19, 2026, with claims closing October 22 and the opt-out window closed, the public site still lacks the motion that tells class members how many people objected, how many opted out and why counsel think $400,000 is reasonable. We will update when the motion, the opt-out count or the final approval order is posted.