Secure Healthcare Information Management Data Breach Lawsuit: Filed October 15, 2026
Active Litigation
Secure Healthcare Information Management (SHIM) is an Allentown, Pennsylvania billing company for doctors’ practices — so you likely never dealt with it directly. Someone was inside its network from July 6 to July 16, 2026, and notice letters went out on October 6. The first class action was filed in federal court in Pennsylvania on October 15. There is no settlement and no claim form. The one deadline that matters now is free identity protection: enroll by January 4, 2027.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened in the Secure Healthcare Information Management Data Breach
SHIM handles billing and medical management for independent physicians and medical institutions in Northeastern Pennsylvania. Patients give their records to the practice; the practice’s billing runs through SHIM.
According to SHIM’s own notice of October 6, 2026, it experienced a network disruption on July 17, 2026. Its investigation found that an unknown actor accessed or acquired personal information at some point between July 6 and July 16, 2026. SHIM confirmed the scope on September 18, 2026.
The information that may have been involved: names, dates of birth, Social Security numbers, driver’s license or state ID numbers, medical information and health insurance information. SHIM says it reported the incident to the HHS Office for Civil Rights and to the consumer reporting agencies.
How many people? SHIM has not said publicly. As of October 12, 2026, HIPAA Journal reported that the incident was not yet on the federal breach portal, so the count was unclear. We have found no state attorney general filing with a number either.
Case details
Smith v. Secure Healthcare Information Management, LLC, No. 5:26-cv-07903, was filed on October 15, 2026 in the U.S. District Court for the Eastern District of Pennsylvania and assigned to Judge Jeffrey L. Schmehl. The plaintiff is a Pennsylvania resident and demands a jury.
The 40-page complaint pleads negligence, breach of implied contract, unjust enrichment and declaratory judgment. It alleges that SHIM kept patient data in an unencrypted, Internet-accessible environment, and it asks for damages, security improvements and lifetime identity theft protection. These are allegations; SHIM has not responded in court and nothing has been proven. The public docket is on CourtListener.
Status: Class Action Filed, No Settlement
A law-firm lead-generation site, ClassAction.org, posted an “investigation” page on October 7, 2026. Those are solicitations, not separate lawsuits. More suits may follow; if they do, they are often combined into one case.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Latest From the Court Docket
Recent entries in the federal case behind this page, taken from the court's own docket. We check it at least once a day; this list is as of Oct 19, 2026.
Case: SMITH v. SECURE HEALTHCARE INFORMATION MANAGEMENT, LLC, No. 5:26-cv-07903 (E.D. Pa.)
Oct 15, 2026
Notice re: Availability of Court-Annexed Mediation
ECF No. 4
Oct 15, 2026
Complaint (Attorney)
ECF No. 1
A docket entry is a step in the case, not a decision on who wins. Sources: the courts' PACER feeds and CourtListener (Free Law Project). Not legal advice.
Am I Affected by the SHIM Breach?
The complaint proposes a class of all individuals in the United States whose information was compromised in the breach. No court has approved that class. You do not need to sign up anywhere to be included if one is certified.
The practical test is a letter dated around October 6, 2026. SHIM mailed notices to people it had addresses for. Because SHIM is a vendor, you may know it only through your doctor’s office in Northeastern Pennsylvania. Keep the letter: it states which of your data was involved and is your proof that you were notified.
No letter but you think you were a patient of a SHIM client? SHIM’s call center, 1-833-516-7420 (weekdays, 8 a.m. to 8 p.m. Eastern), can verify eligibility.
Is There Money? Not Yet
What you can get now is the free service SHIM offers: identity protection through Cyberscout, a TransUnion company. The enrollment deadline is January 4, 2027.
For a sense of what resolved healthcare-breach cases have paid, see our data breach settlement calculator — that is context, not a prediction for this case.
SHIM Data Breach Timeline
July 6–16, 2026 — Unauthorized Access
Per SHIM, an unknown actor accesses or acquires personal information at some point in this window.
July 17, 2026 — Network Disruption
SHIM experiences a network disruption and starts an investigation with cybersecurity experts.
September 18, 2026 — Scope Confirmed
SHIM finishes reviewing the affected files and confirms whose information was involved.
October 6, 2026 — Letters Mailed
SHIM mails notices and publishes a press release. Free Cyberscout identity protection is offered, enrollment by January 4, 2027.
October 15, 2026 — First Class Action
Smith v. Secure Healthcare Information Management, LLC, No. 5:26-cv-07903, is filed in the Eastern District of Pennsylvania.
As of October 19, 2026 — Pleading Stage
SHIM has not responded in court. No settlement, fund, administrator, claim form or claim deadline exists.
Three Things to Watch For
A breach involving Social Security numbers and health insurance data, with a lawsuit in the news and no claim form, invites these:
“Claim your SHIM settlement” pages
There is no settlement and no claims site. A page asking for your Social Security number to “register” for a SHIM payout is collecting data, not filing a claim.
Calls posing as SHIM or Cyberscout
The only call center SHIM published is 1-833-516-7420. Call that number yourself rather than trusting an incoming call, and never pay a fee for the free identity protection.
Fake bills or insurance notices from your doctor
Billing records and insurance details were exposed, so a fraudster can send a convincing “balance due” notice. Check any unexpected bill against the number on your doctor’s own website before paying.
SHIM Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a Secure Healthcare Information Management data breach lawsuit?
Yes. Smith v. Secure Healthcare Information Management, LLC, No. 5:26-cv-07903, was filed on October 15, 2026 in the U.S. District Court for the Eastern District of Pennsylvania, before Judge Jeffrey L. Schmehl. It is a proposed class action; no class has been certified.
Who is SHIM, and why did it have my information?
SHIM is an Allentown, Pennsylvania billing and medical management company for independent physicians and medical institutions in Northeastern Pennsylvania. If your doctor’s office used it for billing, your records passed through its systems.
What data was exposed?
Per SHIM: names, dates of birth, Social Security numbers, driver’s license or state ID numbers, medical information and health insurance information. Your own letter says which applied to you.
How many people were affected?
Not public. SHIM has not released a number. As of October 12, 2026, HIPAA Journal reported the breach was not yet on the HHS breach portal, so the count was unclear.
How much can you get from a data breach lawsuit?
From this one, nothing yet — it was filed October 15, 2026 and there is no settlement. Resolved data breach cases usually pay documented losses up to a cap plus a smaller flat payment; our calculator shows ranges from comparable cases.
What do I do if my information was in a data breach?
Enroll in the free Cyberscout identity protection SHIM offers before January 4, 2027. Freeze your credit at the three bureaus — it is free. Read your insurer’s explanation-of-benefits statements for care you never received. Keep the notice letter.
I did not get a letter. Can I still enroll?
Possibly. SHIM says people without a letter must verify eligibility through its call center, 1-833-516-7420, weekdays 8 a.m. to 8 p.m. Eastern. The enrollment deadline is January 4, 2027.
Do I need to join the lawsuit?
No. If a class is certified or a settlement is reached, class members are notified and included unless they opt out. There is nothing to sign up for today. A law firm’s intake form is a choice to hire that firm, not registration for the case.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Open Class Action SettlementsSettlements taking claims right now, with deadlines
- Change Healthcare Data BreachThe largest healthcare billing breach, now a federal MDL
- Healthcare Highways Data BreachAnother health-plan vendor breach reported in October 2026