UI Community HomeCare Data Breach Lawsuit: 211,000 People, Eight Class Actions
Active Litigation
On July 3, 2025, someone broke into the computer system of UI Community HomeCare, the home infusion and medical equipment affiliate of University of Iowa Health Care, and copied patient files. Letters went to about 211,000 people on August 29, 2025 — including a group of UI Health Care patients. At least eight class actions followed in Iowa state court. As of October 2026 there is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Happened and What the Lawsuits Say
According to UI Health Care, an unauthorized person accessed UI Community HomeCare's computer system on July 3, 2025. HomeCare shut down its servers, brought in outside experts and restored systems within one business day. The investigation found that a cybercriminal was able to “see and take copies” of data files — including shared files on a group of UI Health Care patients. UI Health Care says its own electronic health record system was not affected.
The exposed data was not the same for everyone. Per the official notice it may include name, date of birth, address, phone number, medical record number, provider, dates of service, health insurance information, Social Security number and type of visit.
The lawsuits allege that the defendants failed to use reasonable data security and that they waited nearly two months — until August 29, 2025 — to tell patients. One complaint alleges the plaintiff would have paid less for care had the security practices been known. These are allegations; no court has ruled on them.
Case details
Within two weeks of the August 29 letters, at least eight separate class actions were filed, seeking compensatory and punitive damages, according to The Gazette. One was filed on September 10, 2025 in Johnson County District Court in Iowa — a state court, not a federal one. The defendants vary by case and include University of Iowa Health Care, UI Community HomeCare and UI Community Medical Services LLC, the company that does business as UI Community HomeCare.
On September 17, 2025 a plaintiffs' attorney asked the court to consolidate the cases and appoint co-lead counsel. A judge initially denied that because “the defendants have not been served in any of the cases,” and said the motion could be refiled after service. We could not confirm case numbers, the assigned judge or later rulings; a search of federal dockets shows no federal case against UI Community Medical Services.
A separate, older case: HomeCare also had a ransomware attack discovered on March 23, 2023, reported to federal health regulators as affecting up to 67,897 people. A former employee and a patient's parent sued UI Community HomeCare and UI Community Medical Services over that incident, seeking class certification, damages and security improvements. The report does not name the court, and we found no settlement in that case either.
Status: Lawsuits Filed, No Settlement
If you were affected, there is nothing to file today. Any page or caller offering a “UI Community HomeCare settlement payment” is describing something that, as far as public records show, does not exist.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is Affected
The proposed classes cover people whose information was in the stolen files — about 211,000 people by UI Health Care's count. That includes HomeCare customers in Iowa, western Illinois and northern Missouri, and also a group of UI Health Care patients who never used HomeCare: their records sat in data files shared with the affiliate.
Your letter is the test. UI Health Care says every affected person was mailed a notice on August 29, 2025. Keep it — it lists what was involved and carries an engagement number. If you think you were affected but got no letter, the official hotline is 833-745-0871, Monday through Friday, 8 a.m. to 8 p.m. Central. You do not need to sign up anywhere to be part of a class action; if a class is certified or a settlement is reached, class members are notified.
Is There Money?
For context only, not a prediction: healthcare-breach settlements that involved Social Security numbers have generally combined reimbursement of documented losses, a smaller flat payment for people who document nothing, and credit monitoring. Our data breach settlement calculator shows how class size affects what one person receives.
UI Community HomeCare Breach Timeline
March 23, 2023 — Earlier Ransomware Attack
HomeCare discovers files on its network encrypted. The breach is reported to HHS as affecting up to 67,897 people, and a class action follows later that year.
July 3, 2025 — The Second Intrusion
Someone accesses UI Community HomeCare's computer system. Servers are shut down and restored within one business day, but data files were copied.
August 29, 2025 — Letters to 211,000 People
UI Community HomeCare and UI Health Care mail notices and post a substitute notice online. No credit monitoring is offered.
September 10, 2025 — Lawsuits in Johnson County
Within two weeks, at least eight class actions are filed, including one in Johnson County District Court alleging delayed notice.
September 17, 2025 — Consolidation Asked, Denied for Now
Plaintiffs ask to combine the cases. A judge says no until the defendants have been served; the motion may be refiled.
October 2026 — No Settlement Found
No settlement, fund, claim form or deadline has been announced for either breach. Later rulings could not be confirmed.
Three Things to Watch For
A breach of medical records with no claim form leaves room for imposters:
“Claim your UI HomeCare settlement” sites
There is no settlement and no claims portal. A page asking for your Social Security number or medical record number to “secure your payment” is collecting data, not filing a claim.
Calls that mention your infusion or equipment
The stolen files listed providers, visit types and insurance details, so a caller can sound informed. UI Health Care's real hotline is 833-745-0871 — call it yourself rather than trusting a number someone gives you.
Fake credit monitoring offers
UI Community HomeCare did not offer credit monitoring for this breach. An email or letter offering “free monitoring from UI Health Care” that asks for a card number or login is not from them.
UI Community HomeCare Breach — Questions People Ask
Short answers to the questions people ask most about this case.
How do I find out if my data was breached?
UI Health Care says every affected person was mailed a letter on August 29, 2025. If you did not get one and think you should have, call the official line at 833-745-0871 (weekdays, 8 a.m. to 8 p.m. Central) and have any engagement number ready.
How many people were affected?
About 211,000 people, according to UI Health Care. The earlier March 2023 ransomware attack was reported to HHS as affecting up to 67,897 people.
I never used UI Community HomeCare. Why was my information there?
UI Health Care says HomeCare and the health system have historically shared patients, employees and data files. Files containing UI Health Care patient data were stored on HomeCare's system and were compromised.
What data was exposed?
It varied by person and may include name, date of birth, address, phone number, medical record number, provider, dates of service, health insurance information, Social Security number and type of visit. UI Health Care says its electronic health record system was not affected.
Is there a UI Community HomeCare settlement or claim form?
No. As of October 2026 we found no settlement, fund, administrator, claim form or deadline for the 2025 breach or the 2023 attack.
How do I sue for a data breach?
You do not have to file your own case to be part of a class action. At least eight class actions were filed in September 2025 over this breach, one of them in Johnson County District Court; if a class is certified or a settlement is reached, class members are notified. Filing an individual suit is a separate choice to discuss with a licensed attorney.
Was there credit monitoring?
No. UI Community HomeCare said it was not offering credit monitoring because it had no indication the data had been misused. You can get free credit reports at annualcreditreport.com or 1-877-322-8228, and freeze your credit at each bureau for free.
What is worth doing right now?
Keep your notice letter. Freeze your credit at Equifax, Experian and TransUnion — it is free and reversible. Read your insurer's explanation-of-benefits statements for care you never received, since medical record numbers and insurance details were in the files.
About This Information
- Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated
- $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Open Class Action SettlementsSettlements taking claims now, with deadlines
- Data Breach Settlement CalculatorWhat breach settlements of this size have paid per person
- Settlement Payout CalculatorHow fund size and claim rates set individual payments
- Lone Star Community Health BreachAnother 2026 health-provider breach, at the investigation stage