Lawyers Report Change Healthcare Data Breach Litigation Proceeding Smoothly in MDL

MDL Judge overseeing the Change Healthcare data breach lawsuits will meet electronically with lawyers involved in the cases on Thursday, to review the status of the litigation.

As coordinated pretrial proceedings move forward in dozens of Change Healthcare data breach lawsuits, lawyers involved in the cases indicate that discussions between the parties have gone well, and a limited stay on discovery proceedings in the litigation has been lifted, to allow plaintiffs to address the company’s calls to have some cases thrown out.

Change Healthcare provides essential software, analytics and services to the healthcare industry. However, following a data breach last year that reportedly exposed the personal data of up to 190 million patients, the company now faces nearly a rapidly growing number of lawsuits and class action claims alleging that hackers accessed customers’ sensitive personal data, such as names, Social Security numbers, birthdates, addresses, medical records and insurance details.

In addition to claims from the patients themselves, Change Healthcare also faces lawsuits from doctors’ offices and clinics nationwide, indicating that the breach caused havoc in their ability to process claims and payments.

The Change Healthcare litigation raises allegations that massive security failures inside the organization resulted in the data breach, seeking hundreds of millions of dollars in financial compensation for those impacted.

Given common questions of fact and law raised in complaints brought throughout the federal court system, the U.S. Judicial Panel on Multidistrict Litigation (JPML) centralized all federal Change Healthcare data breach lawsuits in the District of Minnesota in June 2024, appointing U.S. District Judge Donovan Frank to preside over coordinated discovery and pretrial proceedings.

Early in the litigation, Change Healthcare filed a motion to dismiss, targeting individual claims, provider claims and lawsuits seeking credit monitoring for those impacted by the breach. However, in a joint status report (PDF) submitted on April 11, the parties report that they are working well together to resolve issues necessary for discovery to move forward.

“There are currently no disputes requiring Court’s attention,” the status report states, indicating that both plaintiffs and defendants are willing to attend a status conference scheduled for Thursday, unless the Court does not see the need.

The parties also noted that they have agreed on stipulations regarding limited discovery proceedings, which were stayed in August shortly after the creation of the Change Healthcare data breach multidistrict litigation.

In a pretrial order (PDF) issued on April 14, U.S. Magistrate Judge Dulce J. Foster agreed to lift the discovery stay to address Change’s motion to dismiss claims.

“The current stay of discovery shall be lifted for the limited purpose of permitting Plaintiffs to serve personal jurisdiction discovery on those Defendants asserting personal jurisdiction defenses, namely, Change Healthcare Inc. and Change Healthcare Operations,” the pretrial order states. “This stipulation relates only to lifting the stay and limiting the specific Defendants subject to the discovery and does not constitute an agreement that Plaintiffs’ request for personal jurisdiction discovery is proper.”

While not cancelling the status conference, a text-only order indicates the conference before Judge Frank and Magistrate Judge Foster will be held by electronic means instead of being held in person.

Last month, Judge Frank ordered the parties to meet with Judge Foster on April 30, 2025 at 10:00 a.m., to outline the structure and timeline for potential Change Healthcare settlement negotiations, which may allow the parties to find an early resolution for the claims brought nationwide.