Change Healthcare Data Breach Settlement Status To Be Reviewed by Federal Judge

Lawyers for plaintiffs and defendants were ordered to begin early settlement negotiations earlier last year, in hopes of reaching a swift resolution to the litigation.

A federal judge wants to meet with lawyers involved in Change Healthcare data breach lawsuits in February 2026, to review the progress of settlement negotiations, and what may be needed to help the parties reach a resolution for the litigation, which stems from the disclosure of private medical information for millions of Americans.

Change Healthcare provides essential software, analytics and services to the healthcare industry. While not a household name, the company plays a critical role behind the scenes, handling the private health data for about a third of all Americans each year.

In February 2024, Change Healthcare was targeted by a ransomware attack that is believed to have exposed the personal data of up to 190 million patients. Data including names, birthdates, Social Security numbers, medical records and insurance details were obtained by the hackers.

Following the disclosure of the Change Healthcare data breach, lawsuits began to emerge in both federal and state courts nationwide, as impacted individuals sought to hold the company accountable for failing to safeguard their information. In addition to claims from the patients themselves, Change Healthcare also faces lawsuits from doctors’ offices and clinics nationwide who say the breach, and Change Healthcare’s response, caused havoc in their ability to process claims and payments.

Nearly 90 Change healthcare lawsuits have been consolidated as part of a federal MDL, or multidistrict litigation, in the District of Minnesota before U.S. District Judge Donovan Frank for coordinated discovery and pretrial proceedings. However, there are numerous other claims filed in various state courts nationwide, including in California, Florida, Texas, Arizona, Tennessee, New Jersey and Nebraska. To avoid conflicting pretrial rulings and schedules, Judge Frank has coordinated efforts across all jurisdictions.

Since the litigation’s consolidation, it was expected that Judge Frank would call for the parties to prepare a group of bellwether test trials, to help see how juries may respond to evidence and testimony likely to be repeated in both state and federal trials. However, in the meantime, the judge has made a strong push for the parties to potentially reach a settlement before such trials are needed.

In May 2025, Judge Frank directed the parties to begin early Change Healthcare data breach settlement talks, while preparing for pretrial discovery. On December 23, Magistrate Judge Dulce J. Foster issued a pretrial order (PDF) calling on the parties to attend a pretrial conference via Zoom on February 4, 2026 to discuss the progress and future of settlement negotiations.

The magistrate indicated that the parties must prepare a one to two-page letter “describing any settlement discussions that have taken place, whether and when the party believes a settlement conference or private mediation might be most productive, and what discovery might be needed to maximize the chances of reaching a settlement in such a conference.”

The letters are to be emailed to Magistrate Judge Foster at least one week before the conference, the order states. In addition, plaintiffs and defendants must submit a list of individuals likely to have discoverable information, for use in discovery proceedings if the bellwether trials need to proceed.

While the results of these bellwether trials will not be binding on other claims, they could be additional help for the parties to reach a Change Healthcare data breach settlement agreement.

Sign up for more legal news that could affect you or your family.