Change Healthcare Seeks Dismissal of Data Breach Lawsuits Brought by Consumers and Medical Providers

After filing a flurry of motions to dismiss lawsuits over a massive data breach last year, Change Healthcare is seeking a court hearing to discuss the filings on June 12.

Change Healthcare Inc. has filed a number of motions to dismiss lawsuits brought on behalf of both individuals and healthcare providers, seeking damages for a massive data breach last year, which exposed private health information for about a third of all Americans, and disrupted the processing of medical payments for providers nationwide.

In February 2024, Change Healthcare announced it had been the target of a data breach by hackers who accessed customers’ sensitive data, such as names, Social Security numbers, birth dates, addresses, medical records and insurance details. The breach reportedly exposed the personal data of up to 190 million people.

In addition, clinics and doctors’ offices nationwide were frequently unable to interact with the service after the breach, leaving them unable to process patients’ healthcare insurance plans.

As a result, the company faces a rapidly growing number of data breach lawsuits, including claims brought on behalf of individuals who now face a risk of identity theft, and class action lawsuits on behalf of healthcare service companies, which relied on the company’s system.

At least 65 Change Healthcare data breach lawsuits have been filed throughout the federal court system, and a number of claims have also been brought in various different state courts, including California, Florida, Texas, Arizona, Tennessee, New Jersey and Nebraska.

Given common questions of fact and law raised in the litigation, the U.S. Judicial Panel on Multidistrict Litigation (JPML) centralized the federal lawsuits in the District of Minnesota in June 2024, appointing U.S. District Judge Donovan Frank to preside over coordinated discovery and pretrial proceedings.

However, on March 21, Change Healthcare issued motions to dismiss the individual claims (PDF), provider claims (PDF) and other claims seeking credit monitoring for those impacted by the data breach. 

In a memorandum (PDF) accompanying the motion to dismiss credit monitoring claims, Change Healthcare indicated the court lacks personal jurisdiction for all non-Minnesota plaintiffs.

“When personal jurisdiction over a defendant is lacking, a court has no power to adjudicate claims brought against that defendant, and the defendant must be dismissed from the litigation,” the memorandum states. “Personal jurisdiction can be general or specific. Here the vast majority of Plaintiffs do not— and cannot—demonstrate either as it relates to Change or Change Operations.”

According to a notice of hearing (PDF) issued on March 24, Change has called for a hearing before Judge Frank on the motions, scheduled for June 12.

Judge Frank has ordered the parties to meet with Magistrate Judge Dulce J. Foster on April 30, 2025 at 10:00 a.m., to outline the structure and timeline for potential Change Healthcare settlement negotiations, which may allow the parties to find an early resolution for the claims brought nationwide.