HCA Healthcare Settlement: Who Qualifies, Payouts, and Deadlines

If you were an HCA Healthcare patient whose information was exposed in the July 2023 cyberattack, the HCA Healthcare data breach settlement offers up to $5,000 in reimbursement for documented losses plus one year of credit monitoring and identity theft protection. The claim filing deadline was September 25, 2025, and claims are submitted at HCAHealthcareSettlement.com.¹ A federal judge in Nashville granted final approval to the deal in late October 2025.²

Who Qualifies as a Class Member

The settlement class covers current HCA patients living in the United States whose personal information was compromised in the breach HCA announced on or about July 10, 2023. That’s roughly 11.27 million people who received care at HCA hospitals and physician offices across 20 states.³

If you were affected, you should have received a personalized email notice containing a unique Class Member ID. That ID is required to file.⁴

What You Can Claim

The settlement offers two categories of relief, and eligible class members can take both.

Reimbursement for documented losses, up to $5,000 per person. This covers out-of-pocket expenses you can trace to the breach: fraudulent charges, bank fees, identity restoration costs, or credit monitoring you paid for yourself. You must submit receipts, bank statements, or similar documentation with your claim.⁵

One year of credit monitoring and identity theft protection. The coverage includes credit monitoring, fraud consultation, and identity theft restoration services backed by a $1 million insurance policy. You can defer enrollment for up to 12 months if you prefer to hold it in reserve.⁴

HCA denied the negligence allegations and settled without admitting liability.⁶ As part of the deal, the company also committed to maintaining enhanced data security measures for at least two years, with the specifics filed under seal.⁷

How to File a Claim

Claims can be filed online at HCAHealthcareSettlement.com or by printing and mailing a paper claim form available on the same site. You’ll need the Class Member ID from your email notice.⁴

The settlement administrator is Kroll Settlement Administration LLC, which can be reached at (833) 420-3945 for questions about your notice, your Class Member ID, or the status of your claim.⁵

The Deadlines

Claim filing: September 25, 2025, either submitted online or postmarked by that date.
Opt-out or objection: August 25, 2025.¹

Both dates have passed. If you missed the claim deadline, the settlement website and administrator are the places to confirm whether any late-claim relief is available in your situation; nothing in the approved terms guarantees it.

When Payments Will Be Sent

Even for people who filed on time, no settlement benefits have been distributed yet. The official settlement website states that benefits will only be made available after all possible appeals from the final approval order are resolved.⁴ The court granted final approval in late October 2025, so any appeal window and appeal proceedings sit between that date and actual payment.²

What Information the Breach Exposed

Whether you have a documented-loss claim depends in part on what was taken. According to HCA, the stolen data included patient names, addresses, email addresses, phone numbers, dates of birth, gender, and dates and locations of past or upcoming medical appointments.⁸ HCA said the breach did not include clinical information such as diagnoses or treatment records, and did not include Social Security numbers, payment card details, passwords, or driver’s license numbers.⁹

One posting on the dark-web forum where the data was released advertised that the stolen files included “emails with health diagnosis that corresponds to a ClientID,” which contradicted HCA’s public statements about clinical information. The full stolen database consisted of 17 files containing 27.7 million rows of records.¹⁰

Plaintiffs in the consolidated case, In re: HCA Healthcare, Inc. Data Security Litigation, Case No. 3:23-cv-00684 in the U.S. District Court for the Middle District of Tennessee, reported injuries including increased spam, unauthorized financial charges, identity theft, and time and money spent on credit monitoring and mitigation.¹⁰ Those are the types of losses the $5,000 reimbursement track is designed to cover, provided you can document them.

A Separate HCA Settlement You May Have Heard About

If you searched for an HCA Healthcare settlement and came across news of a $2.9 million multi-state deal in July 2025, that’s a different matter. It resolved claims by the attorneys general of California, Colorado, and Nevada over “Training Repayment Agreement Provisions” that HCA required newly hired nurses to sign through its StaRN apprenticeship program.¹¹ It provides restitution and debt forgiveness for affected nurses in those three states, not for patients affected by the 2023 data breach.

1
HCA Healthcare Settlement. In Re HCA Healthcare, Inc. Data Security Litigation Settlement
2
Becker’s Hospital Review. HCA Gets Final Approval for Data Breach Settlement
3
HIPAA Journal. HCA Healthcare Data Breach Settlement
4
ClassAction.org. HCA Healthcare Settlement Resolves Data Breach Lawsuit Over Cyberattack Announced in July 2023
5
HCA Healthcare Settlement. In Re HCA Healthcare, Inc. Data Security Litigation Settlement FAQ
6
HIPAA Times. HCA Healthcare Reaches Data Breach Settlement Following 27.7 Million Record Leak
7
ClassAction.org. In Re HCA Healthcare, Inc. Data Security Litigation, Settlement Agreement
8
HIPAA Journal. HCA Healthcare Cyberattack Data Breach
9
Chief Healthcare Executive. HCA Healthcare Discloses Data Breach Affecting as Many as 11 Million Patients
10
GovInfo. In Re HCA Healthcare, Inc. Data Security Litigation, Memorandum Opinion
11
California Office of the Attorney General. Attorney General Bonta Secures $1.53 Million Settlement With One of Nation’s Largest Healthcare Providers