Health Lawsuits to Watch: Data Breaches, Mifepristone, and PFAS

The health lawsuits to watch in 2026 cluster around a handful of fronts: the largest patient data breach in US history is heading toward settlement, juries have started holding social media platforms liable for harming children, the Supreme Court preserved mail-order access to mifepristone, a federal judge froze the Trump administration’s vaccine policy overhaul, and a closely watched case asks whether an insurer’s AI tool wrongly denied Medicare Advantage claims. Several of these cases will produce rulings, deadlines, or payouts before the year is out.

Change Healthcare Data Breach (MDL No. 3108)

The February 2024 ransomware attack on Change Healthcare, a payment-processing subsidiary of UnitedHealth Group, affected roughly 190 million people, making it the largest healthcare data breach on record.¹ Patient and provider lawsuits were consolidated into a multidistrict litigation in the District of Minnesota before Judge Donovan W. Frank.²

In December 2025, the court allowed some claims from patients and providers to move forward and dismissed others. Fact discovery is scheduled to close by November 2, 2026, and Magistrate Judge Dulce J. Foster has pushed the parties toward settlement talks, with a status conference set for June 18, 2026.² No global settlement has been reached. If one is announced, it is expected to run on parallel tracks: credit monitoring, identity restoration, and documented loss reimbursement for patients, and recovery of payment-disruption losses for providers.¹

Other Hospital Data Breach Settlements

Several hospital system breach cases are at or near resolution. Capital Health Systems in New Jersey agreed to a $4.5 million settlement over a late-2023 cyberattack that may have exposed data of more than 500,000 people, including Social Security numbers and clinical records.³ Class members could claim up to $5,000 with documentation or roughly $100 without, plus three years of credit monitoring. The claim deadline passed April 6, 2026, and the final approval hearing is set for July 14, 2026.⁴

City of Hope National Medical Center settled similar claims for $8.5 million over a breach between September and October 2023, with the same $5,000-documented or $100-flat structure, credit monitoring, and an extra $250 statutory payment for California residents.⁵ The court issued final approval on February 20, 2026.⁶

Covenant Health, a Texas hospital system, faces a pending class action over a May 2025 cyberattack. Covenant initially reported fewer than 8,000 affected patients to Maine’s Attorney General in July 2025, then revised the figure to more than 478,000 in December 2025. The suit alleges inadequate security and delayed notification.⁷

A different kind of patient privacy case, In re Meta Pixel Healthcare Litigation, is pending in the Northern District of California. The consolidated class action alleges Meta received protected health information from more than 40 hospital websites through its tracking pixel without proper patient authorization. A motion for class certification was filed in September 2025, with the next case management conference set for July 7, 2026.⁸

Social Media and Youth Mental Health (MDL No. 3047)

The MDL over social media’s effects on young people, consolidated before Judge Yvonne Gonzalez Rogers in the Northern District of California, produced its first trial outcomes in 2026. Roughly 2,664 individual lawsuits are pending.⁹

In March 2026, a California jury found Meta and Google liable for negligently designing Instagram and YouTube. The plaintiff, a 20-year-old woman identified as KGM, testified that she began using YouTube at age six and Instagram at age nine and that addictive design features contributed to her depression, anxiety, and body dysmorphia. The jury awarded $6 million total, split evenly between compensatory and punitive damages, with Meta assigned 70 percent of the liability. Jurors found both companies acted with “malice, oppression or fraud.”¹⁰ The plaintiffs targeted platform design features such as infinite scroll, autoplay, push notifications, and beauty filters, rather than specific user content, a theory meant to sidestep Section 230.¹¹ A post-trial motion for a new trial was denied.⁹

On the school-district track, Breathitt County Schools in Kentucky became the first district to settle, resolving its claims in May 2026 for a combined $27 million:¹²

Meta (Facebook/Instagram): $9 million
Snap: $8 million
TikTok: $8 million
YouTube (Google): slightly more than $2 million, plus a commitment to provide teacher training programs

Breathitt County had sought $60 million. The payout exceeded the district’s annual operating budget by about eight percent.¹³ Roughly 1,200 additional school districts have filed similar claims, and the next bellwether trial is set for February 2027 in Tucson, Arizona. Bloomberg Intelligence has estimated the industry’s total potential exposure from these cases at $400 billion.¹²

Mifepristone Access: Louisiana v. FDA

Louisiana, represented by the Alliance Defending Freedom, sued the FDA in October 2025, challenging 2023 regulations that allow remote prescribing and mail delivery of mifepristone.¹⁴ On May 1, 2026, a Fifth Circuit panel sided with Louisiana and ordered a stay of the FDA’s 2023 risk-management framework pending appeal, finding that the agency had removed adverse-event reporting requirements and then relied on the resulting lack of data, which the court called “arbitrary and capricious.”¹⁵

Manufacturers Danco Laboratories and GenBioPro sought emergency relief at the Supreme Court. On May 14, 2026, the Court voted 7-2 to preserve nationwide access by granting an emergency stay of the Fifth Circuit’s order. Justices Clarence Thomas and Samuel Alito dissented; Thomas invoked the 1873 Comstock Act as grounds for treating the mailing of abortion pills as a federal crime.¹⁶ The case has been remanded to the Fifth Circuit for further proceedings. Access is expected to remain uninterrupted into 2027 while the litigation continues.¹⁴ The Trump administration did not file a brief at the Supreme Court. FDA Commissioner Marty Makary was pushed out in May 2026 after pressure from anti-abortion lawmakers over the pace of the agency’s mifepristone safety review.

Federal Vaccine Policy: AAP v. Kennedy

A coalition led by the American Academy of Pediatrics sued HHS Secretary Robert F. Kennedy Jr. in the District of Massachusetts over sweeping changes to federal immunization policy. The complaint alleges that Kennedy’s HHS bypassed scientific review procedures and violated the Federal Advisory Committee Act when it fired all 17 members of the Advisory Committee on Immunization Practices and replaced them with appointees the plaintiffs allege lacked immunology expertise and held anti-vaccine views.¹⁷

On March 16, 2026, Judge Brian E. Murphy issued a preliminary injunction. The order stays Kennedy’s ACIP appointments, invalidates all votes taken by the reconstituted committee, stays a revised vaccine schedule issued in January 2026, overturns a May 2025 directive on COVID-19 vaccines, and reverses downgraded Hepatitis B recommendations from a December 2025 ACIP meeting.¹⁸ The court found the government’s actions “likely unlawful.”¹⁷ The government filed a notice of appeal on April 29, 2026, and has sought a stay of the injunction.¹⁹

Chiles v. Salazar: Conversion Therapy and the First Amendment

On March 31, 2026, the Supreme Court ruled 8-1 in Chiles v. Salazar that laws banning conversion therapy, as applied to licensed counselors’ talk therapy, are viewpoint discrimination and must survive strict scrutiny under the First Amendment.²⁰

Kaley Chiles, a Colorado therapist, challenged the state’s 2019 ban on conversion therapy for minors. Writing for the majority, Justice Gorsuch rejected the argument that talk therapy is regulable “conduct” rather than speech, holding that labeling speech as a “treatment” does not strip it of constitutional protection. Because the Colorado law allows therapists to affirm a client’s gender transition while prohibiting speech aimed at changing sexual orientation or gender identity, the Court found it discriminated by viewpoint.²¹ Justice Kagan concurred, joined by Justice Sotomayor; Justice Jackson was the lone dissenter, arguing that professional speech within the doctor-patient relationship remains subject to state regulation.²² Twenty-three states have similar bans, and the ruling leaves those statutes vulnerable to First Amendment challenges when applied to licensed counselors doing talk-based therapy.²⁰

AI Claim Denials: Estate of Lokken v. UnitedHealth Group

A proposed class action in the District of Minnesota alleges that UnitedHealthcare and its subsidiary NaviHealth used an AI tool called “nH Predict” to systematically deny post-acute care coverage for Medicare Advantage enrollees. The complaint, filed by patient estates, claims the tool overrode clinical determinations by treating physicians, even though UnitedHealthcare’s member materials promised coverage decisions would be made by “clinical staff and physicians.”²³ The case asserts breach of contract, insurance bad faith, and unjust enrichment. A ruling on motions to dismiss allowed portions to proceed, and defendants were due to respond to a motion to compel by April 29, 2026. The case is being watched as a bellwether for litigation over algorithmic decision-making in healthcare.²⁴

ACA Marketplace Rules: City of Columbus v. Kennedy

A federal judge in Maryland issued a nationwide stay on August 22, 2025, blocking six of eight contested provisions of a CMS “program integrity” rule in City of Columbus et al. v. Kennedy et al. The court found the plaintiffs, including the cities of Columbus, Baltimore, and Chicago, had a “strong likelihood of succeeding” on the merits.²⁵

The blocked provisions would have denied coverage to enrollees with past-due premiums, required additional documentation for special enrollment periods, cut subsidies for auto-enrolled consumers, and allowed insurers to sell less generous plans. Plaintiffs argued the changes would strip coverage from at least 1.8 million people.²⁵ The Fourth Circuit denied the government’s emergency request to lift the stay in September 2025.²⁶ A parallel case, State of California et al. v. Kennedy, is being briefed in Massachusetts.²⁷

PFAS Drinking Water Litigation

PFAS cases are moving on two tracks. 3M agreed in 2024 to pay up to $12.5 billion and DuPont agreed to $1.185 billion to fund water testing and treatment for public utilities that detect PFAS at any level. Claim deadlines for water systems fall in mid-2026: June 30 for the DuPont fund and July 31 for 3M.²⁸

On the regulatory side, water utilities are challenging the EPA’s 2024 tap-water limits for six PFAS chemicals in American Water Works Association v. EPA. The Trump administration’s EPA said it would stop defending limits on four of those chemicals and moved to rescind the standards through new rulemaking, but the D.C. Circuit on March 19, 2026, denied the agency’s request to sever and pause those claims.²⁹ NRDC and Sierra Club intervened to defend the original standards. Oral arguments have not been scheduled.³⁰

340B Drug Discount Program

The 340B program, which requires manufacturers to sell outpatient drugs at steep discounts to safety-net hospitals and clinics, has become a litigation front since the Supreme Court’s 2024 end of Chevron deference in Loper Bright Enterprises v. Raimondo. In April 2026, AbbVie sued HRSA seeking a judicial redefinition of who counts as a “patient” eligible for 340B pricing, arguing HRSA’s 1996 guidance is too broad and was never adopted through formal rulemaking.³¹

A separate case brought by the American Hospital Association over an HRSA pilot program that would have replaced upfront 340B discounts with post-dispensing rebates ended in February 2026, when the court vacated the pilot and remanded it after a nationwide preliminary injunction. Any future rebate model must go through formal notice-and-comment rulemaking.³²

Other Fronts to Follow

Opioid settlement spending. More than $50 billion in settlement funds are being distributed to state and local governments over 18 years, now in year three. Reporting has found some entities spending the money on items with weak ties to addiction treatment, including law enforcement equipment and community events. Optum Rx, UnitedHealth Group’s pharmacy benefit manager, sued five Kentucky counties in August 2025 to prevent its inclusion in ongoing opioid claims.³³

Hospital price transparency. CMS began enforcing updated price transparency requirements on April 1, 2026, under rules finalized in November 2025. Hospitals that fail to post machine-readable pricing files or consumer-friendly cost lists face civil monetary penalties, with a 35 percent reduction for hospitals that waive their hearing rights within 30 days (not available for violations of core requirements or repeat offenses).³⁴

California clinic ballot measure. The California Primary Care Association and Open Door Community Health Centers sued in federal court in April 2026 to keep a union-backed ballot initiative off the November 2026 ballot. The measure, backed by SEIU-United Healthcare Workers West, would require federally qualified health centers to spend 90 percent of their revenue on primary and preventive care for low-income populations, with penalties redirected to a state workforce training account.³⁵ The clinics argue the measure conflicts with federal law and could strip nearly $2 billion from health systems; the union, which collected over one million signatures, calls the initiative “legally sound.”³⁶ The case was pending in the Northern District of California as of May 2026.³⁷

1
Panorays. Change Healthcare Data Breach
2
U.S. District Court, District of Minnesota. Change Healthcare, Inc. Data Breach
3
HIPAA Journal. Capital Health Class Action Data Breach Settlement
4
Capital Health Data Breach Settlement. Home
5
PR Newswire. City of Hope Data Security Incident Settlement Notice
6
City of Hope Data Breach Settlement. Documents
7
ClassAction.org. Covenant Health Faces Class Action Lawsuit Over May 2025 Data Breach
8
U.S. District Court, Northern District of California. In Re Meta Pixel Healthcare Litigation Calendar
9
ConsumerNotice.org. Social Media Harm Lawsuit
10
6abc. Jury Finds Instagram YouTube Liable in Landmark Court Case
11
NPR. Meta YouTube Social Media Trial Verdict
12
The Next Web. Social Media $27 Million Settlement Breathitt County Details
13
Lexington Herald-Leader. Breathitt County Social Media Settlement
14
The Guardian. Supreme Court Mifepristone Abortion Pill Upheld
15
U.S. Court of Appeals, Fifth Circuit. State of Louisiana v. FDA
16
WBUR. Supreme Court Abortion Mifepristone
17
American Association of Immunologists. Federal Court Blocks US Vaccine Policy Overhaul
18
American Public Health Association. Federal Judge Blocks Immunization Schedule Changes
19
Georgetown Law Litigation Tracker. American Academy of Pediatrics et al. v. Kennedy et al.
20
Supreme Court of the United States. Chiles v. Salazar, 607 U.S. ___
21
Cornell Law Institute. Chiles v. Salazar
22
SCOTUSblog. Chiles v. Salazar
23
Georgetown Law Litigation Tracker. Estate of Gene B. Lokken et al. v. UnitedHealth Group, Inc. et al.
24
Commercial Litigation Update. Five Cases Health Care and Life Sciences GCs Should Keep Watching in 2026
25
HFMA. Court Limits CMS’s Authority to Immediately Apply the ACA Marketplace Program Integrity Final Rule
26
State Health & Value Strategies. Ruling in Challenge to Marketplace Rule: Initial Analysis and Implications for States
27
Georgetown Law Litigation Tracker. Affordable Care Act Litigation
28
NRDC. PFAS Settlement Money Water Utilities Poised Evaporate
29
Harvard Environmental and Energy Law Program. PFAS in Drinking Water
30
CourtListener. American Water Works Association v. EPA
31
Washington Legal Foundation. The 340B Drug Discount Program Shows Why Courts Can’t Defer to Agencies
32
Barnes & Thornburg. 340B Rebate Model Pilot Program Effectively Ends, Preserving Upfront Discounts for Now
33
KFF Health News. Opioid Settlements
34
CMS. Hospital Price Transparency
35
CalMatters. Healthcare Workers Clinics Ballot Measure
36
iNewsource. California Union Clinics Spending Ballot Lawsuit
37
Law360. Calif. Sued Over Ballot Measure for Health Clinic Fund Use