Frequently Asked Questions

The Court authorized this Notice because you have a right to know about the Settlement, and all your options, before the Court decides whether to give final approval to the Settlement. This Notice explains the nature of the Action that is the subject of the Settlement, the general terms of the Settlement, and your legal rights and options.

The Judge Jack Zouhary of the United States District Court for the Middle District of Tennessee is overseeing this case captioned as In re HCA Healthcare, Inc. Data Security Litigation, Case No. 3:23-cv-00684. The people who brought the lawsuit are called the Settlement Class Representatives. The company being sued, HCA Healthcare, Inc., is called the Defendant.
 

The Action alleges that on or about July 10, 2023, HCA announced that it had discovered it had been the target of a criminal cyberattack in which the attackers accessed and stole information from an external storage location used to automate the formatting of email messages, or Data Incident. As a result of the Data Incident, twenty-seven (27) putative class action lawsuits were filed against HCA, alleging that HCA had inadequate data security practices and failed to properly safeguard affected patients’ information.

Defendant denies any wrongdoing whatsoever. No court or other judicial body has made any judgment or other determination that Defendant has done anything wrong.
 

In a class action, one or more people called “Settlement Class Representatives” or “Plaintiffs” sue on behalf of all people who have similar claims. Together, all these people are called a “Settlement Class,” and the individuals are called “Settlement Class Members.” One court resolves the issues for all Settlement Class Members, except for those who exclude themselves from the Settlement Class.

The Court has not decided in favor of the Plaintiffs or Defendant. Instead, both sides agreed to the Settlement. The Settlement avoids the cost and risk of a trial and related appeals, while providing benefits to Settlement Class Members. The Settlement Class Representatives appointed to represent the Settlement Class, and the attorneys for the Settlement Class, Lead Counsel, think the Settlement is best for all Settlement Class Members.

You are affected by the Settlement and potentially a Settlement Class Member if you are a current HCA patient residing in the United States whose personal information was compromised in the Data Incident that HCA announced on or about July 10, 2023. 

Excluded from the Settlement Class are: (i) HCA’s officers, directors, legal representatives, successors, subsidiaries, and assigns; (ii) any judge, justice, or judicial officer presiding over this matter and the members of their immediate families and judicial staff, and (iii) any Settlement Class Member who timely and validly requests to opt-out from the Settlement.
 

If you are not sure whether you are included in the Settlement, you may call (833) 420-3945 with questions. You may also write with questions to:

In re HCA Healthcare, Inc., Data Security Litigation
c/o Kroll Settlement Administration LLC
P.O. Box 225391
New York, NY 10150-5391
 

The Settlement provides the following Settlement Benefits available to Settlement Class Members who submit Approved Claims: (a) Credit Monitoring and Insurance Services; and (b) Documented Loss payment of up to $5,000. 

Settlement Class Members that submit a valid and timely Claim Form supported by reasonable documentation may select both of the following Settlement Benefits:

• Credit Monitoring and Insurance Services. One (1) year of Credit Monitoring and Insurance Services. CMIS will include credit monitoring, fraud consultation, and identity theft restoration services. A Settlement Class Member who chooses CMIS as their respective Settlement Benefit and already maintains a credit monitoring service may elect to defer their enrollment in the CMIS for a period of twelve (12) months for no additional charge. 
  • The CMIS will include the following services, among other features, to be provided to each Settlement Class Member who submits an Approved Claim for CMIS: (i) up to $1 million dollars of identity theft insurance coverage; and (ii) one-bureau credit monitoring providing notice of changes to the Settlement Class Member’s credit profile;

AND

• Documented Loss Payment. Settlement Class Members may submit a claim supported by reasonable documentation for a Documented Loss payment of up to $5,000.
  • To receive Documented Loss payment, a Settlement Class Member must choose to do so on their given Claim Form and submit to the Settlement Administrator the following: 
    1. A valid Claim Form electing to receive the Documented Loss Payment benefit; 
    2. An attestation regarding any actual and unreimbursed Documented Loss; and 
    3. Reasonable Documentation that demonstrates the Documented Loss to be reimbursed pursuant to the terms of the Settlement. If a Settlement Class Member does not submit Reasonable Documentation supporting a Documented Loss payment claim, or if a Settlement Class Member’s claim for a Documented Loss payment is rejected by the Settlement Administrator for any reason, the Settlement Class Member shall be provided with an opportunity to cure their claim and provide additional documentation, as directed by the Settlement Administrator.
       1. Examples of reasonable documentation include (but are not limited to): receipts, bills or invoices, bank statements, or correspondence including emails. Personal certifications, declarations, or affidavits from the Settlement Class Member are not reasonable documentation but may be included to provide clarification, context, or support for other submitted reasonable documentation. You will not be reimbursed for expenses if you have been reimbursed for the same expenses by another source, including compensation provided in connection with any credit monitoring and identity theft protection product.

To receive a Settlement Benefit, you must complete and submit a Claim Form with reasonable documentation online at here or by mail to In re HCA Healthcare, Inc., Data Security Litigation, c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391. Read the Claim Form instructions carefully, fill out the Claim Form, provide the required documentation, and submit online by September 25, 2025 or by mail postmarked by September 25, 2025.

TO RECEIVE AN ELECTRONIC OR ACH PAYMENT FOR YOUR APPROVED CLAIM, YOU MUST FILE A CLAIM FORM ONLINE HERE

The Court will hold a Final Approval Hearing on October 27, 2025, at 9:30 a.m. CT to decide whether to approve the Settlement. If the Court approves the Settlement, there may be appeals from that decision and resolving them can take time. It also takes time for all the Claim Forms for documented losses to be processed. Please be patient. Settlement Benefits will begin after the Settlement has obtained Court approval and the time for all appeals has expired.

Defendant and its affiliates will receive a release from all claims that could have been or that were brought against Defendant relating to the Data Incident. Thus, if the Settlement becomes final and you do not exclude yourself from the Settlement, you will be a Settlement Class Member and you will give up your right to sue Defendant as well as its respective agents, directors, officers, attorneys, and employees, affiliates, parents, subsidiaries, divisions, successors, assigns, releases all claims for any damages or other relief, including Unknown Claims, against the Settlement Class Representatives, their counsel, Lead Counsel and their heirs, assigns, executors, administrators, predecessors, successors, and any other person purporting to claim on their behalf, and assigns of each of them as well as covered entities associated with the Data Incident. The Released Claims are described in Section 9 of the Settlement Agreement, which is available here. If you have any questions, you can talk to the law firms listed in Question 17 for free or you can talk to your own lawyer.

No. If you exclude yourself, you will not be entitled to receive any benefits from the Settlement.

No. Unless you exclude yourself, you give up any right to sue Defendant and any other parties for any claim that could have been or was brought relating to the Data Incident. You must exclude yourself from the Settlement to start your own lawsuit or to be part of any different lawsuit relating to the claims in this case. 

To exclude yourself, send an opt-out request or written notice of intent to opt-out that says you want to be excluded from the Settlement. The opt-out request must have the following: (i) state the Settlement Class Member’s full name and current address and signature, and (ii) specifically state their desire to be excluded from the Settlement and from the Settlement Class. You must mail your opt-out request to the Settlement Administrator postmarked by August 25, 2025, to:

In re HCA Healthcare, Inc., Data Security Litigation
c/o Kroll Settlement Administration LLC
P.O. Box 225391
New York, NY 10150-5391

If you do not timely submit the opt-out request, it will result in the Settlement Class Member being bound by the terms of the Settlement. Any Settlement Class Member who submits a timely opt-out request may not make any objections to the Settlement and shall be deemed to have waived any rights or benefits under this Settlement Agreement.
 

You can tell the Court that you do not agree with the Settlement, or some part of it by objecting to the Settlement. For an objection to be a valid objection under the Settlement, it must be mailed to Lead Counsel and Defendant’s counsel at the addresses listed below, postmarked by no later than August 25, 2025.

The objection must state: 

1. the objector’s full name and address; 
2. the case name and docket number – In re HCA Healthcare, Inc. Data Security Litigation, Case No. 3:23-cv-00684 (M.D. Tenn.); 
3. information identifying the objector as a Settlement Class Member, including proof that the objector is a member of the Settlement Class (e.g., copy of the objector’s settlement notice, copy of original notice of the Data Incident, the Class Members’ unique ID as displayed on the Notice or obtained from the Settlement Administrator, or a statement explaining why the objector believes they are a Settlement Class Member); 
4. a written statement of all grounds for the objection, accompanied by any legal support for the objection the objector believes applicable; 
5. the identity of any and all counsel representing the objector in connection with the objection; 
6. a statement whether the objector and/or their counsel will appear at the Final Approval Hearing; and 
7. the objector’s signature or the signature of the objector’s duly authorized attorney or other duly authorized representative (if any) representing them in connection with the objection. 
    

Objecting is telling the Court that you do not like the Settlement or parts of it and why you do not think it should be approved. You can object only if you are a Settlement Class Member. Excluding yourself is telling the Court that you do not want to be part of the Settlement Class and do not want to receive any benefit from the Settlement. 

Yes. The Court appointed Jean Martin of Morgan & Morgan Complex Litigation Group and J. Gerard Stranch, IV of Stranch, Jennings & Garvey, PLLC, as Lead Counsel to represent the Settlement Class in Settlement negotiations. The Court also appointed Jillian Dent of Stueve Siegel Hanson LLP, Sabita Soneji of Tycko & Zavareei LLP, Gary Klinger of Milberg Coleman Bryson Phillips Grossman, PLLC, Jeffrey Ostrow of Kopelowitz Ostrow Ferguson Weiselberg Gilbert P.A., and James Pizzirusso of Hausfeld LLP as an Executive Committee. If you want to be represented by your own lawyer, you may hire one at your own expense.

Lead Counsel may request an amount up to $3,100,000 from the Court for their attorneys’ fees, costs, and expenses. Defendant shall separately pay the attorneys’ fees, costs, and expenses awarded by the Court to Lead Counsel, in addition to and without diminishing the value of the Settlement to the Class. Such attorneys’ fees, costs, and expenses shall be paid in the amount approved by the Court. The amount of attorneys’ fees and expenses to be awarded will be decided by the Court upon consideration of the complete factual record before the Court at the Final Approval Hearing, provided that the amount does not exceed $3,100,000. 

The motion for attorneys’ fees, costs, and expenses must be filed at least twenty (20) days before the deadline for filing objections to the Settlement.

The Parties agree that Settlement Class Representatives and Lead Counsel may seek a Service Award to each Settlement Class Representative not to exceed $5,000. Defendant shall pay the Service Award(s) approved by the Court to the Settlement Class Representative. Any requests for such an award must be filed at least 20 days before the deadline for filing objections to the Settlement.
 

The Court will hold a Final Approval Hearing on October 27, 2025 at 9:30 am CT, at the United States District Court for the Middle District of Tennessee, at the Fred D. Thompson U.S. Courthouse and Federal Building, 719 Church Street, Nashville, TN 37203 as ordered by the Court. At this hearing, the Court will consider whether the Settlement is fair, reasonable, and adequate. If there are timely and valid objections, the Court will consider them and will listen to people who have asked to speak at the hearing if such a request has been properly made. The Court will also rule on the attorneys’ fees, costs, and Service Awards payments. After the hearing, the Court will decide whether to approve the Settlement. We do not know how long these decisions will take. The hearing may be moved to a different date or time without additional notice, so Lead Counsel recommends checking the Settlement Website, or calling (833) 420-3945.

No. Lead Counsel will present the Settlement Class to the Court. You or your own lawyer are welcome to attend at your expense, but you are not required to do so. If you send an objection, you do not have to visit the Court to talk about it. As long as you filed your written objection on time with the Court and mailed it according to the instructions provided in Question 15, the Court will consider it.

You may ask the Court for permission to speak at the Final Approval Hearing. To do so, you must file an objection according to the instructions in Question 15, including all the information required. Your objection must be mailed to Lead Counsel and Defendant’s counsel, at the mailing addresses listed above, postmarked by no later than August 25, 2025.

If you do nothing, you will not receive any Settlement Benefits from this Settlement. If the Settlement is granted final approval and becomes final, you will not be able to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against Defendant or the Released Claims based on any claim that could have been or that was brought relating to the Data Incident.

This Notice summarizes the Settlement. More details are in the Settlement Agreement itself.  A copy of the Settlement Agreement is available here. You may also call the Settlement Administrator with questions or to receive a Claim Form at (833) 420-3945.

It is your responsibility to inform the Settlement Administrator of your updated information. You may do so at the address below, calling toll-free (833) 420-3945 or at the Contact page found here:

In re HCA Healthcare, Inc., Data Security Litigation
c/o Kroll Settlement Administration LLC
P.O. Box 225391
New York, NY 10150-5391

PLEASE DO NOT CONTACT THE COURT, OR CLERK OF THE COURT FOR INFORMATION ABOUT THE CLASS ACTION SETTLEMENT
 

All submitted Claims have been reviewed, and Settlement payments for approved Claims were issued on July 27, 2026. Please deposit or cash your check promptly, as any uncashed checks will become void after November 24, 2026.

If you filed a paper Claim Form, your payment was issued as a paper check. If you filed an online Claim Form, your payment was sent according to the method you selected during the claim submission process. For electronic payments, emails were sent from the following domains, so please check your spam or junk folder if you have not yet received your payment notification. In case you have any questions about your specific payment type, we have also included the applicable customer service helpline.

1. You must activate your identity monitoring services by November 24, 2026. Your Activation Code will not work after this date.
2. Visit Enroll.krollmonitoring.com/redeem to activate your identity monitoring services.
3. Provide Your Activation Code and Your Verification ID.