Judge Sets Deadlines for Motion To Dismiss Change Healthcare Data Breach Lawsuits

The U.S. District Judge recently appointed to preside over all Change Healthcare data breach lawsuits being pursued throughout the federal court system has established a deadline in late March, for the defendants to file any motion to dismiss certain claims raised in the litigation.

Dozens of complaints have been filed since a massive Change Healthcare data breach was disclosed in February 2024, after it was discovered that hackers gained access to the names, Social Security numbers, dates of birth, addresses, medical records, insurance details and other sensitive data for millions of individuals.

While Change Healthcare is not well known among most U.S. consumers, the company is a subsidiary of UnitedHealth, which provides critical software, analytics and services for medical providers throughout the healthcare system. Some estimates suggest that one out of every three Americans has their private health information pass through the company’s servers.

UnitedHealth and Change Healthcare now face both individual lawsuits brought by individuals impacted by the data breach, as well as lawsuits filed by medical facilities, which experienced severe business disruptions when they were unable to process claims after the incident.

Given common questions of fact and law raised in the claims, a federal multidistrict litigation (MDL) has been established in the District of Minnesota, where U.S. District Judge Donovan Frank is presiding over coordinated discovery and pretrial proceedings.

UnitedHealth Group, which recently indicated that the data breach at its Change Healthcare subsidiary affected about 190 million patients, has expressed plans to try to have certain claims brought in the complaints dismissed based on a variety of factors.

On February 4, following a status conference held with the parties, Judge Frank issued a court order (PDF) setting a Motion to Dismiss briefing schedule, which calls for defendants to file the motion and memorandum of support by March 21. Plaintiffs’ response to the motion will be due by April 25 and the defendants’ reply is due by May 23.

The judge also set page limits for the submissions, with the memorandum limited to 60 pages, plaintiffs’ response is limited to 90 pages, and defendants’ reply will be limited to 30 pages.

The order comes as the parties continue to hold a series of Change Healthcare lawsuit settlement talks, in hopes of resolving claims early in the litigation.

However, if a settlement is not reached, it is likely that Judge Frank will call for a series of bellwether trials, which would allow the parties to see how juries will respond to evidence and testimony likely to be repeated throughout the litigation.

Judge Frank is expected to meet again with lawyers involved in the Change Healthcare data breach litigation at a status conference on April 17.