Deadline Announced for Filing Motions to Dismiss in Change Healthcare Data Breach Lawsuits

A District Court Judge has set the due date in March 2025 for Change Healthcare to submit motions to dismiss some claims brought up in multiple lawsuits associated with the ransomware attack and data breach in February 2024.

Change Healthcare encountered a ransomware attack in February 2024, which is dubbed the biggest healthcare data breach reported in history. This happened because Change Healthcare lacked multi-factor authentication (MFA) on its remote access servers, a requirement of HIPAA. Files were encrypted and the protected health information (PHI) of around 190 million people was stolen. The stolen information contained names, contact details, birth dates, Social Security numbers, and medical data. The ransomware attack caused an outage for many weeks, and significantly affected claims processing, resulting in substantial disruption to Change Healthcare’s revenue cycles.

Many individuals whose data were stolen in the attack took legal action because of the data breach. Providers impacted by the lengthy shutdown of Change Healthcare’s systems also filed lawsuits. The lawsuits were combined into a federal multi-district lawsuit because of the common issues of fact and law. U.S. District Court Judge Donovan Frank is hearing the MDL in the District of Minnesota.

Change Healthcare has earlier mentioned about a plan to file motions to dismiss multiple lawsuit claims. The last day to file those motions to dismiss is extended until March 21, 2025 according to a February 4, 2025 court order. Judge Frank has likewise released the Memorandums of Support with a 60-page limit. Plaintiffs were given up to April 25, 2025 to reply to motions to dismiss, with the Memorandums of Support limited to 90 pages. The defendants have until May 23, 2025, to respond with a 30-page limit.

There are ongoing talks about a settlement to resolve the litigation, however, if no settlement is reached, Judge Frank will probably schedule several bellwether trials to know how juries would reply to the evidence and testimony. The schedule of the next litigation status conference is April 17, 2024.