Patients whose information was exposed in the July 2026 Secure Healthcare Information Management (SHIM) data breach may be covered by a proposed class action alleging the Allentown, Pennsylvania medical billing company failed to protect their Social Security numbers, ID numbers and health information. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Secure Healthcare Information Management, LLC has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
A Pennsylvania patient filed a proposed class action on October 15, 2026 against Secure Healthcare Information Management, LLC (SHIM), a billing and medical management company that serves independent physicians and medical institutions in northeastern Pennsylvania. The case, Smith v. Secure Healthcare Information Management, LLC, No. 5:26-cv-07903, is pending in the U.S. District Court for the Eastern District of Pennsylvania before Judge Jeffrey L. Schmehl.The lawsuit follows SHIM’s October 6, 2026 announcement that an unknown actor accessed or acquired patient information from its network in July 2026. The complaint alleges SHIM failed to use reasonable security to protect that data. SHIM has not yet responded in court, and none of the allegations has been proven.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Happened in the SHIM Data Breach?
According to SHIM’s public notice, the company experienced a network disruption on July 17, 2026 and began an investigation with outside cybersecurity experts. The investigation found that an unknown actor accessed or acquired certain personal information without authorization at some point between July 6 and July 16, 2026. After reviewing the affected files, SHIM confirmed the scope of the incident on September 18, 2026 and mailed notice letters on October 6, 2026 to affected individuals for whom it had addresses.SHIM says the information involved may include:
- Names and dates of birth
- Social Security numbers
- Driver’s license or state identification numbers
- Medical information
- Health insurance information
SHIM reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights and to the consumer reporting agencies. It has not publicly said how many people were affected. SHIM is offering complimentary identity protection services through Cyberscout, a TransUnion company, with an enrollment deadline of January 4, 2027; people who did not receive a letter must verify eligibility through SHIM’s call center to enroll.
What Does the Lawsuit Allege?
The complaint alleges that SHIM stored patient information in an unencrypted, internet-accessible environment and failed to implement reasonable data security, and that it waited nearly three months after discovering the breach to begin notifying patients. It says affected patients now face a long-term risk of identity theft and medical fraud, and must spend time and money monitoring their accounts.The lawsuit asserts claims for negligence, breach of implied contract, unjust enrichment and declaratory judgment. It seeks damages, restitution, an order requiring SHIM to improve its security practices, and at least ten years of credit monitoring for class members. SHIM has not been found liable.
Who Is in the Proposed Class?
The complaint proposes a nationwide class of all individuals in the United States whose private information was compromised in the SHIM data breach. SHIM, its subsidiaries and affiliates, its officers and directors, and entities it controls are excluded. The court has not certified any class.What Happens Next?
SHIM will respond to the complaint, often with a motion to dismiss. Data breach cases filed against the same company frequently draw additional lawsuits that are later consolidated before one judge. Any money would come only through a settlement or judgment, which would have its own court-approved notice and claim process. There is no settlement or claim form today.Questions
What happened in the Secure Healthcare Information Management data breach?
SHIM, a billing and medical management company for independent physicians and medical institutions in northeastern Pennsylvania, says it experienced a network disruption on July 17, 2026. Its investigation found that an unknown actor accessed or acquired certain personal information without authorization between July 6 and July 16, 2026. SHIM confirmed the scope on September 18, 2026 and began mailing notices on October 6, 2026.
What information was exposed in the SHIM data breach?
According to SHIM’s notice, the potentially affected information may include names, dates of birth, Social Security numbers, driver’s license or state identification numbers, medical information and health insurance information.
Who is in the proposed SHIM data breach class?
The complaint proposes a class of all individuals in the United States whose private information was compromised in the SHIM data breach. SHIM, its affiliates, officers and directors are excluded. No class has been certified.
Is there a settlement or claim form for the SHIM data breach?
No. The lawsuit was filed on October 15, 2026 and is at the complaint stage. There is no settlement and no claim form. Separately, SHIM is offering complimentary Cyberscout identity protection services to notified individuals, with an enrollment deadline of January 4, 2027; that offer is not part of the lawsuit.
Sources
- Class Action Complaint, Smith v. Secure Healthcare Information Management, LLC, No. 5:26-cv-07903 (E.D. Pa. filed Oct. 15, 2026), ECF No. 1
- Docket via CourtListener (RECAP)
- SHIM, “Secure Healthcare Information Management, LLC Provides Notice Following Data Security Incident” (Oct. 6, 2026)
